fe566ca92d40914438c7ce3157a6a0936ac7be94e71e6c37b95ac84177511874

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 12:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
JavaChecker.exe
Size 2.8MB
Sample260809-pj4b2sxflc
SHA256 fe566ca92d40914438c7ce3157a6a0936ac7be94e71e6c37b95ac84177511874
MD5 41251868de0e68da924595a9e4b6b899
SHA1 38fe8d2da94de97b0a6c0e7648dba85e00eeecca
SHA512 62b59e8557f9a34d9c56f0e43727e73fae1b3e930e02c59dd993de0b81e697fa1b07bb6997a9d268ec13ed0ecb4963ba2a19e2bca2930509d23a3950b34d83f4
SSDEEP 49152:EskiAPIyu6mNOWek2aB1KYULQ6INRA4d/FLN4WVVWh9A3h2R4bbmyQy0vIXdPb5K:EskiAPIyu6mNOWek2aB1K9nINiwFbVS9
TLSH
T184D5DF81B5A8B1FAE0546F3082E398E157F92DD60AB466011E07F66DD034BBB3C4D76B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Loads dropped DLL 28 IoCs

pid	Process
824	aspnet_compiler.exe
824	aspnet_compiler.exe
824	aspnet_compiler.exe
824	aspnet_compiler.exe
824	aspnet_compiler.exe
824	aspnet_compiler.exe
824	aspnet_compiler.exe
824	aspnet_compiler.exe
824	aspnet_compiler.exe
824	aspnet_compiler.exe
824	aspnet_compiler.exe
824	aspnet_compiler.exe
824	aspnet_compiler.exe
824	aspnet_compiler.exe
1476	aspnet_compiler.exe
1476	aspnet_compiler.exe
1476	aspnet_compiler.exe
1476	aspnet_compiler.exe
1476	aspnet_compiler.exe
1476	aspnet_compiler.exe
1476	aspnet_compiler.exe
1476	aspnet_compiler.exe
1476	aspnet_compiler.exe
1476	aspnet_compiler.exe
1476	aspnet_compiler.exe
1476	aspnet_compiler.exe
1476	aspnet_compiler.exe
1476	aspnet_compiler.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 552 set thread context of 824	552	JavaChecker.exe	91
PID 4824 set thread context of 1476	4824	JavaChecker.exe	96

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JavaChecker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JavaChecker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1684	schtasks.exe
1248	schtasks.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	552	JavaChecker.exe
Token: SeDebugPrivilege	4824	JavaChecker.exe
Token: SeDebugPrivilege	824	aspnet_compiler.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
824	aspnet_compiler.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 552 wrote to memory of 1684	552	JavaChecker.exe	89
PID 552 wrote to memory of 824	552	JavaChecker.exe	91
PID 552 wrote to memory of 824	552	JavaChecker.exe	91
PID 552 wrote to memory of 824	552	JavaChecker.exe	91
PID 552 wrote to memory of 824	552	JavaChecker.exe	91
PID 552 wrote to memory of 824	552	JavaChecker.exe	91
PID 4824 wrote to memory of 1248	4824	JavaChecker.exe	94
PID 4824 wrote to memory of 1476	4824	JavaChecker.exe	96
PID 4824 wrote to memory of 1476	4824	JavaChecker.exe	96
PID 4824 wrote to memory of 1476	4824	JavaChecker.exe	96
PID 4824 wrote to memory of 1476	4824	JavaChecker.exe	96
PID 4824 wrote to memory of 1476	4824	JavaChecker.exe	96

C:\Users\Admin\AppData\Local\Temp\JavaChecker.exe
"C:\Users\Admin\AppData\Local\Temp\JavaChecker.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:552
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks" /create /f /tn "JavaChecker_Admin" /tr "C:\Users\Admin\AppData\Local\Temp\JavaChecker.exe" /sc onlogon /rl highest
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:1684
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:824

C:\Users\Admin\AppData\Local\Temp\JavaChecker.exe
C:\Users\Admin\AppData\Local\Temp\JavaChecker.exe
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks" /create /f /tn "JavaChecker_Admin" /tr "C:\Users\Admin\AppData\Local\Temp\JavaChecker.exe" /sc onlogon /rl highest
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:1248
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aforge.video.directshow.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\AE8DDD6C7BED471C6F37F2DC312D5130\aforge.video.directshow.dll
Size 71KB
SHA256 d789138f067708113636174e74697f7538f2dd49603c46dd3970926519b6c5a8
MD5 428e5480573bdaf15ead6bc7f973d583
SHA1 3c1d4104fe259a78c3beb73d816c32128e7fd3c1
SHA512 2ace6bb7f1376e7d20c3be0ad97d22a11b983da4400dbcb9e52b0b7f085294baa5aa2759e53b02f0750e58b9bcaf816d8764b11b8abedc28a65fa0277333a9eb
SSDEEP 1536:VAbtvEFuhi8r58RK8eTkqjz1g8zQ6tkUC+xQ6:VAKFiBoK8eThn1g8jkUCp6
TLSH
T1FE638E12737CE517D59E4FB574B71B014BB0AA466222E3CE0FB6515C6CB3B808E907A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aforge.video.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\AE8DDD6C7BED471C6F37F2DC312D5130\aforge.video.dll
Size 20KB
SHA256 52616d3438d2c853d69c68dade7bc280a7ffabdc85f1ce4a47166a98343f61b7
MD5 4a48a7428af3f34f8a2e1decf0723da6
SHA1 0f8d9da3c12467e3d2a7e27d6120e337e9b7b585
SHA512 fc319ffa826fc234c19a148810e54a59f80fe7c316d910cd7cc2eb2460d9cd2a564e1bd513192c76c9dbfbf95859f154a22b848e8bfc22e2c401fdda9bc39d63
SSDEEP 384:2tGvUPEoSfESuAGMMOKamweaQIqFS0kklo0KD:p8EoSfVPRZZ0LrKD
TLSH
T1CF92F81D5BACD737CA7E47BAEC6203014770961B3502FB9E7CCDB496AC6339909422A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnetzip.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\AE8DDD6C7BED471C6F37F2DC312D5130\dotnetzip.dll
Size 468KB
SHA256 0e52639dbddef74bc32f25555b193ab336e45e2f856d0424b140048c42b097ad
MD5 081c3e4b982ef5f2316bbdd31b324fc2
SHA1 f26053d054bace097d491f12f1503893bd87788f
SHA512 d68ed098de77c8b563ae6fb1f704c042b9ef2f7cf41f89d5ddf9fddf8937485d096052884bbf2ebd2378acdf2bb5686633473e9fc43525e96acaab0b729f3401
SSDEEP 6144:GuCInHLhJI4FY/ixjci6ychf8xalGQGtSV41kJDsTDDpBnse6OVxLV/WK:UQL32ikCaUS4csRBse6sfWK
TLSH
T1A6A4AE0427EC4B57E1EF5BB5E0B69592C3B1B462693EEB8F5D4024EE2C17390C911BA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sharpdx.direct3d11.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\AE8DDD6C7BED471C6F37F2DC312D5130\sharpdx.direct3d11.dll
Size 271KB
SHA256 d7617d926648849cbfef450b8f48e458ee52e2793fb2251a30094b778aa8848c
MD5 98eb5ba5871acdeaebf3a3b0f64be449
SHA1 c965284f60ef789b00b10b3df60ee682b4497de3
SHA512 a60025e304713d333e4b82b2d0be28087950688b049c98d2db5910c00b8d45b92e16d25ac8a58ff1318de019de3a9a00c7cbf8a6ad4b5bb1cb175dafa1b9bea2
SSDEEP 3072:6ccUvNf/AThDrcfiSDt0XN3ZDoyz91Sy0KwbwgG5OHDyGQsnHZ09K3vJqlQ1VcTS:zRfi+SmNgOHDyGQsucvJqW6Ts4dDjJZ
TLSH
T1F444E612DD465D0FC68F127EB4127A2743B08506489AF76FAC9C8C9E0FE63DC9A1A7C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sharpdx.direct3d9.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\AE8DDD6C7BED471C6F37F2DC312D5130\sharpdx.direct3d9.dll
Size 338KB
SHA256 02da4af8cd4a8de19d816000caaae885e676b9e52f136ff071a279c2b8ad34c7
MD5 934da0e49208d0881c44fe19d5033840
SHA1 a19c5a822e82e41752a08d3bd9110db19a8a5016
SHA512 de62f629c2299b50af62893244a28895d63b78138c8632449984306f45de16bd01076eadbb0d75a700215e970c1df731e202ea640236c0f0da6ed15146193b59
SSDEEP 6144:sF8TUNl4RaWH/EgJ2bOVbIbgiSC0EhS/:+8laWsgOOQHS
TLSH
T15B742B216F4AA723C74E2BBB98525D1CC334C202899FEB9F15E894710FC13958E5E6DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sharpdx.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\AE8DDD6C7BED471C6F37F2DC312D5130\sharpdx.dll
Size 247KB
SHA256 061542ff3fb36039b7bbffdf3e07b66176b264c1dfd834a14b09c08620717303
MD5 ffb4b61cc11bec6d48226027c2c26704
SHA1 fa8b9e344accbdc4dffa9b5d821d23f0716da29e
SHA512 48aa6130bf1f5bd6de19256bbdf754c0158b43dd122cec47bb801a7a7b56f2da268bfdec24d135621764a23278ead3dcc35911a057e2dfa55a348bae8ef7b8a9
SSDEEP 6144:/yx2FKVw+6LRnencMdWqtFhdpGFfnbJoeeYr:6w+Ienc1qf6bJrd
TLSH
T167348C36DB5C0923CE8E47BEAC67011307F69204E116DB4F3A7564A929CB384AD6E7D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sharpdx.dxgi.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\AE8DDD6C7BED471C6F37F2DC312D5130\sharpdx.dxgi.dll
Size 125KB
SHA256 3762d43c83af69cd38c9341a927ca6bd00f6bae8217c874d693047d6df4705bf
MD5 2b44c70c49b70d797fbb748158b5d9bb
SHA1 93e00e6527e461c45c7868d14cf05c007e478081
SHA512 faced62f6ecbfa2ee0d7a47e300302d23030d1f28758cbe9c442e9d8d4f8359c59088aa6237a28103e43d248c8efc7eeaf2c184028701b752df6cce92d6854d0
SSDEEP 1536:taSL4xpOaI0PXSgMkPXsHIrPQkrNCivO5Ib6VU3x8w85SMxcnqNojG5JW/UlibAs:taSLYpfI0fTtP8HIbQkreK
TLSH
T1E3C31F8A6F7187B1EA4F6FBE6652B92A6123F1110481735206D534004BB9253CFBFBDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/552-6-0x00000000748F0000-0x00000000750AC000-memory.dmp

Download

memory/552-1-0x0000000000DE0000-0x00000000010AA000-memory.dmp

Download

memory/552-2-0x0000000006180000-0x000000000673A000-memory.dmp

Download

memory/552-3-0x0000000005C60000-0x0000000005CF2000-memory.dmp

Download

memory/552-18-0x00000000748F0000-0x00000000750AC000-memory.dmp

Download

memory/552-4-0x0000000005BC0000-0x0000000005BCA000-memory.dmp

Download

memory/552-5-0x00000000748F0000-0x00000000750AC000-memory.dmp

Download

memory/552-7-0x0000000006000000-0x0000000006012000-memory.dmp

Download

memory/552-0-0x0000000074902000-0x0000000074903000-memory.dmp

Download

memory/824-10-0x00000000748F0000-0x00000000750AC000-memory.dmp

Download

memory/824-9-0x00000000748F0000-0x00000000750AC000-memory.dmp

Download

memory/824-8-0x0000000000400000-0x00000000006AE000-memory.dmp

Download

memory/824-73-0x0000000009CD0000-0x0000000009D6C000-memory.dmp

Download

memory/824-74-0x000000000A1F0000-0x000000000A256000-memory.dmp

Download

memory/824-75-0x00000000748F0000-0x00000000750AC000-memory.dmp

Download

memory/824-76-0x00000000748F0000-0x00000000750AC000-memory.dmp

Download

memory/4824-20-0x00000000748F0000-0x00000000750AC000-memory.dmp

Download

memory/4824-19-0x00000000748F0000-0x00000000750AC000-memory.dmp

Download

memory/4824-71-0x00000000748F0000-0x00000000750AC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads