178158bc6dc23ab2effd22dd75bcdd7ef1aa7c2182ae5924702582dc7d51a32b

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/09/2026, 13:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
178158bc6dc23ab2effd22dd75bcdd7ef1aa7c2182ae5924702582dc7d51a32b.exe
Size 1.2MB
Sample260928-qyn2caba29
SHA256 178158bc6dc23ab2effd22dd75bcdd7ef1aa7c2182ae5924702582dc7d51a32b
MD5 52bd030547ad26347860e44bb1b56254
SHA1 f5b8fd1b1265367544f9546cd3899e8d14018ff9
SHA512 3193eb1e491fb6458582fb25bd8a55b8d1a35d4baf4073ee9c3a3a831581fa0904ad55963d306300e6d4f45ac5bf8e1c5f224830aeeb89ebfa146a289f057a6a
SSDEEP 24576:hrkRmtSgXqJ6jT9kTfP8cpw384F3/85RkV8vn+W:hGwSxJk9kTfkcpUF3UfkVS+W
TLSH
T185456A2176E58036F1B32731687C92649A3AFCB1993A850F73C8666D5F30A81CE35B77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	178158bc6dc23ab2effd22dd75bcdd7ef1aa7c2182ae5924702582dc7d51a32b.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	178158bc6dc23ab2effd22dd75bcdd7ef1aa7c2182ae5924702582dc7d51a32b.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	178158bc6dc23ab2effd22dd75bcdd7ef1aa7c2182ae5924702582dc7d51a32b.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4616	javaws.exe
4616	javaws.exe
4028	jp2launcher.exe
4028	jp2launcher.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5080	178158bc6dc23ab2effd22dd75bcdd7ef1aa7c2182ae5924702582dc7d51a32b.exe
5080	178158bc6dc23ab2effd22dd75bcdd7ef1aa7c2182ae5924702582dc7d51a32b.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
5080	178158bc6dc23ab2effd22dd75bcdd7ef1aa7c2182ae5924702582dc7d51a32b.exe
5080	178158bc6dc23ab2effd22dd75bcdd7ef1aa7c2182ae5924702582dc7d51a32b.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4028	jp2launcher.exe
5080	178158bc6dc23ab2effd22dd75bcdd7ef1aa7c2182ae5924702582dc7d51a32b.exe
5080	178158bc6dc23ab2effd22dd75bcdd7ef1aa7c2182ae5924702582dc7d51a32b.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5080 wrote to memory of 4616	5080	178158bc6dc23ab2effd22dd75bcdd7ef1aa7c2182ae5924702582dc7d51a32b.exe	90
PID 4616 wrote to memory of 4028	4616	javaws.exe	91

C:\Users\Admin\AppData\Local\Temp\178158bc6dc23ab2effd22dd75bcdd7ef1aa7c2182ae5924702582dc7d51a32b.exe
"C:\Users\Admin\AppData\Local\Temp\178158bc6dc23ab2effd22dd75bcdd7ef1aa7c2182ae5924702582dc7d51a32b.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5080
- C:\Program Files\Java\jre-1.8\bin\javaws.exe
  "C:\Program Files\Java\jre-1.8\bin\javaws.exe" -J-Djdk.disableLastUsageTracking=true -SSVBaselineUpdate
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4616
- - C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
    "C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre-1.8" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxsaWJcZGVwbG95LmphcgAtRGphdmEuc2VjdXJpdHkucG9saWN5PWZpbGU6QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZS0xLjhcbGliXHNlY3VyaXR5XGphdmF3cy5wb2xpY3kALUR0cnVzdFByb3h5PXRydWUALVh2ZXJpZnk6cmVtb3RlAC1Eam5scHguaG9tZT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxqYXZhd3MuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxkZXBsb3kuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxwbHVnaW4uamFyAC1EamRrLmRpc2FibGVMYXN0VXNhZ2VUcmFja2luZz10cnVlAC1Eam5scHguanZtPUM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGJpblxqYXZhdy5leGUALURqbmxweC52bWFyZ3M9TFVScVpHc3VaR2x6WVdKc1pVeGhjM1JWYzJGblpWUnlZV05yYVc1blBYUnlkV1VB -ma LVNTVkJhc2VsaW5lVXBkYXRlAC1ub3RXZWJKYXZh
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:4028

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

deployment.properties

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\deployment.properties
Size 896B
SHA256 9702b08edd38b41e88008e1fc595d03d747e4fa86aeb157a0c505c881319c259
MD5 48a2a793d54883f38a32ef76b3b8388e
SHA1 e609ef4bbe997227aea063eefd10d20fcb4821de
SHA512 f2334f90cc44bc1a84f8c7f1d46aa85585758322038ab22bf27fdee79d961fc7cf0051393654e19d2c94d37d3c5d959fa4950dcc048680048abd5532d87a067f
TLSH
T10711E582B82BA07029413432EACF43F73BF2A73D08A56175B1C058CDB865F3606E3C25
MD5 SHA1 SHA512 TLSH

Submit Download

securitypack.jar

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\security\securitypack.jar
Size 12KB
SHA256 e94ed703c880dc054137c8de6a731bc8a9f06302b59f2ebe4de3436e582ad464
MD5 0e287ef1530ad82a789e6f511fe69b9d
SHA1 1ba51bf0716dd402f6536f11d49008a8fadb7ad3
SHA512 9fb21d01922c214254f52eb933efa6589f9d2a54772ec777b0eed84f968edcfdf1025c81e64a542f6390dc11554f568bf0f156b1e54b8d57dc33d20a51c80d5d
SSDEEP 384:EoZ7VvSQIFCrCwZ6io/GUTySCkervC2NJM5bBsUq:zTaQmaCviFUThervC2bMd2B
TLSH
T16542C07A1A75ED07CD377A336610F90B9A6DD28A1748520753CA0B798ED1BE003919CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 164KB
SHA256 51f557bc9e6bb296776a669b9ca8bdc50e68c96aba4ba7970640f5aed0a297ab
MD5 c7831d76df997d780eeba0a75d378507
SHA1 5cecd4aead15a3d4850fd27f58541e4ee09f4445
SHA512 ce4d2bdb1a6dfe183babc16126dea153329f38f44c581a2608c96335d2e494b25b62ea06b2cd7d658996a01e3cd6418816932e952cb45a28b613a0c1df521bcd
SSDEEP 3072:QdJp6zZkin11os1FlRJA9xVLnCQ77RLUFActrfsDsY0S:IUJ5m
TLSH
T1C2F37687866E44FB34130FA3C76A5C685563272D535E4F2D31EF828EA041E03D6AE5EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4028-19-0x00000129AD880000-0x00000129ADAF0000-memory.dmp

Download

memory/4028-50-0x00000129AD3C0000-0x00000129AD3C1000-memory.dmp

Download

memory/4028-307-0x00000129AD3C0000-0x00000129AD3C1000-memory.dmp

Download

memory/4028-329-0x00000129AD3C0000-0x00000129AD3C1000-memory.dmp

Download

memory/4028-341-0x00000129AD3C0000-0x00000129AD3C1000-memory.dmp

Download

memory/4028-368-0x00000129AD3C0000-0x00000129AD3C1000-memory.dmp

Download

memory/4028-370-0x00000129AD3C0000-0x00000129AD3C1000-memory.dmp

Download

memory/4028-393-0x00000129AD3C0000-0x00000129AD3C1000-memory.dmp

Download

memory/4028-394-0x00000129AD880000-0x00000129ADAF0000-memory.dmp

Download