File name:

RuneLite.jar

Full analysis: https://app.any.run/tasks/eadc4d75-e15c-4845-b9e9-40b881fa9f14
Verdict: Malicious activity
Analysis date: September 03, 2018, 23:54:58
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/java-archive
File info: Java archive data (JAR)
MD5:

E17E1C6DC75057DC9D1D3B399378E5E5

SHA1:

AF603517121A17CAB6BCE157D62B496C3C8C7B48

SHA256:

5FD754334F71D2E054B7256D8872F6B5D2B96F5E251F10544044182EB28554C1

SSDEEP:

196608:YwoYSJ11QvYlKMloiTLJOQD1mBz5Rcl61NQzFav2xteKYPRgv+h8RJBu:YLY616vFMlTLv1mBzHjazxtXYs+h8RLu

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • RuneLite32.exe (PID: 3016)
      • dookie.exe (PID: 2216)
      • dshocker.exe (PID: 1272)
      • dshocker.exe (PID: 472)

    • Loads dropped or rewritten executable

      • javaw.exe (PID: 928)

    • Changes the autorun value in the registry

      • WScript.exe (PID: 4024)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • javaw.exe (PID: 928)
      • RuneLite32.exe (PID: 3016)

    • Creates files in the user directory

      • javaw.exe (PID: 928)

    • Connects to unusual port

      • javaw.exe (PID: 928)

    • Modifies the open verb of a shell class

      • javaw.exe (PID: 928)

    • Uses TASKKILL.EXE to kill process

      • dookie.exe (PID: 2216)

    • Executes scripts

      • RuneLite32.exe (PID: 3016)

    • Application launched itself

      • dshocker.exe (PID: 1272)

  • INFO

    • Dropped object may contain URL's

      • javaw.exe (PID: 928)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.spe | SPSS Extension (58.2)
.litemod | Minecraft LiteLoader Mod (20.3)
.maff | Mozilla Archive Format (gen) (13.5)
.zip | ZIP compressed archive (7.7)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0808
ZipCompression: Deflated
ZipModifyDate: 2018:09:02 22:56:01
ZipCRC: 0x863a672b
ZipCompressedSize: 120
ZipUncompressedSize: 137
ZipFileName: META-INF/MANIFEST.MF
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
8
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start start drop and start javaw.exe runelite32.exe dookie.exe no specs taskkill.exe no specs wscript.exe taskkill.exe no specs dshocker.exe no specs dshocker.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
472C:\Users\admin\AppData\Local\Temp\as3n\dshocker.exe" C:\Users\admin\AppData\Local\Temp\as3n\dshocker.exe—dshocker.exe
User:
admin
Company:
Jagex Ltd.
Integrity Level:
MEDIUM
Description:
RuneScape Launcher
Exit code:
0
Version:
224.01
Modules
Images
c:\users\admin\appdata\local\temp\as3n\dshocker.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
928"C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe" -jar "C:\Users\admin\AppData\Local\Temp\RuneLite.jar"C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe
explorer.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.920.14
Modules
Images
c:\program files\java\jre1.8.0_92\bin\javaw.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1272"C:\Users\admin\AppData\Local\Temp\as3n\dshocker.exe" C:\Users\admin\AppData\Local\Temp\as3n\dshocker.exe—WScript.exe
User:
admin
Company:
Jagex Ltd.
Integrity Level:
MEDIUM
Description:
RuneScape Launcher
Exit code:
0
Version:
224.01
Modules
Images
c:\users\admin\appdata\local\temp\as3n\dshocker.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2216"C:\Users\admin\AppData\Local\Temp\dookie.exe" C:\Users\admin\AppData\Local\Temp\dookie.exe—RuneLite32.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.00
Modules
Images
c:\users\admin\appdata\local\temp\dookie.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2540taskkill.exe /IM msascuil.exe /FC:\Windows\system32\taskkill.exe—dookie.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
3016"C:\Users\admin\AppData\Roaming\RuneLite\RuneLite32.exe" C:\Users\admin\AppData\Roaming\RuneLite\RuneLite32.exe
javaw.exe
User:
admin
Company:
Jagex Ltd.
Integrity Level:
MEDIUM
Description:
RuneScape Launcher
Exit code:
0
Version:
224.01
Modules
Images
c:\users\admin\appdata\roaming\runelite\runelite32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
3184taskkill.exe /IM msseces.exe /FC:\Windows\system32\taskkill.exe—dookie.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
4024"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\as3n\dshocker.vbs" C:\Windows\System32\WScript.exe
RuneLite32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
1 102
Read events
1 084
Write events
18
Delete events
0

Modification events

(PID) Process:(928) javaw.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(928) javaw.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(928) javaw.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Direct3D\MostRecentApplication
Operation:writeName:Name
Value:
javaw.exe
(PID) Process:(928) javaw.exeKey:HKEY_CLASSES_ROOT\discord-409416265891971072
Operation:writeName:
Value:
URL:Run game 409416265891971072 protocol
(PID) Process:(928) javaw.exeKey:HKEY_CLASSES_ROOT\discord-409416265891971072
Operation:writeName:URL Protocol
Value:
(PID) Process:(928) javaw.exeKey:HKEY_CLASSES_ROOT\discord-409416265891971072\DefaultIcon
Operation:writeName:
Value:
C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe
(PID) Process:(928) javaw.exeKey:HKEY_CLASSES_ROOT\discord-409416265891971072\shell\open\command
Operation:writeName:
Value:
C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe
(PID) Process:(3016) RuneLite32.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3016) RuneLite32.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(4024) WScript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
Operation:writeName:DShocker RPC
Value:
C:\Users\admin\AppData\Local\Temp\as3n\dshocker.vbs
Executable files
5
Suspicious files
3
Text files
8
Unknown types
24

Dropped files

PID
Process
Filename
Type
928javaw.exeC:\Users\admin\AppData\Local\Temp\imageio1492086059639593291.tmp —
MD5:—
SHA256:—
928javaw.exeC:\Users\admin\AppData\Local\Temp\imageio2274738219081966617.tmp —
MD5:—
SHA256:—
928javaw.exeC:\Users\admin\AppData\Local\Temp\imageio3403884208330676590.tmp —
MD5:—
SHA256:—
928javaw.exeC:\Users\admin\AppData\Local\Temp\imageio4877762380845580701.tmp —
MD5:—
SHA256:—
928javaw.exeC:\Users\admin\AppData\Local\Temp\imageio2083548510559300991.tmp —
MD5:—
SHA256:—
928javaw.exeC:\Users\admin\AppData\Local\Temp\imageio3930572693637203777.tmp —
MD5:—
SHA256:—
928javaw.exeC:\Users\admin\AppData\Local\Temp\imageio5939000057880313885.tmp —
MD5:—
SHA256:—
928javaw.exeC:\Users\admin\AppData\Local\Temp\imageio5373793590823008925.tmp —
MD5:—
SHA256:—
928javaw.exeC:\Users\admin\AppData\Local\Temp\imageio2432255148104825183.tmp —
MD5:—
SHA256:—
928javaw.exeC:\Users\admin\AppData\Local\Temp\imageio8780543373840991734.tmp —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
10
DNS requests
5
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
928
javaw.exe
GET
302
91.235.140.148:80
http://oldschool.runescape.com/jav_config.ws
GB
—
—
suspicious
928
javaw.exe
GET
200
104.28.18.98:80
http://public.githubrepository.host/_mvn/ArrestSavaged.zip
US
compressed
245 Kb
suspicious
928
javaw.exe
GET
200
62.67.0.210:80
http://oldschool3.runescape.com/jav_config.ws?userFlow=742822007474982084
GB
text
2.32 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
928
javaw.exe
91.235.140.148:80
oldschool.runescape.com
Level 3 Communications, Inc.
GB
suspicious
928
javaw.exe
62.67.0.210:80
oldschool3.runescape.com
Level 3 Communications, Inc.
GB
unknown
928
javaw.exe
172.64.103.2:443
api.runelite.net
Cloudflare Inc
US
shared
928
javaw.exe
104.28.18.98:80
public.githubrepository.host
Cloudflare Inc
US
shared
928
javaw.exe
62.67.0.210:43594
oldschool3.runescape.com
Level 3 Communications, Inc.
GB
unknown
928
javaw.exe
104.244.46.231:443
pbs.twimg.com
Twitter Inc.
US
unknown

DNS requests

Domain
IP
Reputation
oldschool.runescape.com
  • 91.235.140.148
suspicious
oldschool3.runescape.com
  • 62.67.0.210
unknown
api.runelite.net
  • 172.64.103.2
  • 172.64.102.2
suspicious
public.githubrepository.host
  • 104.28.18.98
  • 104.28.19.98
suspicious
pbs.twimg.com
  • 104.244.46.231
  • 104.244.46.103
whitelisted

Threats

PID
Process
Class
Message
928
javaw.exe
Misc activity
POLICY [PTsecurity] Zip as Image content mistmach (Downloader.Java.Agent)
928
javaw.exe
A Network Trojan was detected
ET CURRENT_EVENTS DRIVEBY Generic - JAR Containing Windows Executable
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
RuneLite.jar