Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
02/10/2026, 06:22
General
- Target jave/jave.exe
- Size 46KB
- Sample261002-g4xe8ssapc
- SHA256 bab8d70f4fb9023cd5e13c210879436c87aba329a6615dd732445f012b633e5f
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\jave\jave.exe"C:\Users\Admin\AppData\Local\Temp\jave\jave.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\7858.tmp\7859.tmp\785A.bat C:\Users\Admin\AppData\Local\Temp\jave\jave.exe"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exejavaw -Xmx128M -jar jave.jar3⤵
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
785A.bat
memory/2476-0-0x0000000000400000-0x000000000041E000-memory.dmp
memory/2476-3-0x0000000000400000-0x000000000041E000-memory.dmp
memory/2536-6-0x0000022887DC0000-0x0000022888030000-memory.dmp
memory/2536-15-0x00000228863B0000-0x00000228863B1000-memory.dmp
memory/2536-26-0x0000022888030000-0x0000022888040000-memory.dmp
memory/2536-28-0x0000022888040000-0x0000022888050000-memory.dmp
memory/2536-30-0x0000022888050000-0x0000022888060000-memory.dmp
memory/2536-32-0x0000022888060000-0x0000022888070000-memory.dmp
memory/2536-34-0x0000022888070000-0x0000022888080000-memory.dmp
memory/2536-36-0x0000022888080000-0x0000022888090000-memory.dmp
memory/2536-37-0x00000228863B0000-0x00000228863B1000-memory.dmp
memory/2536-39-0x00000228863B0000-0x00000228863B1000-memory.dmp
memory/2536-40-0x0000022888090000-0x00000228880A0000-memory.dmp
memory/2536-42-0x00000228880A0000-0x00000228880B0000-memory.dmp
memory/2536-45-0x00000228880B0000-0x00000228880C0000-memory.dmp
memory/2536-44-0x0000022887DC0000-0x0000022888030000-memory.dmp
memory/2536-47-0x00000228880C0000-0x00000228880D0000-memory.dmp
memory/2536-50-0x00000228880D0000-0x00000228880E0000-memory.dmp
memory/2536-49-0x0000022888030000-0x0000022888040000-memory.dmp
memory/2536-54-0x00000228880E0000-0x00000228880F0000-memory.dmp
memory/2536-53-0x0000022888040000-0x0000022888050000-memory.dmp
memory/2536-57-0x00000228880F0000-0x0000022888100000-memory.dmp
memory/2536-56-0x0000022888050000-0x0000022888060000-memory.dmp
memory/2536-59-0x0000022888060000-0x0000022888070000-memory.dmp
memory/2536-60-0x0000022888100000-0x0000022888110000-memory.dmp
memory/2536-61-0x00000228863B0000-0x00000228863B1000-memory.dmp
memory/2536-64-0x0000022888110000-0x0000022888120000-memory.dmp
memory/2536-63-0x0000022888070000-0x0000022888080000-memory.dmp
memory/2536-72-0x0000022888140000-0x0000022888150000-memory.dmp
memory/2536-71-0x0000022888090000-0x00000228880A0000-memory.dmp
memory/2536-70-0x0000022888130000-0x0000022888140000-memory.dmp
memory/2536-69-0x0000022888120000-0x0000022888130000-memory.dmp
memory/2536-68-0x0000022888080000-0x0000022888090000-memory.dmp
memory/2536-74-0x00000228880A0000-0x00000228880B0000-memory.dmp
memory/2536-75-0x0000022888150000-0x0000022888160000-memory.dmp
memory/2536-77-0x00000228880B0000-0x00000228880C0000-memory.dmp
memory/2536-80-0x00000228880C0000-0x00000228880D0000-memory.dmp
memory/2536-81-0x0000022888170000-0x0000022888180000-memory.dmp
memory/2536-79-0x0000022888160000-0x0000022888170000-memory.dmp
memory/2536-84-0x0000022888180000-0x0000022888190000-memory.dmp
memory/2536-83-0x00000228880D0000-0x00000228880E0000-memory.dmp
memory/2536-87-0x00000228880F0000-0x0000022888100000-memory.dmp
memory/2536-88-0x0000022888190000-0x00000228881A0000-memory.dmp
memory/2536-91-0x00000228881A0000-0x00000228881B0000-memory.dmp
memory/2536-93-0x00000228881B0000-0x00000228881C0000-memory.dmp
memory/2536-92-0x0000022888100000-0x0000022888110000-memory.dmp
memory/2536-86-0x00000228880E0000-0x00000228880F0000-memory.dmp
memory/2536-95-0x0000022888110000-0x0000022888120000-memory.dmp
memory/2536-97-0x00000228881C0000-0x00000228881D0000-memory.dmp
memory/2536-96-0x0000022888130000-0x0000022888140000-memory.dmp
memory/2536-100-0x00000228881D0000-0x00000228881E0000-memory.dmp
memory/2536-99-0x0000022888120000-0x0000022888130000-memory.dmp
memory/2536-104-0x00000228881E0000-0x00000228881F0000-memory.dmp
memory/2536-103-0x0000022888140000-0x0000022888150000-memory.dmp
memory/2536-106-0x0000022888150000-0x0000022888160000-memory.dmp
memory/2536-107-0x00000228881F0000-0x0000022888200000-memory.dmp
memory/2536-110-0x0000022888200000-0x0000022888210000-memory.dmp
memory/2536-109-0x0000022888160000-0x0000022888170000-memory.dmp
memory/2536-112-0x0000022888170000-0x0000022888180000-memory.dmp
memory/2536-113-0x0000022888210000-0x0000022888220000-memory.dmp
memory/2536-118-0x0000022888220000-0x0000022888230000-memory.dmp
memory/2536-117-0x0000022888180000-0x0000022888190000-memory.dmp
memory/2536-121-0x0000022888230000-0x0000022888240000-memory.dmp
memory/2536-120-0x0000022888190000-0x00000228881A0000-memory.dmp
memory/2536-124-0x0000022888240000-0x0000022888250000-memory.dmp
memory/2536-123-0x00000228881A0000-0x00000228881B0000-memory.dmp
memory/2536-127-0x0000022888250000-0x0000022888260000-memory.dmp
memory/2536-126-0x00000228881B0000-0x00000228881C0000-memory.dmp
memory/2536-131-0x0000022888260000-0x0000022888270000-memory.dmp
memory/2536-130-0x00000228881C0000-0x00000228881D0000-memory.dmp
memory/2536-134-0x0000022888270000-0x0000022888280000-memory.dmp
memory/2536-133-0x00000228881D0000-0x00000228881E0000-memory.dmp
memory/2536-137-0x0000022888280000-0x0000022888290000-memory.dmp
memory/2536-136-0x00000228881E0000-0x00000228881F0000-memory.dmp
memory/2536-141-0x0000022888290000-0x00000228882A0000-memory.dmp
memory/2536-140-0x00000228881F0000-0x0000022888200000-memory.dmp
memory/2536-142-0x0000022888200000-0x0000022888210000-memory.dmp
memory/2536-143-0x00000228882A0000-0x00000228882B0000-memory.dmp
memory/2536-147-0x00000228882B0000-0x00000228882C0000-memory.dmp
memory/2536-146-0x0000022888210000-0x0000022888220000-memory.dmp
memory/2536-150-0x00000228882C0000-0x00000228882D0000-memory.dmp
memory/2536-149-0x0000022888220000-0x0000022888230000-memory.dmp
memory/2536-153-0x00000228882D0000-0x00000228882E0000-memory.dmp
memory/2536-152-0x0000022888230000-0x0000022888240000-memory.dmp
memory/2536-157-0x00000228882E0000-0x00000228882F0000-memory.dmp
memory/2536-156-0x0000022888240000-0x0000022888250000-memory.dmp
memory/2536-159-0x0000022888250000-0x0000022888260000-memory.dmp
memory/2536-160-0x00000228882F0000-0x0000022888300000-memory.dmp
memory/2536-163-0x0000022888260000-0x0000022888270000-memory.dmp
memory/2536-164-0x0000022888300000-0x0000022888310000-memory.dmp
memory/2536-167-0x0000022888310000-0x0000022888320000-memory.dmp
memory/2536-166-0x0000022888270000-0x0000022888280000-memory.dmp
memory/2536-170-0x0000022888280000-0x0000022888290000-memory.dmp
memory/2536-171-0x0000022888320000-0x0000022888330000-memory.dmp
memory/2536-174-0x0000022888330000-0x0000022888340000-memory.dmp
memory/2536-173-0x0000022888290000-0x00000228882A0000-memory.dmp
memory/2536-177-0x00000228882A0000-0x00000228882B0000-memory.dmp
memory/2536-178-0x0000022888340000-0x0000022888350000-memory.dmp
memory/2536-180-0x00000228882B0000-0x00000228882C0000-memory.dmp
memory/2536-181-0x0000022888350000-0x0000022888360000-memory.dmp
memory/2536-182-0x00000228863B0000-0x00000228863B1000-memory.dmp
memory/2536-184-0x00000228882C0000-0x00000228882D0000-memory.dmp
memory/2536-187-0x00000228863B0000-0x00000228863B1000-memory.dmp
memory/2536-284-0x00000228863B0000-0x00000228863B1000-memory.dmp