Analysis
- max time kernel
598s - max time network
428s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
13/09/2026, 12:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jar_mods_injector.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
600 seconds
Behavioral task
behavioral2
Sample
jar_mods_injector.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
600 seconds
General
- Target jar_mods_injector.exe
- Size 5.4MB
- Sample260913-p686tabd84
- SHA256 0d577d29185c72eec169ea4c0cd171f07815b06d01926ff7de1a3bb896f5bbb5
- MD5 4dd6bef74876037046ee8c40a0338bef
- SHA1 1dff6dc4065918a4d55249109cca9ee8cf112725
- SHA512 26bbeec274f376d90a29fb53ac606e673e0db8ac7a3351e3d6bc4cc22b9c89fb31699a5173e4a8f2ed0ced8bee1b62fac44ed4d790433d84b6169e40e54edc76
- SSDEEP 49152:MlZi8lgDOQVi+6+FWcrlMrby+EIY1hYi/Cq2smDK/eBv1JwbiBOavpwJQb3kO4XS:N7/f/MmKAbiIaeJYY7Jpbt1It
- TLSH T1C9468D03B74A9AADC01BC474834686735A76B4CB0B35A9FF55C859383F6AAF04F38359
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Enumerates VirtualBox registry keys 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService reg.exe - Looks for VMWare services registry key. 1 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmmouse reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMTools reg.exe - Discovers running processes 1 TTPs 1 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 4496 tasklist.exe - Modifies registry key 1 TTPs 11 IoCs
pid Process 4428 reg.exe 3288 reg.exe 4608 reg.exe 1504 reg.exe 3096 reg.exe 1032 reg.exe 3632 reg.exe 4148 reg.exe 4376 reg.exe 552 reg.exe 1980 reg.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4496 tasklist.exe Token: SeIncreaseQuotaPrivilege 2152 wmic.exe Token: SeSecurityPrivilege 2152 wmic.exe Token: SeTakeOwnershipPrivilege 2152 wmic.exe Token: SeLoadDriverPrivilege 2152 wmic.exe Token: SeSystemProfilePrivilege 2152 wmic.exe Token: SeSystemtimePrivilege 2152 wmic.exe Token: SeProfSingleProcessPrivilege 2152 wmic.exe Token: SeIncBasePriorityPrivilege 2152 wmic.exe Token: SeCreatePagefilePrivilege 2152 wmic.exe Token: SeBackupPrivilege 2152 wmic.exe Token: SeRestorePrivilege 2152 wmic.exe Token: SeShutdownPrivilege 2152 wmic.exe Token: SeDebugPrivilege 2152 wmic.exe Token: SeSystemEnvironmentPrivilege 2152 wmic.exe Token: SeRemoteShutdownPrivilege 2152 wmic.exe Token: SeUndockPrivilege 2152 wmic.exe Token: SeManageVolumePrivilege 2152 wmic.exe Token: 33 2152 wmic.exe Token: 34 2152 wmic.exe Token: 35 2152 wmic.exe Token: 36 2152 wmic.exe Token: SeIncreaseQuotaPrivilege 2152 wmic.exe Token: SeSecurityPrivilege 2152 wmic.exe Token: SeTakeOwnershipPrivilege 2152 wmic.exe Token: SeLoadDriverPrivilege 2152 wmic.exe Token: SeSystemProfilePrivilege 2152 wmic.exe Token: SeSystemtimePrivilege 2152 wmic.exe Token: SeProfSingleProcessPrivilege 2152 wmic.exe Token: SeIncBasePriorityPrivilege 2152 wmic.exe Token: SeCreatePagefilePrivilege 2152 wmic.exe Token: SeBackupPrivilege 2152 wmic.exe Token: SeRestorePrivilege 2152 wmic.exe Token: SeShutdownPrivilege 2152 wmic.exe Token: SeDebugPrivilege 2152 wmic.exe Token: SeSystemEnvironmentPrivilege 2152 wmic.exe Token: SeRemoteShutdownPrivilege 2152 wmic.exe Token: SeUndockPrivilege 2152 wmic.exe Token: SeManageVolumePrivilege 2152 wmic.exe Token: 33 2152 wmic.exe Token: 34 2152 wmic.exe Token: 35 2152 wmic.exe Token: 36 2152 wmic.exe Token: SeIncreaseQuotaPrivilege 5092 wmic.exe Token: SeSecurityPrivilege 5092 wmic.exe Token: SeTakeOwnershipPrivilege 5092 wmic.exe Token: SeLoadDriverPrivilege 5092 wmic.exe Token: SeSystemProfilePrivilege 5092 wmic.exe Token: SeSystemtimePrivilege 5092 wmic.exe Token: SeProfSingleProcessPrivilege 5092 wmic.exe Token: SeIncBasePriorityPrivilege 5092 wmic.exe Token: SeCreatePagefilePrivilege 5092 wmic.exe Token: SeBackupPrivilege 5092 wmic.exe Token: SeRestorePrivilege 5092 wmic.exe Token: SeShutdownPrivilege 5092 wmic.exe Token: SeDebugPrivilege 5092 wmic.exe Token: SeSystemEnvironmentPrivilege 5092 wmic.exe Token: SeRemoteShutdownPrivilege 5092 wmic.exe Token: SeUndockPrivilege 5092 wmic.exe Token: SeManageVolumePrivilege 5092 wmic.exe Token: 33 5092 wmic.exe Token: 34 5092 wmic.exe Token: 35 5092 wmic.exe Token: 36 5092 wmic.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4684 jar_mods_injector.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 4684 wrote to memory of 4428 4684 jar_mods_injector.exe 85 PID 4684 wrote to memory of 3632 4684 jar_mods_injector.exe 86 PID 4684 wrote to memory of 4148 4684 jar_mods_injector.exe 87 PID 4684 wrote to memory of 4376 4684 jar_mods_injector.exe 88 PID 4684 wrote to memory of 3288 4684 jar_mods_injector.exe 89 PID 4684 wrote to memory of 4608 4684 jar_mods_injector.exe 90 PID 4684 wrote to memory of 1504 4684 jar_mods_injector.exe 91 PID 4684 wrote to memory of 3096 4684 jar_mods_injector.exe 92 PID 4684 wrote to memory of 552 4684 jar_mods_injector.exe 93 PID 4684 wrote to memory of 1980 4684 jar_mods_injector.exe 94 PID 4684 wrote to memory of 1032 4684 jar_mods_injector.exe 95 PID 4684 wrote to memory of 4496 4684 jar_mods_injector.exe 96 PID 4684 wrote to memory of 3960 4684 jar_mods_injector.exe 98 PID 4684 wrote to memory of 2152 4684 jar_mods_injector.exe 100 PID 4684 wrote to memory of 5092 4684 jar_mods_injector.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\jar_mods_injector.exe"C:\Users\Admin\AppData\Local\Temp\jar_mods_injector.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Windows\system32\reg.exe"reg" query HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest2⤵
- Enumerates VirtualBox registry keys
- Modifies registry key
PID:4428
-
-
C:\Windows\system32\reg.exe"reg" query HKLM\SYSTEM\CurrentControlSet\Services\VBoxService2⤵
- Enumerates VirtualBox registry keys
- Modifies registry key
PID:3632
-
-
C:\Windows\system32\reg.exe"reg" query HKLM\SYSTEM\CurrentControlSet\Services\vmhgfs2⤵
- Modifies registry key
PID:4148
-
-
C:\Windows\system32\reg.exe"reg" query HKLM\SYSTEM\CurrentControlSet\Services\vmmouse2⤵
- Looks for VMWare services registry key.
- Modifies registry key
PID:4376
-
-
C:\Windows\system32\reg.exe"reg" query HKLM\SYSTEM\CurrentControlSet\Services\VMTools2⤵
- Looks for VMWare services registry key.
- Modifies registry key
PID:3288
-
-
C:\Windows\system32\reg.exe"reg" query HKLM\SYSTEM\CurrentControlSet\Services\Hyper-V2⤵
- Modifies registry key
PID:4608
-
-
C:\Windows\system32\reg.exe"reg" query HKLM\SYSTEM\CurrentControlSet\Services\KvmGuest2⤵
- Modifies registry key
PID:1504
-
-
C:\Windows\system32\reg.exe"reg" query HKLM\SYSTEM\CurrentControlSet\Services\QEMU2⤵
- Modifies registry key
PID:3096
-
-
C:\Windows\system32\reg.exe"reg" query HKLM\SYSTEM\CurrentControlSet\Services\Xen2⤵
- Modifies registry key
PID:552
-
-
C:\Windows\system32\reg.exe"reg" query HKLM\SYSTEM\CurrentControlSet\Services\Parallels2⤵
- Modifies registry key
PID:1980
-
-
C:\Windows\system32\reg.exe"reg" query HKLM\SYSTEM\CurrentControlSet\Services\VirtualBox2⤵
- Modifies registry key
PID:1032
-
-
C:\Windows\system32\tasklist.exe"tasklist"2⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
PID:4496
-
-
C:\Windows\system32\getmac.exe"getmac"2⤵PID:3960
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" os get manufacturer2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2152
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" logicaldisk get name2⤵
- Suspicious use of AdjustPrivilegeToken
PID:5092
-