Analysis
- user interaction
yes - max time kernel
898s - max time network
472s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
24/10/2026, 10:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Aristois-Free.jar
Resource
win10v2004-20260911-en
3 signatures
900 seconds
General
- Target Aristois-Free.jar
- Size 6.6MB
- Sample261024-ms32jayv9l
- SHA256 c3b6900f62cdec6b8bedebc6804a75c60b314ff871461ea279de6e592e944223
- MD5 ba90e49c77196f2ec55466d8b190d622
- SHA1 abcc1ebcef5243af9ad5bda0f1b343e06b60fcea
- SHA512 26ee98b745fe921f794702d0da4e7d3b95d2c771430e6618bac15f6522f12eb9ee6ccb31873e2ae6637d394b809058c38ad23f78f8a72d252032c1b6fc9ebfba
- SSDEEP 196608:cpoYXXwEffBc7ykQ3dw1ReCzAh+1blTRL82KCDy:M7Dfp3k3jAh8dJ82Kgy
- TLSH T150662222ECEA612EF937413920434566353A67C9EECBD4E109E972C1D46383A5F937BC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 2 IoCs
pid Process 2316 java.exe 2316 java.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeSystemEnvironmentPrivilege 4968 bootim.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2316 java.exe
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\Aristois-Free.jar1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2316
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3284
-
C:\Windows\System32\bootim.exe"C:\Windows\System32\bootim.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4968
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\lwjglAdmin\3.3.1-SNAPSHOT\glfw.dll
- Size 357KB
- SHA256 f61949c469c54a5f4e5a8e1668255b919ee1237f1e568acf4127dda0abcdc9a8
- MD5 dad976fafd111ceedc7a473932e9da8f
- SHA1 3c0e8e7fcbc854a87219fbbfd181c2cc76018144
- SHA512 64801d4d34f130b5ee33d2df3a266e2aed981265d13c6552ab73418471398c49cab9a617647b64298c1de432d078f1a7b830d4330980e7ef10dd15a1d18bda11
- SSDEEP 6144:T0AJZkW+P2H68GNlqUF6dFpXKy1oO6OgbCoRbH:T0AJyWo2H6JxFibN1oO
- TLSH T123741918E7B1045ACA2B4433C5DFFA229577744C3BEBA5DF7A5409983E22FE18079B24
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\lwjglAdmin\3.3.1-SNAPSHOT\lwjgl.dll
- Size 446KB
- SHA256 1cbc8a197aea7eee710735a57a8cae6c0953ad1fe2cb6e17c2e5afebeb93b5ec
- MD5 78b8212a157e985fa9d9ee9eaab033bd
- SHA1 0c9b501520c20055ba77bbd8cae4895fcb1cfa40
- SHA512 180dd20b04643d42195a30c28d455c923f395977f7dcb66b1ace85e99c1e3c00906542221092bf6d5465a5fc451d7523df862ab2bc050da3a136a6f635706d80
- SSDEEP 6144:4t4oJB/Uv4X12DbMPN894sQetCxgWIwebtd9:4t4oJB/UvA12DbMF89A5epf
- TLSH T1C7A4E931DE12C68CDCEB723960535001EB7678640B1227CB27AB9A5BB516BF093F6F25
- MD5 SHA1 SHA512 SSDEEP TLSH