File name:

11.1.jar

Full analysis: https://app.any.run/tasks/f49d869e-91ae-4c39-ba63-59bc24b5a8e9
Verdict: Malicious activity
Analysis date: February 25, 2020, 13:00:45
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/java-archive
File info: Java archive data (JAR)
MD5:

5505EC151916D81CE0B065926DFE8005

SHA1:

FFC51A2A73F0C230856BCA0BE0E3675652EF3E92

SHA256:

63D05D8545F0604EC104DFF8E07F889D1A15CCFEF10A3C65B1A7C73DF02FF8EA

SSDEEP:

6144:FQu7BUkU8Xwat1+OIiYid4yaqM4z5li2NXocOKU95SNWpw8OFHVZfWAoynHv+Edb:ZtrUmzt1ZI3mq4zPi2BRUCWpwzF1Eynl

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • javaw.exe (PID: 3368)
      • svchost.exe (PID: 796)
      • explorer.exe (PID: 372)
      • SearchProtocolHost.exe (PID: 3548)

    • Application was dropped or rewritten from another process

      • javaw.exe (PID: 3368)

    • Changes Image File Execution Options

      • reg.exe (PID: 3052)
      • reg.exe (PID: 1712)
      • reg.exe (PID: 2592)
      • reg.exe (PID: 3424)
      • reg.exe (PID: 2540)
      • reg.exe (PID: 2580)
      • reg.exe (PID: 3528)
      • reg.exe (PID: 576)
      • reg.exe (PID: 3316)
      • reg.exe (PID: 3332)

    • Disables Windows Defender

      • reg.exe (PID: 1836)
      • reg.exe (PID: 4040)
      • reg.exe (PID: 3848)
      • reg.exe (PID: 4068)

    • Runs app for hidden code execution

      • javaw.exe (PID: 3368)

    • Changes the autorun value in the registry

      • javaw.exe (PID: 3368)

  • SUSPICIOUS

    • Creates files in the user directory

      • javaw.exe (PID: 3368)

    • Executes JAVA applets

      • explorer.exe (PID: 372)

    • Uses WMIC.EXE to obtain a system information

      • cmd.exe (PID: 2836)
      • cmd.exe (PID: 2876)
      • cmd.exe (PID: 3800)

    • Uses WMIC.EXE to obtain a list of Firewalls

      • cmd.exe (PID: 2836)

    • Uses WMIC.EXE to obtain a list of AntiViruses

      • cmd.exe (PID: 2876)

    • Uses ATTRIB.EXE to modify file attributes

      • javaw.exe (PID: 3368)

    • Executable content was dropped or overwritten

      • javaw.exe (PID: 3368)

    • Searches for installed software

      • reg.exe (PID: 3872)
      • reg.exe (PID: 2692)
      • reg.exe (PID: 2988)
      • reg.exe (PID: 1488)
      • reg.exe (PID: 2356)
      • reg.exe (PID: 1488)
      • reg.exe (PID: 3884)
      • reg.exe (PID: 956)
      • reg.exe (PID: 3012)
      • reg.exe (PID: 3200)
      • reg.exe (PID: 3300)
      • reg.exe (PID: 1504)
      • reg.exe (PID: 3316)
      • reg.exe (PID: 2580)
      • reg.exe (PID: 3600)
      • reg.exe (PID: 2056)
      • reg.exe (PID: 3276)
      • reg.exe (PID: 3984)
      • reg.exe (PID: 3400)
      • reg.exe (PID: 1844)
      • reg.exe (PID: 3968)
      • reg.exe (PID: 3488)
      • reg.exe (PID: 3584)
      • reg.exe (PID: 3576)
      • reg.exe (PID: 1928)
      • reg.exe (PID: 3820)
      • reg.exe (PID: 2744)
      • reg.exe (PID: 3824)
      • reg.exe (PID: 3068)
      • reg.exe (PID: 3776)
      • reg.exe (PID: 4056)
      • reg.exe (PID: 2428)
      • reg.exe (PID: 772)
      • reg.exe (PID: 332)
      • reg.exe (PID: 2708)
      • reg.exe (PID: 2464)
      • reg.exe (PID: 2492)
      • reg.exe (PID: 3084)
      • reg.exe (PID: 3460)
      • reg.exe (PID: 3916)
      • reg.exe (PID: 3716)
      • reg.exe (PID: 2596)
      • reg.exe (PID: 1524)
      • reg.exe (PID: 3624)
      • reg.exe (PID: 2716)
      • reg.exe (PID: 3308)
      • reg.exe (PID: 1092)
      • reg.exe (PID: 4092)
      • reg.exe (PID: 2388)
      • reg.exe (PID: 2720)
      • reg.exe (PID: 3860)
      • reg.exe (PID: 2944)
      • reg.exe (PID: 3308)
      • reg.exe (PID: 272)
      • reg.exe (PID: 3756)
      • reg.exe (PID: 1692)
      • reg.exe (PID: 3100)
      • reg.exe (PID: 620)
      • reg.exe (PID: 3960)
      • reg.exe (PID: 3976)
      • reg.exe (PID: 3860)
      • reg.exe (PID: 3484)
      • reg.exe (PID: 3076)
      • reg.exe (PID: 2348)
      • reg.exe (PID: 2076)
      • reg.exe (PID: 2960)
      • reg.exe (PID: 1536)
      • reg.exe (PID: 2120)
      • reg.exe (PID: 3756)
      • reg.exe (PID: 3160)
      • reg.exe (PID: 2320)
      • reg.exe (PID: 2140)
      • reg.exe (PID: 2564)
      • reg.exe (PID: 956)
      • reg.exe (PID: 2904)
      • reg.exe (PID: 3420)
      • reg.exe (PID: 2880)
      • reg.exe (PID: 1748)
      • reg.exe (PID: 3384)
      • reg.exe (PID: 4092)
      • reg.exe (PID: 2716)
      • reg.exe (PID: 3344)
      • reg.exe (PID: 3456)
      • reg.exe (PID: 2904)
      • reg.exe (PID: 3728)
      • reg.exe (PID: 2880)
      • reg.exe (PID: 2388)
      • reg.exe (PID: 3636)
      • reg.exe (PID: 308)
      • reg.exe (PID: 3424)
      • reg.exe (PID: 2864)
      • reg.exe (PID: 1092)
      • reg.exe (PID: 3932)
      • reg.exe (PID: 3880)
      • reg.exe (PID: 3580)
      • reg.exe (PID: 872)
      • reg.exe (PID: 2944)
      • reg.exe (PID: 772)
      • reg.exe (PID: 2948)
      • reg.exe (PID: 1520)
      • reg.exe (PID: 3972)
      • reg.exe (PID: 2548)
      • reg.exe (PID: 308)
      • reg.exe (PID: 2948)
      • reg.exe (PID: 3120)
      • reg.exe (PID: 2816)
      • reg.exe (PID: 1832)
      • reg.exe (PID: 1740)
      • reg.exe (PID: 2604)
      • reg.exe (PID: 3664)
      • reg.exe (PID: 820)
      • reg.exe (PID: 2448)
      • reg.exe (PID: 3192)
      • reg.exe (PID: 3596)
      • reg.exe (PID: 4480)
      • reg.exe (PID: 5312)
      • reg.exe (PID: 820)
      • reg.exe (PID: 3084)
      • reg.exe (PID: 6020)
      • reg.exe (PID: 5580)
      • reg.exe (PID: 4324)
      • reg.exe (PID: 2872)
      • reg.exe (PID: 5140)
      • reg.exe (PID: 6036)
      • reg.exe (PID: 2076)
      • reg.exe (PID: 5176)
      • reg.exe (PID: 6020)
      • reg.exe (PID: 5184)
      • reg.exe (PID: 3792)
      • reg.exe (PID: 4580)
      • reg.exe (PID: 5484)
      • reg.exe (PID: 5684)
      • reg.exe (PID: 4428)
      • reg.exe (PID: 5568)
      • reg.exe (PID: 5876)
      • reg.exe (PID: 4580)
      • reg.exe (PID: 5564)
      • reg.exe (PID: 4792)
      • reg.exe (PID: 4168)
      • reg.exe (PID: 4632)

    • Uses REG.EXE to modify Windows registry

      • cmd.exe (PID: 3740)
      • cmd.exe (PID: 2828)
      • cmd.exe (PID: 3044)
      • javaw.exe (PID: 3368)
      • cmd.exe (PID: 1352)
      • cmd.exe (PID: 3804)
      • cmd.exe (PID: 3872)
      • cmd.exe (PID: 1348)
      • cmd.exe (PID: 3304)
      • cmd.exe (PID: 3744)
      • cmd.exe (PID: 4080)
      • cmd.exe (PID: 4036)
      • cmd.exe (PID: 2660)
      • cmd.exe (PID: 1944)
      • cmd.exe (PID: 2500)
      • cmd.exe (PID: 3588)
      • cmd.exe (PID: 3852)
      • cmd.exe (PID: 2132)
      • cmd.exe (PID: 1876)
      • cmd.exe (PID: 1888)
      • cmd.exe (PID: 3356)
      • cmd.exe (PID: 2064)
      • cmd.exe (PID: 2432)
      • cmd.exe (PID: 4052)
      • cmd.exe (PID: 3556)
      • cmd.exe (PID: 2560)
      • cmd.exe (PID: 3832)
      • cmd.exe (PID: 2740)
      • cmd.exe (PID: 1500)
      • cmd.exe (PID: 2856)
      • cmd.exe (PID: 2424)
      • cmd.exe (PID: 3220)
      • cmd.exe (PID: 2824)
      • cmd.exe (PID: 576)
      • cmd.exe (PID: 3144)
      • cmd.exe (PID: 3576)
      • cmd.exe (PID: 3472)
      • cmd.exe (PID: 1136)
      • cmd.exe (PID: 3104)
      • cmd.exe (PID: 4008)
      • cmd.exe (PID: 1084)
      • cmd.exe (PID: 3428)
      • cmd.exe (PID: 3200)
      • cmd.exe (PID: 3816)
      • cmd.exe (PID: 3720)
      • cmd.exe (PID: 3284)
      • cmd.exe (PID: 2488)
      • cmd.exe (PID: 2128)
      • cmd.exe (PID: 3272)
      • cmd.exe (PID: 3296)
      • cmd.exe (PID: 3876)
      • cmd.exe (PID: 3248)
      • cmd.exe (PID: 3608)
      • cmd.exe (PID: 3992)
      • cmd.exe (PID: 1740)
      • cmd.exe (PID: 2956)
      • cmd.exe (PID: 540)
      • cmd.exe (PID: 3484)
      • cmd.exe (PID: 2636)
      • cmd.exe (PID: 3820)
      • cmd.exe (PID: 2892)
      • cmd.exe (PID: 3100)
      • cmd.exe (PID: 3968)
      • cmd.exe (PID: 3292)
      • cmd.exe (PID: 2056)
      • cmd.exe (PID: 2720)
      • cmd.exe (PID: 2072)
      • cmd.exe (PID: 3452)
      • cmd.exe (PID: 564)
      • cmd.exe (PID: 1688)
      • cmd.exe (PID: 3008)
      • cmd.exe (PID: 3732)
      • cmd.exe (PID: 3840)
      • cmd.exe (PID: 2288)
      • cmd.exe (PID: 3264)
      • cmd.exe (PID: 2772)
      • cmd.exe (PID: 1156)
      • cmd.exe (PID: 1024)
      • cmd.exe (PID: 3088)
      • cmd.exe (PID: 2688)
      • cmd.exe (PID: 2340)
      • cmd.exe (PID: 3452)
      • cmd.exe (PID: 2436)
      • cmd.exe (PID: 2724)
      • cmd.exe (PID: 3488)
      • cmd.exe (PID: 3344)
      • cmd.exe (PID: 340)
      • cmd.exe (PID: 4020)
      • cmd.exe (PID: 2732)
      • cmd.exe (PID: 952)
      • cmd.exe (PID: 3992)
      • cmd.exe (PID: 3360)
      • cmd.exe (PID: 1536)
      • cmd.exe (PID: 3924)
      • cmd.exe (PID: 1912)
      • cmd.exe (PID: 3312)
      • cmd.exe (PID: 3068)
      • cmd.exe (PID: 2576)
      • cmd.exe (PID: 2796)
      • cmd.exe (PID: 2436)
      • cmd.exe (PID: 2756)
      • cmd.exe (PID: 3040)
      • cmd.exe (PID: 2728)
      • cmd.exe (PID: 3076)
      • cmd.exe (PID: 2572)
      • cmd.exe (PID: 1256)
      • cmd.exe (PID: 3460)
      • cmd.exe (PID: 3888)
      • cmd.exe (PID: 2452)
      • cmd.exe (PID: 660)
      • cmd.exe (PID: 912)
      • cmd.exe (PID: 3752)
      • cmd.exe (PID: 1692)
      • cmd.exe (PID: 3020)
      • cmd.exe (PID: 1744)
      • cmd.exe (PID: 2940)
      • cmd.exe (PID: 3976)
      • cmd.exe (PID: 3376)
      • cmd.exe (PID: 2752)
      • cmd.exe (PID: 3972)
      • cmd.exe (PID: 2496)
      • cmd.exe (PID: 620)
      • cmd.exe (PID: 3916)
      • cmd.exe (PID: 2244)
      • cmd.exe (PID: 3384)
      • cmd.exe (PID: 2568)
      • cmd.exe (PID: 3580)
      • cmd.exe (PID: 2600)
      • cmd.exe (PID: 1832)
      • cmd.exe (PID: 3164)
      • cmd.exe (PID: 1748)
      • cmd.exe (PID: 2348)
      • cmd.exe (PID: 2728)
      • cmd.exe (PID: 4056)
      • cmd.exe (PID: 1156)
      • cmd.exe (PID: 2588)
      • cmd.exe (PID: 2120)
      • cmd.exe (PID: 2548)
      • cmd.exe (PID: 2608)
      • cmd.exe (PID: 2336)
      • cmd.exe (PID: 4840)
      • cmd.exe (PID: 3456)
      • cmd.exe (PID: 1504)
      • cmd.exe (PID: 2484)
      • cmd.exe (PID: 5552)
      • cmd.exe (PID: 5104)
      • cmd.exe (PID: 5936)
      • cmd.exe (PID: 4576)
      • cmd.exe (PID: 5192)
      • cmd.exe (PID: 5124)
      • cmd.exe (PID: 2184)
      • cmd.exe (PID: 5748)
      • cmd.exe (PID: 4304)
      • cmd.exe (PID: 4684)
      • cmd.exe (PID: 5544)
      • cmd.exe (PID: 5324)
      • cmd.exe (PID: 6036)
      • cmd.exe (PID: 4156)
      • cmd.exe (PID: 4972)
      • cmd.exe (PID: 2884)
      • cmd.exe (PID: 6008)
      • cmd.exe (PID: 5044)
      • cmd.exe (PID: 5580)
      • cmd.exe (PID: 5744)
      • cmd.exe (PID: 5376)
      • cmd.exe (PID: 4232)
      • cmd.exe (PID: 4328)
      • cmd.exe (PID: 3664)
      • cmd.exe (PID: 4912)
      • cmd.exe (PID: 4484)
      • cmd.exe (PID: 5128)

    • Connects to unusual port

      • javaw.exe (PID: 3368)

    • Uses TASKKILL.EXE to kill process

      • javaw.exe (PID: 3368)

    • Starts CMD.EXE for commands execution

      • javaw.exe (PID: 3368)

    • Writes to a desktop.ini file (may be used to cloak folders)

      • javaw.exe (PID: 3368)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0808
ZipCompression: Deflated
ZipModifyDate: 2020:02:25 19:51:23
ZipCRC: 0x8af85fba
ZipCompressedSize: 395
ZipUncompressedSize: 512
ZipFileName: META-INF/MANIFEST.MF
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
652
Monitored processes
386
Malicious processes
5
Suspicious processes
14

Behavior graph

Click at the process to see the details
start javaw.exe cmd.exe no specs wmic.exe no specs cmd.exe no specs wmic.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs cmd.exe no specs reg.exe no specs wmic.exe no specs cmd.exe no specs reg.exe taskkill.exe reg.exe reg.exe no specs cmd.exe no specs explorer.exe no specs svchost.exe no specs searchprotocolhost.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs reg.exe reg.exe cmd.exe no specs reg.exe no specs cmd.exe no specs taskkill.exe reg.exe no specs cmd.exe no specs reg.exe reg.exe reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs taskkill.exe reg.exe reg.exe cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe reg.exe reg.exe no specs cmd.exe no specs taskkill.exe reg.exe no specs cmd.exe no specs reg.exe no specs reg.exe cmd.exe no specs reg.exe no specs reg.exe cmd.exe no specs reg.exe no specs taskkill.exe cmd.exe no specs reg.exe no specs reg.exe cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs reg.exe cmd.exe no specs reg.exe no specs cmd.exe no specs taskkill.exe reg.exe no specs reg.exe cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs taskkill.exe cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs taskkill.exe cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs taskkill.exe reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs taskkill.exe cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
272reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0017-0411-0000-0000000FF1CE}"C:\Windows\system32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\imm32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\user32.dll
c:\windows\system32\kernelbase.dll
c:\systemroot\system32\ntdll.dll
c:\windows\system32\reg.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
308reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001B-0409-0000-0000000FF1CE}"C:\Windows\system32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
308reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001F-040C-0000-0000000FF1CE}"C:\Windows\system32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\imm32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\usp10.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\kernelbase.dll
c:\systemroot\system32\ntdll.dll
c:\windows\system32\reg.exe
c:\windows\system32\kernel32.dll
332reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0015-0410-0000-0000000FF1CE}"C:\Windows\system32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
340cmd.exeC:\Windows\system32\cmd.exe—javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\imm32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\user32.dll
c:\windows\system32\kernelbase.dll
c:\systemroot\system32\ntdll.dll
c:\windows\system32\cmd.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
372C:\Windows\Explorer.EXEC:\Windows\explorer.exe——
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\winanr.dll
c:\windows\system32\wshtcpip.dll
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
376"C:\Windows\System32\taskkill.exe" /IM "MSASCuiL.exe" /T /FC:\Windows\System32\taskkill.exe
javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msctf.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\conhost.exe
c:\windows\system32\taskkill.exe
c:\systemroot\system32\ntdll.dll
540cmd.exeC:\Windows\system32\cmd.exe—javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
548WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:ListC:\Windows\System32\Wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
564cmd.exeC:\Windows\system32\cmd.exe—javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
2 284
Read events
2 245
Write events
39
Delete events
0

Modification events

(PID) Process:(3548) SearchProtocolHost.exeKey:HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3548) SearchProtocolHost.exeKey:HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:@C:\Windows\System32\ieframe.dll,-912
Value:
HTML Document
(PID) Process:(3548) SearchProtocolHost.exeKey:HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:@C:\Windows\system32\notepad.exe,-469
Value:
Text Document
(PID) Process:(372) explorer.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(372) explorer.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:@C:\Windows\System32\display.dll,-4
Value:
S&creen resolution
(PID) Process:(372) explorer.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:@C:\Program Files\Windows Sidebar\sidebar.exe,-11100
Value:
&Gadgets
(PID) Process:(372) explorer.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:@C:\Windows\system32\themecpl.dll,-10
Value:
Pe&rsonalize
(PID) Process:(3368) javaw.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
Operation:writeName:ZlUNqYe
Value:
"C:\Users\admin\Oracle\bin\javaw.exe" -jar "C:\Users\admin\IueMc\tIKhw.class.txt"
(PID) Process:(3368) javaw.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:ZlUNqYe
Value:
"C:\Users\admin\Oracle\bin\javaw.exe" -jar "C:\Users\admin\IueMc\tIKhw.class.txt"
(PID) Process:(3368) javaw.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
Executable files
108
Suspicious files
10
Text files
65
Unknown types
15

Dropped files

PID
Process
Filename
Type
3368javaw.exeC:\Users\admin\Oracle\bin\client\classes.jsa —
MD5:—
SHA256:—
3368javaw.exeC:\Users\admin\.oracle_jre_usage\90737d32e3abaa4.timestamptext
MD5:—
SHA256:—
3368javaw.exeC:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302019708-1500728564-335382590-1000\83aa4cc77f591dfc2374580bbd95f6ba_90059c37-1320-41a4-b58d-2b75a9850d2fdbf
MD5:C8366AE350E7019AEFC9D1E6E6A498C6
SHA256:11E6ACA8E682C046C83B721EEB5C72C5EF03CB5936C60DF6F4993511DDC61238
3368javaw.exeC:\Users\admin\Oracle\bin\eula.dllexecutable
MD5:6F1188DF337E62427791C77EA36E6EEF
SHA256:DEC4F2F32EDC45F70E7119C9E52C4CEF44BB9AA627DBEC1EE70F61D37468556B
3368javaw.exeC:\Users\admin\Oracle\bin\dt_socket.dllexecutable
MD5:138F156057245747692A68EBE50D52C2
SHA256:F0FD0268D6E410C05E7EE71AD9C96744CD5E4A97329F608041D7078FAEE24ED0
3368javaw.exeC:\Users\admin\Oracle\bin\awt.dllexecutable
MD5:775D4B37E0DDBFA0EB56DB38126FB444
SHA256:E5D4FC7D47A38A389884AF1EA5F06F7C61C5CDE6AFC154A23A3CB5A127DA1E34
3368javaw.exeC:\Users\admin\Oracle\bin\dt_shmem.dllexecutable
MD5:0744E6A5145AA945D89A16EAC835FAB2
SHA256:C417390F681276EC0D55D81A91B87EAE75CA245045F5C23E9B43550B708FB1A6
3368javaw.exeC:\Users\admin\Oracle\bin\dtplugin\deployJava1.dllexecutable
MD5:CBABA29CE7925BAA5B0C45DC78C1A275
SHA256:ADAAA9037BE30C708865A6627DF9C0E43ACF93D100469E5FDF83F632D2FE1829
3368javaw.exeC:\Users\admin\Oracle\bin\glass.dllexecutable
MD5:BE9D67DFFCC06D2073831F5D8CDE2DC0
SHA256:A92DF0E1F93E29FAE427DA766D9B91BDA4B421E6AB86AEB9CDD060B218028D35
3368javaw.exeC:\Users\admin\Oracle\bin\glib-lite.dllexecutable
MD5:7AB8AFD789E45C2D08CBC3233DAEC0BF
SHA256:465541EF4E9337108B375984C23F5D31E6C060FED16820BB9BC5AF79A2109EAC
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
1
Threats
1

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3368
javaw.exe
118.100.66.100:4424
dman20.ddns.net
TM Net, Internet Service Provider
MY
unknown

DNS requests

Domain
IP
Reputation
dman20.ddns.net
  • 118.100.66.100
unknown

Threats

PID
Process
Class
Message
1052
svchost.exe
Potentially Bad Traffic
ET POLICY DNS Query to DynDNS Domain *.ddns .net
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
11.1.jar