analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

11.1.jar

Full analysis: https://app.any.run/tasks/f49d869e-91ae-4c39-ba63-59bc24b5a8e9
Verdict: Malicious activity
Analysis date: February 25, 2020, 13:00:45
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/java-archive
File info: Java archive data (JAR)
MD5:

5505EC151916D81CE0B065926DFE8005

SHA1:

FFC51A2A73F0C230856BCA0BE0E3675652EF3E92

SHA256:

63D05D8545F0604EC104DFF8E07F889D1A15CCFEF10A3C65B1A7C73DF02FF8EA

SSDEEP:

6144:FQu7BUkU8Xwat1+OIiYid4yaqM4z5li2NXocOKU95SNWpw8OFHVZfWAoynHv+Edb:ZtrUmzt1ZI3mq4zPi2BRUCWpwzF1Eynl

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • javaw.exe (PID: 3368)
      • explorer.exe (PID: 372)
      • svchost.exe (PID: 796)
      • SearchProtocolHost.exe (PID: 3548)

    • Changes the autorun value in the registry

      • javaw.exe (PID: 3368)

    • Runs app for hidden code execution

      • javaw.exe (PID: 3368)

    • Application was dropped or rewritten from another process

      • javaw.exe (PID: 3368)

    • Changes Image File Execution Options

      • reg.exe (PID: 3052)
      • reg.exe (PID: 2592)
      • reg.exe (PID: 1712)
      • reg.exe (PID: 3424)
      • reg.exe (PID: 2540)
      • reg.exe (PID: 2580)
      • reg.exe (PID: 576)
      • reg.exe (PID: 3528)
      • reg.exe (PID: 3316)
      • reg.exe (PID: 3332)

    • Disables Windows Defender

      • reg.exe (PID: 4040)
      • reg.exe (PID: 1836)
      • reg.exe (PID: 3848)
      • reg.exe (PID: 4068)

  • SUSPICIOUS

    • Uses WMIC.EXE to obtain a list of AntiViruses

      • cmd.exe (PID: 2876)

    • Uses WMIC.EXE to obtain a system information

      • cmd.exe (PID: 2876)
      • cmd.exe (PID: 2836)
      • cmd.exe (PID: 3800)

    • Creates files in the user directory

      • javaw.exe (PID: 3368)

    • Executes JAVA applets

      • explorer.exe (PID: 372)

    • Uses WMIC.EXE to obtain a list of Firewalls

      • cmd.exe (PID: 2836)

    • Uses ATTRIB.EXE to modify file attributes

      • javaw.exe (PID: 3368)

    • Executable content was dropped or overwritten

      • javaw.exe (PID: 3368)

    • Uses REG.EXE to modify Windows registry

      • cmd.exe (PID: 4052)
      • cmd.exe (PID: 3740)
      • cmd.exe (PID: 3220)
      • cmd.exe (PID: 3556)
      • cmd.exe (PID: 2824)
      • cmd.exe (PID: 2828)
      • cmd.exe (PID: 3044)
      • cmd.exe (PID: 1352)
      • cmd.exe (PID: 3872)
      • javaw.exe (PID: 3368)
      • cmd.exe (PID: 3744)
      • cmd.exe (PID: 1348)
      • cmd.exe (PID: 3804)
      • cmd.exe (PID: 4080)
      • cmd.exe (PID: 4036)
      • cmd.exe (PID: 3304)
      • cmd.exe (PID: 2660)
      • cmd.exe (PID: 3852)
      • cmd.exe (PID: 1944)
      • cmd.exe (PID: 3588)
      • cmd.exe (PID: 2500)
      • cmd.exe (PID: 1876)
      • cmd.exe (PID: 1888)
      • cmd.exe (PID: 3356)
      • cmd.exe (PID: 2132)
      • cmd.exe (PID: 2064)
      • cmd.exe (PID: 2432)
      • cmd.exe (PID: 2740)
      • cmd.exe (PID: 2560)
      • cmd.exe (PID: 3832)
      • cmd.exe (PID: 2424)
      • cmd.exe (PID: 2856)
      • cmd.exe (PID: 1500)
      • cmd.exe (PID: 3144)
      • cmd.exe (PID: 3428)
      • cmd.exe (PID: 1084)
      • cmd.exe (PID: 576)
      • cmd.exe (PID: 1136)
      • cmd.exe (PID: 3472)
      • cmd.exe (PID: 3576)
      • cmd.exe (PID: 3104)
      • cmd.exe (PID: 3720)
      • cmd.exe (PID: 3284)
      • cmd.exe (PID: 4008)
      • cmd.exe (PID: 3816)
      • cmd.exe (PID: 2128)
      • cmd.exe (PID: 3200)
      • cmd.exe (PID: 3296)
      • cmd.exe (PID: 2488)
      • cmd.exe (PID: 3876)
      • cmd.exe (PID: 2636)
      • cmd.exe (PID: 3272)
      • cmd.exe (PID: 3992)
      • cmd.exe (PID: 3608)
      • cmd.exe (PID: 2956)
      • cmd.exe (PID: 540)
      • cmd.exe (PID: 1740)
      • cmd.exe (PID: 3248)
      • cmd.exe (PID: 3484)
      • cmd.exe (PID: 2892)
      • cmd.exe (PID: 3820)
      • cmd.exe (PID: 2056)
      • cmd.exe (PID: 3100)
      • cmd.exe (PID: 3292)
      • cmd.exe (PID: 3968)
      • cmd.exe (PID: 1688)
      • cmd.exe (PID: 564)
      • cmd.exe (PID: 2720)
      • cmd.exe (PID: 3452)
      • cmd.exe (PID: 3088)
      • cmd.exe (PID: 2072)
      • cmd.exe (PID: 2772)
      • cmd.exe (PID: 3008)
      • cmd.exe (PID: 3840)
      • cmd.exe (PID: 3264)
      • cmd.exe (PID: 3732)
      • cmd.exe (PID: 2288)
      • cmd.exe (PID: 1024)
      • cmd.exe (PID: 1156)
      • cmd.exe (PID: 3344)
      • cmd.exe (PID: 2340)
      • cmd.exe (PID: 2732)
      • cmd.exe (PID: 2688)
      • cmd.exe (PID: 2724)
      • cmd.exe (PID: 3488)
      • cmd.exe (PID: 3452)
      • cmd.exe (PID: 2436)
      • cmd.exe (PID: 340)
      • cmd.exe (PID: 4020)
      • cmd.exe (PID: 2576)
      • cmd.exe (PID: 3992)
      • cmd.exe (PID: 952)
      • cmd.exe (PID: 2796)
      • cmd.exe (PID: 3924)
      • cmd.exe (PID: 1536)
      • cmd.exe (PID: 1912)
      • cmd.exe (PID: 3312)
      • cmd.exe (PID: 3360)
      • cmd.exe (PID: 3068)
      • cmd.exe (PID: 2756)
      • cmd.exe (PID: 2728)
      • cmd.exe (PID: 2436)
      • cmd.exe (PID: 3040)
      • cmd.exe (PID: 3076)
      • cmd.exe (PID: 2572)
      • cmd.exe (PID: 1256)
      • cmd.exe (PID: 3376)
      • cmd.exe (PID: 3888)
      • cmd.exe (PID: 2452)
      • cmd.exe (PID: 3460)
      • cmd.exe (PID: 912)
      • cmd.exe (PID: 660)
      • cmd.exe (PID: 3752)
      • cmd.exe (PID: 2940)
      • cmd.exe (PID: 1692)
      • cmd.exe (PID: 1744)
      • cmd.exe (PID: 3020)
      • cmd.exe (PID: 3976)
      • cmd.exe (PID: 2752)
      • cmd.exe (PID: 3972)
      • cmd.exe (PID: 2568)
      • cmd.exe (PID: 2496)
      • cmd.exe (PID: 620)
      • cmd.exe (PID: 3916)
      • cmd.exe (PID: 2244)
      • cmd.exe (PID: 3384)
      • cmd.exe (PID: 1156)
      • cmd.exe (PID: 3580)
      • cmd.exe (PID: 2600)
      • cmd.exe (PID: 4056)
      • cmd.exe (PID: 2728)
      • cmd.exe (PID: 1832)
      • cmd.exe (PID: 2348)
      • cmd.exe (PID: 3164)
      • cmd.exe (PID: 1748)
      • cmd.exe (PID: 1504)
      • cmd.exe (PID: 2120)
      • cmd.exe (PID: 3456)
      • cmd.exe (PID: 2588)
      • cmd.exe (PID: 2484)
      • cmd.exe (PID: 2548)
      • cmd.exe (PID: 2336)
      • cmd.exe (PID: 5748)
      • cmd.exe (PID: 2608)
      • cmd.exe (PID: 4840)
      • cmd.exe (PID: 5552)
      • cmd.exe (PID: 4304)
      • cmd.exe (PID: 5104)
      • cmd.exe (PID: 5936)
      • cmd.exe (PID: 5192)
      • cmd.exe (PID: 4576)
      • cmd.exe (PID: 2184)
      • cmd.exe (PID: 5124)
      • cmd.exe (PID: 5044)
      • cmd.exe (PID: 4684)
      • cmd.exe (PID: 5580)
      • cmd.exe (PID: 6036)
      • cmd.exe (PID: 5544)
      • cmd.exe (PID: 5324)
      • cmd.exe (PID: 4156)
      • cmd.exe (PID: 6008)
      • cmd.exe (PID: 2884)
      • cmd.exe (PID: 4972)
      • cmd.exe (PID: 4484)
      • cmd.exe (PID: 5744)
      • cmd.exe (PID: 5128)
      • cmd.exe (PID: 4232)
      • cmd.exe (PID: 5376)
      • cmd.exe (PID: 4328)
      • cmd.exe (PID: 3664)
      • cmd.exe (PID: 4912)

    • Connects to unusual port

      • javaw.exe (PID: 3368)

    • Writes to a desktop.ini file (may be used to cloak folders)

      • javaw.exe (PID: 3368)

    • Searches for installed software

      • reg.exe (PID: 2988)
      • reg.exe (PID: 3872)
      • reg.exe (PID: 2692)
      • reg.exe (PID: 1488)
      • reg.exe (PID: 2356)
      • reg.exe (PID: 1488)
      • reg.exe (PID: 956)
      • reg.exe (PID: 3012)
      • reg.exe (PID: 3884)
      • reg.exe (PID: 3276)
      • reg.exe (PID: 3200)
      • reg.exe (PID: 3600)
      • reg.exe (PID: 2056)
      • reg.exe (PID: 2580)
      • reg.exe (PID: 1504)
      • reg.exe (PID: 3316)
      • reg.exe (PID: 3300)
      • reg.exe (PID: 3984)
      • reg.exe (PID: 3484)
      • reg.exe (PID: 1844)
      • reg.exe (PID: 3488)
      • reg.exe (PID: 3584)
      • reg.exe (PID: 3400)
      • reg.exe (PID: 3968)
      • reg.exe (PID: 3820)
      • reg.exe (PID: 2744)
      • reg.exe (PID: 3576)
      • reg.exe (PID: 3824)
      • reg.exe (PID: 3068)
      • reg.exe (PID: 1928)
      • reg.exe (PID: 3776)
      • reg.exe (PID: 332)
      • reg.exe (PID: 2428)
      • reg.exe (PID: 3084)
      • reg.exe (PID: 772)
      • reg.exe (PID: 2492)
      • reg.exe (PID: 3460)
      • reg.exe (PID: 2708)
      • reg.exe (PID: 4056)
      • reg.exe (PID: 2464)
      • reg.exe (PID: 3916)
      • reg.exe (PID: 3716)
      • reg.exe (PID: 2596)
      • reg.exe (PID: 1524)
      • reg.exe (PID: 3624)
      • reg.exe (PID: 3308)
      • reg.exe (PID: 2388)
      • reg.exe (PID: 2720)
      • reg.exe (PID: 4092)
      • reg.exe (PID: 1092)
      • reg.exe (PID: 2716)
      • reg.exe (PID: 2944)
      • reg.exe (PID: 272)
      • reg.exe (PID: 3860)
      • reg.exe (PID: 3308)
      • reg.exe (PID: 3756)
      • reg.exe (PID: 3100)
      • reg.exe (PID: 620)
      • reg.exe (PID: 1692)
      • reg.exe (PID: 3960)
      • reg.exe (PID: 3976)
      • reg.exe (PID: 2120)
      • reg.exe (PID: 2076)
      • reg.exe (PID: 2960)
      • reg.exe (PID: 2348)
      • reg.exe (PID: 3860)
      • reg.exe (PID: 3076)
      • reg.exe (PID: 1536)
      • reg.exe (PID: 3420)
      • reg.exe (PID: 2140)
      • reg.exe (PID: 2320)
      • reg.exe (PID: 3756)
      • reg.exe (PID: 956)
      • reg.exe (PID: 2564)
      • reg.exe (PID: 2904)
      • reg.exe (PID: 2880)
      • reg.exe (PID: 3160)
      • reg.exe (PID: 2904)
      • reg.exe (PID: 4092)
      • reg.exe (PID: 1748)
      • reg.exe (PID: 3384)
      • reg.exe (PID: 2716)
      • reg.exe (PID: 3728)
      • reg.exe (PID: 3344)
      • reg.exe (PID: 3932)
      • reg.exe (PID: 3456)
      • reg.exe (PID: 1092)
      • reg.exe (PID: 3880)
      • reg.exe (PID: 2880)
      • reg.exe (PID: 2388)
      • reg.exe (PID: 3636)
      • reg.exe (PID: 1520)
      • reg.exe (PID: 2864)
      • reg.exe (PID: 308)
      • reg.exe (PID: 3580)
      • reg.exe (PID: 3424)
      • reg.exe (PID: 2944)
      • reg.exe (PID: 872)
      • reg.exe (PID: 772)
      • reg.exe (PID: 3972)
      • reg.exe (PID: 2948)
      • reg.exe (PID: 1832)
      • reg.exe (PID: 308)
      • reg.exe (PID: 1740)
      • reg.exe (PID: 2948)
      • reg.exe (PID: 3120)
      • reg.exe (PID: 2604)
      • reg.exe (PID: 2816)
      • reg.exe (PID: 2548)
      • reg.exe (PID: 820)
      • reg.exe (PID: 820)
      • reg.exe (PID: 3664)
      • reg.exe (PID: 3084)
      • reg.exe (PID: 2448)
      • reg.exe (PID: 3192)
      • reg.exe (PID: 3596)
      • reg.exe (PID: 5176)
      • reg.exe (PID: 4480)
      • reg.exe (PID: 5312)
      • reg.exe (PID: 6020)
      • reg.exe (PID: 5580)
      • reg.exe (PID: 5140)
      • reg.exe (PID: 4324)
      • reg.exe (PID: 6036)
      • reg.exe (PID: 2076)
      • reg.exe (PID: 2872)
      • reg.exe (PID: 5184)
      • reg.exe (PID: 5568)
      • reg.exe (PID: 6020)
      • reg.exe (PID: 5484)
      • reg.exe (PID: 4580)
      • reg.exe (PID: 3792)
      • reg.exe (PID: 5684)
      • reg.exe (PID: 4428)
      • reg.exe (PID: 4792)
      • reg.exe (PID: 4168)
      • reg.exe (PID: 4632)
      • reg.exe (PID: 5876)
      • reg.exe (PID: 4580)
      • reg.exe (PID: 5564)

    • Uses TASKKILL.EXE to kill process

      • javaw.exe (PID: 3368)

    • Starts CMD.EXE for commands execution

      • javaw.exe (PID: 3368)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: META-INF/MANIFEST.MF
ZipUncompressedSize: 512
ZipCompressedSize: 395
ZipCRC: 0x8af85fba
ZipModifyDate: 2020:02:25 19:51:23
ZipCompression: Deflated
ZipBitFlag: 0x0808
ZipRequiredVersion: 20
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
652
Monitored processes
386
Malicious processes
5
Suspicious processes
14

Behavior graph

Click at the process to see the details
start javaw.exe cmd.exe no specs wmic.exe no specs cmd.exe no specs wmic.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs cmd.exe no specs reg.exe no specs wmic.exe no specs cmd.exe no specs taskkill.exe reg.exe reg.exe reg.exe no specs cmd.exe no specs svchost.exe no specs explorer.exe no specs searchprotocolhost.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs reg.exe reg.exe cmd.exe no specs reg.exe no specs cmd.exe no specs taskkill.exe reg.exe no specs cmd.exe no specs reg.exe reg.exe reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe taskkill.exe reg.exe reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe reg.exe reg.exe no specs cmd.exe no specs taskkill.exe reg.exe no specs cmd.exe no specs reg.exe no specs reg.exe cmd.exe no specs reg.exe no specs reg.exe cmd.exe no specs reg.exe no specs taskkill.exe cmd.exe no specs reg.exe no specs reg.exe cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs reg.exe cmd.exe no specs reg.exe no specs cmd.exe no specs taskkill.exe reg.exe no specs reg.exe cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs taskkill.exe cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs taskkill.exe cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs taskkill.exe reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs taskkill.exe cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3368"C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe" -jar "C:\Users\admin\AppData\Local\Temp\11.1.jar.zip"C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe
explorer.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Version:
8.0.920.14
2876cmd.exeC:\Windows\system32\cmd.exe—javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
548WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:ListC:\Windows\System32\Wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2836cmd.exeC:\Windows\system32\cmd.exe—javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
1332WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /Format:ListC:\Windows\System32\Wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2856attrib +h C:\Users\admin\OracleC:\Windows\system32\attrib.exe—javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Attribute Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2788attrib +h +r +s C:\Users\admin\.ntusernt.iniC:\Windows\system32\attrib.exe—javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Attribute Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
4012attrib -s -r C:\Users\admin\IueMc\Desktop.iniC:\Windows\system32\attrib.exe—javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Attribute Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2748attrib +s +r C:\Users\admin\IueMc\Desktop.iniC:\Windows\system32\attrib.exe—javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Attribute Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2516attrib -s -r C:\Users\admin\IueMcC:\Windows\system32\attrib.exe—javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Attribute Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
2 284
Read events
2 245
Write events
0
Delete events
0

Modification events

No data
Executable files
108
Suspicious files
10
Text files
65
Unknown types
15

Dropped files

PID
Process
Filename
Type
3368javaw.exeC:\Users\admin\Oracle\bin\client\classes.jsa —
MD5:—
SHA256:—
3368javaw.exeC:\Users\admin\.oracle_jre_usage\90737d32e3abaa4.timestamptext
MD5:D7E7A1E50F3B7FD60BFD7D33B3CB1394
SHA256:B86426B8484D329FFB09A07F7F53E6EBCEC26798A3ED654EFB2D8F9035D90C18
3368javaw.exeC:\Users\admin\Oracle\bin\client\Xusage.txttext
MD5:B3174769A9E9E654812315468AE9C5FA
SHA256:37CF4E6CDC4357CEBB0EC8108D5CB0AD42611F675B926C819AE03B74CE990A08
3368javaw.exeC:\Users\admin\Oracle\bin\glass.dllexecutable
MD5:BE9D67DFFCC06D2073831F5D8CDE2DC0
SHA256:A92DF0E1F93E29FAE427DA766D9B91BDA4B421E6AB86AEB9CDD060B218028D35
3368javaw.exeC:\Users\admin\Oracle\bin\fontmanager.dllexecutable
MD5:412B97D96EA9384C78851938921EE44A
SHA256:20BEF5BCD523CFF21BAD585AF91D1C913D5535A6B20AC70F5F3D8DAFB2F90F25
3368javaw.exeC:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302019708-1500728564-335382590-1000\83aa4cc77f591dfc2374580bbd95f6ba_90059c37-1320-41a4-b58d-2b75a9850d2fdbf
MD5:C8366AE350E7019AEFC9D1E6E6A498C6
SHA256:11E6ACA8E682C046C83B721EEB5C72C5EF03CB5936C60DF6F4993511DDC61238
3368javaw.exeC:\Users\admin\Oracle\bin\deploy.dllexecutable
MD5:720EDC1469525DFCD3AE211E653D0241
SHA256:BFF79FB05667992CC2BDA9BAE6E5A301BAF553042F952203641CCD7E1FC4552D
3368javaw.exeC:\Users\admin\Oracle\bin\dcpr.dllexecutable
MD5:682CFD9431E5675900B04FEBE6CD4EB9
SHA256:80111E1D706741F5EF7F661835C3AA46664666425AA1B5F93103410F2BEE1213
3368javaw.exeC:\Users\admin\Oracle\bin\decora_sse.dllexecutable
MD5:94434B8739CB5CD184C63CEC209F06E2
SHA256:ADF4E9CE0866FF16A16F626CFC62355FB81212B1E7C95DD908E3644F88B77E91
3368javaw.exeC:\Users\admin\Oracle\bin\dt_socket.dllexecutable
MD5:138F156057245747692A68EBE50D52C2
SHA256:F0FD0268D6E410C05E7EE71AD9C96744CD5E4A97329F608041D7078FAEE24ED0
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3368
javaw.exe
118.100.66.100:4424
dman20.ddns.net
TM Net, Internet Service Provider
MY
unknown

DNS requests

Domain
IP
Reputation
dman20.ddns.net
  • 118.100.66.100
unknown

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET POLICY DNS Query to DynDNS Domain *.ddns .net
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
11.1.jar