Edit tour

Windows Analysis Report
Shipping Bill6239999 dated 13122024.PDF.jar

Overview

General Information

Sample name:	Shipping Bill6239999 dated 13122024.PDF.jar
Analysis ID:	1576665
MD5:	01fd77362fbe5b158352d203bf4e264d
SHA1:	b707961bf70f6798103b0f9dcf516ca3fb63a52f
SHA256:	9dbfb2b2c624a39591fd60397997ae7d9c09896862b5d97c5db3c7dd6c6d902b
Tags:	evilginx-misecure-comjaruser-JAMESWT_MHT
Infos:

Detection

Caesium Obfuscator, STRRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Caesium Obfuscator

Yara detected STRRAT

AI detected suspicious sample

Creates autostart registry keys to launch java

Exploit detected, runtime environment starts unknown processes

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Sigma detected: Rare Remote Thread Creation By Uncommon Source Image

Sigma detected: Suspicious Startup Folder Persistence

Uses an obfuscated file name to hide its real file extension (double extension)

Uses schtasks.exe or at.exe to add and modify task schedules

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to detect virtual machines (SLDT)

Contains functionality to query CPU information (cpuid)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected TCP or UDP traffic on non-standard ports

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Launches a Java Jar file from a suspicious file location

May check the online IP address of the machine

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Shell Process Spawned by Java.EXE

Sigma detected: Startup Folder File Write

Sigma detected: Suspicious Schtasks From Env Var Folder

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Stores files to the Windows start menu directory

Uses a known web browser user agent for HTTP communication

Uses cacls to modify the permissions of files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

cmd.exe (PID: 6764 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\Java\jre-1.8\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\Shipping Bill6239999 dated 13122024.PDF.jar"" >> C:\cmdlinestart.log 2>&1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6788 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

java.exe (PID: 6924 cmdline: "C:\Program Files (x86)\Java\jre-1.8\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\Shipping Bill6239999 dated 13122024.PDF.jar" MD5: 9DAA53BAB2ECB33DC0D9CA51552701FA)

icacls.exe (PID: 7080 cmdline: C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M MD5: 2E49585E4E08565F52090B144062F97E)

conhost.exe (PID: 7144 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6180 cmdline: cmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\user\AppData\Roaming\Shipping Bill6239999 dated 13122024.PDF.jar" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 7052 cmdline: schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\user\AppData\Roaming\Shipping Bill6239999 dated 13122024.PDF.jar" MD5: 48C2FE20575769DE916F48EF0676A965)

java.exe (PID: 5016 cmdline: "C:\Program Files (x86)\Java\jre-1.8\bin\java.exe" -jar "C:\Users\user\AppData\Roaming\Shipping Bill6239999 dated 13122024.PDF.jar" MD5: 9DAA53BAB2ECB33DC0D9CA51552701FA)

conhost.exe (PID: 1772 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 420 cmdline: cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 348 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 7056 cmdline: wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list MD5: E2DE6500DE1148C7F6027AD50AC8B891)

cmd.exe (PID: 2288 cmdline: cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5964 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 1608 cmdline: wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list MD5: E2DE6500DE1148C7F6027AD50AC8B891)

cmd.exe (PID: 7144 cmdline: cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5744 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 280 cmdline: wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list MD5: E2DE6500DE1148C7F6027AD50AC8B891)

cmd.exe (PID: 7112 cmdline: cmd.exe /c "wmic /node:localhost /namespace:'\\root\securitycenter2' path antivirusproduct get displayname /format:list" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6944 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 6180 cmdline: wmic /node:localhost /namespace:'\\root\securitycenter2' path antivirusproduct get displayname /format:list MD5: E2DE6500DE1148C7F6027AD50AC8B891)

javaw.exe (PID: 5780 cmdline: "C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\user\AppData\Roaming\Shipping Bill6239999 dated 13122024.PDF.jar" MD5: 6E0F4F812AE02FBCB744A929E74A04B8)

javaw.exe (PID: 7076 cmdline: "C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\user\AppData\Roaming\Shipping Bill6239999 dated 13122024.PDF.jar" MD5: 6E0F4F812AE02FBCB744A929E74A04B8)

javaw.exe (PID: 2228 cmdline: "C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\user\AppData\Roaming\Shipping Bill6239999 dated 13122024.PDF.jar" MD5: 6E0F4F812AE02FBCB744A929E74A04B8)

javaw.exe (PID: 4088 cmdline: "C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Shipping Bill6239999 dated 13122024.PDF.jar" MD5: 6E0F4F812AE02FBCB744A929E74A04B8)

cleanup

Malware Configuration

Threatname: STRRAT

{"C2 list": "evilginx.misecure.com:1790", "url": "http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5", "Proxy": "evilginx.misecure.com:1790", "lid": "RKA0-KES0-EPPK-UDRO-JNCG", "Startup": "true", "Secondary Startup": "true", "Scheduled Task": "true"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000002.00000003.1772738637.0000000000B1A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CaesiumObfuscator	Yara detected Caesium Obfuscator	Joe Security
00000006.00000003.1797761433.000000000082B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CaesiumObfuscator	Yara detected Caesium Obfuscator	Joe Security
0000001B.00000002.3009029991.000000000A568000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_STRRAT	Yara detected STRRAT	Joe Security
0000001C.00000002.3009084016.0000000009768000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_STRRAT	Yara detected STRRAT	Joe Security
0000001C.00000002.3009084016.0000000009798000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CaesiumObfuscator	Yara detected Caesium Obfuscator	Joe Security
00000016.00000003.1920754006.0000000000AB6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CaesiumObfuscator	Yara detected Caesium Obfuscator	Joe Security
0000001A.00000003.2002849792.00000000004C5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CaesiumObfuscator	Yara detected Caesium Obfuscator	Joe Security
00000016.00000002.3008961235.0000000009D68000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_STRRAT	Yara detected STRRAT	Joe Security
00000006.00000002.3008381214.0000000009A28000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CaesiumObfuscator	Yara detected Caesium Obfuscator	Joe Security
00000006.00000002.3008381214.0000000009997000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CaesiumObfuscator	Yara detected Caesium Obfuscator	Joe Security
0000001A.00000002.3009108330.0000000009797000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CaesiumObfuscator	Yara detected Caesium Obfuscator	Joe Security
0000001C.00000002.3009084016.0000000009829000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CaesiumObfuscator	Yara detected Caesium Obfuscator	Joe Security
0000001B.00000002.3009029991.000000000A628000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CaesiumObfuscator	Yara detected Caesium Obfuscator	Joe Security
00000006.00000002.3008381214.0000000009968000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_STRRAT	Yara detected STRRAT	Joe Security
0000001B.00000003.2087844478.0000000001326000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CaesiumObfuscator	Yara detected Caesium Obfuscator	Joe Security
00000016.00000002.3008961235.0000000009D97000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CaesiumObfuscator	Yara detected Caesium Obfuscator	Joe Security
00000016.00000002.3008961235.0000000009E28000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CaesiumObfuscator	Yara detected Caesium Obfuscator	Joe Security
0000001A.00000002.3009108330.0000000009768000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_STRRAT	Yara detected STRRAT	Joe Security
0000001A.00000002.3009108330.0000000009828000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CaesiumObfuscator	Yara detected Caesium Obfuscator	Joe Security
00000002.00000002.1801801717.0000000009D50000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CaesiumObfuscator	Yara detected Caesium Obfuscator	Joe Security
0000001B.00000002.3009029991.000000000A597000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CaesiumObfuscator	Yara detected Caesium Obfuscator	Joe Security
Process Memory Space: java.exe PID: 6924	JoeSecurity_CaesiumObfuscator	Yara detected Caesium Obfuscator	Joe Security
Process Memory Space: java.exe PID: 6924	JoeSecurity_STRRAT	Yara detected STRRAT	Joe Security
Process Memory Space: java.exe PID: 5016	JoeSecurity_CaesiumObfuscator	Yara detected Caesium Obfuscator	Joe Security
Process Memory Space: java.exe PID: 5016	JoeSecurity_STRRAT	Yara detected STRRAT	Joe Security
Process Memory Space: javaw.exe PID: 5780	JoeSecurity_CaesiumObfuscator	Yara detected Caesium Obfuscator	Joe Security
Process Memory Space: javaw.exe PID: 5780	JoeSecurity_STRRAT	Yara detected STRRAT	Joe Security
Click to see the 22 entries

Sigma Signatures

System Summary

Sigma detected: Rare Remote Thread Creation By Uncommon Source Image

Source: Threat created

Author: Perez Diego (@darkquassar), oscd.community: Data: EventID: 8, SourceImage: C:\Windows\SysWOW64\wbem\WMIC.exe, SourceProcessId: 6180, StartAddress: 7574D700, TargetImage: C:\Windows\SysWOW64\cmd.exe, TargetProcessId: 6180

Sigma detected: Suspicious Startup Folder Persistence

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe, ProcessId: 6924, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Shipping Bill6239999 dated 13122024.PDF.jar

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\user\AppData\Roaming\Shipping Bill6239999 dated 13122024.PDF.jar", EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe, ProcessId: 6924, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Shipping Bill6239999 dated 13122024.PDF

Sigma detected: Shell Process Spawned by Java.EXE

Source: Process started

Author: Andreas Hunkeler (@Karneades), Nasreddine Bencherchali: Data: Command: cmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\user\AppData\Roaming\Shipping Bill6239999 dated 13122024.PDF.jar", CommandLine: cmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\user\AppData\Roaming\Shipping Bill6239999 dated 13122024.PDF.jar", CommandLine|base64offset|contains: rg, Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Program Files (x86)\Java\jre-1.8\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\Shipping Bill6239999 dated 13122024.PDF.jar" , ParentImage: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe, ParentProcessId: 6924, ParentProcessName: java.exe, ProcessCommandLine: cmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\user\AppData\Roaming\Shipping Bill6239999 dated 13122024.PDF.jar", ProcessId: 6180, ProcessName: cmd.exe

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe, ProcessId: 6924, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Shipping Bill6239999 dated 13122024.PDF.jar

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\user\AppData\Roaming\Shipping Bill6239999 dated 13122024.PDF.jar", CommandLine: schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\user\AppData\Roaming\Shipping Bill6239999 dated 13122024.PDF.jar", CommandLine|base64offset|contains: mj,, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: cmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\user\AppData\Roaming\Shipping Bill6239999 dated 13122024.PDF.jar", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 6180, ParentProcessName: cmd.exe, ProcessCommandLine: schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\user\AppData\Roaming\Shipping Bill6239999 dated 13122024.PDF.jar", ProcessId: 7052, ProcessName: schtasks.exe

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\user\AppData\Roaming\Shipping Bill6239999 dated 13122024.PDF.jar", EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe, ProcessId: 6924, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Shipping Bill6239999 dated 13122024.PDF

Suricata Signatures

ET MALWARE STRRAT CnC Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-17T11:43:22.819766+0100	2030358	1	Malware Command and Control Activity Detected	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:43:27.839117+0100	2030358	1	Malware Command and Control Activity Detected	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:43:32.842825+0100	2030358	1	Malware Command and Control Activity Detected	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:43:37.857823+0100	2030358	1	Malware Command and Control Activity Detected	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:43:42.855342+0100	2030358	1	Malware Command and Control Activity Detected	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:43:48.039680+0100	2030358	1	Malware Command and Control Activity Detected	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:43:53.041467+0100	2030358	1	Malware Command and Control Activity Detected	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:43:58.045446+0100	2030358	1	Malware Command and Control Activity Detected	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:44:03.041819+0100	2030358	1	Malware Command and Control Activity Detected	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:44:08.056353+0100	2030358	1	Malware Command and Control Activity Detected	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:44:13.056681+0100	2030358	1	Malware Command and Control Activity Detected	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:44:18.072847+0100	2030358	1	Malware Command and Control Activity Detected	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:44:23.072460+0100	2030358	1	Malware Command and Control Activity Detected	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:44:28.091740+0100	2030358	1	Malware Command and Control Activity Detected	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:44:33.088280+0100	2030358	1	Malware Command and Control Activity Detected	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:44:38.087821+0100	2030358	1	Malware Command and Control Activity Detected	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:44:43.104067+0100	2030358	1	Malware Command and Control Activity Detected	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:44:48.106462+0100	2030358	1	Malware Command and Control Activity Detected	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:44:53.124572+0100	2030358	1	Malware Command and Control Activity Detected	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:44:58.532478+0100	2030358	1	Malware Command and Control Activity Detected	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:45:03.526669+0100	2030358	1	Malware Command and Control Activity Detected	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:45:08.525862+0100	2030358	1	Malware Command and Control Activity Detected	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:45:14.946681+0100	2030358	1	Malware Command and Control Activity Detected	192.168.2.4	49730	194.59.30.164	1790	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: Shipping Bill6239999 dated 13122024.PDF.jar

Malware Configuration Extractor: STRRAT {"C2 list": "evilginx.misecure.com:1790", "url": "http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5", "Proxy": "evilginx.misecure.com:1790", "lid": "RKA0-KES0-EPPK-UDRO-JNCG", "Startup": "true", "Secondary Startup": "true", "Scheduled Task": "true"}

Multi AV Scanner detection for submitted file

Source: Shipping Bill6239999 dated 13122024.PDF.jar

ReversingLabs: Detection: 13%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 90.7% probability

Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	File opened: C:\Users\user\AppData\
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	File opened: C:\Users\user\AppData\Roaming\
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	File opened: C:\Users\user\
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\

Software Vulnerabilities

Exploit detected, runtime environment starts unknown processes

Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe

Process created: C:\Windows\SysWOW64\cmd.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2030358 - Severity 1 - ET MALWARE STRRAT CnC Checkin : 192.168.2.4:49730 -> 194.59.30.164:1790

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 194.59.30.164:1790

Source: Joe Sandbox View

IP Address: 208.95.112.1 208.95.112.1

Source: Joe Sandbox View

ASN Name: COMBAHTONcombahtonGmbHDE COMBAHTONcombahtonGmbHDE

Source: unknown

DNS query: name: ip-api.com

Source: global traffic

HTTP traffic detected: GET /json/ HTTP/1.1Host: ip-api.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.86 Safari/537.36Connection: close

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

Source: global traffic	DNS traffic detected: DNS query: evilginx.misecure.com
Source: global traffic	DNS traffic detected: DNS query: ip-api.com

Source: java.exe, 00000002.00000002.1801801717.0000000009DF7000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000006.00000002.3008381214.0000000009968000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000016.00000002.3008961235.0000000009D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://bugreport.sun.com/bugreport/
Source: javaw.exe, 00000016.00000002.3006328327.0000000004808000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRoo
Source: java.exe, 00000002.00000002.1801801717.0000000009F65000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.1799231041.0000000004D29000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000006.00000002.3008381214.0000000009997000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000006.00000002.3008381214.00000000099F8000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000016.00000002.3008961235.0000000009DF8000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000016.00000002.3008961235.0000000009D97000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000001A.00000002.3009108330.00000000097F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt
Source: java.exe, 00000002.00000002.1801801717.0000000009F65000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.1806610893.0000000015490000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.1801801717.0000000009ED2000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000006.00000003.2407427930.0000000014FB1000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000006.00000002.3014723940.0000000014FD2000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000006.00000002.3008381214.0000000009997000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000006.00000003.1851426752.0000000014F8A000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000006.00000003.1851690816.0000000014FCB000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000006.00000003.2407940459.0000000014FCB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000016.00000002.3014954855.00000000153A7000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000016.00000002.3008961235.0000000009D97000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000016.00000003.1973692767.0000000015389000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000016.00000003.1973874850.00000000153A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: java.exe, 00000002.00000002.1799231041.0000000004D29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crts
Source: java.exe, 00000002.00000002.1801801717.0000000009ED2000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000006.00000002.3008381214.0000000009997000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000006.00000002.3008381214.00000000099F8000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000016.00000002.3008961235.0000000009DF8000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000016.00000002.3008961235.0000000009D97000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000001A.00000002.3009108330.00000000097F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt
Source: java.exe, 00000002.00000002.1801801717.0000000009ED2000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000006.00000002.3008381214.0000000009968000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000016.00000002.3008961235.0000000009D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: java.exe, 00000002.00000002.1801801717.0000000009F65000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.1799231041.0000000004D29000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000006.00000002.3008381214.0000000009997000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000006.00000002.3008381214.00000000099F8000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000016.00000002.3008961235.0000000009DF8000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000016.00000002.3008961235.0000000009D97000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000001A.00000002.3009108330.00000000097F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt
Source: java.exe, 00000002.00000002.1801801717.0000000009F65000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.1801801717.0000000009ED2000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000006.00000002.3008381214.0000000009997000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000016.00000002.3008961235.0000000009D97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: java.exe, 00000002.00000002.1799231041.0000000004D29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crts
Source: java.exe, 00000002.00000002.1801801717.0000000009F65000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.1799231041.0000000004D29000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000006.00000002.3008381214.0000000009A01000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000006.00000002.3008381214.0000000009997000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000016.00000002.3008961235.0000000009E01000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000016.00000002.3008961235.0000000009D97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl
Source: java.exe, 00000002.00000002.1801801717.0000000009F65000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.1806610893.0000000015490000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.1801801717.0000000009ED2000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000006.00000003.2407427930.0000000014FB1000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000006.00000002.3014723940.0000000014FD2000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000006.00000002.3008381214.0000000009997000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000006.00000003.1851426752.0000000014F8A000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000006.00000003.1851690816.0000000014FCB000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000006.00000003.2407940459.0000000014FCB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000016.00000002.3014954855.00000000153A7000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000016.00000002.3008961235.0000000009D97000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000016.00000003.1973692767.0000000015389000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000016.00000003.1973874850.00000000153A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: java.exe, 00000002.00000002.1799231041.0000000004D29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crlS
Source: java.exe, 00000002.00000002.1801801717.0000000009ED2000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000006.00000002.3008381214.0000000009A01000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000006.00000002.3008381214.0000000009997000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000016.00000002.3008961235.0000000009E01000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000016.00000002.3008961235.0000000009D97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl
Source: java.exe, 00000002.00000002.1801801717.0000000009ED2000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000006.00000002.3008381214.0000000009997000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000006.00000002.3008381214.0000000009968000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000016.00000002.3008961235.0000000009D68000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000016.00000002.3008961235.0000000009D97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: java.exe, 00000002.00000002.1801801717.0000000009F65000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.1799231041.0000000004D29000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000006.00000002.3008381214.0000000009997000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000006.00000002.3008381214.0000000009A08000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000016.00000002.3008961235.0000000009D97000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000016.00000002.3008961235.0000000009E08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl
Source: java.exe, 00000002.00000002.1801801717.0000000009F65000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.1806610893.0000000015490000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.1801801717.0000000009ED2000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000006.00000003.2407427930.0000000014FB1000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000006.00000002.3014723940.0000000014FD2000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000006.00000002.3008381214.0000000009997000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000006.00000003.1851426752.0000000014F8A000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000006.00000003.1851690816.0000000014FCB000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000006.00000003.2407940459.0000000014FCB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000016.00000002.3014954855.00000000153A7000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000016.00000002.3008961235.0000000009D97000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000016.00000003.1973692767.0000000015389000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000016.00000003.1973874850.00000000153A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: java.exe, 00000002.00000002.1801801717.0000000009E10000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000006.00000002.3008381214.0000000009997000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000016.00000002.3008961235.0000000009D97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://java.oracle.com/
Source: java.exe, 00000002.00000002.1799231041.0000000004814000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.1799231041.00000000049B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://jbfrost.live/strigoi/server/?hwid=1&
Source: javaw.exe, 0000001A.00000002.3006380906.00000000045B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5
Source: java.exe, 00000002.00000002.1801801717.000000000A022000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.1805910363.00000000150E0000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.1806610893.00000000155EF000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000006.00000002.3008381214.0000000009B08000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000006.00000003.2407427930.0000000014FB1000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000006.00000003.1851910383.0000000014FE5000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000006.00000003.1851426752.0000000014F8A000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000006.00000003.2408218238.0000000014FF5000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000006.00000003.1851690816.0000000014FCB000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000006.00000002.3014957684.0000000014FFC000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000006.00000003.2407940459.0000000014FCB000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000006.00000003.2408188379.0000000014FE5000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000016.00000002.3013011209.0000000014F8B000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000016.00000002.3006328327.0000000004C4B000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000016.00000003.1974052145.0000000014F74000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000016.00000003.1974634408.0000000014F84000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000001A.00000002.3006380906.000000000464E000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000001A.00000003.2056506590.0000000014C82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://null.oracle.com/
Source: java.exe, 00000002.00000002.1799231041.0000000004D29000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000006.00000002.3008381214.00000000099F8000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000016.00000002.3008961235.0000000009DF8000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000001A.00000002.3009108330.00000000097F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com
Source: java.exe, 00000002.00000002.1801801717.0000000009F65000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.1799231041.0000000004D29000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.1801801717.0000000009ED2000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000006.00000002.3008381214.0000000009997000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000016.00000002.3008961235.0000000009D97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: java.exe, 00000002.00000002.1801801717.0000000009F65000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.1806610893.0000000015490000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.1799231041.0000000004D29000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.1801801717.0000000009ED2000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000006.00000003.2407427930.0000000014FB1000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000006.00000002.3014723940.0000000014FD2000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000006.00000002.3008381214.0000000009997000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000006.00000003.1851426752.0000000014F8A000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000006.00000003.1851690816.0000000014FCB000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000006.00000003.2407940459.0000000014FCB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000016.00000002.3014954855.00000000153A7000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000016.00000002.3008961235.0000000009D97000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000016.00000003.1973692767.0000000015389000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000016.00000003.1973874850.00000000153A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: java.exe, 00000002.00000002.1801801717.0000000009F65000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.1801801717.0000000009ED2000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000006.00000002.3008381214.0000000009997000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000006.00000002.3008381214.0000000009968000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000016.00000002.3008961235.0000000009D68000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000016.00000002.3008961235.0000000009D97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: java.exe, 00000002.00000002.1799231041.0000000004D29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comC

Source: classification engine

Classification label: mal100.troj.expl.evad.winJAR@39/11@2/2

Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe

File created: C:\Users\user\1790lock.file

Jump to behavior

Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5744:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:348:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6944:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5964:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7144:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6788:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8:120:WilError_03

Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe

File created: C:\Users\user\AppData\Local\Temp\hsperfdata_user

Jump to behavior

Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Shipping Bill6239999 dated 13122024.PDF.jar

ReversingLabs: Detection: 13%

Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\Java\jre-1.8\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\Shipping Bill6239999 dated 13122024.PDF.jar"" >> C:\cmdlinestart.log 2>&1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe "C:\Program Files (x86)\Java\jre-1.8\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\Shipping Bill6239999 dated 13122024.PDF.jar"
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
Source: C:\Windows\SysWOW64\icacls.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\user\AppData\Roaming\Shipping Bill6239999 dated 13122024.PDF.jar"
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe "C:\Program Files (x86)\Java\jre-1.8\bin\java.exe" -jar "C:\Users\user\AppData\Roaming\Shipping Bill6239999 dated 13122024.PDF.jar"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\user\AppData\Roaming\Shipping Bill6239999 dated 13122024.PDF.jar"
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c "wmic /node:localhost /namespace:'\\root\securitycenter2' path antivirusproduct get displayname /format:list"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic /node:localhost /namespace:'\\root\securitycenter2' path antivirusproduct get displayname /format:list
Source: unknown	Process created: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe "C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\user\AppData\Roaming\Shipping Bill6239999 dated 13122024.PDF.jar"
Source: unknown	Process created: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe "C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\user\AppData\Roaming\Shipping Bill6239999 dated 13122024.PDF.jar"
Source: unknown	Process created: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe "C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\user\AppData\Roaming\Shipping Bill6239999 dated 13122024.PDF.jar"
Source: unknown	Process created: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe "C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Shipping Bill6239999 dated 13122024.PDF.jar"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe "C:\Program Files (x86)\Java\jre-1.8\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\Shipping Bill6239999 dated 13122024.PDF.jar"	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\user\AppData\Roaming\Shipping Bill6239999 dated 13122024.PDF.jar"	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe "C:\Program Files (x86)\Java\jre-1.8\bin\java.exe" -jar "C:\Users\user\AppData\Roaming\Shipping Bill6239999 dated 13122024.PDF.jar"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\user\AppData\Roaming\Shipping Bill6239999 dated 13122024.PDF.jar"	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list"	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list"	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list"	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c "wmic /node:localhost /namespace:'\\root\securitycenter2' path antivirusproduct get displayname /format:list"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic /node:localhost /namespace:'\\root\securitycenter2' path antivirusproduct get displayname /format:list	Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: mswsock.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: dhcpcsvc.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: mswsock.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: dhcpcsvc.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: mswsock.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: dhcpcsvc.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: dnsapi.dll

Source: C:\Windows\SysWOW64\wbem\WMIC.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Data Obfuscation

Yara detected Caesium Obfuscator

Source: Yara match	File source: 00000002.00000003.1772738637.0000000000B1A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.1797761433.000000000082B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.3009084016.0000000009798000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.1920754006.0000000000AB6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000003.2002849792.00000000004C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3008381214.0000000009A28000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3008381214.0000000009997000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.3009108330.0000000009797000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.3009084016.0000000009829000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.3009029991.000000000A628000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2087844478.0000000001326000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.3008961235.0000000009D97000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.3008961235.0000000009E28000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.3009108330.0000000009828000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1801801717.0000000009D50000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.3009029991.000000000A597000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: java.exe PID: 6924, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: java.exe PID: 5016, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: javaw.exe PID: 5780, type: MEMORYSTR

Source: Java tracing

Executes: java.lang.ProcessBuilder(java.lang.String[]) on "c:\program files (x86)\java\jre-1.8\bin\java.exe" -jar "c:\users\user\appdata\roaming\shipping bill6239999 dated 13122024.pdf.jar"

Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 2_2_026BFE51 push cs; retf	2_2_026BFE71
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 2_2_026BCC4D push ecx; retn 0022h	2_2_026BCD02
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 2_2_026BC993 push es; iretd	2_2_026BC99A
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 2_2_0261D8F7 push 00000000h; mov dword ptr [esp], esp	2_2_0261D921
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 2_2_0261A20A push ecx; ret	2_2_0261A21A
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 2_2_0261A21B push ecx; ret	2_2_0261A225
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 2_2_0261BB67 push 00000000h; mov dword ptr [esp], esp	2_2_0261BB8D
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 2_2_0261B3B7 push 00000000h; mov dword ptr [esp], esp	2_2_0261B3DD
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 2_2_0261D8D1 push 00000000h; mov dword ptr [esp], esp	2_2_0261D921
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 2_2_0261B947 push 00000000h; mov dword ptr [esp], esp	2_2_0261B96D
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 2_2_0261C477 push 00000000h; mov dword ptr [esp], esp	2_2_0261C49D
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 6_2_02368A11 push cs; retf	6_2_02368A31
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 6_2_022CA20A push ecx; ret	6_2_022CA21A
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 6_2_022CA21B push ecx; ret	6_2_022CA225
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 6_2_022CBB67 push 00000000h; mov dword ptr [esp], esp	6_2_022CBB8D
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 6_2_022CB3B7 push 00000000h; mov dword ptr [esp], esp	6_2_022CB3DD
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 6_2_022CB947 push 00000000h; mov dword ptr [esp], esp	6_2_022CB96D
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 6_2_022CC477 push 00000000h; mov dword ptr [esp], esp	6_2_022CC49D
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Code function: 22_2_026BA20A push ecx; ret	22_2_026BA21A
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Code function: 22_2_026BA21B push ecx; ret	22_2_026BA225
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Code function: 22_2_026BBB67 push 00000000h; mov dword ptr [esp], esp	22_2_026BBB8D
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Code function: 22_2_026BB3B7 push 00000000h; mov dword ptr [esp], esp	22_2_026BB3DD
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Code function: 22_2_026BB947 push 00000000h; mov dword ptr [esp], esp	22_2_026BB96D
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Code function: 22_2_026BC477 push 00000000h; mov dword ptr [esp], esp	22_2_026BC49D
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Code function: 26_2_0212A21B push ecx; ret	26_2_0212A225
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Code function: 26_2_0212A20A push ecx; ret	26_2_0212A21A
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Code function: 26_2_0212BB67 push 00000000h; mov dword ptr [esp], esp	26_2_0212BB8D
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Code function: 26_2_0212B3B7 push 00000000h; mov dword ptr [esp], esp	26_2_0212B3DD
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Code function: 26_2_0212B947 push 00000000h; mov dword ptr [esp], esp	26_2_0212B96D
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Code function: 26_2_0212C477 push 00000000h; mov dword ptr [esp], esp	26_2_0212C49D
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Code function: 27_2_02DDA21B push ecx; ret	27_2_02DDA225

Boot Survival

Creates autostart registry keys to launch java

Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe

Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Shipping Bill6239999 dated 13122024.PDF "C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\user\AppData\Roaming\Shipping Bill6239999 dated 13122024.PDF.jar"

Jump to behavior

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\user\AppData\Roaming\Shipping Bill6239999 dated 13122024.PDF.jar"

Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Shipping Bill6239999 dated 13122024.PDF.jar

Jump to behavior

Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Shipping Bill6239999 dated 13122024.PDF.jar			Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\Shipping Bill6239999 dated 13122024.PDF.jar			Jump to behavior

Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Shipping Bill6239999 dated 13122024.PDF	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Shipping Bill6239999 dated 13122024.PDF	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Shipping Bill6239999 dated 13122024.PDF	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Shipping Bill6239999 dated 13122024.PDF	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses an obfuscated file name to hide its real file extension (double extension)

Source: Possible double extension: pdf.jar

Static PE information: Shipping Bill6239999 dated 13122024.PDF.jar

Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe

Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M

Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Source: C:\Windows\SysWOW64\wbem\WMIC.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT VolumeSerialNumber FROM win32_logicaldisk

Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe

Code function: 2_2_026BE469 sldt word ptr [eax]

2_2_026BE469

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	File opened: C:\Users\user\AppData\
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	File opened: C:\Users\user\AppData\Roaming\
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	File opened: C:\Users\user\
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\

Source: javaw.exe, 00000016.00000003.1921418826.0000000014CCE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: com/sun/corba/se/impl/util/SUNVMCID.classPK
Source: javaw.exe, 00000016.00000003.1921418826.0000000014CCE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: &com/sun/corba/se/impl/util/SUNVMCID.classPK
Source: java.exe, 00000006.00000002.3004161734.000000000081B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll}L1
Source: java.exe, 00000002.00000002.1797760450.0000000000B0B000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000006.00000002.3004161734.000000000081B000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000016.00000002.3004513817.0000000000AD0000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000001A.00000002.3004176616.00000000004B7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [Ljava/lang/VirtualMachineError;
Source: javaw.exe, 00000016.00000003.1921418826.0000000014CCE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: org/omg/CORBA/OMGVMCID.classPK
Source: java.exe, 00000002.00000002.1797760450.0000000000B0B000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000006.00000002.3004161734.000000000081B000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000016.00000002.3004513817.0000000000AD0000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000001A.00000002.3004176616.00000000004B7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: cjava/lang/VirtualMachineError
Source: java.exe, 00000002.00000003.1773866353.0000000014C6E000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000006.00000003.1798410151.00000000148C1000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000016.00000003.1921418826.0000000014CCE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: java/lang/VirtualMachineError.classPK
Source: java.exe, 00000002.00000002.1797760450.0000000000B0B000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000016.00000002.3004513817.0000000000AA8000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000001A.00000002.3004176616.00000000004B7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\SysWOW64\wbem\WMIC.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe

Memory protected: page read and write | page guard

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe "C:\Program Files (x86)\Java\jre-1.8\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\Shipping Bill6239999 dated 13122024.PDF.jar"	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\user\AppData\Roaming\Shipping Bill6239999 dated 13122024.PDF.jar"	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe "C:\Program Files (x86)\Java\jre-1.8\bin\java.exe" -jar "C:\Users\user\AppData\Roaming\Shipping Bill6239999 dated 13122024.PDF.jar"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\user\AppData\Roaming\Shipping Bill6239999 dated 13122024.PDF.jar"	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list"	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list"	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list"	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c "wmic /node:localhost /namespace:'\\root\securitycenter2' path antivirusproduct get displayname /format:list"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic /node:localhost /namespace:'\\root\securitycenter2' path antivirusproduct get displayname /format:list	Jump to behavior

Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe

Code function: 2_2_026103C0 cpuid

2_2_026103C0

Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\java.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\client\jvm.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\java.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\java.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\hsperfdata_user\6924 VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\resources.jar VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\rt.jar VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\jsse.jar VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\jce.jar VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\charsets.jar VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\jfr.jar VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\jartracer.jar VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Queries volume information: C:\Users\user\1790lock.file VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\java.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\client\jvm.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\java.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\java.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\hsperfdata_user\5016 VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\resources.jar VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\rt.jar VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\jsse.jar VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\charsets.jar VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\jfr.jar VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\meta-index VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Queries volume information: C:\Users\user\1790lock.file VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\java.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\client\jvm.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\java.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\java.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\hsperfdata_user\5780 VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\resources.jar VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\rt.jar VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\jsse.jar VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\jce.jar VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\charsets.jar VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\jfr.jar VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\meta-index VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Users\user\1790lock.file VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\java.dll VolumeInformation
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\client\jvm.dll VolumeInformation
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\java.dll VolumeInformation
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\java.dll VolumeInformation
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\hsperfdata_user\7076 VolumeInformation
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\resources.jar VolumeInformation
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\rt.jar VolumeInformation
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\jsse.jar VolumeInformation
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\charsets.jar VolumeInformation
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\meta-index VolumeInformation
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Users\user\1790lock.file VolumeInformation
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\java.dll VolumeInformation
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\client\jvm.dll VolumeInformation
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\java.dll VolumeInformation
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\java.dll VolumeInformation
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\hsperfdata_user\2228 VolumeInformation
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\resources.jar VolumeInformation
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\jce.jar VolumeInformation
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\charsets.jar VolumeInformation
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\meta-index VolumeInformation
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Users\user\1790lock.file VolumeInformation
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\java.dll VolumeInformation
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\client\jvm.dll VolumeInformation
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\java.dll VolumeInformation
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\java.dll VolumeInformation
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\hsperfdata_user\4088 VolumeInformation
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\resources.jar VolumeInformation
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\rt.jar VolumeInformation
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\jsse.jar VolumeInformation
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\jce.jar VolumeInformation
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\charsets.jar VolumeInformation
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\jfr.jar VolumeInformation
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\meta-index VolumeInformation
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Users\user\1790lock.file VolumeInformation

Source: C:\Windows\SysWOW64\cmd.exe	WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : SELECT displayName FROM antivirusproduct
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : SELECT displayName FROM antivirusproduct

Stealing of Sensitive Information

Yara detected STRRAT

Source: Yara match	File source: 0000001B.00000002.3009029991.000000000A568000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.3009084016.0000000009768000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.3008961235.0000000009D68000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3008381214.0000000009968000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.3009108330.0000000009768000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: java.exe PID: 6924, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: java.exe PID: 5016, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: javaw.exe PID: 5780, type: MEMORYSTR

Remote Access Functionality

Yara detected STRRAT

Source: Yara match	File source: 0000001B.00000002.3009029991.000000000A568000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.3009084016.0000000009768000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.3008961235.0000000009D68000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3008381214.0000000009968000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.3009108330.0000000009768000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: java.exe PID: 6924, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: java.exe PID: 5016, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: javaw.exe PID: 5780, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	1 Scheduled Task/Job	11 Process Injection	11 Masquerading	OS Credential Dumping	111 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	121 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	1 Virtualization/Sandbox Evasion	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	1 Services File Permissions Weakness	121 Registry Run Keys / Startup Folder	1 Disable or Modify Tools	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 DLL Side-Loading	1 Services File Permissions Weakness	11 Process Injection	NTDS	1 System Network Configuration Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 DLL Side-Loading	11 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Services File Permissions Weakness	Cached Domain Credentials	21 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Shipping Bill6239999 dated 13122024.PDF.jar	13%	ReversingLabs	ByteCode-JAVA.Trojan.Generic

Source	Detection	Scanner	Label	Link
http://null.oracle.com/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ip-api.com	208.95.112.1	true	false		high
evilginx.misecure.com	194.59.30.164	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://ip-api.com/json/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://java.oracle.com/	java.exe, 00000002.00000002.1801801717.0000000009E10000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000006.00000002.3008381214.0000000009997000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000016.00000002.3008961235.0000000009D97000.00000004.00000800.00020000.00000000.sdmp	false		high
http://null.oracle.com/	java.exe, 00000002.00000002.1801801717.000000000A022000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.1805910363.00000000150E0000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.1806610893.00000000155EF000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000006.00000002.3008381214.0000000009B08000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000006.00000003.2407427930.0000000014FB1000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000006.00000003.1851910383.0000000014FE5000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000006.00000003.1851426752.0000000014F8A000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000006.00000003.2408218238.0000000014FF5000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000006.00000003.1851690816.0000000014FCB000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000006.00000002.3014957684.0000000014FFC000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000006.00000003.2407940459.0000000014FCB000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000006.00000003.2408188379.0000000014FE5000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000016.00000002.3013011209.0000000014F8B000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000016.00000002.3006328327.0000000004C4B000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000016.00000003.1974052145.0000000014F74000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000016.00000003.1974634408.0000000014F84000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000001A.00000002.3006380906.000000000464E000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000001A.00000003.2056506590.0000000014C82000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5	javaw.exe, 0000001A.00000002.3006380906.00000000045B9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://bugreport.sun.com/bugreport/	java.exe, 00000002.00000002.1801801717.0000000009DF7000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000006.00000002.3008381214.0000000009968000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000016.00000002.3008961235.0000000009D68000.00000004.00000800.00020000.00000000.sdmp	false		high
http://jbfrost.live/strigoi/server/?hwid=1&	java.exe, 00000002.00000002.1799231041.0000000004814000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.1799231041.00000000049B2000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
194.59.30.164	evilginx.misecure.com	Germany		30823	COMBAHTONcombahtonGmbHDE	true
208.95.112.1	ip-api.com	United States		53334	TUT-ASUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1576665
Start date and time:	2024-12-17 11:42:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 32s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsfilecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	30
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Java) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Shipping Bill6239999 dated 13122024.PDF.jar
Detection:	MAL
Classification:	mal100.troj.expl.evad.winJAR@39/11@2/2
EGA Information:	Successful, ratio: 16.7%
HCA Information:	Successful, ratio: 91% Number of executed functions: 73 Number of non-executed functions: 2
Cookbook Comments:	Found application associated with file extension: .jar

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 4.245.163.56, 13.107.246.43
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target java.exe, PID 5016 because it is empty
Execution Graph export aborted for target javaw.exe, PID 2228 because it is empty
Execution Graph export aborted for target javaw.exe, PID 4088 because it is empty
Execution Graph export aborted for target javaw.exe, PID 5780 because it is empty
Execution Graph export aborted for target javaw.exe, PID 7076 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: Shipping Bill6239999 dated 13122024.PDF.jar

Simulations

Behavior and APIs

Time	Type	Description
05:43:13	API Interceptor	4x Sleep call for process: WMIC.exe modified
10:43:12	Task Scheduler	Run new task: Skype path: C:\Users\user\AppData\Roaming\Shipping s>Bill6239999 dated 13122024.PDF.jar
10:43:14	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Shipping Bill6239999 dated 13122024.PDF "C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\user\AppData\Roaming\Shipping Bill6239999 dated 13122024.PDF.jar"
10:43:23	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run Shipping Bill6239999 dated 13122024.PDF "C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\user\AppData\Roaming\Shipping Bill6239999 dated 13122024.PDF.jar"
10:43:31	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Shipping Bill6239999 dated 13122024.PDF "C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\user\AppData\Roaming\Shipping Bill6239999 dated 13122024.PDF.jar"
10:43:40	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Shipping Bill6239999 dated 13122024.PDF.jar

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	Creal.exe	Get hash	malicious	Blackshades	Browse	ip-api.com/json/
	factura 000601.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting
	Orden de compra_#000000090764534236475890765432567890765768978687569867970875766868.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	msedge.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	imagelogger.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	NJRAT DANGEROUS.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	com surrogate.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	jerniuiopu.exe	Get hash	malicious	Blackshades	Browse	ip-api.com/json/
	file.exe	Get hash	malicious	ScreenConnect Tool, Amadey, LummaC Stealer, Vidar, XWorm, Xmrig	Browse	ip-api.com/line/?fields=hosting
	RdLfpZY5A9.exe	Get hash	malicious	77Rootkit, XWorm	Browse	ip-api.com/line/?fields=hosting

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ip-api.com	Creal.exe	Get hash	malicious	Blackshades	Browse	208.95.112.1
	factura 000601.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	Orden de compra_#000000090764534236475890765432567890765768978687569867970875766868.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	msedge.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	imagelogger.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	NJRAT DANGEROUS.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	com surrogate.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	jerniuiopu.exe	Get hash	malicious	Blackshades	Browse	208.95.112.1
	file.exe	Get hash	malicious	ScreenConnect Tool, Amadey, LummaC Stealer, Vidar, XWorm, Xmrig	Browse	208.95.112.1
	RdLfpZY5A9.exe	Get hash	malicious	77Rootkit, XWorm	Browse	208.95.112.1

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
COMBAHTONcombahtonGmbHDE	Support.ClientSetup.exe	Get hash	malicious	ScreenConnect Tool	Browse	194.59.31.27
	Counseling_Services_Overview.docm	Get hash	malicious	Unknown	Browse	45.147.231.195
	Nowe zam#U00f3wienie - 0072291855.pdf (243KB).com.exe	Get hash	malicious	Quasar	Browse	194.59.31.75
	https://cloudserver-filesredir667900989385.s3.eu-central-1.amazonaws.com/6354799604_PDF.html	Get hash	malicious	ScreenConnect Tool	Browse	194.59.31.199
	https://cloudserver-filesredir667900989385.s3.eu-central-1.amazonaws.com/6354799604_PDF.html	Get hash	malicious	ScreenConnect Tool	Browse	194.59.31.199
	firestub.bat	Get hash	malicious	Unknown	Browse	194.59.30.10
	Cotizaci#U00f3n 99026475526_pdf.com.exe	Get hash	malicious	Quasar	Browse	194.59.31.75
	file.exe	Get hash	malicious	ScreenConnect Tool	Browse	194.59.30.222
	DEMASI-24-12B DOC. SCAN.exe	Get hash	malicious	GuLoader, Remcos	Browse	194.59.31.40
	Orden de Noviembre.com.exe	Get hash	malicious	AsyncRAT	Browse	194.59.31.47
TUT-ASUS	Creal.exe	Get hash	malicious	Blackshades	Browse	208.95.112.1
	factura 000601.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	Orden de compra_#000000090764534236475890765432567890765768978687569867970875766868.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	msedge.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	imagelogger.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	NJRAT DANGEROUS.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	com surrogate.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	jerniuiopu.exe	Get hash	malicious	Blackshades	Browse	208.95.112.1
	https://fsharetv.io	Get hash	malicious	Unknown	Browse	162.252.214.4
	file.exe	Get hash	malicious	ScreenConnect Tool, Amadey, LummaC Stealer, Vidar, XWorm, Xmrig	Browse	208.95.112.1

Process:	C:\Program Files (x86)\Java\jre-1.8\bin\java.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	201515
Entropy (8bit):	7.891155587199237
Encrypted:	false
SSDEEP:	3072:lROA9tlCGC9tKioY4Ql1wVa3CZGfteVTIglU5N0cVfG6lLAANinz94ZC6vr5:/9/LC9sGVNSZGfteVTAjJ1qANmx4x
MD5:	01FD77362FBE5B158352D203BF4E264D
SHA1:	B707961BF70F6798103B0F9DCF516CA3FB63A52F
SHA-256:	9DBFB2B2C624A39591FD60397997AE7D9C09896862B5D97C5DB3C7DD6C6D902B
SHA-512:	C64D87211760ECE2E76ED4BD9255D2F728159CED3A03BDFAC28FA17D9B0F452D73E0EF62521EC354A44657028ACEA8E620620C1A4D3C0C4A91612D5C347288D7
Malicious:	true
Preview:	PK...........Y................kingDavid/k.class/]PQO.P.=w.u+.nCEQ.Tt.q[...2.$...71..r..,..t.b.1....>.......7.kG..4....{.....#..V..&7;V.%.........1.wy.gl..d..f..1..Ur...Y%..8Ch.Bw.r.Z.iY#oP."\|y3W%.Q..t5....\.7...S4=....N......iY.H^.FQ#..R.... .....C/..z..b.2..C.m."....4.CR......&hD..n.d.IU....0).<..8.)....e.......#A.7}2......."n0.{...J*..\|......nbN.../p.....'..5......D.M!.m.e9...'..T_G.....(.........cp.(..1..H..j...R.$.......N...;.@...A..........6.R..u..e..i.;E.)1..v.o...3.a....I=F5.......<!.q..U.I..:.s....T.J.3.....O^{...!.I},....3.....@..0..(....3.]z?.....C.'zu..Z.Yr....gh.&dx@~....e....BG.`...PK.....bH...;...PK...........Y............"...kingDavid/k.class/caesium_27.classc..PK..............PK...........Y............"...kingDavid/k.class/caesium_26.classc..PK..............PK...........Y............"...kingDavid/k.class/caesium_25.classc..PK..............PK...........Y................kingDavid/b.class/.{wtUE.......u........^.."(.6..(...B........`W...+..P.

C:\ProgramData\Oracle\Java\.oracle_jre_usage\b5820291038aa69c.timestamp

Download File

Process:	C:\Program Files (x86)\Java\jre-1.8\bin\java.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	52
Entropy (8bit):	4.873140679513134
Encrypted:	false
SSDEEP:	3:oFj4I5vpm4USRs:oJ5bRs
MD5:	A84CB6CFA9FAB524AAD2C6232C7A26CE
SHA1:	C3075AC40DB02AE3DDBBDA0F8C28F485B02913B2
SHA-256:	DFDCBF0F2D12502480DC245A541974005495AA9F877101C8005A9044E1430D19
SHA-512:	884992989AD85EC0F9913F38E0E254D1B0304D8C854CE3A5F53CE8BB817200A6AF27770F665378515F7BFE9D3DF34DBFEB4C7F53F4E01C4B15966D8C209115B6
Malicious:	false
Preview:	C:\Program Files (x86)\Java\jre-1.8..1734432228972..

C:\Users\user\AppData\Local\Temp\hsperfdata_user\2228

Download File

Process:	C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.285807693629497
Encrypted:	false
SSDEEP:	96:RwGrT2Z8G2sF1V6anGwegIZZuSTzHG1bowo:Rwmi8G2sF1V6aHIFfHGd
MD5:	51ACACD83117C28A31C0CD4B0A82CF85
SHA1:	98CC33DE356172B5AFD8C1F90767A93F6BD4177C
SHA-256:	A7340986475766A9B434FFE97627A3FC8F6D542E520FCCBCB08AD4AEDE9FCD80
SHA-512:	01631EC44DD631CBFB98A96D6F87B1C63EDC407838EB8B803D5BD7C1B4BCAC88D4DADA39F34898D12C933AECD8F684AD16A924E6AC7D5DAD7A6BD87AEC72D741
Malicious:	false
Preview:	........09........6..... .......8...........J...0...sun.rt._sync_Inflations.............8...........J...0...sun.rt._sync_Deflations.............@...........J...8...sun.rt._sync_ContendedLockAttempts..........8...........J...0...sun.rt._sync_FutileWakeups..........0...........J...(...sun.rt._sync_Parks..........@...........J...8...sun.rt._sync_EmptyNotifications.............8...........J...0...sun.rt._sync_Notifications..........8...........J...0...sun.rt._sync_SlowEnter..............8...........J...0...sun.rt._sync_SlowExit...............8...........J...0...sun.rt._sync_SlowNotify.............8...........J...0...sun.rt._sync_SlowNotifyAll..........8...........J...0...sun.rt._sync_FailedSpins............@...........J...8...sun.rt._sync_SuccessfulSpins................8...........J...0...sun.rt._sync_PrivateA...............8...........J...0...sun.rt._sync_PrivateB...............@...........J...8...sun.rt._sync_MonInCirculation...............8...........J...0...sun.rt._sync_MonScavenged...

C:\Users\user\AppData\Local\Temp\hsperfdata_user\4088

Download File

Process:	C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.2975240377547206
Encrypted:	false
SSDEEP:	96:Jwmro6K8G4WUIsV6m1w0uMKsnGYST64HG1bowI3:Jwt8GZUIsV6VMKsnsJHGd
MD5:	64382E09A526C2041250AD8D537E5089
SHA1:	C292E72A04B9D0189DDE66FA99EA95A5348C3E8C
SHA-256:	CB1674D2E59509E918E2B2C54F7581DCEF91B5CD47F509E178BC9DE459A2E24E
SHA-512:	A8D5B5BFD7F2C4CCEC9025C519EBE1A9A090EC9DE9A918DC538CE570FEB4D2A6BEE743F50C7BF3A762C1988AB490A2F1E280775670EE2EB334283571D599DCEA
Malicious:	false
Preview:	.........9............. .......8...........J...0...sun.rt._sync_Inflations.............8...........J...0...sun.rt._sync_Deflations.............@...........J...8...sun.rt._sync_ContendedLockAttempts..........8...........J...0...sun.rt._sync_FutileWakeups..........0...........J...(...sun.rt._sync_Parks..........@...........J...8...sun.rt._sync_EmptyNotifications.............8...........J...0...sun.rt._sync_Notifications..........8...........J...0...sun.rt._sync_SlowEnter..............8...........J...0...sun.rt._sync_SlowExit...............8...........J...0...sun.rt._sync_SlowNotify.............8...........J...0...sun.rt._sync_SlowNotifyAll..........8...........J...0...sun.rt._sync_FailedSpins............@...........J...8...sun.rt._sync_SuccessfulSpins................8...........J...0...sun.rt._sync_PrivateA...............8...........J...0...sun.rt._sync_PrivateB...............@...........J...8...sun.rt._sync_MonInCirculation...............8...........J...0...sun.rt._sync_MonScavenged...

C:\Users\user\AppData\Local\Temp\hsperfdata_user\5016

Download File

Process:	C:\Program Files (x86)\Java\jre-1.8\bin\java.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.286593090969108
Encrypted:	false
SSDEEP:	96:h9fVrdl0eU8GPxP2H+61v/u8lyDlPQf61JAMuSTQHG1bowo:h9/l0z8GPxP2e6l/Eqf61cHGd
MD5:	3D81812B39A7D3951227F40F10372C71
SHA1:	8717D3AEF4E353ABA25132337EC1E095FCF4C753
SHA-256:	FC362638B7403FCD8B9038DC84BD4F1C7F0FE3E35A02AB2B1A22C7641E879B25
SHA-512:	4315C0D4C1B76F8615FAAFF0B968D729939E039C626AE19B16B8057973E92E08AC1F730E6E4CC6FF7DD7F958F502E0CE21AC039B843B73DCB41FDB130008DDEE
Malicious:	false
Preview:	........09.............. .......8...........J...0...sun.rt._sync_Inflations.............8...........J...0...sun.rt._sync_Deflations.............@...........J...8...sun.rt._sync_ContendedLockAttempts..........8...........J...0...sun.rt._sync_FutileWakeups..........0...........J...(...sun.rt._sync_Parks..........@...........J...8...sun.rt._sync_EmptyNotifications.............8...........J...0...sun.rt._sync_Notifications..........8...........J...0...sun.rt._sync_SlowEnter..............8...........J...0...sun.rt._sync_SlowExit...............8...........J...0...sun.rt._sync_SlowNotify.............8...........J...0...sun.rt._sync_SlowNotifyAll..........8...........J...0...sun.rt._sync_FailedSpins............@...........J...8...sun.rt._sync_SuccessfulSpins................8...........J...0...sun.rt._sync_PrivateA...............8...........J...0...sun.rt._sync_PrivateB...............@...........J...8...sun.rt._sync_MonInCirculation...............8...........J...0...sun.rt._sync_MonScavenged...

C:\Users\user\AppData\Local\Temp\hsperfdata_user\5780

Download File

Process:	C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.2864338836313851
Encrypted:	false
SSDEEP:	96:zwGrYiyd8Gf/ENgssV6++wvgIb6BSTzHG1bowo:zwZ98GENgssV6pIbjfHGd
MD5:	571202552E4589AB3A3B8049943182A5
SHA1:	607BB27E0F57899BFEE64A3B99DC975D27A0070D
SHA-256:	0AC86A07253D524D2B45B1A7A0F5F073F76F3A6C19B65232D5074463567FD25E
SHA-512:	D98EE2ED8201D7F10845CF926BDC8F09A287D063A8CBF2600758CE50A437EDB8745CFA7509B4D1B749880057FF628125F28E2F80C36B4705FF7BC70016CE6443
Malicious:	false
Preview:	........09.......:...... .......8...........J...0...sun.rt._sync_Inflations.............8...........J...0...sun.rt._sync_Deflations.............@...........J...8...sun.rt._sync_ContendedLockAttempts..........8...........J...0...sun.rt._sync_FutileWakeups..........0...........J...(...sun.rt._sync_Parks..........@...........J...8...sun.rt._sync_EmptyNotifications.............8...........J...0...sun.rt._sync_Notifications..........8...........J...0...sun.rt._sync_SlowEnter..............8...........J...0...sun.rt._sync_SlowExit...............8...........J...0...sun.rt._sync_SlowNotify.............8...........J...0...sun.rt._sync_SlowNotifyAll..........8...........J...0...sun.rt._sync_FailedSpins............@...........J...8...sun.rt._sync_SuccessfulSpins................8...........J...0...sun.rt._sync_PrivateA...............8...........J...0...sun.rt._sync_PrivateB...............@...........J...8...sun.rt._sync_MonInCirculation...............8...........J...0...sun.rt._sync_MonScavenged...

C:\Users\user\AppData\Local\Temp\hsperfdata_user\6924

Download File

Process:	C:\Program Files (x86)\Java\jre-1.8\bin\java.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.305369882562548
Encrypted:	false
SSDEEP:	96:NwOrBo8GLnDsn8XI6B1bwdcA7nnSTUHE19o22+:NwZ8GLnDs8XI6lA2oHErK
MD5:	33124DA5FABAFD6CF7849AAB5CA11B43
SHA1:	EBB4542FBF93E38338AB669039299F415C2BDAC9
SHA-256:	F232B203BBA2259B0AFA9B39FCD3EB5C849BB0E58963C42700194B6B81A45000
SHA-512:	4583B485CB406075B5E8E722C92D534806861C1BEA9E459BEC91D52BF6604E3D38F300D07A2E7C43AFFB199A8EF415746FAEBDAD24E4092BE09FA59FC9D72146
Malicious:	false
Preview:	.........9......}....... .......8...........J...0...sun.rt._sync_Inflations.............8...........J...0...sun.rt._sync_Deflations.............@...........J...8...sun.rt._sync_ContendedLockAttempts..........8...........J...0...sun.rt._sync_FutileWakeups..........0...........J...(...sun.rt._sync_Parks.. .......@...........J...8...sun.rt._sync_EmptyNotifications.............8...........J...0...sun.rt._sync_Notifications.. .......8...........J...0...sun.rt._sync_SlowEnter..............8...........J...0...sun.rt._sync_SlowExit...............8...........J...0...sun.rt._sync_SlowNotify.............8...........J...0...sun.rt._sync_SlowNotifyAll..........8...........J...0...sun.rt._sync_FailedSpins............@...........J...8...sun.rt._sync_SuccessfulSpins................8...........J...0...sun.rt._sync_PrivateA...............8...........J...0...sun.rt._sync_PrivateB...............@...........J...8...sun.rt._sync_MonInCirculation...............8...........J...0...sun.rt._sync_MonScavenged...

C:\Users\user\AppData\Local\Temp\hsperfdata_user\7076

Download File

Process:	C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.2859300793533026
Encrypted:	false
SSDEEP:	96:d2wGrg3Q8GWqgmXV6amwCgs0QvSTzHG1bowo:wwLA8GWXmXV6As0ffHGd
MD5:	E378D9DFCB45F0DF92E5F1ED841D9442
SHA1:	3676E24A10C4F69205A3FD126F4F8EEFF9682392
SHA-256:	A11EF55A1D931B59F17099EA89683E1FA60316BD434C0F8DED83AA5BBA745F06
SHA-512:	32956ABC747F3579D2BEEBD10EABF6EEFE30D8707431E779209912C23437A1549C4120CD65152E779809E0871438CBA99A5C987701164DB17FDDE4D8D8EF9A4A
Malicious:	false
Preview:	........09......W....... .......8...........J...0...sun.rt._sync_Inflations.............8...........J...0...sun.rt._sync_Deflations.............@...........J...8...sun.rt._sync_ContendedLockAttempts..........8...........J...0...sun.rt._sync_FutileWakeups..........0...........J...(...sun.rt._sync_Parks..........@...........J...8...sun.rt._sync_EmptyNotifications.............8...........J...0...sun.rt._sync_Notifications..........8...........J...0...sun.rt._sync_SlowEnter..............8...........J...0...sun.rt._sync_SlowExit...............8...........J...0...sun.rt._sync_SlowNotify.............8...........J...0...sun.rt._sync_SlowNotifyAll..........8...........J...0...sun.rt._sync_FailedSpins............@...........J...8...sun.rt._sync_SuccessfulSpins................8...........J...0...sun.rt._sync_PrivateA...............8...........J...0...sun.rt._sync_PrivateB...............@...........J...8...sun.rt._sync_MonInCirculation...............8...........J...0...sun.rt._sync_MonScavenged...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Shipping Bill6239999 dated 13122024.PDF.jar

Download File

Process:	C:\Program Files (x86)\Java\jre-1.8\bin\java.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	modified
Size (bytes):	201515
Entropy (8bit):	7.891155587199237
Encrypted:	false
SSDEEP:	3072:lROA9tlCGC9tKioY4Ql1wVa3CZGfteVTIglU5N0cVfG6lLAANinz94ZC6vr5:/9/LC9sGVNSZGfteVTAjJ1qANmx4x
MD5:	01FD77362FBE5B158352D203BF4E264D
SHA1:	B707961BF70F6798103B0F9DCF516CA3FB63A52F
SHA-256:	9DBFB2B2C624A39591FD60397997AE7D9C09896862B5D97C5DB3C7DD6C6D902B
SHA-512:	C64D87211760ECE2E76ED4BD9255D2F728159CED3A03BDFAC28FA17D9B0F452D73E0EF62521EC354A44657028ACEA8E620620C1A4D3C0C4A91612D5C347288D7
Malicious:	true
Preview:	PK...........Y................kingDavid/k.class/]PQO.P.=w.u+.nCEQ.Tt.q[...2.$...71..r..,..t.b.1....>.......7.kG..4....{.....#..V..&7;V.%.........1.wy.gl..d..f..1..Ur...Y%..8Ch.Bw.r.Z.iY#oP."\|y3W%.Q..t5....\.7...S4=....N......iY.H^.FQ#..R.... .....C/..z..b.2..C.m."....4.CR......&hD..n.d.IU....0).<..8.)....e.......#A.7}2......."n0.{...J*..\|......nbN.../p.....'..5......D.M!.m.e9...'..T_G.....(.........cp.(..1..H..j...R.$.......N...;.@...A..........6.R..u..e..i.;E.)1..v.o...3.a....I=F5.......<!.q..U.I..:.s....T.J.3.....O^{...!.I},....3.....@..0..(....3.]z?.....C.'zu..Z.Yr....gh.&dx@~....e....BG.`...PK.....bH...;...PK...........Y............"...kingDavid/k.class/caesium_27.classc..PK..............PK...........Y............"...kingDavid/k.class/caesium_26.classc..PK..............PK...........Y............"...kingDavid/k.class/caesium_25.classc..PK..............PK...........Y................kingDavid/b.class/.{wtUE.......u........^.."(.6..(...B........`W...+..P.

C:\Users\user\AppData\Roaming\Shipping Bill6239999 dated 13122024.PDF.jar

Download File

Process:	C:\Program Files (x86)\Java\jre-1.8\bin\java.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	201515
Entropy (8bit):	7.891155587199237
Encrypted:	false
SSDEEP:	3072:lROA9tlCGC9tKioY4Ql1wVa3CZGfteVTIglU5N0cVfG6lLAANinz94ZC6vr5:/9/LC9sGVNSZGfteVTAjJ1qANmx4x
MD5:	01FD77362FBE5B158352D203BF4E264D
SHA1:	B707961BF70F6798103B0F9DCF516CA3FB63A52F
SHA-256:	9DBFB2B2C624A39591FD60397997AE7D9C09896862B5D97C5DB3C7DD6C6D902B
SHA-512:	C64D87211760ECE2E76ED4BD9255D2F728159CED3A03BDFAC28FA17D9B0F452D73E0EF62521EC354A44657028ACEA8E620620C1A4D3C0C4A91612D5C347288D7
Malicious:	true
Preview:	PK...........Y................kingDavid/k.class/]PQO.P.=w.u+.nCEQ.Tt.q[...2.$...71..r..,..t.b.1....>.......7.kG..4....{.....#..V..&7;V.%.........1.wy.gl..d..f..1..Ur...Y%..8Ch.Bw.r.Z.iY#oP."\|y3W%.Q..t5....\.7...S4=....N......iY.H^.FQ#..R.... .....C/..z..b.2..C.m."....4.CR......&hD..n.d.IU....0).<..8.)....e.......#A.7}2......."n0.{...J*..\|......nbN.../p.....'..5......D.M!.m.e9...'..T_G.....(.........cp.(..1..H..j...R.$.......N...;.@...A..........6.R..u..e..i.;E.)1..v.o...3.a....I=F5.......<!.q..U.I..:.s....T.J.3.....O^{...!.I},....3.....@..0..(....3.]z?.....C.'zu..Z.Yr....gh.&dx@~....e....BG.`...PK.....bH...;...PK...........Y............"...kingDavid/k.class/caesium_27.classc..PK..............PK...........Y............"...kingDavid/k.class/caesium_26.classc..PK..............PK...........Y............"...kingDavid/k.class/caesium_25.classc..PK..............PK...........Y................kingDavid/b.class/.{wtUE.......u........^.."(.6..(...B........`W...+..P.

C:\cmdlinestart.log

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	3.9898227820087544
Encrypted:	false
SSDEEP:	3:qUew/GWXqov:qTeGQj
MD5:	682C76D1B5180FAF3EAB2321053CD21D
SHA1:	B89BF15F5BA460A3FE13B72BC2F65A6C7CB88B8A
SHA-256:	74944370F3B678E5B7A62BAF377EA956023FCF40B2133134B9F168D898299639
SHA-512:	5EC21614E10855A53F3DE93D37F1639165756A84FBDC3DDF1CF697EADD0B02A5CECF7A9CFDFD2C342AEAF46ECECFDCF7B58FD28ACC1A5FD4595B8ED296119E39
Malicious:	false
Preview:	Inside main method..Inside constructor..

Static File Info

General

File type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Entropy (8bit):	7.891155587199237
TrID:	Java Archive (13504/1) 62.80% ZIP compressed archive (8000/1) 37.20%
File name:	Shipping Bill6239999 dated 13122024.PDF.jar
File size:	201'515 bytes
MD5:	01fd77362fbe5b158352d203bf4e264d
SHA1:	b707961bf70f6798103b0f9dcf516ca3fb63a52f
SHA256:	9dbfb2b2c624a39591fd60397997ae7d9c09896862b5d97c5db3c7dd6c6d902b
SHA512:	c64d87211760ece2e76ed4bd9255d2f728159ced3a03bdfac28fa17d9b0f452d73e0ef62521ec354a44657028acea8e620620c1a4d3c0c4a91612d5c347288d7
SSDEEP:	3072:lROA9tlCGC9tKioY4Ql1wVa3CZGfteVTIglU5N0cVfG6lLAANinz94ZC6vr5:/9/LC9sGVNSZGfteVTAjJ1qANmx4x
TLSH:	CD14BE24BF8092B2E37774B6049CD319B9B4A4EEC21C66970FF1AC1FDC26D540F25AA5
File Content Preview:	PK...........Y................kingDavid/k.class/]PQO.P.=w.u+.nCEQ.Tt.q[....2.$...71..r..,..t.b.1....>........7.kG..4......{.....#..V..&7;V.%.............1.wy.gl..d...f..1..Ur...Y%..8Ch.Bw.r.Z.iY#oP."\|y3W%.Q..t5....\.7...S4=....N......iY.H^..FQ#..R...... .

File Icon


Icon Hash:	d08c8e8ea2868a54

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-17T11:43:22.819766+0100	2030358	ET MALWARE STRRAT CnC Checkin	1	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:43:27.839117+0100	2030358	ET MALWARE STRRAT CnC Checkin	1	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:43:32.842825+0100	2030358	ET MALWARE STRRAT CnC Checkin	1	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:43:37.857823+0100	2030358	ET MALWARE STRRAT CnC Checkin	1	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:43:42.855342+0100	2030358	ET MALWARE STRRAT CnC Checkin	1	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:43:48.039680+0100	2030358	ET MALWARE STRRAT CnC Checkin	1	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:43:53.041467+0100	2030358	ET MALWARE STRRAT CnC Checkin	1	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:43:58.045446+0100	2030358	ET MALWARE STRRAT CnC Checkin	1	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:44:03.041819+0100	2030358	ET MALWARE STRRAT CnC Checkin	1	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:44:08.056353+0100	2030358	ET MALWARE STRRAT CnC Checkin	1	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:44:13.056681+0100	2030358	ET MALWARE STRRAT CnC Checkin	1	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:44:18.072847+0100	2030358	ET MALWARE STRRAT CnC Checkin	1	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:44:23.072460+0100	2030358	ET MALWARE STRRAT CnC Checkin	1	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:44:28.091740+0100	2030358	ET MALWARE STRRAT CnC Checkin	1	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:44:33.088280+0100	2030358	ET MALWARE STRRAT CnC Checkin	1	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:44:38.087821+0100	2030358	ET MALWARE STRRAT CnC Checkin	1	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:44:43.104067+0100	2030358	ET MALWARE STRRAT CnC Checkin	1	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:44:48.106462+0100	2030358	ET MALWARE STRRAT CnC Checkin	1	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:44:53.124572+0100	2030358	ET MALWARE STRRAT CnC Checkin	1	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:44:58.532478+0100	2030358	ET MALWARE STRRAT CnC Checkin	1	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:45:03.526669+0100	2030358	ET MALWARE STRRAT CnC Checkin	1	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:45:08.525862+0100	2030358	ET MALWARE STRRAT CnC Checkin	1	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:45:14.946681+0100	2030358	ET MALWARE STRRAT CnC Checkin	1	192.168.2.4	49730	194.59.30.164	1790	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 17, 2024 11:43:13.509488106 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:43:13.629255056 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:43:13.629343987 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:43:21.453871965 CET	49731	80	192.168.2.4	208.95.112.1
Dec 17, 2024 11:43:21.574359894 CET	80	49731	208.95.112.1	192.168.2.4
Dec 17, 2024 11:43:21.578208923 CET	49731	80	192.168.2.4	208.95.112.1
Dec 17, 2024 11:43:21.578671932 CET	49731	80	192.168.2.4	208.95.112.1
Dec 17, 2024 11:43:21.699189901 CET	80	49731	208.95.112.1	192.168.2.4
Dec 17, 2024 11:43:22.697033882 CET	80	49731	208.95.112.1	192.168.2.4
Dec 17, 2024 11:43:22.697253942 CET	80	49731	208.95.112.1	192.168.2.4
Dec 17, 2024 11:43:22.697340965 CET	49731	80	192.168.2.4	208.95.112.1
Dec 17, 2024 11:43:22.698847055 CET	49731	80	192.168.2.4	208.95.112.1
Dec 17, 2024 11:43:22.699249983 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:43:22.819401026 CET	80	49731	208.95.112.1	192.168.2.4
Dec 17, 2024 11:43:22.819713116 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:43:22.819766045 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:43:22.939460993 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:43:27.718954086 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:43:27.838828087 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:43:27.839117050 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:43:27.959435940 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:43:32.722713947 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:43:32.842737913 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:43:32.842824936 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:43:32.962727070 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:43:37.737337112 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:43:37.857764959 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:43:37.857822895 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:43:37.977536917 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:43:42.735337019 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:43:42.855232954 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:43:42.855341911 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:43:42.975123882 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:43:47.919590950 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:43:48.039599895 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:43:48.039680004 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:43:48.159743071 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:43:52.921658993 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:43:53.041376114 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:43:53.041466951 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:43:53.161237955 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:43:57.925487041 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:43:58.045288086 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:43:58.045445919 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:43:58.166105986 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:44:02.921824932 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:44:03.041763067 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:44:03.041819096 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:44:03.161833048 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:44:07.936537027 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:44:08.056241989 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:44:08.056353092 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:44:08.176278114 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:44:12.936757088 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:44:13.056557894 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:44:13.056680918 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:44:13.176557064 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:44:17.952604055 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:44:18.072654963 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:44:18.072846889 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:44:18.192693949 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:44:22.952616930 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:44:23.072360992 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:44:23.072459936 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:44:23.316638947 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:44:27.971841097 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:44:28.091599941 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:44:28.091739893 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:44:28.211584091 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:44:32.968135118 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:44:33.088179111 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:44:33.088279963 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:44:33.209220886 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:44:37.967967033 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:44:38.087711096 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:44:38.087821007 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:44:38.207633018 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:44:42.984245062 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:44:43.104010105 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:44:43.104067087 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:44:43.223916054 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:44:47.986438990 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:44:48.106405973 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:44:48.106462002 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:44:48.226238966 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:44:52.999394894 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:44:53.124357939 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:44:53.124572039 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:44:53.244396925 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:44:58.412513018 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:44:58.532411098 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:44:58.532478094 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:44:58.652230024 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:45:03.405597925 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:45:03.525265932 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:45:03.526669025 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:45:03.646434069 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:45:08.405744076 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:45:08.525679111 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:45:08.525861979 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:45:08.645639896 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:45:14.823234081 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:45:14.943167925 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:45:14.946681023 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:45:15.066512108 CET	1790	49730	194.59.30.164	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 17, 2024 11:43:13.288032055 CET	56408	53	192.168.2.4	1.1.1.1
Dec 17, 2024 11:43:13.497453928 CET	53	56408	1.1.1.1	192.168.2.4
Dec 17, 2024 11:43:21.315377951 CET	63255	53	192.168.2.4	1.1.1.1
Dec 17, 2024 11:43:21.452620029 CET	53	63255	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 17, 2024 11:43:13.288032055 CET	192.168.2.4	1.1.1.1	0x4dab	Standard query (0)	evilginx.misecure.com	A (IP address)	IN (0x0001)	false
Dec 17, 2024 11:43:21.315377951 CET	192.168.2.4	1.1.1.1	0x9de1	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 17, 2024 11:43:13.497453928 CET	1.1.1.1	192.168.2.4	0x4dab	No error (0)	evilginx.misecure.com		194.59.30.164	A (IP address)	IN (0x0001)	false
Dec 17, 2024 11:43:21.452620029 CET	1.1.1.1	192.168.2.4	0x9de1	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	208.95.112.1	80	5016	C:\Program Files (x86)\Java\jre-1.8\bin\java.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 11:43:21.578671932 CET	188	OUT	GET /json/ HTTP/1.1 Host: ip-api.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.86 Safari/537.36 Connection: close
Dec 17, 2024 11:43:22.697033882 CET	483	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 10:43:22 GMT Content-Type: application/json; charset=utf-8 Content-Length: 306 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 55 53 22 2c 22 72 65 67 69 6f 6e 22 3a 22 4e 59 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 7a 69 70 22 3a 22 31 30 31 32 33 22 2c 22 6c 61 74 22 3a 34 30 2e 37 31 32 38 2c 22 6c 6f 6e 22 3a 2d 37 34 2e 30 30 36 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 22 2c 22 69 73 70 22 3a 22 4c 65 76 65 6c 20 33 22 2c 22 6f 72 67 22 3a 22 43 65 6e 74 75 72 79 4c 69 6e 6b 20 43 6f 6d 6d 75 6e 69 63 61 74 69 6f 6e 73 2c 20 4c 4c 43 22 2c 22 61 73 22 3a 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 33 20 50 61 72 65 6e 74 2c 20 4c 4c 43 22 2c 22 71 75 65 72 79 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 7d Data Ascii: {"status":"success","country":"United States","countryCode":"US","region":"NY","regionName":"New York","city":"New York","zip":"10123","lat":40.7128,"lon":-74.006,"timezone":"America/New_York","isp":"Level 3","org":"CenturyLink Communications, LLC","as":"AS3356 Level 3 Parent, LLC","query":"8.46.123.189"}

Target ID:	0
Start time:	05:43:08
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\Java\jre-1.8\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\Shipping Bill6239999 dated 13122024.PDF.jar"" >> C:\cmdlinestart.log 2>&1
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	05:43:08
Start date:	17/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	05:43:08
Start date:	17/12/2024
Path:	C:\Program Files (x86)\Java\jre-1.8\bin\java.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Java\jre-1.8\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\Shipping Bill6239999 dated 13122024.PDF.jar"
Imagebase:	0xdd0000
File size:	257'664 bytes
MD5 hash:	9DAA53BAB2ECB33DC0D9CA51552701FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CaesiumObfuscator, Description: Yara detected Caesium Obfuscator, Source: 00000002.00000003.1772738637.0000000000B1A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CaesiumObfuscator, Description: Yara detected Caesium Obfuscator, Source: 00000002.00000002.1801801717.0000000009D50000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	05:43:10
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\icacls.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
Imagebase:	0x640000
File size:	29'696 bytes
MD5 hash:	2E49585E4E08565F52090B144062F97E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	05:43:10
Start date:	17/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	05:43:11
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\user\AppData\Roaming\Shipping Bill6239999 dated 13122024.PDF.jar"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	05:43:11
Start date:	17/12/2024
Path:	C:\Program Files (x86)\Java\jre-1.8\bin\java.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Java\jre-1.8\bin\java.exe" -jar "C:\Users\user\AppData\Roaming\Shipping Bill6239999 dated 13122024.PDF.jar"
Imagebase:	0xdd0000
File size:	257'664 bytes
MD5 hash:	9DAA53BAB2ECB33DC0D9CA51552701FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CaesiumObfuscator, Description: Yara detected Caesium Obfuscator, Source: 00000006.00000003.1797761433.000000000082B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CaesiumObfuscator, Description: Yara detected Caesium Obfuscator, Source: 00000006.00000002.3008381214.0000000009A28000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CaesiumObfuscator, Description: Yara detected Caesium Obfuscator, Source: 00000006.00000002.3008381214.0000000009997000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_STRRAT, Description: Yara detected STRRAT, Source: 00000006.00000002.3008381214.0000000009968000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	05:43:11
Start date:	17/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	05:43:11
Start date:	17/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	05:43:11
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\user\AppData\Roaming\Shipping Bill6239999 dated 13122024.PDF.jar"
Imagebase:	0x5b0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	05:43:12
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	05:43:12
Start date:	17/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	05:43:13
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list
Imagebase:	0x490000
File size:	427'008 bytes
MD5 hash:	E2DE6500DE1148C7F6027AD50AC8B891
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	05:43:14
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	05:43:14
Start date:	17/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	05:43:14
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list
Imagebase:	0x490000
File size:	427'008 bytes
MD5 hash:	E2DE6500DE1148C7F6027AD50AC8B891
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	05:43:15
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	05:43:15
Start date:	17/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	05:43:15
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list
Imagebase:	0x490000
File size:	427'008 bytes
MD5 hash:	E2DE6500DE1148C7F6027AD50AC8B891
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	05:43:17
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c "wmic /node:localhost /namespace:'\\root\securitycenter2' path antivirusproduct get displayname /format:list"
Imagebase:	0x7ff70f330000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	05:43:17
Start date:	17/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	05:43:17
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic /node:localhost /namespace:'\\root\securitycenter2' path antivirusproduct get displayname /format:list
Imagebase:	0x490000
File size:	427'008 bytes
MD5 hash:	E2DE6500DE1148C7F6027AD50AC8B891
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	05:43:23
Start date:	17/12/2024
Path:	C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\user\AppData\Roaming\Shipping Bill6239999 dated 13122024.PDF.jar"
Imagebase:	0xcd0000
File size:	257'664 bytes
MD5 hash:	6E0F4F812AE02FBCB744A929E74A04B8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CaesiumObfuscator, Description: Yara detected Caesium Obfuscator, Source: 00000016.00000003.1920754006.0000000000AB6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_STRRAT, Description: Yara detected STRRAT, Source: 00000016.00000002.3008961235.0000000009D68000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CaesiumObfuscator, Description: Yara detected Caesium Obfuscator, Source: 00000016.00000002.3008961235.0000000009D97000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CaesiumObfuscator, Description: Yara detected Caesium Obfuscator, Source: 00000016.00000002.3008961235.0000000009E28000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	05:43:31
Start date:	17/12/2024
Path:	C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\user\AppData\Roaming\Shipping Bill6239999 dated 13122024.PDF.jar"
Imagebase:	0xcd0000
File size:	257'664 bytes
MD5 hash:	6E0F4F812AE02FBCB744A929E74A04B8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CaesiumObfuscator, Description: Yara detected Caesium Obfuscator, Source: 0000001A.00000003.2002849792.00000000004C5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CaesiumObfuscator, Description: Yara detected Caesium Obfuscator, Source: 0000001A.00000002.3009108330.0000000009797000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_STRRAT, Description: Yara detected STRRAT, Source: 0000001A.00000002.3009108330.0000000009768000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CaesiumObfuscator, Description: Yara detected Caesium Obfuscator, Source: 0000001A.00000002.3009108330.0000000009828000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	05:43:40
Start date:	17/12/2024
Path:	C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\user\AppData\Roaming\Shipping Bill6239999 dated 13122024.PDF.jar"
Imagebase:	0xcd0000
File size:	257'664 bytes
MD5 hash:	6E0F4F812AE02FBCB744A929E74A04B8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_STRRAT, Description: Yara detected STRRAT, Source: 0000001B.00000002.3009029991.000000000A568000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CaesiumObfuscator, Description: Yara detected Caesium Obfuscator, Source: 0000001B.00000002.3009029991.000000000A628000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CaesiumObfuscator, Description: Yara detected Caesium Obfuscator, Source: 0000001B.00000003.2087844478.0000000001326000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CaesiumObfuscator, Description: Yara detected Caesium Obfuscator, Source: 0000001B.00000002.3009029991.000000000A597000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	05:43:48
Start date:	17/12/2024
Path:	C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Shipping Bill6239999 dated 13122024.PDF.jar"
Imagebase:	0xcd0000
File size:	257'664 bytes
MD5 hash:	6E0F4F812AE02FBCB744A929E74A04B8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_STRRAT, Description: Yara detected STRRAT, Source: 0000001C.00000002.3009084016.0000000009768000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CaesiumObfuscator, Description: Yara detected Caesium Obfuscator, Source: 0000001C.00000002.3009084016.0000000009798000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CaesiumObfuscator, Description: Yara detected Caesium Obfuscator, Source: 0000001C.00000002.3009084016.0000000009829000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 02610672 Relevance: 1.6, APIs: 1, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 026106D5

Memory Dump Source

Source File: 00000002.00000002.1798629235.0000000002610000.00000040.00000800.00020000.00000000.sdmp, Offset: 02610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2610000_java.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: ed75e148c468f5adb501353e2aad55fe9f6ba1d7e63b2f06930a3a0182af5efc
Instruction ID: c9ec2e478556933fb869abc5190393e0e5033ce534f41a1a307a03062d92637d
Opcode Fuzzy Hash: ed75e148c468f5adb501353e2aad55fe9f6ba1d7e63b2f06930a3a0182af5efc
Instruction Fuzzy Hash: 361149B690022ADFCF18DF48C5954ADB7B0FF98314B6A4525DC69A3345D33479A0CB90

Function 0261D8F7 Relevance: .2, Instructions: 223
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.1798629235.0000000002612000.00000040.00000800.00020000.00000000.sdmp, Offset: 02612000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2612000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 184b3fa2f5c9b4a4a3817fbcfcd89ac6a728338ac72883d80f62075ca47d809d
Instruction ID: 04a782b80d1623b8de57ea6d19613ec1527c366e03c1670278176607cb8be1ff
Opcode Fuzzy Hash: 184b3fa2f5c9b4a4a3817fbcfcd89ac6a728338ac72883d80f62075ca47d809d
Instruction Fuzzy Hash: 5BA198B5A04601DFDB18CF24C594BAAFBB1FF49318F08859DD81A8B381CB74B885CB91

Function 0261D8D1 Relevance: .2, Instructions: 166
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.1798629235.0000000002612000.00000040.00000800.00020000.00000000.sdmp, Offset: 02612000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2612000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3017bf2f542bb391276616ad4a6bba6294e46308bb48ee8a19976c0104d603e
Instruction ID: 1831575ef8473623e2b11aacb3b323f9b9f96c6de8516b2847314bd1b18634a9
Opcode Fuzzy Hash: c3017bf2f542bb391276616ad4a6bba6294e46308bb48ee8a19976c0104d603e
Instruction Fuzzy Hash: F67198B1604641EFEB18CF24C994BAAFBB5FB49714F08859DD81A8B381C774B885CB91

Function 026CF3A7 Relevance: .1, Instructions: 84
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.1798629235.00000000026B4000.00000040.00000800.00020000.00000000.sdmp, Offset: 026B4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_26b4000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f447cc2df479904f0561516f3384b6bdfaac285b5a2354996b77e89c0d2e5929
Instruction ID: a5c48534f5abf1791a16850bedb6a07623d597b51f83077a8352c1b97fe6e17b
Opcode Fuzzy Hash: f447cc2df479904f0561516f3384b6bdfaac285b5a2354996b77e89c0d2e5929
Instruction Fuzzy Hash: 5331E270A08745AFD715DF24D5487B9BBB1FF41308F24C66EC84887B81D734A558CB81

Function 02624CCD Relevance: .0, Instructions: 22
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.1798629235.0000000002612000.00000040.00000800.00020000.00000000.sdmp, Offset: 02612000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2612000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03afee348c050c8758e2dfa7873c35edaf0cdc71996e4893d8e19a6dc00e3b28
Instruction ID: dd6d93440a8f2c2111b7e49f9de6e6cb27958658f6059fea36df1ff872ef8c80
Opcode Fuzzy Hash: 03afee348c050c8758e2dfa7873c35edaf0cdc71996e4893d8e19a6dc00e3b28
Instruction Fuzzy Hash: 39F0BCB5900A06EBEB15CF20C0047EAF7B4BB88704F14420AD82C53710C378B469CBD0

Function 02624B78 Relevance: .0, Instructions: 21
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.1798629235.0000000002612000.00000040.00000800.00020000.00000000.sdmp, Offset: 02612000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2612000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d43da79f530cf5d6da9d091c4b40ba1b722a5b5250a40a87c1393ad88d7b9f1f
Instruction ID: 9098d93718f267249fba12e194244bdcda395bb815c0f6af4a4be8369151a7b6
Opcode Fuzzy Hash: d43da79f530cf5d6da9d091c4b40ba1b722a5b5250a40a87c1393ad88d7b9f1f
Instruction Fuzzy Hash: 22F07FB5904A06EBDB158F61C0047DAFBB4FB88718F15421AD82C57750D778B4658BC0

Function 0261EC1C Relevance: .0, Instructions: 20
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.1798629235.0000000002612000.00000040.00000800.00020000.00000000.sdmp, Offset: 02612000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2612000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ae2c255b3b35184110ca92ec687ab685eef8850bc2b70234dcaaa1181a749c8
Instruction ID: 7c73a47780f92553828a1c9b07023da22395665ba7f77f1e70944bf607a19747
Opcode Fuzzy Hash: 6ae2c255b3b35184110ca92ec687ab685eef8850bc2b70234dcaaa1181a749c8
Instruction Fuzzy Hash: B3F092B5904A06EBDB15CF65C0047DAFBB4BB88714F14421AD42C67750D778B469CBC0

Function 0261DA35 Relevance: .0, Instructions: 18
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.1798629235.0000000002612000.00000040.00000800.00020000.00000000.sdmp, Offset: 02612000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2612000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 151cd88b456ce9cb81fc7481b4ba478997931b2f77f9c59b2c487cad63a6803f
Instruction ID: eaa5daacff69e85d6362b1c3dda76e1e9188ce89c7f92a838d77ec98877c96c3
Opcode Fuzzy Hash: 151cd88b456ce9cb81fc7481b4ba478997931b2f77f9c59b2c487cad63a6803f
Instruction Fuzzy Hash: C9F0C2B6D00A0AEBDB248F61C0047DAFBB5BB48714F18421AC42C63710D378B465CBC0

Function 026249AA Relevance: .0, Instructions: 18
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.1798629235.0000000002612000.00000040.00000800.00020000.00000000.sdmp, Offset: 02612000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2612000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c341414688d6e68fb8fb8372d083c64c7a5e76e0754037d80d42c8d1e863df43
Instruction ID: b32853f69aa1dd800bbc40dfddd1d182ad8f803cdd5d8d5511c5ee576e0c841d
Opcode Fuzzy Hash: c341414688d6e68fb8fb8372d083c64c7a5e76e0754037d80d42c8d1e863df43
Instruction Fuzzy Hash: 5EF0C2B6D00A06ABDB248F61C0047CAFBB4BB48714F14421AC42C67710D378B465CBC0

Function 0261DE6E Relevance: .0, Instructions: 18
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.1798629235.0000000002612000.00000040.00000800.00020000.00000000.sdmp, Offset: 02612000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2612000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f92a716f669317d4408f09107d162f1893f100658dd11f53672d6f2a810dc29
Instruction ID: c2a92284aebe6113f9b7b6a6e69baaca2ba2b14d95778adb49408ae0c330f732
Opcode Fuzzy Hash: 1f92a716f669317d4408f09107d162f1893f100658dd11f53672d6f2a810dc29
Instruction Fuzzy Hash: 7CF0C2B6D00A06ABDB248F61C0047CAFBB4BB44714F15421AC42C63710C778B465CBC0

Function 02623C76 Relevance: .0, Instructions: 18
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.1798629235.0000000002612000.00000040.00000800.00020000.00000000.sdmp, Offset: 02612000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2612000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bc3f109678cfe5cd5307d51162a8e1dd7240f17ad87c61e9c10f2fe75d5f405
Instruction ID: 9039101dac24fbcafc91c54d5f994de60d4c883e3943be29f58cf1e7fdeb32ce
Opcode Fuzzy Hash: 4bc3f109678cfe5cd5307d51162a8e1dd7240f17ad87c61e9c10f2fe75d5f405
Instruction Fuzzy Hash: 2FF0C2B6D00A0AABDB248F61C0047CAFBB4BB48714F14421AC42C67710D378B465CBC0

Function 0261B4F5 Relevance: .0, Instructions: 18
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.1798629235.0000000002612000.00000040.00000800.00020000.00000000.sdmp, Offset: 02612000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2612000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f92a716f669317d4408f09107d162f1893f100658dd11f53672d6f2a810dc29
Instruction ID: c2a92284aebe6113f9b7b6a6e69baaca2ba2b14d95778adb49408ae0c330f732
Opcode Fuzzy Hash: 1f92a716f669317d4408f09107d162f1893f100658dd11f53672d6f2a810dc29
Instruction Fuzzy Hash: 7CF0C2B6D00A06ABDB248F61C0047CAFBB4BB44714F15421AC42C63710C778B465CBC0

Function 026245E9 Relevance: .0, Instructions: 18
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.1798629235.0000000002612000.00000040.00000800.00020000.00000000.sdmp, Offset: 02612000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2612000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 958d64357ab919f270c9d3a94f6bac778c62d72e355af0588dd6cd6e78c86423
Instruction ID: ac2b43f1089e13ad44485092c5409f8a7aea05676ec3a53e330b3bb422372222
Opcode Fuzzy Hash: 958d64357ab919f270c9d3a94f6bac778c62d72e355af0588dd6cd6e78c86423
Instruction Fuzzy Hash: 87F0C2B6D00A0AABDB248F61C0047CAFBB5BB48714F18421AC52C63710D378B465CBC0

Function 02624EF4 Relevance: .0, Instructions: 17
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.1798629235.0000000002612000.00000040.00000800.00020000.00000000.sdmp, Offset: 02612000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2612000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfd2244f23901520d8b68fbe4b1f38bda5a7c3117cb1f89d9ed181a3f261a689
Instruction ID: 5ac18a9024ddf74d361194b95f0f61aede4d72237ff91cb4028dbd38ccd14008
Opcode Fuzzy Hash: cfd2244f23901520d8b68fbe4b1f38bda5a7c3117cb1f89d9ed181a3f261a689
Instruction Fuzzy Hash: BEF0C2B5D00A0AABDB24CF61C10438AF7B0BB48B14F14421AC42C63710C378B465CBC0

Non-executed Functions

Function 026103C0 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798629235.0000000002610000.00000040.00000800.00020000.00000000.sdmp, Offset: 02610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2610000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a012a9fb5cf5d9e1554885d89a3030425dd9bcc3e3bcfa4e280c99466c7885fc
Instruction ID: f5d12b0be4bcf51918d70176af761c1a964970327c496bd79c61ef24e352a413
Opcode Fuzzy Hash: a012a9fb5cf5d9e1554885d89a3030425dd9bcc3e3bcfa4e280c99466c7885fc
Instruction Fuzzy Hash: 2121E4BA5082568FDF358F598C403D9B7E5FB58314F21482EDEC9E7710D3306A898B91

Function 026BE469 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798629235.00000000026B4000.00000040.00000800.00020000.00000000.sdmp, Offset: 026B4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_26b4000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35cfca38a64c3ff3937ba3edcbc8bb1544487143f9c1f7a554a90dce2bed6829
Instruction ID: d80f39aca5c87c5e874190d0985c3c095158185e79a5596655d3cef11b0c67d0
Opcode Fuzzy Hash: 35cfca38a64c3ff3937ba3edcbc8bb1544487143f9c1f7a554a90dce2bed6829
Instruction Fuzzy Hash: FCF01EA240E3C18FC3039B348C366813F704E63205B2E45EBD081DF0E3E25A4A6AD322

Analysis Process: java.exePID: 5016, Parent PID: 6924COMMON

Executed Functions

Function 02369712 Relevance: .3, Instructions: 313COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3004911981.0000000002361000.00000040.00000800.00020000.00000000.sdmp, Offset: 02361000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2361000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b46434ca218e6f9bb161adeadaf016e40ae1f995481324e962bcefa147e03893
Instruction ID: 1428c8b1af323d0d2b4b6f364e75d8a8f82e5710a66a83dd0876fdc87f20e9f0
Opcode Fuzzy Hash: b46434ca218e6f9bb161adeadaf016e40ae1f995481324e962bcefa147e03893
Instruction Fuzzy Hash: DBD1F975A08340CFC714CF19C18872ABBF6BB89314F65C9AED8999B359C735E842CB81

Function 022CD9A5 Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3004911981.00000000022C2000.00000040.00000800.00020000.00000000.sdmp, Offset: 022C2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_22c2000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 238482c87dbaaf795f5b85ec6ace2db2ee356c997e4e4ecad4e69f55af1aebf4
Instruction ID: 6de3c5a86dbfd301177189a0fa83c79fac5ffa69c1e34042dfd391de5f313633
Opcode Fuzzy Hash: 238482c87dbaaf795f5b85ec6ace2db2ee356c997e4e4ecad4e69f55af1aebf4
Instruction Fuzzy Hash: EA81F4B5A14602DFDB18CFA4C594BA9F7B1FF49314F2482ADD81A4B389CB74A944CF90

Function 022C0672 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3004911981.00000000022C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_22c0000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed75e148c468f5adb501353e2aad55fe9f6ba1d7e63b2f06930a3a0182af5efc
Instruction ID: 1e9a59e97f4801b6c447a4d81f776a24bc950ef3f0a8233b8b8f53a660d6df03
Opcode Fuzzy Hash: ed75e148c468f5adb501353e2aad55fe9f6ba1d7e63b2f06930a3a0182af5efc
Instruction Fuzzy Hash: F4114CB691022BDFCF18DF88C8855ADB7B0FB98314F654629DC69A3349D3346A60CB90

Function 022C0722 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3004911981.00000000022C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_22c0000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a88776f8235f6b0c93d982b0301c995d4e8eee1a694dd39eb109f49dc123123
Instruction ID: b091f072401216050b8c5ca13710c7be300bacacd4dd491af7359be569ed31d2
Opcode Fuzzy Hash: 3a88776f8235f6b0c93d982b0301c995d4e8eee1a694dd39eb109f49dc123123
Instruction Fuzzy Hash: 20F01C76C0022ADB8B14DF84C4400EDF771EB04218B29859ADC2C37245D3326E51CF81

Function 022D4B78 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3004911981.00000000022C2000.00000040.00000800.00020000.00000000.sdmp, Offset: 022C2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_22c2000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6ed9817168c78bd7fff4c806cdb026febbd81f0a05118b21334f65b833a6ae3
Instruction ID: e2b5f14ebaa0ba42dd37b9dc1608edaad6807d9d630aac695772007ea08aaf90
Opcode Fuzzy Hash: c6ed9817168c78bd7fff4c806cdb026febbd81f0a05118b21334f65b833a6ae3
Instruction Fuzzy Hash: E2F07FB5904A06EBDB15CF61C0047DAFBB4FB88718F15421AD42C57750D778B4658BC0

Function 022CEC1C Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3004911981.00000000022C2000.00000040.00000800.00020000.00000000.sdmp, Offset: 022C2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_22c2000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f5ce3be467d1f054114f7a2c4007f98df3801c0b0b360d1ef372405925ee8f9
Instruction ID: 8b09a22b6f1aee5c63390f622f3e3c6f9185447c19ec338c661c9de87b63a43b
Opcode Fuzzy Hash: 8f5ce3be467d1f054114f7a2c4007f98df3801c0b0b360d1ef372405925ee8f9
Instruction Fuzzy Hash: B3F09BB6A14A06EBDB29CF65C0047DAFBB4BB88718F14421AC42C67750D778B469CBC0

Function 022D6495 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3004911981.00000000022C2000.00000040.00000800.00020000.00000000.sdmp, Offset: 022C2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_22c2000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86305e3d3c915be6718c5e953109e70a0f6b676504a3fb785fbf5b1a34a9beb4
Instruction ID: c2e45cb4de8820a60049be99117059293ed18de19ab5a28c78e53d9b3eb35b30
Opcode Fuzzy Hash: 86305e3d3c915be6718c5e953109e70a0f6b676504a3fb785fbf5b1a34a9beb4
Instruction Fuzzy Hash: 2BF09BBAA14A16EBDB25CF65C0047CAFBB4BB88714F14421AC42C67750D778B469CBC0

Function 022CDA35 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3004911981.00000000022C2000.00000040.00000800.00020000.00000000.sdmp, Offset: 022C2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_22c2000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c12cd392cb1f71691dde4ce26bddbccdaa7b1afa45c34cbd74e26a47e1b74057
Instruction ID: a7cf02ca2afd7f7af546cf5957871b3f780d5de0cecbd65bf19619bcd4524e5f
Opcode Fuzzy Hash: c12cd392cb1f71691dde4ce26bddbccdaa7b1afa45c34cbd74e26a47e1b74057
Instruction Fuzzy Hash: 33F0C2B6D00A0AEBDB24CFA1C0047DAFBB5BB48714F14421AC42C63710D378B465CBC0

Function 022D49AA Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3004911981.00000000022C2000.00000040.00000800.00020000.00000000.sdmp, Offset: 022C2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_22c2000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66582ac800662c1e0a210a91c0fc81b0b329dab098ac8985d278b2253b972cdc
Instruction ID: 33a2099864365e6085c4dfaee9243809ab20e5c277d47095c2f8d8ea33aad4d0
Opcode Fuzzy Hash: 66582ac800662c1e0a210a91c0fc81b0b329dab098ac8985d278b2253b972cdc
Instruction Fuzzy Hash: 20F0CAB6D00A0AEBDB24CFA1C0047CAFBB4BB88714F24421AC42C67720D378B469CBC0

Function 022CB407 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3004911981.00000000022C2000.00000040.00000800.00020000.00000000.sdmp, Offset: 022C2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_22c2000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e3b2667e1a66f8dc7e9ec527f1856c20b047aa0c388fb35262e4c204b6455f4
Instruction ID: cff0ced1606e523267d16e132a767bc5a2a96834a6edfa211370ae99a0712ca7
Opcode Fuzzy Hash: 6e3b2667e1a66f8dc7e9ec527f1856c20b047aa0c388fb35262e4c204b6455f4
Instruction Fuzzy Hash: 5AF0C2B6D00A06EBDB24CFA1C0047CAFBB4BB44714F19421AC42C63750D378B465CBC0

Function 022D3C76 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3004911981.00000000022C2000.00000040.00000800.00020000.00000000.sdmp, Offset: 022C2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_22c2000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc8a12220e471fbcfb564260a143837f44b9182b0088285e4b12a3bbe58d0e5c
Instruction ID: 7ddff0533de8b311cd6ccca9ad08fb86d56ca89828af88b0a445506860386dc5
Opcode Fuzzy Hash: cc8a12220e471fbcfb564260a143837f44b9182b0088285e4b12a3bbe58d0e5c
Instruction Fuzzy Hash: 39F0C2B6D00A0AEBDB24CFA1C0047CAFBB4BB48714F14421AC42C67710D378B465CBC0

Function 022D45E9 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3004911981.00000000022C2000.00000040.00000800.00020000.00000000.sdmp, Offset: 022C2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_22c2000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1972d0de419b18bde206c1db252254bad3dc14a7a5e34e45fb1bb7c0b014fc2
Instruction ID: 8ac0c2923794f4e50fd3e7bc8ff49748537dcc0eebc622f4ae1a39179d3b2bb2
Opcode Fuzzy Hash: a1972d0de419b18bde206c1db252254bad3dc14a7a5e34e45fb1bb7c0b014fc2
Instruction Fuzzy Hash: 37F0C2B6D00A0AEBDB24CFA1C0047CAFBB5BB48714F14421AC52C63710D378B465CBC0

Function 022D4EF4 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3004911981.00000000022C2000.00000040.00000800.00020000.00000000.sdmp, Offset: 022C2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_22c2000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d6f6a64cac522e4931a854eab73fcd9c67b047b97b5b226f6ce8aa9dd667b40
Instruction ID: d19d9d74e62321f7042a89a413df28682e88f8934e7ccc79b78f5b4462d9a3e8
Opcode Fuzzy Hash: 8d6f6a64cac522e4931a854eab73fcd9c67b047b97b5b226f6ce8aa9dd667b40
Instruction Fuzzy Hash: 44F0C2B5D00A0AEBDB24CF61C10438AF7B0BB48B14F14421AC42C63710C378B465CBC0

Analysis Process: javaw.exePID: 5780, Parent PID: 2580COMMON

Executed Functions

Function 026BD9A5 Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.3005454258.00000000026B2000.00000040.00000800.00020000.00000000.sdmp, Offset: 026B2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_26b2000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cefe72ce1e52db7219ef06730c62bfc1fb4d8cdea9dd985b94d6a6a7423df96
Instruction ID: edfced6cfa9ccb6ca48b5f200237efc0c3d99203f2aeb9687ed6b091ac2e1408
Opcode Fuzzy Hash: 7cefe72ce1e52db7219ef06730c62bfc1fb4d8cdea9dd985b94d6a6a7423df96
Instruction Fuzzy Hash: 168166B5A04601DFDB1ACF24C594BA9FBB1FF49318F0881ADC91A5F381CB35A885CB91

Function 026B0672 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.3005454258.00000000026B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_26b0000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed75e148c468f5adb501353e2aad55fe9f6ba1d7e63b2f06930a3a0182af5efc
Instruction ID: dd8d93a58a5053a02477ff97bc6d5f49d0748d7035344ca4b73f23b3cfe34a6c
Opcode Fuzzy Hash: ed75e148c468f5adb501353e2aad55fe9f6ba1d7e63b2f06930a3a0182af5efc
Instruction Fuzzy Hash: 571149B690022A9FCF29CF58C4954EEBBB0FF98314B664565DC65A3741E33469A0CB90

Function 026B0722 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.3005454258.00000000026B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_26b0000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a88776f8235f6b0c93d982b0301c995d4e8eee1a694dd39eb109f49dc123123
Instruction ID: 48ee7509b95a5cc645e87a73efce2d4bd902d7ea8a55a2edb563657cd483fddc
Opcode Fuzzy Hash: 3a88776f8235f6b0c93d982b0301c995d4e8eee1a694dd39eb109f49dc123123
Instruction Fuzzy Hash: AAF01576C00229DB8B15DF48C4400EEFBB1EF04218B2A84A6DC2837741E332ADA2CF81

Function 026C4CCD Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.3005454258.00000000026B2000.00000040.00000800.00020000.00000000.sdmp, Offset: 026B2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_26b2000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00c4197e77b80197a6501e56149e53322a52423454562b2921fdcaae46599e06
Instruction ID: 95497168500156d216f60c3687e4f64ef611cde7db02366f5a3af238ea711821
Opcode Fuzzy Hash: 00c4197e77b80197a6501e56149e53322a52423454562b2921fdcaae46599e06
Instruction Fuzzy Hash: 5EF0BCB5900A06EBEB15CF20C0047EAFBB4BB88704F14420AD42C53710C378B469CBD0

Function 026C4B78 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.3005454258.00000000026B2000.00000040.00000800.00020000.00000000.sdmp, Offset: 026B2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_26b2000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 163a0298c584cc73974f4af4c8263175bd73a0390e2c3f5b63c1235c5ab0c316
Instruction ID: c815f4fb3863b19d959d81a37d9b6100182470b5a4ee2cf99e7369b331c9559e
Opcode Fuzzy Hash: 163a0298c584cc73974f4af4c8263175bd73a0390e2c3f5b63c1235c5ab0c316
Instruction Fuzzy Hash: 50F07FB5904A06EBDB158F61C0047DAFBB4FB88718F15421AD42C57750D778B4658BC0

Function 026BEC1C Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.3005454258.00000000026B2000.00000040.00000800.00020000.00000000.sdmp, Offset: 026B2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_26b2000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6728404d3b85f86d7f1c90ac5586e910c986a03fc69ddf622a6984d4b073f4e3
Instruction ID: 3d6433e79d2188f33c0a804ac1e6cf994d29ba8d46754a2cb0325e1f4e6746f2
Opcode Fuzzy Hash: 6728404d3b85f86d7f1c90ac5586e910c986a03fc69ddf622a6984d4b073f4e3
Instruction Fuzzy Hash: FBF09BB6A04A06EBDB29CF65C0047DAFBB4BB88718F14421AC42C67750D778B4A9CBC0

Function 026C6495 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.3005454258.00000000026B2000.00000040.00000800.00020000.00000000.sdmp, Offset: 026B2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_26b2000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fdd22c62c4d9777ddf8255cc6f6d6d438035b3ed81edbacd6fe9904e68124b0
Instruction ID: 3b857c753d83f79b20a3ba8ce2ff92cbf4edf310b7d8fe122f6d6f9c096a43d9
Opcode Fuzzy Hash: 3fdd22c62c4d9777ddf8255cc6f6d6d438035b3ed81edbacd6fe9904e68124b0
Instruction Fuzzy Hash: 5CF09BBAA04A16EBDB26CF65C0047CAFBB4BB88714F14421AC42C67750D778B469CBC0

Function 026BDA35 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.3005454258.00000000026B2000.00000040.00000800.00020000.00000000.sdmp, Offset: 026B2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_26b2000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a7eacd8268cf0ed248b210806039259c6e1e3dbae8fcfdbb2b0facd6382cf9a
Instruction ID: 314f1d142de1e5a1afb3d7213527635aa67aa76b1ce387df38231b5a534eb183
Opcode Fuzzy Hash: 2a7eacd8268cf0ed248b210806039259c6e1e3dbae8fcfdbb2b0facd6382cf9a
Instruction Fuzzy Hash: E2F0C2B6D00A0AEBDB258F61C0047DAFBB5BB48714F14421AC42C63710D378B465CBC0

Function 026C49AA Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.3005454258.00000000026B2000.00000040.00000800.00020000.00000000.sdmp, Offset: 026B2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_26b2000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 177a3504c811690a2871accbc7d4e02a7f01ac8ef858e991005f260fe77ccc25
Instruction ID: a1456feccafd9238aa3a1d5814fe36c386ef90a124cbed2c14c09b05c352ad7a
Opcode Fuzzy Hash: 177a3504c811690a2871accbc7d4e02a7f01ac8ef858e991005f260fe77ccc25
Instruction Fuzzy Hash: 4FF0CAB6D00A0AABDB258F61C0047CAFBB4BB88714F14421AC42C67720E378B4A9CBC0

Function 026C3C76 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.3005454258.00000000026B2000.00000040.00000800.00020000.00000000.sdmp, Offset: 026B2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_26b2000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d52c37e52602f690930a723ecb39c5f8ecd326789ff518cb4b4cc6d53391a0c4
Instruction ID: b94eb0b581daf99f8bf70d84ff23470e308b28ee9a0a1b9487bbc4cc7949992a
Opcode Fuzzy Hash: d52c37e52602f690930a723ecb39c5f8ecd326789ff518cb4b4cc6d53391a0c4
Instruction Fuzzy Hash: 1BF0C2B6D00A0AABDB258F61C0047CAFBB4BB48714F14421AC42C67710D378B465CBC0

Function 026C45E9 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.3005454258.00000000026B2000.00000040.00000800.00020000.00000000.sdmp, Offset: 026B2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_26b2000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6758368d6bb036304becd8d139c7e36f7e142cb088847c538711cbaf28ee62c
Instruction ID: 1ee65419138d7dcc7c3ba0a3886f898aebfcfaa86ec748df2b70fd47aecd25cb
Opcode Fuzzy Hash: e6758368d6bb036304becd8d139c7e36f7e142cb088847c538711cbaf28ee62c
Instruction Fuzzy Hash: FFF0C2B6D00A0AABDB258F61C0047CAFBB5BB48714F14421AC52C63710D378B465CBC0

Function 026C4EF4 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.3005454258.00000000026B2000.00000040.00000800.00020000.00000000.sdmp, Offset: 026B2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_26b2000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a76e438e45d7bde2bcca2057d5fdc72bf6425cd8745507eb0fb358f6251ff0b3
Instruction ID: 5d34ce223dec3340b29a82721a89c2041b8314f23b7e89c343f01ddb064012d4
Opcode Fuzzy Hash: a76e438e45d7bde2bcca2057d5fdc72bf6425cd8745507eb0fb358f6251ff0b3
Instruction Fuzzy Hash: 5CF0CAB6D00A0AABDB25CF61C1043CAFBB0BF88B18F14421AC42C63710D378B865CBC0

Analysis Process: javaw.exePID: 7076, Parent PID: 2580COMMON

Executed Functions

Function 0212D9A5 Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.3005330739.0000000002122000.00000040.00000800.00020000.00000000.sdmp, Offset: 02122000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_2122000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f52f59fa357f1e3c1c745d72c6314cd55a33d9bcfde47bebdf1d563fe6bd3bbe
Instruction ID: 6deab14df0072f44d92108c5cd9fe044e37f8368b3e234af5e5a33746f703efe
Opcode Fuzzy Hash: f52f59fa357f1e3c1c745d72c6314cd55a33d9bcfde47bebdf1d563fe6bd3bbe
Instruction Fuzzy Hash: 988122B5A44615DFDB18CF24E494BA9F7B1FF09314F18819DE81A5B381CB34A868CF90

Function 02120672 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.3005330739.0000000002120000.00000040.00000800.00020000.00000000.sdmp, Offset: 02120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_2120000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed75e148c468f5adb501353e2aad55fe9f6ba1d7e63b2f06930a3a0182af5efc
Instruction ID: 245e0518d598e11a452c415c765a5b58b8a4717768ccbd20e3b4d47c077f022f
Opcode Fuzzy Hash: ed75e148c468f5adb501353e2aad55fe9f6ba1d7e63b2f06930a3a0182af5efc
Instruction Fuzzy Hash: B91149B6D4023A9FCF18CF48C4854ADB7B1FBAC314B964629EC66A3341D3346974CB90

Function 02120722 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.3005330739.0000000002120000.00000040.00000800.00020000.00000000.sdmp, Offset: 02120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_2120000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a88776f8235f6b0c93d982b0301c995d4e8eee1a694dd39eb109f49dc123123
Instruction ID: 70d4a383c8696f7d72af9bf712589c7c278f1e68c1f850dfb6c4fded866f9ca1
Opcode Fuzzy Hash: 3a88776f8235f6b0c93d982b0301c995d4e8eee1a694dd39eb109f49dc123123
Instruction Fuzzy Hash: 7EF0157AC40229DBCB14DF48C4400ADF7B2EB18218B1A8596EC6837241D332AD66CF81

Function 02134CCD Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.3005330739.0000000002122000.00000040.00000800.00020000.00000000.sdmp, Offset: 02122000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_2122000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e89354d56158aafa9a373a57f18f82d9a26d574573bfa6aa29262244522ab985
Instruction ID: 976182c709c0f225e5e9cbe3ed5249ce7d745f9d0d93a93830d099f17ad06154
Opcode Fuzzy Hash: e89354d56158aafa9a373a57f18f82d9a26d574573bfa6aa29262244522ab985
Instruction Fuzzy Hash: 23F0BCB5900A06EBEB25CF20C0047EAF7B4FB88704F05420AD42C53710C378B429CBD0

Function 02134B78 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.3005330739.0000000002122000.00000040.00000800.00020000.00000000.sdmp, Offset: 02122000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_2122000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32ae4ee7c46e9b6f95a1f01929aa001ff310582ac7670e06cd7dc5d5c275afa8
Instruction ID: 34d2e8fe3641e601891327b54b2bae917d67e1c3259a4a5d6bbf591f78801cf5
Opcode Fuzzy Hash: 32ae4ee7c46e9b6f95a1f01929aa001ff310582ac7670e06cd7dc5d5c275afa8
Instruction Fuzzy Hash: 34F07FB5904A16EBDB258F61C0047DAFBB4FB98718F15421AD42C57750D778B4698BC0

Function 0212EC1C Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.3005330739.0000000002122000.00000040.00000800.00020000.00000000.sdmp, Offset: 02122000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_2122000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42c53b6a43cb31f46749cf055c128a4d641a382d0e15341617bf31b5e391985a
Instruction ID: 7e28dc34da21cc948e84c9541b2a620873d97c078b2cb27197430f3e59299a59
Opcode Fuzzy Hash: 42c53b6a43cb31f46749cf055c128a4d641a382d0e15341617bf31b5e391985a
Instruction Fuzzy Hash: E3F0FBB6A00A06EBDB29CF21C0047CAFBB0BB88718F04420AC42C63750C778B469CBC0

Function 02136495 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.3005330739.0000000002122000.00000040.00000800.00020000.00000000.sdmp, Offset: 02122000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_2122000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9ded2bca32e274ae897c3e5ac67fc689f900a41d65ac8e9de80b23e5f706eeb
Instruction ID: f7bce38c845fdaeabb21a6dc2413089b5f67c57652659c5ad9d32367b6f31e58
Opcode Fuzzy Hash: f9ded2bca32e274ae897c3e5ac67fc689f900a41d65ac8e9de80b23e5f706eeb
Instruction Fuzzy Hash: F5F09BBAA04A16EBDB25CF65C0047CAFBB4BB98714F15421AD42C67750D778B469CBC0

Function 0212DA35 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.3005330739.0000000002122000.00000040.00000800.00020000.00000000.sdmp, Offset: 02122000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_2122000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29995f15d872365a04cd7e63b114800720359f2c2bcdb68d33b564c1261958e5
Instruction ID: 9181c420f4ba24b913ab4d2acde3a07423e37bc0eac1879630f6106164e087f5
Opcode Fuzzy Hash: 29995f15d872365a04cd7e63b114800720359f2c2bcdb68d33b564c1261958e5
Instruction Fuzzy Hash: 81F0CAB6D00A1AEBDB248F61C0047DAFBB6BB98714F19421AC42C63720D378B469CBC0

Function 021349AA Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.3005330739.0000000002122000.00000040.00000800.00020000.00000000.sdmp, Offset: 02122000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_2122000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 956e54bf23284365c5c9cadd695bdfbbdf0198356242075349d738de1d4895ef
Instruction ID: 2b4ec81ce49656e17506aa7e81bcd011c46cfab0d974ae082a1c71188644a272
Opcode Fuzzy Hash: 956e54bf23284365c5c9cadd695bdfbbdf0198356242075349d738de1d4895ef
Instruction Fuzzy Hash: 16F0CAB6D00A1AABDB248F61C0047CAFBB4BB98714F15421AC42C67720D378B469CBC0

Function 02133C76 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.3005330739.0000000002122000.00000040.00000800.00020000.00000000.sdmp, Offset: 02122000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_2122000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99a64b4ec0b77d3b02f59ce48039708535421d8eb77825d64b9e9e729c7ff8ff
Instruction ID: 9f7236e58925b57e575ec8101c40653b7dbb071286c26ca20ff2dbe3cba5468c
Opcode Fuzzy Hash: 99a64b4ec0b77d3b02f59ce48039708535421d8eb77825d64b9e9e729c7ff8ff
Instruction Fuzzy Hash: 19F0CAB6D00A1AABDB248F61C0047CAFBB5BB98718F15421AC42C67720D378B469CBC0

Function 021345E9 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.3005330739.0000000002122000.00000040.00000800.00020000.00000000.sdmp, Offset: 02122000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_2122000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f29a8930f6ce769411abd134445f90d38a307f5953f89062311e104bc3655a35
Instruction ID: c0891ed85515615b1e3925995e6ac4eb59215c1b0803d7f2d2b5ebeca3f692af
Opcode Fuzzy Hash: f29a8930f6ce769411abd134445f90d38a307f5953f89062311e104bc3655a35
Instruction Fuzzy Hash: 34F0C2B6D00A1AABDB248F61C0047CAFBB5BB58714F15421AC52C63710D378B469CBC0

Function 02134EF4 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.3005330739.0000000002122000.00000040.00000800.00020000.00000000.sdmp, Offset: 02122000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_2122000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2a3db019c57da53aff0bc2116be014ecaa88ed500bd28ffb9a5b59772277281
Instruction ID: d1117fc69139dbee2eb38aaab914beda9071a5c1b4d241c35c5a436402f49e9a
Opcode Fuzzy Hash: a2a3db019c57da53aff0bc2116be014ecaa88ed500bd28ffb9a5b59772277281
Instruction Fuzzy Hash: F4F0CAB6D00A1AABDB24CF61C10438AFBB1BB98B18F15421AC42C63710C378B869CBC0

Analysis Process: javaw.exePID: 2228, Parent PID: 2580COMMON

Executed Functions

Function 02DDD9A5 Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.3005439095.0000000002DD2000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DD2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_2dd2000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37d25eacc61a7fa9cb372bbb25ed151f7a3475e8e54bab5f37ada320f798afe7
Instruction ID: 3e0a4b3a883c6587a6d8d0ddf14e90f1b2714c55b63c7a8f7f06ad1652c34984
Opcode Fuzzy Hash: 37d25eacc61a7fa9cb372bbb25ed151f7a3475e8e54bab5f37ada320f798afe7
Instruction Fuzzy Hash: 96817A76A04A019FDF18CF64C594BA9FBB2FF49318F188599D85A5B381CB34AC44CB91

Function 02DD0672 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.3005439095.0000000002DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_2dd0000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed75e148c468f5adb501353e2aad55fe9f6ba1d7e63b2f06930a3a0182af5efc
Instruction ID: 7ff767bd80afb18f71a50897149e4713bd28f097eac862ed427bceaedb4d98a2
Opcode Fuzzy Hash: ed75e148c468f5adb501353e2aad55fe9f6ba1d7e63b2f06930a3a0182af5efc
Instruction Fuzzy Hash: 5B1179B6D0066A9FCF24DF48C8814ADB7B0FB88315F568529EC65A3341D334AD20CB81

Function 02DD0722 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.3005439095.0000000002DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_2dd0000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a88776f8235f6b0c93d982b0301c995d4e8eee1a694dd39eb109f49dc123123
Instruction ID: c6e57df51fbe6e12fdcab13c2b3a054bf81fd6e17a00a3d9a84f52a3894bdb3b
Opcode Fuzzy Hash: 3a88776f8235f6b0c93d982b0301c995d4e8eee1a694dd39eb109f49dc123123
Instruction Fuzzy Hash: 98F0A57AC00269EB8B14DF48C4411ADB7B1FB85318F1A8496DC697B341D332AD62CF92

Function 02DE4B78 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.3005439095.0000000002DD2000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DD2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_2dd2000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd44d45fc3bb47026edb2caca9024f612e3e5b4afcea5971ecbb406b68d5052e
Instruction ID: 979145637cc2e35fb40290aa0c0085d2d7d0915542534ed3796b59f8297ce426
Opcode Fuzzy Hash: cd44d45fc3bb47026edb2caca9024f612e3e5b4afcea5971ecbb406b68d5052e
Instruction Fuzzy Hash: 94F07FB5904A06EBDB158F61C0047DAFBB4FB88718F15421AD42C57750D778B465CBC0

Function 02DE6495 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.3005439095.0000000002DD2000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DD2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_2dd2000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fdf2988b296ca338ff218201f789bf439b3fce8f8b3a5e70e4be357ab153242
Instruction ID: 0ad5f017c62dba6b7d5bd94f730c72ab5d1123dd812d6d271efced68abc48a34
Opcode Fuzzy Hash: 7fdf2988b296ca338ff218201f789bf439b3fce8f8b3a5e70e4be357ab153242
Instruction Fuzzy Hash: 64F09BBAA04A16EBDB25CF65C0047CAFBB4BB88714F14421AC42C67750D778B469CBC0

Function 02DDEC1C Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.3005439095.0000000002DD2000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DD2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_2dd2000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0863e9d509c735dc872c22c19e85d57233e17b54eb1f720a7abad9bc930e31d
Instruction ID: dd0df67807cbc23a56cfb42d29ab20e8c23738899994d4f3d2ad16fb7048dd02
Opcode Fuzzy Hash: b0863e9d509c735dc872c22c19e85d57233e17b54eb1f720a7abad9bc930e31d
Instruction Fuzzy Hash: DEF09BB6A04A06EBDB29CF65C0047DAFBB4BB88718F14421AC42C67750D778B869CBC0

Function 02DDDA35 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.3005439095.0000000002DD2000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DD2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_2dd2000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f5048d7ea7509a0aa0f0af5f16abe28b1ee6ca23a892c321c500b55c01d7358
Instruction ID: bc27d76ff83b2c6edebb7ea7e89b753829e71bfcb5e1274d930f4828bee08d44
Opcode Fuzzy Hash: 3f5048d7ea7509a0aa0f0af5f16abe28b1ee6ca23a892c321c500b55c01d7358
Instruction Fuzzy Hash: 56F0CAB6D00A0AEBDB248F61C0047DAFBB9BB88714F18421AC42C63720D378B469CBC0

Function 02DE49AA Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.3005439095.0000000002DD2000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DD2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_2dd2000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3953ab5be2f2022a132f23c04c99dcaf4291d8949f614619275b90eeb27bf694
Instruction ID: 894da0a02fb527576023d27dd2f015bcf961a38b956c2c6d2885dd34f0bcc50f
Opcode Fuzzy Hash: 3953ab5be2f2022a132f23c04c99dcaf4291d8949f614619275b90eeb27bf694
Instruction Fuzzy Hash: 5DF0CAB6D00A0AABDB248F61C0047CAFBB8BB88714F14421AC42C67720D378B469CBC0

Function 02DE3C76 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.3005439095.0000000002DD2000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DD2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_2dd2000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cc7bc9c3e365ea47568549b9927bc2375b1cde7b1b291202e4a2d327502e1d4
Instruction ID: 139424b436d01a2d832b448d3b514b6935b8bab698f51156500c1113fb8640e7
Opcode Fuzzy Hash: 8cc7bc9c3e365ea47568549b9927bc2375b1cde7b1b291202e4a2d327502e1d4
Instruction Fuzzy Hash: 72F0CAB6D00A0AABDB248F61C0047CAFBB8BB88718F14421AC42C67720D378B469CBC0

Function 02DE45E9 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.3005439095.0000000002DD2000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DD2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_2dd2000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ab20337aa1d85a3445d20c184eed8f6d3539aabac0d7d754bab2c48379a3f5f
Instruction ID: 80dd9346f2a4d633bc56769f81456ecba446a314b6d4ddf530aff198047224db
Opcode Fuzzy Hash: 2ab20337aa1d85a3445d20c184eed8f6d3539aabac0d7d754bab2c48379a3f5f
Instruction Fuzzy Hash: E5F0C2B6D00A0AABDB248F61C0047CAFBB5BB88714F14421AC52C63710D378B465CBC0

Function 02DE4EF4 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.3005439095.0000000002DD2000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DD2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_2dd2000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dad28ef1e9ffb33dde08426e990dad4d4e8d25afd2b7552153ed16277ea7880a
Instruction ID: af55d982c252f9d2cfaa999a277f5332c1b00794c1d8efc799d61da3a38067a2
Opcode Fuzzy Hash: dad28ef1e9ffb33dde08426e990dad4d4e8d25afd2b7552153ed16277ea7880a
Instruction Fuzzy Hash: B0F0CAB6D00A0AABDB24CF61C10438AFBB4BB88B18F14421AC42C63710C378B865CBC0

Analysis Process: javaw.exePID: 4088, Parent PID: 2580COMMON

Executed Functions

Function 0212D9A5 Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.3004912319.0000000002122000.00000040.00000800.00020000.00000000.sdmp, Offset: 02122000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_2122000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63cae95bd0a16cbadaed710adfc4fb6c175f449eb5600deb4427a9f44b634931
Instruction ID: 868d64759660fb29e044061fcc2da2a666336942080ad06685db21b62c855460
Opcode Fuzzy Hash: 63cae95bd0a16cbadaed710adfc4fb6c175f449eb5600deb4427a9f44b634931
Instruction Fuzzy Hash: DB8122B5A44615DFDB18CF24E494BA9F7B1FF09314F18819DE81A9B381CB34A868CF90

Function 02120672 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.3004912319.0000000002120000.00000040.00000800.00020000.00000000.sdmp, Offset: 02120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_2120000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed75e148c468f5adb501353e2aad55fe9f6ba1d7e63b2f06930a3a0182af5efc
Instruction ID: 245e0518d598e11a452c415c765a5b58b8a4717768ccbd20e3b4d47c077f022f
Opcode Fuzzy Hash: ed75e148c468f5adb501353e2aad55fe9f6ba1d7e63b2f06930a3a0182af5efc
Instruction Fuzzy Hash: B91149B6D4023A9FCF18CF48C4854ADB7B1FBAC314B964629EC66A3341D3346974CB90

Function 02120722 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.3004912319.0000000002120000.00000040.00000800.00020000.00000000.sdmp, Offset: 02120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_2120000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a88776f8235f6b0c93d982b0301c995d4e8eee1a694dd39eb109f49dc123123
Instruction ID: 70d4a383c8696f7d72af9bf712589c7c278f1e68c1f850dfb6c4fded866f9ca1
Opcode Fuzzy Hash: 3a88776f8235f6b0c93d982b0301c995d4e8eee1a694dd39eb109f49dc123123
Instruction Fuzzy Hash: 7EF0157AC40229DBCB14DF48C4400ADF7B2EB18218B1A8596EC6837241D332AD66CF81

Function 02134B78 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.3004912319.0000000002122000.00000040.00000800.00020000.00000000.sdmp, Offset: 02122000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_2122000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32ae4ee7c46e9b6f95a1f01929aa001ff310582ac7670e06cd7dc5d5c275afa8
Instruction ID: 34d2e8fe3641e601891327b54b2bae917d67e1c3259a4a5d6bbf591f78801cf5
Opcode Fuzzy Hash: 32ae4ee7c46e9b6f95a1f01929aa001ff310582ac7670e06cd7dc5d5c275afa8
Instruction Fuzzy Hash: 34F07FB5904A16EBDB258F61C0047DAFBB4FB98718F15421AD42C57750D778B4698BC0

Function 0212EC1C Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.3004912319.0000000002122000.00000040.00000800.00020000.00000000.sdmp, Offset: 02122000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_2122000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42c53b6a43cb31f46749cf055c128a4d641a382d0e15341617bf31b5e391985a
Instruction ID: 7e28dc34da21cc948e84c9541b2a620873d97c078b2cb27197430f3e59299a59
Opcode Fuzzy Hash: 42c53b6a43cb31f46749cf055c128a4d641a382d0e15341617bf31b5e391985a
Instruction Fuzzy Hash: E3F0FBB6A00A06EBDB29CF21C0047CAFBB0BB88718F04420AC42C63750C778B469CBC0

Function 02136495 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.3004912319.0000000002122000.00000040.00000800.00020000.00000000.sdmp, Offset: 02122000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_2122000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9ded2bca32e274ae897c3e5ac67fc689f900a41d65ac8e9de80b23e5f706eeb
Instruction ID: f7bce38c845fdaeabb21a6dc2413089b5f67c57652659c5ad9d32367b6f31e58
Opcode Fuzzy Hash: f9ded2bca32e274ae897c3e5ac67fc689f900a41d65ac8e9de80b23e5f706eeb
Instruction Fuzzy Hash: F5F09BBAA04A16EBDB25CF65C0047CAFBB4BB98714F15421AD42C67750D778B469CBC0

Function 0212DA35 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.3004912319.0000000002122000.00000040.00000800.00020000.00000000.sdmp, Offset: 02122000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_2122000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29995f15d872365a04cd7e63b114800720359f2c2bcdb68d33b564c1261958e5
Instruction ID: 9181c420f4ba24b913ab4d2acde3a07423e37bc0eac1879630f6106164e087f5
Opcode Fuzzy Hash: 29995f15d872365a04cd7e63b114800720359f2c2bcdb68d33b564c1261958e5
Instruction Fuzzy Hash: 81F0CAB6D00A1AEBDB248F61C0047DAFBB6BB98714F19421AC42C63720D378B469CBC0

Function 021349AA Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.3004912319.0000000002122000.00000040.00000800.00020000.00000000.sdmp, Offset: 02122000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_2122000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 956e54bf23284365c5c9cadd695bdfbbdf0198356242075349d738de1d4895ef
Instruction ID: 2b4ec81ce49656e17506aa7e81bcd011c46cfab0d974ae082a1c71188644a272
Opcode Fuzzy Hash: 956e54bf23284365c5c9cadd695bdfbbdf0198356242075349d738de1d4895ef
Instruction Fuzzy Hash: 16F0CAB6D00A1AABDB248F61C0047CAFBB4BB98714F15421AC42C67720D378B469CBC0

Function 02133C76 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.3004912319.0000000002122000.00000040.00000800.00020000.00000000.sdmp, Offset: 02122000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_2122000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99a64b4ec0b77d3b02f59ce48039708535421d8eb77825d64b9e9e729c7ff8ff
Instruction ID: 9f7236e58925b57e575ec8101c40653b7dbb071286c26ca20ff2dbe3cba5468c
Opcode Fuzzy Hash: 99a64b4ec0b77d3b02f59ce48039708535421d8eb77825d64b9e9e729c7ff8ff
Instruction Fuzzy Hash: 19F0CAB6D00A1AABDB248F61C0047CAFBB5BB98718F15421AC42C67720D378B469CBC0

Function 021345E9 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.3004912319.0000000002122000.00000040.00000800.00020000.00000000.sdmp, Offset: 02122000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_2122000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f29a8930f6ce769411abd134445f90d38a307f5953f89062311e104bc3655a35
Instruction ID: c0891ed85515615b1e3925995e6ac4eb59215c1b0803d7f2d2b5ebeca3f692af
Opcode Fuzzy Hash: f29a8930f6ce769411abd134445f90d38a307f5953f89062311e104bc3655a35
Instruction Fuzzy Hash: 34F0C2B6D00A1AABDB248F61C0047CAFBB5BB58714F15421AC52C63710D378B469CBC0

Function 02134EF4 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.3004912319.0000000002122000.00000040.00000800.00020000.00000000.sdmp, Offset: 02122000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_2122000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2a3db019c57da53aff0bc2116be014ecaa88ed500bd28ffb9a5b59772277281
Instruction ID: d1117fc69139dbee2eb38aaab914beda9071a5c1b4d241c35c5a436402f49e9a
Opcode Fuzzy Hash: a2a3db019c57da53aff0bc2116be014ecaa88ed500bd28ffb9a5b59772277281
Instruction Fuzzy Hash: F4F0CAB6D00A1AABDB24CF61C10438AFBB1BB98B18F15421AC42C63710C378B869CBC0

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the binaries used by services. Adversaries may use flaws in the permissions of Windows services to replace the binary that is executed upon service start. These service processes may automatically execute specific binaries as part of their functionality or to perform other actions. If the permissions on the file system directory containing a target binary, or permissions on the binary itself are improperly set, then the target binary may be overwritten with another binary using user-level permissions and executed by the original process. If the original process and thread are running under a higher permissions level, then the replaced binary will also execute under higher-level permissions, which could include SYSTEM.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Process: Process Creation, Service: Service Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Shipping Bill6239999 dated 13122024.PDF.jar

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: STRRAT

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\Shipping Bill6239999 dated 13122024.PDF.jar

C:\ProgramData\Oracle\Java\.oracle_jre_usage\b5820291038aa69c.timestamp

C:\Users\user\AppData\Local\Temp\hsperfdata_user\2228

C:\Users\user\AppData\Local\Temp\hsperfdata_user\4088

C:\Users\user\AppData\Local\Temp\hsperfdata_user\5016

C:\Users\user\AppData\Local\Temp\hsperfdata_user\5780

C:\Users\user\AppData\Local\Temp\hsperfdata_user\6924

C:\Users\user\AppData\Local\Temp\hsperfdata_user\7076

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Shipping Bill6239999 dated 13122024.PDF.jar

C:\Users\user\AppData\Roaming\Shipping Bill6239999 dated 13122024.PDF.jar

C:\cmdlinestart.log

Static File Info

General

File Icon

Network Behavior

Suricata IDS Alerts

Windows Analysis Report
Shipping Bill6239999 dated 13122024.PDF.jar