Analysis
- user interaction
yes - max time kernel
598s - max time network
479s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/09/2026, 12:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jar_mods_injector.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
600 seconds
Behavioral task
behavioral2
Sample
jar_mods_injector.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
600 seconds
General
- Target jar_mods_injector.exe
- Size 5.4MB
- Sample260913-p686tabd84
- SHA256 0d577d29185c72eec169ea4c0cd171f07815b06d01926ff7de1a3bb896f5bbb5
- MD5 4dd6bef74876037046ee8c40a0338bef
- SHA1 1dff6dc4065918a4d55249109cca9ee8cf112725
- SHA512 26bbeec274f376d90a29fb53ac606e673e0db8ac7a3351e3d6bc4cc22b9c89fb31699a5173e4a8f2ed0ced8bee1b62fac44ed4d790433d84b6169e40e54edc76
- SSDEEP 49152:MlZi8lgDOQVi+6+FWcrlMrby+EIY1hYi/Cq2smDK/eBv1JwbiBOavpwJQb3kO4XS:N7/f/MmKAbiIaeJYY7Jpbt1It
- TLSH T1C9468D03B74A9AADC01BC474834686735A76B4CB0B35A9FF55C859383F6AAF04F38359
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Enumerates VirtualBox registry keys 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService reg.exe - Looks for VMWare services registry key. 1 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmmouse reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMTools reg.exe - Discovers running processes 1 TTPs 1 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 932 tasklist.exe - Modifies registry key 1 TTPs 11 IoCs
pid Process 2172 reg.exe 3312 reg.exe 2728 reg.exe 3188 reg.exe 4864 reg.exe 4116 reg.exe 4284 reg.exe 5200 reg.exe 1860 reg.exe 3512 reg.exe 1164 reg.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2420 wmic.exe 2420 wmic.exe 2420 wmic.exe 2420 wmic.exe 2608 wmic.exe 2608 wmic.exe 2608 wmic.exe 2608 wmic.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 932 tasklist.exe Token: SeIncreaseQuotaPrivilege 2420 wmic.exe Token: SeSecurityPrivilege 2420 wmic.exe Token: SeTakeOwnershipPrivilege 2420 wmic.exe Token: SeLoadDriverPrivilege 2420 wmic.exe Token: SeSystemProfilePrivilege 2420 wmic.exe Token: SeSystemtimePrivilege 2420 wmic.exe Token: SeProfSingleProcessPrivilege 2420 wmic.exe Token: SeIncBasePriorityPrivilege 2420 wmic.exe Token: SeCreatePagefilePrivilege 2420 wmic.exe Token: SeBackupPrivilege 2420 wmic.exe Token: SeRestorePrivilege 2420 wmic.exe Token: SeShutdownPrivilege 2420 wmic.exe Token: SeDebugPrivilege 2420 wmic.exe Token: SeSystemEnvironmentPrivilege 2420 wmic.exe Token: SeRemoteShutdownPrivilege 2420 wmic.exe Token: SeUndockPrivilege 2420 wmic.exe Token: SeManageVolumePrivilege 2420 wmic.exe Token: 33 2420 wmic.exe Token: 34 2420 wmic.exe Token: 35 2420 wmic.exe Token: 36 2420 wmic.exe Token: SeIncreaseQuotaPrivilege 2420 wmic.exe Token: SeSecurityPrivilege 2420 wmic.exe Token: SeTakeOwnershipPrivilege 2420 wmic.exe Token: SeLoadDriverPrivilege 2420 wmic.exe Token: SeSystemProfilePrivilege 2420 wmic.exe Token: SeSystemtimePrivilege 2420 wmic.exe Token: SeProfSingleProcessPrivilege 2420 wmic.exe Token: SeIncBasePriorityPrivilege 2420 wmic.exe Token: SeCreatePagefilePrivilege 2420 wmic.exe Token: SeBackupPrivilege 2420 wmic.exe Token: SeRestorePrivilege 2420 wmic.exe Token: SeShutdownPrivilege 2420 wmic.exe Token: SeDebugPrivilege 2420 wmic.exe Token: SeSystemEnvironmentPrivilege 2420 wmic.exe Token: SeRemoteShutdownPrivilege 2420 wmic.exe Token: SeUndockPrivilege 2420 wmic.exe Token: SeManageVolumePrivilege 2420 wmic.exe Token: 33 2420 wmic.exe Token: 34 2420 wmic.exe Token: 35 2420 wmic.exe Token: 36 2420 wmic.exe Token: SeIncreaseQuotaPrivilege 2608 wmic.exe Token: SeSecurityPrivilege 2608 wmic.exe Token: SeTakeOwnershipPrivilege 2608 wmic.exe Token: SeLoadDriverPrivilege 2608 wmic.exe Token: SeSystemProfilePrivilege 2608 wmic.exe Token: SeSystemtimePrivilege 2608 wmic.exe Token: SeProfSingleProcessPrivilege 2608 wmic.exe Token: SeIncBasePriorityPrivilege 2608 wmic.exe Token: SeCreatePagefilePrivilege 2608 wmic.exe Token: SeBackupPrivilege 2608 wmic.exe Token: SeRestorePrivilege 2608 wmic.exe Token: SeShutdownPrivilege 2608 wmic.exe Token: SeDebugPrivilege 2608 wmic.exe Token: SeSystemEnvironmentPrivilege 2608 wmic.exe Token: SeRemoteShutdownPrivilege 2608 wmic.exe Token: SeUndockPrivilege 2608 wmic.exe Token: SeManageVolumePrivilege 2608 wmic.exe Token: 33 2608 wmic.exe Token: 34 2608 wmic.exe Token: 35 2608 wmic.exe Token: 36 2608 wmic.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5828 jar_mods_injector.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 5828 wrote to memory of 5200 5828 jar_mods_injector.exe 88 PID 5828 wrote to memory of 2172 5828 jar_mods_injector.exe 89 PID 5828 wrote to memory of 1860 5828 jar_mods_injector.exe 90 PID 5828 wrote to memory of 3312 5828 jar_mods_injector.exe 91 PID 5828 wrote to memory of 3512 5828 jar_mods_injector.exe 92 PID 5828 wrote to memory of 2728 5828 jar_mods_injector.exe 93 PID 5828 wrote to memory of 3188 5828 jar_mods_injector.exe 94 PID 5828 wrote to memory of 4864 5828 jar_mods_injector.exe 95 PID 5828 wrote to memory of 1164 5828 jar_mods_injector.exe 96 PID 5828 wrote to memory of 4116 5828 jar_mods_injector.exe 97 PID 5828 wrote to memory of 4284 5828 jar_mods_injector.exe 98 PID 5828 wrote to memory of 932 5828 jar_mods_injector.exe 99 PID 5828 wrote to memory of 5128 5828 jar_mods_injector.exe 101 PID 5828 wrote to memory of 2420 5828 jar_mods_injector.exe 103 PID 5828 wrote to memory of 2608 5828 jar_mods_injector.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\jar_mods_injector.exe"C:\Users\Admin\AppData\Local\Temp\jar_mods_injector.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5828 -
C:\Windows\system32\reg.exe"reg" query HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest2⤵
- Enumerates VirtualBox registry keys
- Modifies registry key
PID:5200
-
-
C:\Windows\system32\reg.exe"reg" query HKLM\SYSTEM\CurrentControlSet\Services\VBoxService2⤵
- Enumerates VirtualBox registry keys
- Modifies registry key
PID:2172
-
-
C:\Windows\system32\reg.exe"reg" query HKLM\SYSTEM\CurrentControlSet\Services\vmhgfs2⤵
- Modifies registry key
PID:1860
-
-
C:\Windows\system32\reg.exe"reg" query HKLM\SYSTEM\CurrentControlSet\Services\vmmouse2⤵
- Looks for VMWare services registry key.
- Modifies registry key
PID:3312
-
-
C:\Windows\system32\reg.exe"reg" query HKLM\SYSTEM\CurrentControlSet\Services\VMTools2⤵
- Looks for VMWare services registry key.
- Modifies registry key
PID:3512
-
-
C:\Windows\system32\reg.exe"reg" query HKLM\SYSTEM\CurrentControlSet\Services\Hyper-V2⤵
- Modifies registry key
PID:2728
-
-
C:\Windows\system32\reg.exe"reg" query HKLM\SYSTEM\CurrentControlSet\Services\KvmGuest2⤵
- Modifies registry key
PID:3188
-
-
C:\Windows\system32\reg.exe"reg" query HKLM\SYSTEM\CurrentControlSet\Services\QEMU2⤵
- Modifies registry key
PID:4864
-
-
C:\Windows\system32\reg.exe"reg" query HKLM\SYSTEM\CurrentControlSet\Services\Xen2⤵
- Modifies registry key
PID:1164
-
-
C:\Windows\system32\reg.exe"reg" query HKLM\SYSTEM\CurrentControlSet\Services\Parallels2⤵
- Modifies registry key
PID:4116
-
-
C:\Windows\system32\reg.exe"reg" query HKLM\SYSTEM\CurrentControlSet\Services\VirtualBox2⤵
- Modifies registry key
PID:4284
-
-
C:\Windows\system32\tasklist.exe"tasklist"2⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
PID:932
-
-
C:\Windows\system32\getmac.exe"getmac"2⤵PID:5128
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" os get manufacturer2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2420
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" logicaldisk get name2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2608
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:6056