Analysis
- user interaction
yes - max time kernel
150s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/08/2026, 15:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jar_mods_injector.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
jar_mods_injector.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target jar_mods_injector.exe
- Size 5.4MB
- Sample260817-s8ab2sdq4v
- SHA256 0d577d29185c72eec169ea4c0cd171f07815b06d01926ff7de1a3bb896f5bbb5
- MD5 4dd6bef74876037046ee8c40a0338bef
- SHA1 1dff6dc4065918a4d55249109cca9ee8cf112725
- SHA512 26bbeec274f376d90a29fb53ac606e673e0db8ac7a3351e3d6bc4cc22b9c89fb31699a5173e4a8f2ed0ced8bee1b62fac44ed4d790433d84b6169e40e54edc76
- SSDEEP 49152:MlZi8lgDOQVi+6+FWcrlMrby+EIY1hYi/Cq2smDK/eBv1JwbiBOavpwJQb3kO4XS:N7/f/MmKAbiIaeJYY7Jpbt1It
- TLSH T1C9468D03B74A9AADC01BC474834686735A76B4CB0B35A9FF55C859383F6AAF04F38359
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Enumerates VirtualBox registry keys 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService reg.exe - Looks for VMWare services registry key. 1 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmmouse reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMTools reg.exe - Discovers running processes 1 TTPs 1 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 1952 tasklist.exe - Modifies registry key 1 TTPs 11 IoCs
pid Process 3408 reg.exe 868 reg.exe 4400 reg.exe 2540 reg.exe 3712 reg.exe 3412 reg.exe 3404 reg.exe 3360 reg.exe 3344 reg.exe 5512 reg.exe 1872 reg.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2216 wmic.exe 2216 wmic.exe 2216 wmic.exe 2216 wmic.exe 3660 wmic.exe 3660 wmic.exe 3660 wmic.exe 3660 wmic.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1952 tasklist.exe Token: SeIncreaseQuotaPrivilege 2216 wmic.exe Token: SeSecurityPrivilege 2216 wmic.exe Token: SeTakeOwnershipPrivilege 2216 wmic.exe Token: SeLoadDriverPrivilege 2216 wmic.exe Token: SeSystemProfilePrivilege 2216 wmic.exe Token: SeSystemtimePrivilege 2216 wmic.exe Token: SeProfSingleProcessPrivilege 2216 wmic.exe Token: SeIncBasePriorityPrivilege 2216 wmic.exe Token: SeCreatePagefilePrivilege 2216 wmic.exe Token: SeBackupPrivilege 2216 wmic.exe Token: SeRestorePrivilege 2216 wmic.exe Token: SeShutdownPrivilege 2216 wmic.exe Token: SeDebugPrivilege 2216 wmic.exe Token: SeSystemEnvironmentPrivilege 2216 wmic.exe Token: SeRemoteShutdownPrivilege 2216 wmic.exe Token: SeUndockPrivilege 2216 wmic.exe Token: SeManageVolumePrivilege 2216 wmic.exe Token: 33 2216 wmic.exe Token: 34 2216 wmic.exe Token: 35 2216 wmic.exe Token: 36 2216 wmic.exe Token: SeIncreaseQuotaPrivilege 2216 wmic.exe Token: SeSecurityPrivilege 2216 wmic.exe Token: SeTakeOwnershipPrivilege 2216 wmic.exe Token: SeLoadDriverPrivilege 2216 wmic.exe Token: SeSystemProfilePrivilege 2216 wmic.exe Token: SeSystemtimePrivilege 2216 wmic.exe Token: SeProfSingleProcessPrivilege 2216 wmic.exe Token: SeIncBasePriorityPrivilege 2216 wmic.exe Token: SeCreatePagefilePrivilege 2216 wmic.exe Token: SeBackupPrivilege 2216 wmic.exe Token: SeRestorePrivilege 2216 wmic.exe Token: SeShutdownPrivilege 2216 wmic.exe Token: SeDebugPrivilege 2216 wmic.exe Token: SeSystemEnvironmentPrivilege 2216 wmic.exe Token: SeRemoteShutdownPrivilege 2216 wmic.exe Token: SeUndockPrivilege 2216 wmic.exe Token: SeManageVolumePrivilege 2216 wmic.exe Token: 33 2216 wmic.exe Token: 34 2216 wmic.exe Token: 35 2216 wmic.exe Token: 36 2216 wmic.exe Token: SeIncreaseQuotaPrivilege 3660 wmic.exe Token: SeSecurityPrivilege 3660 wmic.exe Token: SeTakeOwnershipPrivilege 3660 wmic.exe Token: SeLoadDriverPrivilege 3660 wmic.exe Token: SeSystemProfilePrivilege 3660 wmic.exe Token: SeSystemtimePrivilege 3660 wmic.exe Token: SeProfSingleProcessPrivilege 3660 wmic.exe Token: SeIncBasePriorityPrivilege 3660 wmic.exe Token: SeCreatePagefilePrivilege 3660 wmic.exe Token: SeBackupPrivilege 3660 wmic.exe Token: SeRestorePrivilege 3660 wmic.exe Token: SeShutdownPrivilege 3660 wmic.exe Token: SeDebugPrivilege 3660 wmic.exe Token: SeSystemEnvironmentPrivilege 3660 wmic.exe Token: SeRemoteShutdownPrivilege 3660 wmic.exe Token: SeUndockPrivilege 3660 wmic.exe Token: SeManageVolumePrivilege 3660 wmic.exe Token: 33 3660 wmic.exe Token: 34 3660 wmic.exe Token: 35 3660 wmic.exe Token: 36 3660 wmic.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2212 jar_mods_injector.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2212 wrote to memory of 3712 2212 jar_mods_injector.exe 90 PID 2212 wrote to memory of 3412 2212 jar_mods_injector.exe 91 PID 2212 wrote to memory of 3404 2212 jar_mods_injector.exe 92 PID 2212 wrote to memory of 3360 2212 jar_mods_injector.exe 93 PID 2212 wrote to memory of 3344 2212 jar_mods_injector.exe 94 PID 2212 wrote to memory of 868 2212 jar_mods_injector.exe 95 PID 2212 wrote to memory of 5512 2212 jar_mods_injector.exe 96 PID 2212 wrote to memory of 1872 2212 jar_mods_injector.exe 97 PID 2212 wrote to memory of 3408 2212 jar_mods_injector.exe 98 PID 2212 wrote to memory of 4400 2212 jar_mods_injector.exe 99 PID 2212 wrote to memory of 2540 2212 jar_mods_injector.exe 100 PID 2212 wrote to memory of 1952 2212 jar_mods_injector.exe 101 PID 2212 wrote to memory of 5916 2212 jar_mods_injector.exe 103 PID 2212 wrote to memory of 2216 2212 jar_mods_injector.exe 105 PID 2212 wrote to memory of 3660 2212 jar_mods_injector.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\jar_mods_injector.exe"C:\Users\Admin\AppData\Local\Temp\jar_mods_injector.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\system32\reg.exe"reg" query HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest2⤵
- Enumerates VirtualBox registry keys
- Modifies registry key
PID:3712
-
-
C:\Windows\system32\reg.exe"reg" query HKLM\SYSTEM\CurrentControlSet\Services\VBoxService2⤵
- Enumerates VirtualBox registry keys
- Modifies registry key
PID:3412
-
-
C:\Windows\system32\reg.exe"reg" query HKLM\SYSTEM\CurrentControlSet\Services\vmhgfs2⤵
- Modifies registry key
PID:3404
-
-
C:\Windows\system32\reg.exe"reg" query HKLM\SYSTEM\CurrentControlSet\Services\vmmouse2⤵
- Looks for VMWare services registry key.
- Modifies registry key
PID:3360
-
-
C:\Windows\system32\reg.exe"reg" query HKLM\SYSTEM\CurrentControlSet\Services\VMTools2⤵
- Looks for VMWare services registry key.
- Modifies registry key
PID:3344
-
-
C:\Windows\system32\reg.exe"reg" query HKLM\SYSTEM\CurrentControlSet\Services\Hyper-V2⤵
- Modifies registry key
PID:868
-
-
C:\Windows\system32\reg.exe"reg" query HKLM\SYSTEM\CurrentControlSet\Services\KvmGuest2⤵
- Modifies registry key
PID:5512
-
-
C:\Windows\system32\reg.exe"reg" query HKLM\SYSTEM\CurrentControlSet\Services\QEMU2⤵
- Modifies registry key
PID:1872
-
-
C:\Windows\system32\reg.exe"reg" query HKLM\SYSTEM\CurrentControlSet\Services\Xen2⤵
- Modifies registry key
PID:3408
-
-
C:\Windows\system32\reg.exe"reg" query HKLM\SYSTEM\CurrentControlSet\Services\Parallels2⤵
- Modifies registry key
PID:4400
-
-
C:\Windows\system32\reg.exe"reg" query HKLM\SYSTEM\CurrentControlSet\Services\VirtualBox2⤵
- Modifies registry key
PID:2540
-
-
C:\Windows\system32\tasklist.exe"tasklist"2⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
PID:1952
-
-
C:\Windows\system32\getmac.exe"getmac"2⤵PID:5916
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" os get manufacturer2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2216
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" logicaldisk get name2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3660
-