Analysis Report

Overview

General Information

Joe Sandbox Version:	20.0.0
Analysis ID:	353368
Start time:	09:40:14
Joe Sandbox Product:	Cloud
Start date:	31.08.2017
Overall analysis duration:	0h 15m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	75Doc 0.26777400 15041397050000000jpg.jar
Cookbook file name:	default.jbs
Analysis system description:	Windows 7 (Office 2010 v14.0.4, Java 1.8.0_40, Flash 16.0.0.305, Acrobat Reader 11.0.08, Internet Explorer 11, Chrome 55, Firefox 43)
Number of analysed new started processes analysed:	40
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies	HCA enabled EGA enabled VBA Instrumentation enabled JavaScript Instrumentation enabled
Detection:	MAL
Classification:	mal92.evad.expl.troj.winJAR@152/348@0/3
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
EGA Information:	Failed
Cookbook Comments:	Sleeps bigger than 20000ms are automatically reduced to 500ms Found application associated with file extension: .jar
Warnings:	Show All Exclude process from analysis (whitelisted): mscorsvw.exe, sppsvc.exe, conhost.exe, dllhost.exe Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtQueryVolumeInformationFile calls found. Report size getting too big, too many NtReadFile calls found. Report size getting too big, too many NtSetInformationFile calls found. Skipping Hybrid Code Analysis (implementation is based on Java, .Net, VB or Delphi, or parses a document) for: java.exe, java.exe, javaw.exe, java.exe

Detection

Strategy	Score	Range	Reporting	Detection
Threshold	92	0 - 100	Report FP / FN

Confidence

Strategy	Score	Range	Further Analysis Required?	Confidence
Threshold	5	0 - 5	false

Classification

Analysis Advice

Sample drops PE files which have not been started, submit dropped PE samples for a secondary analysis to Joe Sandbox

Signature Overview

Click to jump to signature section

DDoS:

Too many similar processes found

Show sources

Source: unknown

Process created: 92

Software Vulnerabilities:

Exploit detected, runtime environment starts unknown processes

Show sources

Source: C:\Program Files\Java\jre1.8.0_40\bin\java.exe

Process created: C:\Windows\System32\cmd.exe

Networking:

Urls found in memory or binary data

Show sources

Source: java.exe	String found in binary or memory: file://
Source: javaw.exe	String found in binary or memory: file:///
Source: java.exe	String found in binary or memory: file:///c:/program%20files/java/jre1.8.0_40/lib/charsets.jar
Source: java.exe	String found in binary or memory: file:///c:/program%20files/java/jre1.8.0_40/lib/ext/access-bridge.jar
Source: java.exe	String found in binary or memory: file:///c:/program%20files/java/jre1.8.0_40/lib/ext/cldrdata.jar
Source: java.exe	String found in binary or memory: file:///c:/program%20files/java/jre1.8.0_40/lib/ext/dnsns.jar
Source: java.exe	String found in binary or memory: file:///c:/program%20files/java/jre1.8.0_40/lib/ext/jaccess.jar
Source: java.exe	String found in binary or memory: file:///c:/program%20files/java/jre1.8.0_40/lib/ext/jfxrt.jar
Source: java.exe	String found in binary or memory: file:///c:/program%20files/java/jre1.8.0_40/lib/ext/localedata.jar
Source: java.exe	String found in binary or memory: file:///c:/program%20files/java/jre1.8.0_40/lib/ext/nashorn.jar
Source: java.exe	String found in binary or memory: file:///c:/program%20files/java/jre1.8.0_40/lib/ext/sunec.jar
Source: java.exe	String found in binary or memory: file:///c:/program%20files/java/jre1.8.0_40/lib/ext/sunjce_provider.jar
Source: java.exe	String found in binary or memory: file:///c:/program%20files/java/jre1.8.0_40/lib/ext/sunmscapi.jar
Source: java.exe	String found in binary or memory: file:///c:/program%20files/java/jre1.8.0_40/lib/ext/sunpkcs11.jar
Source: java.exe	String found in binary or memory: file:///c:/program%20files/java/jre1.8.0_40/lib/ext/zipfs.jar
Source: java.exe	String found in binary or memory: file:///c:/program%20files/java/jre1.8.0_40/lib/jce.jar
Source: java.exe	String found in binary or memory: file:///c:/program%20files/java/jre1.8.0_40/lib/jfr.jar
Source: java.exe	String found in binary or memory: file:///c:/program%20files/java/jre1.8.0_40/lib/jsse.jar
Source: java.exe	String found in binary or memory: file:///c:/program%20files/java/jre1.8.0_40/lib/resources.jar
Source: java.exe	String found in binary or memory: file:///c:/program%20files/java/jre1.8.0_40/lib/rt.jar
Source: java.exe	String found in binary or memory: file:///c:/users/user/appdata/local/temp/_0.4312212827200392546983382786626386.class
Source: javaw.exe	String found in binary or memory: file:///c:/users/user/appdata/roaming/oracle/lib/charsets.jar
Source: javaw.exe	String found in binary or memory: file:///c:/users/user/appdata/roaming/oracle/lib/ext/access-bridge.jar
Source: javaw.exe	String found in binary or memory: file:///c:/users/user/appdata/roaming/oracle/lib/ext/cldrdata.jar
Source: javaw.exe	String found in binary or memory: file:///c:/users/user/appdata/roaming/oracle/lib/ext/dnsns.jar
Source: javaw.exe	String found in binary or memory: file:///c:/users/user/appdata/roaming/oracle/lib/ext/jaccess.jar
Source: javaw.exe	String found in binary or memory: file:///c:/users/user/appdata/roaming/oracle/lib/ext/jfxrt.jar
Source: javaw.exe	String found in binary or memory: file:///c:/users/user/appdata/roaming/oracle/lib/ext/localedata.jar
Source: javaw.exe	String found in binary or memory: file:///c:/users/user/appdata/roaming/oracle/lib/ext/nashorn.jar
Source: javaw.exe	String found in binary or memory: file:///c:/users/user/appdata/roaming/oracle/lib/ext/sunec.jar
Source: javaw.exe	String found in binary or memory: file:///c:/users/user/appdata/roaming/oracle/lib/ext/sunjce_provider.jar
Source: javaw.exe	String found in binary or memory: file:///c:/users/user/appdata/roaming/oracle/lib/ext/sunmscapi.jar
Source: javaw.exe	String found in binary or memory: file:///c:/users/user/appdata/roaming/oracle/lib/ext/sunpkcs11.jar
Source: javaw.exe	String found in binary or memory: file:///c:/users/user/appdata/roaming/oracle/lib/ext/zipfs.jar
Source: javaw.exe	String found in binary or memory: file:///c:/users/user/appdata/roaming/oracle/lib/jce.jar
Source: javaw.exe	String found in binary or memory: file:///c:/users/user/appdata/roaming/oracle/lib/jfr.jar
Source: javaw.exe	String found in binary or memory: file:///c:/users/user/appdata/roaming/oracle/lib/jsse.jar
Source: javaw.exe	String found in binary or memory: file:///c:/users/user/appdata/roaming/oracle/lib/resources.jar
Source: javaw.exe	String found in binary or memory: file:///c:/users/user/appdata/roaming/oracle/lib/rt.jar
Source: java.exe	String found in binary or memory: file:///c:/users/user/desktop/75doc%200.26777400%2015041
Source: java.exe	String found in binary or memory: file:///c:/users/user/desktop/75doc%200.26777400%2015041397050000000jpg.jar
Source: javaw.exe	String found in binary or memory: file:///c:/users/user/eddlsovkfgw/aknzqikoykh.qmsbqy
Source: javaw.exe	String found in binary or memory: http://apache.org/xml/features/
Source: javaw.exe	String found in binary or memory: http://apache.org/xml/features/3
Source: javaw.exe	String found in binary or memory: http://apache.org/xml/features/allow-java-encodings
Source: javaw.exe	String found in binary or memory: http://apache.org/xml/features/continue-after-fatal-error
Source: java.exe	String found in binary or memory: http://apache.org/xml/features/continue-after-fatal-error8
Source: java.exe, javaw.exe	String found in binary or memory: http://apache.org/xml/features/continue-after-fatal-error=
Source: javaw.exe	String found in binary or memory: http://apache.org/xml/features/create-cdata-nodes
Source: javaw.exe	String found in binary or memory: http://apache.org/xml/features/disallow-doctype-decl
Source: javaw.exe	String found in binary or memory: http://apache.org/xml/features/dom/create-entity-ref-nodes
Source: javaw.exe	String found in binary or memory: http://apache.org/xml/features/dom/defer-node-expansion
Source: java.exe, javaw.exe	String found in binary or memory: http://apache.org/xml/features/dom/defer-node-expansion9
Source: javaw.exe	String found in binary or memory: http://apache.org/xml/features/dom/include-ignorable-whitespace
Source: java.exe, javaw.exe	String found in binary or memory: http://apache.org/xml/features/dom/include-ignorable-whitespace/
Source: javaw.exe	String found in binary or memory: http://apache.org/xml/features/generate-synthetic-annotations
Source: java.exe, javaw.exe	String found in binary or memory: http://apache.org/xml/features/generate-synthetic-annotations9
Source: java.exe	String found in binary or memory: http://apache.org/xml/features/generate-synthetic-annotationsh
Source: java.exe, javaw.exe	String found in binary or memory: http://apache.org/xml/features/honour-all-schemalocations
Source: javaw.exe	String found in binary or memory: http://apache.org/xml/features/honour-all-schemalocationsxs
Source: javaw.exe	String found in binary or memory: http://apache.org/xml/features/include-comments
Source: java.exe, javaw.exe	String found in binary or memory: http://apache.org/xml/features/include-comments0
Source: javaw.exe	String found in binary or memory: http://apache.org/xml/features/internal/parser-settings
Source: java.exe, javaw.exe	String found in binary or memory: http://apache.org/xml/features/internal/parser-settings7
Source: javaw.exe	String found in binary or memory: http://apache.org/xml/features/internal/tolerate-duplicates
Source: javaw.exe	String found in binary or memory: http://apache.org/xml/features/internal/validation/schema/use-grammar-pool-only
Source: java.exe	String found in binary or memory: http://apache.org/xml/features/internal/validation/schema/use-grammar-pool-only/
Source: javaw.exe	String found in binary or memory: http://apache.org/xml/features/namespace-growth
Source: javaw.exe	String found in binary or memory: http://apache.org/xml/features/nonvalidating/load-external-dtd
Source: java.exe, javaw.exe	String found in binary or memory: http://apache.org/xml/features/nonvalidating/load-external-dtd:
Source: javaw.exe	String found in binary or memory: http://apache.org/xml/features/scanner/notify-builtin-refs
Source: java.exe, javaw.exe	String found in binary or memory: http://apache.org/xml/features/scanner/notify-builtin-refs7
Source: javaw.exe	String found in binary or memory: http://apache.org/xml/features/scanner/notify-char-refs
Source: javaw.exe	String found in binary or memory: http://apache.org/xml/features/scanner/notify-char-refs3
Source: java.exe, javaw.exe	String found in binary or memory: http://apache.org/xml/features/standard-uri-conformant
Source: java.exe	String found in binary or memory: http://apache.org/xml/features/standard-uri-conformant2
Source: javaw.exe	String found in binary or memory: http://apache.org/xml/features/standard-uri-conformantan2
Source: java.exe	String found in binary or memory: http://apache.org/xml/features/standard-uri-conformants:2
Source: javaw.exe	String found in binary or memory: http://apache.org/xml/features/validate-annotations
Source: javaw.exe	String found in binary or memory: http://apache.org/xml/features/validation/balance-syntax-trees
Source: java.exe	String found in binary or memory: http://apache.org/xml/features/validation/balance-syntax-trees-r1
Source: java.exe, javaw.exe	String found in binary or memory: http://apache.org/xml/features/validation/balance-syntax-trees1
Source: javaw.exe	String found in binary or memory: http://apache.org/xml/features/validation/dynamic
Source: java.exe	String found in binary or memory: http://apache.org/xml/features/validation/dynamicr
Source: javaw.exe	String found in binary or memory: http://apache.org/xml/features/validation/schema
Source: javaw.exe	String found in binary or memory: http://apache.org/xml/features/validation/schema-full-checking
Source: java.exe	String found in binary or memory: http://apache.org/xml/features/validation/schema-full-checking=
Source: java.exe	String found in binary or memory: http://apache.org/xml/features/validation/schema-full-checkingq
Source: javaw.exe	String found in binary or memory: http://apache.org/xml/features/validation/schema/augment-psvi
Source: java.exe	String found in binary or memory: http://apache.org/xml/features/validation/schema/augment-psvicq
Source: java.exe, javaw.exe	String found in binary or memory: http://apache.org/xml/features/validation/schema/element-default
Source: java.exe, javaw.exe	String found in binary or memory: http://apache.org/xml/features/validation/schema/element-defaulta
Source: javaw.exe	String found in binary or memory: http://apache.org/xml/features/validation/schema/normalized-value
Source: java.exe	String found in binary or memory: http://apache.org/xml/features/validation/schema/normalized-value-q
Source: java.exe	String found in binary or memory: http://apache.org/xml/features/validation/schema/normalized-valueb
Source: javaw.exe	String found in binary or memory: http://apache.org/xml/features/validation/warn-on-duplicate-attdef
Source: javaw.exe	String found in binary or memory: http://apache.org/xml/features/validation/warn-on-undeclared-elemdef
Source: java.exe, javaw.exe	String found in binary or memory: http://apache.org/xml/features/validation/warn-on-undeclared-elemdef:
Source: javaw.exe	String found in binary or memory: http://apache.org/xml/features/warn-on-duplicate-entitydef
Source: javaw.exe	String found in binary or memory: http://apache.org/xml/features/xinclude
Source: javaw.exe	String found in binary or memory: http://apache.org/xml/features/xinclude/fixup-base-uris
Source: java.exe, javaw.exe	String found in binary or memory: http://apache.org/xml/features/xinclude/fixup-base-uris6
Source: javaw.exe	String found in binary or memory: http://apache.org/xml/features/xinclude/fixup-language
Source: java.exe, javaw.exe	String found in binary or memory: http://apache.org/xml/features/xinclude/fixup-language;
Source: java.exe, javaw.exe	String found in binary or memory: http://apache.org/xml/features/xinclude1
Source: java.exe, javaw.exe	String found in binary or memory: http://apache.org/xml/properties/
Source: javaw.exe	String found in binary or memory: http://apache.org/xml/properties/-s
Source: javaw.exe	String found in binary or memory: http://apache.org/xml/properties/dom/current-element-node
Source: java.exe	String found in binary or memory: http://apache.org/xml/properties/dom/current-element-node9
Source: java.exe, javaw.exe	String found in binary or memory: http://apache.org/xml/properties/dom/document-class-name
Source: java.exe, javaw.exe	String found in binary or memory: http://apache.org/xml/properties/dom/document-class-name$
Source: java.exe, javaw.exe	String found in binary or memory: http://apache.org/xml/properties/input-buffer-size
Source: javaw.exe	String found in binary or memory: http://apache.org/xml/properties/input-buffer-sizecondit
Source: javaw.exe	String found in binary or memory: http://apache.org/xml/properties/internal/datatype-validator-factory
Source: java.exe, javaw.exe	String found in binary or memory: http://apache.org/xml/properties/internal/datatype-validator-factory:
Source: javaw.exe	String found in binary or memory: http://apache.org/xml/properties/internal/document-scanner
Source: javaw.exe	String found in binary or memory: http://apache.org/xml/properties/internal/document-scanner7
Source: javaw.exe	String found in binary or memory: http://apache.org/xml/properties/internal/dtd-processor
Source: java.exe	String found in binary or memory: http://apache.org/xml/properties/internal/dtd-processor5
Source: javaw.exe	String found in binary or memory: http://apache.org/xml/properties/internal/dtd-scanner
Source: java.exe, javaw.exe	String found in binary or memory: http://apache.org/xml/properties/internal/dtd-scanner8
Source: java.exe, javaw.exe	String found in binary or memory: http://apache.org/xml/properties/internal/entity-manager
Source: java.exe, javaw.exe	String found in binary or memory: http://apache.org/xml/properties/internal/entity-manager8
Source: javaw.exe	String found in binary or memory: http://apache.org/xml/properties/internal/entity-resolver
Source: java.exe	String found in binary or memory: http://apache.org/xml/properties/internal/entity-resolver7
Source: javaw.exe	String found in binary or memory: http://apache.org/xml/properties/internal/error-handler
Source: java.exe, javaw.exe	String found in binary or memory: http://apache.org/xml/properties/internal/error-handler6
Source: java.exe, javaw.exe	String found in binary or memory: http://apache.org/xml/properties/internal/error-reporter
Source: java.exe, javaw.exe	String found in binary or memory: http://apache.org/xml/properties/internal/error-reporter:
Source: javaw.exe	String found in binary or memory: http://apache.org/xml/properties/internal/grammar-pool
Source: java.exe, javaw.exe	String found in binary or memory: http://apache.org/xml/properties/internal/grammar-pool6
Source: javaw.exe	String found in binary or memory: http://apache.org/xml/properties/internal/namespace-binder
Source: javaw.exe	String found in binary or memory: http://apache.org/xml/properties/internal/namespace-context
Source: java.exe	String found in binary or memory: http://apache.org/xml/properties/internal/namespace-context0
Source: javaw.exe	String found in binary or memory: http://apache.org/xml/properties/internal/stax-entity-resolver
Source: javaw.exe	String found in binary or memory: http://apache.org/xml/properties/internal/symbol-table
Source: java.exe	String found in binary or memory: http://apache.org/xml/properties/internal/symbol-tableq
Source: javaw.exe	String found in binary or memory: http://apache.org/xml/properties/internal/validation-manager
Source: java.exe	String found in binary or memory: http://apache.org/xml/properties/internal/validation-manager:q
Source: javaw.exe	String found in binary or memory: http://apache.org/xml/properties/internal/validation-managerf
Source: java.exe, javaw.exe	String found in binary or memory: http://apache.org/xml/properties/internal/validation/schema/dv-factory
Source: java.exe	String found in binary or memory: http://apache.org/xml/properties/internal/validation/schema/dv-factory7
Source: javaw.exe	String found in binary or memory: http://apache.org/xml/properties/internal/validation/schema/dv-factorys
Source: javaw.exe	String found in binary or memory: http://apache.org/xml/properties/internal/validator/dtd
Source: java.exe	String found in binary or memory: http://apache.org/xml/properties/internal/validator/dtd:
Source: javaw.exe	String found in binary or memory: http://apache.org/xml/properties/internal/validator/schema
Source: javaw.exe	String found in binary or memory: http://apache.org/xml/properties/internal/xinclude-handler
Source: java.exe	String found in binary or memory: http://apache.org/xml/properties/internal/xinclude-handler9
Source: javaw.exe	String found in binary or memory: http://apache.org/xml/properties/locale
Source: java.exe, javaw.exe	String found in binary or memory: http://apache.org/xml/properties/localej
Source: javaw.exe	String found in binary or memory: http://apache.org/xml/properties/schema/external-nonamespaceschemalocation
Source: javaw.exe	String found in binary or memory: http://apache.org/xml/properties/schema/external-nonamespaceschemalocation?
Source: javaw.exe	String found in binary or memory: http://apache.org/xml/properties/schema/external-schemalocation
Source: java.exe, javaw.exe	String found in binary or memory: http://apache.org/xml/properties/schema/external-schemalocation(
Source: javaw.exe	String found in binary or memory: http://apache.org/xml/properties/security-manager
Source: java.exe	String found in binary or memory: http://apache.org/xml/properties/security-managerh
Source: java.exe, javaw.exe	String found in binary or memory: http://apache.org/xml/xmlschema/1.0/anonymoustypes
Source: java.exe	String found in binary or memory: http://apache.org/xml/xmlschema/1.0/anonymoustypes/w3c/d
Source: java.exe	String found in binary or memory: http://apache.org/xml/xmlschema/1.0/anonymoustypes;ljava
Source: javaw.exe	String found in binary or memory: http://apache.org/xml/xmlschema/1.0/anonymoustypesg/w3c/
Source: javaw.exe	String found in binary or memory: http://bugreport.java.com/bugreport/crash.jsp
Source: javaw.exe	String found in binary or memory: http://bugreport.java.com/bugreport/crash.jspresourcemanagement
Source: javaw.exe, java.exe	String found in binary or memory: http://bugreport.sun.com/bugreport/
Source: javaw.exe, java.exe	String found in binary or memory: http://bugreport.sun.com/bugreport/java.vendor.url.bughttp://java.oracle.com/java.vendor.urljava.ven
Source: xcopy.exe	String found in binary or memory: http://downloa
Source: java.exe	String found in binary or memory: http://java.oracle.com/
Source: javaw.exe	String found in binary or memory: http://java.sun.com/dtd/properties.dtd
Source: java.exe, javaw.exe	String found in binary or memory: http://java.sun.com/xml/dom/properties/
Source: java.exe, javaw.exe	String found in binary or memory: http://java.sun.com/xml/dom/properties/ancestor-check
Source: javaw.exe	String found in binary or memory: http://java.sun.com/xml/dom/properties/ancestor-check1s
Source: java.exe	String found in binary or memory: http://java.sun.com/xml/dom/properties/b(
Source: java.exe	String found in binary or memory: http://java.sun.com/xml/dom/properties/d(
Source: javaw.exe	String found in binary or memory: http://java.sun.com/xml/dom/properties/e(
Source: javaw.exe	String found in binary or memory: http://java.sun.com/xml/jaxp/properties/
Source: javaw.exe	String found in binary or memory: http://java.sun.com/xml/jaxp/properties/schemalanguage
Source: java.exe, javaw.exe	String found in binary or memory: http://java.sun.com/xml/jaxp/properties/schemalanguage4
Source: javaw.exe	String found in binary or memory: http://java.sun.com/xml/jaxp/properties/schemasource
Source: java.exe, javaw.exe	String found in binary or memory: http://java.sun.com/xml/jaxp/properties/schemasource7
Source: javaw.exe	String found in binary or memory: http://java.sun.com/xml/schema/features/
Source: javaw.exe	String found in binary or memory: http://java.sun.com/xml/schema/features/report-ignored-element-content-whitespace
Source: java.exe	String found in binary or memory: http://java.sun.com/xml/schema/features/report-ignored-element-content-whitespace0
Source: java.exe, javaw.exe	String found in binary or memory: http://java.sun.com/xml/stream/properties/
Source: java.exe	String found in binary or memory: http://java.sun.com/xml/stream/properties/ignore-external-dtd
Source: java.exe	String found in binary or memory: http://java.sun.com/xml/stream/properties/ignore-external-dtde
Source: javaw.exe	String found in binary or memory: http://java.sun.com/xml/stream/properties/ignore-external-dtdtex
Source: java.exe	String found in binary or memory: http://java.sun.com/xml/stream/properties/om/noda
Source: java.exe, javaw.exe	String found in binary or memory: http://java.sun.com/xml/stream/properties/reader-in-defined-state
Source: java.exe	String found in binary or memory: http://java.sun.com/xml/stream/properties/reader-in-defined-state)lorg/w
Source: java.exe	String found in binary or memory: http://java.sun.com/xml/stream/properties/reader-in-defined-stater
Source: javaw.exe	String found in binary or memory: http://java.sun.com/xml/stream/properties/reader-in-defined-staterg/w3c/
Source: java.exe, javaw.exe	String found in binary or memory: http://java.sun.com/xml/stream/properties/report-cdata-event
Source: java.exe	String found in binary or memory: http://java.sun.com/xml/stream/properties/ue
Source: javaw.exe	String found in binary or memory: http://java.sun.com/xml/stream/properties/y;
Source: javaw.exe	String found in binary or memory: http://javax.xml.xmlconstants/feature/secure-processing
Source: java.exe, javaw.exe	String found in binary or memory: http://javax.xml.xmlconstants/property/
Source: java.exe	String found in binary or memory: http://javax.xml.xmlconstants/property//3
Source: java.exe, javaw.exe	String found in binary or memory: http://javax.xml.xmlconstants/property/accessexternaldtd
Source: java.exe, javaw.exe	String found in binary or memory: http://javax.xml.xmlconstants/property/accessexternaldtd;
Source: javaw.exe	String found in binary or memory: http://javax.xml.xmlconstants/property/accessexternalschema
Source: javaw.exe	String found in binary or memory: http://javax.xml.xmlconstants/property/d3
Source: java.exe	String found in binary or memory: http://javax.xml.xmlconstants/property/r3
Source: java.exe, javaw.exe	String found in binary or memory: http://null.sun.com/
Source: java.exe, javaw.exe	String found in binary or memory: http://null.sun.com/0
Source: javaw.exe	String found in binary or memory: http://openjdk.java.net/jeps/220).
Source: java.exe, javaw.exe	String found in binary or memory: http://www.oracle.com/feature/use-service-mechanism
Source: java.exe	String found in binary or memory: http://www.oracle.com/feature/use-service-mechanism/obje
Source: javaw.exe	String found in binary or memory: http://www.oracle.com/feature/use-service-mechanismm/nod
Source: java.exe	String found in binary or memory: http://www.oracle.com/feature/use-service-mechanismon_al
Source: javaw.exe	String found in binary or memory: http://www.oracle.com/hotspot/jvm/
Source: javaw.exe	String found in binary or memory: http://www.oracle.com/hotspot/jvm/java/monitor/address
Source: javaw.exe	String found in binary or memory: http://www.oracle.com/hotspot/jvm/vm/code_sweeper/id
Source: javaw.exe	String found in binary or memory: http://www.oracle.com/hotspot/jvm/vm/compiler/id
Source: javaw.exe	String found in binary or memory: http://www.oracle.com/hotspot/jvm/vm/gc/id
Source: javaw.exe	String found in binary or memory: http://www.oracle.com/technetwork/java/javaseproducts/
Source: javaw.exe	String found in binary or memory: http://www.oracle.com/technetwork/java/javaseproducts/d:
Source: java.exe, javaw.exe	String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/
Source: javaw.exe	String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/elementattributelimit
Source: javaw.exe	String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/elementattributelimit0
Source: java.exe	String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/elementattributelimitv9
Source: java.exe, javaw.exe	String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/entityexpansionlimit
Source: java.exe	String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/entityexpansionlimitac
Source: javaw.exe	String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/entityexpansionlimitl
Source: java.exe	String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/erces19
Source: javaw.exe	String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/g/w3c/9
Source: javaw.exe	String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/getentitycountinfo
Source: java.exe	String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/lang/s9
Source: javaw.exe	String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/maxelementdepth
Source: java.exe	String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/maxelementdeptha/lang/c
Source: javaw.exe	String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/maxgeneralentitysizelimit
Source: java.exe	String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/maxgeneralentitysizelimit(z)v
Source: java.exe, javaw.exe	String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/maxoccurlimit
Source: java.exe	String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/maxoccurlimitde
Source: java.exe	String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/maxoccurlimite
Source: javaw.exe	String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/maxoccurlimitne
Source: java.exe, javaw.exe	String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/maxparameterentitysizelimit
Source: javaw.exe	String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/maxparameterentitysizelimit;)z
Source: java.exe	String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/maxparameterentitysizelimittan
Source: java.exe, javaw.exe	String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/maxxmlnamelimit
Source: javaw.exe	String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/maxxmlnamelimitang/str
Source: java.exe	String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/maxxmlnamelimitass;
Source: java.exe	String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/maxxmlnamelimitljava/l
Source: java.exe, javaw.exe	String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/totalentitysizelimit
Source: java.exe	String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/totalentitysizelimitg_
Source: javaw.exe	String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/totalentitysizelimitja
Source: javaw.exe	String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/xmlsecuritypropertymanager
Source: java.exe, javaw.exe	String found in binary or memory: http://xml.org/sax/features/
Source: javaw.exe	String found in binary or memory: http://xml.org/sax/features//lan
Source: javaw.exe	String found in binary or memory: http://xml.org/sax/features/allow-dtd-events-after-enddtd
Source: java.exe	String found in binary or memory: http://xml.org/sax/features/allow-dtd-events-after-enddtd4q
Source: javaw.exe	String found in binary or memory: http://xml.org/sax/features/external-general-entities
Source: javaw.exe	String found in binary or memory: http://xml.org/sax/features/external-general-entities7
Source: javaw.exe	String found in binary or memory: http://xml.org/sax/features/external-parameter-entities
Source: javaw.exe	String found in binary or memory: http://xml.org/sax/features/namespaces
Source: java.exe	String found in binary or memory: http://xml.org/sax/features/namespaces&
Source: java.exe	String found in binary or memory: http://xml.org/sax/features/om/s
Source: java.exe	String found in binary or memory: http://xml.org/sax/features/tene
Source: javaw.exe	String found in binary or memory: http://xml.org/sax/features/use-entity-resolver2
Source: javaw.exe	String found in binary or memory: http://xml.org/sax/features/validation
Source: javaw.exe	String found in binary or memory: http://xml.org/sax/properties/
Source: java.exe, javaw.exe	String found in binary or memory: http://xml.org/sax/properties/(
Source: javaw.exe	String found in binary or memory: http://xml.org/sax/properties/xml-string
Source: java.exe, javaw.exe	String found in binary or memory: https://jrat.io
Source: java.exe	String found in binary or memory: https://jrat.ios
Source: java.exe	String found in binary or memory: https://jrat.ios1

Detected TCP or UDP traffic on non-standard ports

Show sources

Source: global traffic

TCP traffic: 192.168.1.16:49201 -> 178.175.138.167:9010

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic

Snort IDS: 2020728 ET TROJAN Possible Adwind SSL Cert (assylias.Inc) 178.175.138.167:9010 -> 192.168.1.16:49201

Boot Survival:

Creates an autostart registry key

Show sources

Source: C:\Windows\System32\reg.exe	Registry value created or modified: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run GboKDMbfKti
Source: C:\Windows\System32\reg.exe	Registry value created or modified: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run GboKDMbfKti

Creates autostart registry keys to launch java

Show sources

Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Registry value created or modified: HKEY_USERS\Software\Microsoft\Direct3D\MostRecentApplication Name javaw.exe
Source: C:\Windows\System32\reg.exe	Registry value created or modified: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run GboKDMbfKti "C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe" -jar "C:\Users\user\eDdlsoVKfgW\AknzQIkoyKh.qmSBQy"

Remote Access Functionality:

ADWIND Rat detected

Show sources

Source: C:\Program Files\Java\jre1.8.0_40\bin\java.exe	Dropped file: Set oWMI = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\SecurityCenter2")Set colItems = oWMI.ExecQuery("Select * from AntiVirusProduct")For Each objItem in colItems With objItem WScript.Echo "{""AV"":""" & .displayName & """}" End WithNext
Source: C:\Program Files\Java\jre1.8.0_40\bin\java.exe	Dropped file: Set oWMI = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\SecurityCenter2")Set colItems = oWMI.ExecQuery("Select * from FirewallProduct")For Each objItem in colItems With objItem WScript.Echo "{""FIREWALL"":""" & .displayName & """}" End WithNext
Source: C:\Program Files\Java\jre1.8.0_40\bin\java.exe	Dropped file: Set oWMI = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\SecurityCenter2")Set colItems = oWMI.ExecQuery("Select * from AntiVirusProduct")For Each objItem in colItems With objItem WScript.Echo "{""AV"":""" & .displayName & """}" End WithNext
Source: C:\Program Files\Java\jre1.8.0_40\bin\java.exe	Dropped file: Set oWMI = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\SecurityCenter2")Set colItems = oWMI.ExecQuery("Select * from FirewallProduct")For Each objItem in colItems With objItem WScript.Echo "{""FIREWALL"":""" & .displayName & """}" End WithNext
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Dropped file: Set oWMI = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\SecurityCenter2")Set colItems = oWMI.ExecQuery("Select * from AntiVirusProduct")For Each objItem in colItems With objItem WScript.Echo "{""AV"":""" & .displayName & """}" End WithNext
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Dropped file: Set oWMI = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\SecurityCenter2")Set colItems = oWMI.ExecQuery("Select * from FirewallProduct")For Each objItem in colItems With objItem WScript.Echo "{""FIREWALL"":""" & .displayName & """}" End WithNext
Source: C:\Users\user\AppData\Roaming\Oracle\bin\java.exe	Dropped file: Set oWMI = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\SecurityCenter2")Set colItems = oWMI.ExecQuery("Select * from AntiVirusProduct")For Each objItem in colItems With objItem WScript.Echo "{""AV"":""" & .displayName & """}" End WithNext
Source: C:\Users\user\AppData\Roaming\Oracle\bin\java.exe	Dropped file: Set oWMI = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\SecurityCenter2")Set colItems = oWMI.ExecQuery("Select * from FirewallProduct")For Each objItem in colItems With objItem WScript.Echo "{""FIREWALL"":""" & .displayName & """}" End WithNext

Persistence and Installation Behavior:

Creates license or readme file

Show sources

Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\README.txt
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\THIRDPARTYLICENSEREADME-JAVAFX.txt
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\THIRDPARTYLICENSEREADME-JAVAFX.txt
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\THIRDPARTYLICENSEREADME.txt
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\THIRDPARTYLICENSEREADME.txt

Drops PE files

Show sources

Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\instrument.dll
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\glass.dll
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\unpack200.exe
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\jsoundds.dll
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\deploy.dll
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\sunmscapi.dll
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\pack200.exe
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\javafx_iio.dll
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\decora_sse.dll
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\ktab.exe
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\rmid.exe
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\dcpr.dll
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\t2k.dll
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\kcms.dll
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\jfxmedia.dll
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\JAWTAccessBridge.dll
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\prism_d3d.dll
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\WindowsAccessBridge.dll
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\w2k_lsa_auth.dll
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\jsound.dll
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\jp2iexp.dll
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\keytool.exe
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\hprof.dll
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\wsdetect.dll
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\tnameserv.exe
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\gstreamer-lite.dll
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\java_crw_demo.dll
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\zip.dll
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\jp2native.dll
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\unpack.dll
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\splashscreen.dll
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\javafx_font_t2k.dll
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\rmiregistry.exe
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\javacpl.exe
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\dtplugin\npdeployJava1.dll
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\nio.dll
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\java-rmi.exe
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\plugin2\msvcr100.dll
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\resource.dll
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\jabswitch.exe
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\prism_sw.dll
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\orbd.exe
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\jsdt.dll
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\mlib_image.dll
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\fxplugins.dll
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\kinit.exe
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\jaas_nt.dll
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\klist.exe
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\awt.dll
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\npt.dll
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\dtplugin\deployJava1.dll
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\msvcr100.dll
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\net.dll
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\javaws.exe
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\jdwp.dll
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\dt_shmem.dll
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\jfr.dll
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\jfxwebkit.dll
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\fontmanager.dll
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\dt_socket.dll
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\ssv.dll
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\jawt.dll
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\prism_es2.dll
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	File created: C:\Users\LUKETA~1\AppData\Local\Temp\Windows8952294696781336921.dll
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\prism_common.dll
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\javacpl.cpl
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\jp2launcher.exe
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\JavaAccessBridge.dll
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\servertool.exe
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\management.dll
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\plugin2\npjp2.dll
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\bci.dll
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\j2pcsc.dll
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\jp2ssv.dll
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\lcms.dll
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\jpeg.dll
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\glib-lite.dll
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\ssvagent.exe
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\j2pkcs11.dll
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\verify.dll
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\sunec.dll
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\eula.dll
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\java.dll
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\java.exe
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\policytool.exe
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\client\jvm.dll
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\javafx_font.dll
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\jli.dll
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\jjs.exe

May use bcdedit to modify the Windows boot settings

Show sources

Source: java.exe

Binary or memory string: 0?9bcdedit.exe

Drops files with a non-matching file extension (content does not match file extension)

Show sources

Source: C:\Windows\System32\xcopy.exe

File created: C:\Users\user\AppData\Roaming\Oracle\bin\javacpl.cpl

Spreading:

Enumerates the file system

Show sources

Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	File opened: C:\Users\user\AppData\Roaming\Oracle\lib\
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	File opened: C:\Users\user\AppData\Roaming\Oracle\lib\ext\
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	File opened: C:\Users\user\AppData\Roaming\
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	File opened: C:\Users\user\
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	File opened: C:\Users\user\AppData\Roaming\Oracle\
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	File opened: C:\Users\user\AppData\

System Summary:

Found graphical window changes (likely an installer)

Show sources

Source: Window Recorder

Window detected: More than 3 window changes detected

Uses new MSVCR Dlls

Show sources

Source: C:\Program Files\Java\jre1.8.0_40\bin\java.exe

File opened: C:\Program Files\Java\jre1.8.0_40\bin\msvcr100.dll

Binary contains paths to debug symbols

Show sources

Source:	Binary string: msvcr100.i386.pdb source: javaw.exe
Source:	Binary string: d:\re\puppet\workspace\8-2-build-windows-i586-cygwin\jdk8u40\2855\build\windows-i586\jdk\objs\libverify\verify.pdb source: javaw.exe
Source:	Binary string: C:\Users\Windows10\Desktop\CryptUtil_DLL_Visual Studio 10\Release\CryptUtil.pdbP8PP@Y source: java.exe, javaw.exe
Source:	Binary string: d:\re\puppet\workspace\8-2-build-windows-i586-cygwin\jdk8u40\2855\build\windows-i586\jdk\objs\libawt\awt.pdb source: javaw.exe, java.exe
Source:	Binary string: d:\re\puppet\workspace\8-2-build-windows-i586-cygwin\jdk8u40\2855\build\windows-i586\jdk\objs\libnio\nio.pdb source: javaw.exe, java.exe
Source:	Binary string: d:\re\puppet\workspace\8-2-build-windows-i586-cygwin\jdk8u40\2855\build\windows-i586\jdk\objs\libnet\net.pdb source: javaw.exe, java.exe
Source:	Binary string: C:\Users\Win10\Desktop\RetriveTitle_vb2010\Release\TitleWindow.pdb source: java.exe, javaw.exe
Source:	Binary string: D:\re\puppet\workspace\8-2-build-windows-i586-cygwin\jdk8u40\2855\build\windows-i586\hotspot\windows_i486_compiler1\product\jvm.pdb source: javaw.exe
Source:	Binary string: C:\Users\Windows10\Desktop\RetriveTitle\x64\Release\TitleWindow.pdb source: java.exe, javaw.exe
Source:	Binary string: d:\re\puppet\workspace\8-2-build-windows-i586-cygwin\jdk8u40\2855\build\windows-i586\jdk\objs\java_objs\java.pdb source: java.exe
Source:	Binary string: d:\re\puppet\workspace\8-2-build-windows-i586-cygwin\jdk8u40\2855\build\windows-i586\jdk\objs\libjava\java.pdbW" source: javaw.exe, java.exe
Source:	Binary string: d:\re\puppet\workspace\8-2-build-windows-i586-cygwin\jdk8u40\2855\build\windows-i586\jdk\objs\libawt\awt.pdb8^ source: javaw.exe, java.exe
Source:	Binary string: d:\re\puppet\workspace\8-2-build-windows-i586-cygwin\jdk8u40\2855\build\windows-i586\jdk\objs\libzip\zip.pdb source: javaw.exe, java.exe
Source:	Binary string: C:\Users\Windows10\Desktop\CryptUtil_DLL_Visual Studio 10\x64\Release\CryptUtil.pdb source: java.exe, javaw.exe
Source:	Binary string: d:\re\puppet\workspace\8-2-build-windows-i586-cygwin\jdk8u40\2855\build\windows-i586\jdk\objs\libmanagement\management.pdbi: source: javaw.exe
Source:	Binary string: d:\re\puppet\workspace\8-2-build-windows-i586-cygwin\jdk8u40\2855\build\windows-i586\jdk\objs\javaw_objs\javaw.pdb source: javaw.exe
Source:	Binary string: C:\Users\Windows10\Desktop\CryptUtil_DLL_Visual Studio 10\Release\CryptUtil.pdb source: java.exe, javaw.exe
Source:	Binary string: d:\re\puppet\workspace\8-2-build-windows-i586-cygwin\jdk8u40\2855\build\windows-i586\jdk\objs\libjava\java.pdb source: javaw.exe, java.exe
Source:	Binary string: d:\re\puppet\workspace\8-2-build-windows-i586-cygwin\jdk8u40\2855\build\windows-i586\jdk\objs\libsunec\sunec.pdb source: javaw.exe, java.exe
Source:	Binary string: d:\re\puppet\workspace\8-2-build-windows-i586-cygwin\jdk8u40\2855\build\windows-i586\jdk\objs\libmanagement\management.pdb source: javaw.exe
Source:	Binary string: d:\re\puppet\workspace\8-2-build-windows-i586-cygwin\jdk8u40\2855\build\windows-i586\jdk\objs\libnet\net.pdbI source: javaw.exe, java.exe

Classification label

Show sources

Source: classification engine

Classification label: mal92.evad.expl.troj.winJAR@152/348@0/3

Creates files inside the user directory

Show sources

Source: C:\Program Files\Java\jre1.8.0_40\bin\java.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-312302014-279660585-3511680526-1004\83aa4cc77f591dfc2374580bbd95f6ba_041d84af-7e76-450d-8340-55db3c73c359

Creates temporary files

Show sources

Source: C:\Program Files\Java\jre1.8.0_40\bin\java.exe

File created: C:\Users\LUKETA~1\AppData\Local\Temp\hsperfdata_user

Executable is probably coded in java

Show sources

Source: C:\Program Files\Java\jre1.8.0_40\bin\java.exe

Section loaded: C:\Program Files\Java\jre1.8.0_40\bin\client\jvm.dll

Executes visual basic scripts

Show sources

Source: unknown

Process created: C:\Windows\System32\cmd.exe cmd.exe /C cscript.exe C:\Users\LUKETA~1\AppData\Local\Temp\Retrive2520289818372255555.vbs

Queries process information (via WMI, Win32_Process)

Show sources

Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::ExecQuery - SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\attrib.exe	WMI Queries: IWbemServices::ExecQuery - SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::ExecQuery - SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\cscript.exe	WMI Queries: IWbemServices::ExecQuery - SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Reads software policies

Show sources

Source: C:\Windows\System32\cmd.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Sample is known by Antivirus (Virustotal or Metascan)

Show sources

Source: 75Doc 0.26777400 15041397050000000jpg.jar

Virustotal: hash found

Spawns processes

Show sources

Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c 7za.exe x -y -oC:\jar 'C:\Users\user\Desktop\75Doc 0.26777400 15041397050000000jpg.jar'
Source: unknown	Process created: C:\Windows\System32\7za.exe 7za.exe x -y -oC:\jar 'C:\Users\user\Desktop\75Doc 0.26777400 15041397050000000jpg.jar'
Source: unknown	Process created: C:\Windows\System32\cmd.exe 'C:\Windows\System32\cmd.exe' /c java.exe -jar 'C:\Users\user\Desktop\75Doc 0.26777400 15041397050000000jpg.jar' OnayiZufuhugu.OgiyizEfahiGu.Main >> C:\cmdlinestart.log 2>&1
Source: unknown	Process created: C:\Program Files\Java\jre1.8.0_40\bin\java.exe java.exe -jar 'C:\Users\user\Desktop\75Doc 0.26777400 15041397050000000jpg.jar' OnayiZufuhugu.OgiyizEfahiGu.Main
Source: unknown	Process created: C:\Program Files\Java\jre1.8.0_40\bin\java.exe 'C:\Program Files\Java\jre1.8.0_40\bin\java.exe' -jar C:\Users\LUKETA~1\AppData\Local\Temp\_0.4312212827200392546983382786626386.class
Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd.exe /C cscript.exe C:\Users\LUKETA~1\AppData\Local\Temp\Retrive2520289818372255555.vbs
Source: unknown	Process created: C:\Windows\System32\cscript.exe cscript.exe C:\Users\LUKETA~1\AppData\Local\Temp\Retrive2520289818372255555.vbs
Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd.exe /C cscript.exe C:\Users\LUKETA~1\AppData\Local\Temp\Retrive194914766236682624.vbs
Source: unknown	Process created: C:\Windows\System32\cscript.exe cscript.exe C:\Users\LUKETA~1\AppData\Local\Temp\Retrive194914766236682624.vbs
Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd.exe /C cscript.exe C:\Users\LUKETA~1\AppData\Local\Temp\Retrive3159448250120760692.vbs
Source: unknown	Process created: C:\Windows\System32\xcopy.exe xcopy 'C:\Program Files\Java\jre1.8.0_40' 'C:\Users\user\AppData\Roaming\Oracle\' /e
Source: unknown	Process created: C:\Windows\System32\cscript.exe cscript.exe C:\Users\LUKETA~1\AppData\Local\Temp\Retrive3159448250120760692.vbs
Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd.exe /C cscript.exe C:\Users\LUKETA~1\AppData\Local\Temp\Retrive8817309470254096997.vbs
Source: unknown	Process created: C:\Windows\System32\cscript.exe cscript.exe C:\Users\LUKETA~1\AppData\Local\Temp\Retrive8817309470254096997.vbs
Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd.exe
Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd.exe
Source: unknown	Process created: C:\Windows\System32\reg.exe reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v GboKDMbfKti /t REG_EXPAND_SZ /d '\'C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe\' -jar \'C:\Users\user\eDdlsoVKfgW\AknzQIkoyKh.qmSBQy\'' /f
Source: unknown	Process created: C:\Windows\System32\attrib.exe attrib +h 'C:\Users\user\eDdlsoVKfgW\.'
Source: unknown	Process created: C:\Windows\System32\attrib.exe attrib +h 'C:\Users\user\eDdlsoVKfgW'
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe -jar C:\Users\user\eDdlsoVKfgW\AknzQIkoyKh.qmSBQy
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Oracle\bin\java.exe C:\Users\user\AppData\Roaming\Oracle\bin\java.exe -jar C:\Users\LUKETA~1\AppData\Local\Temp\_0.94322696032766358809744035144248591.class
Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd.exe /C cscript.exe C:\Users\LUKETA~1\AppData\Local\Temp\Retrive6799039488535261462.vbs
Source: unknown	Process created: C:\Windows\System32\cscript.exe cscript.exe C:\Users\LUKETA~1\AppData\Local\Temp\Retrive6799039488535261462.vbs
Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd.exe /C cscript.exe C:\Users\LUKETA~1\AppData\Local\Temp\Retrive6418174406144645399.vbs
Source: unknown	Process created: C:\Windows\System32\cscript.exe cscript.exe C:\Users\LUKETA~1\AppData\Local\Temp\Retrive6418174406144645399.vbs
Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd.exe /C cscript.exe C:\Users\LUKETA~1\AppData\Local\Temp\Retrive3450254285310729085.vbs
Source: unknown	Process created: C:\Windows\System32\cscript.exe cscript.exe C:\Users\LUKETA~1\AppData\Local\Temp\Retrive3450254285310729085.vbs
Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd.exe /C cscript.exe C:\Users\LUKETA~1\AppData\Local\Temp\Retrive2857528709846908978.vbs
Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd.exe
Source: unknown	Process created: C:\Windows\System32\cscript.exe cscript.exe C:\Users\LUKETA~1\AppData\Local\Temp\Retrive2857528709846908978.vbs
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\7za.exe 7za.exe x -y -oC:\jar 'C:\Users\user\Desktop\75Doc 0.26777400 15041397050000000jpg.jar'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Java\jre1.8.0_40\bin\java.exe java.exe -jar 'C:\Users\user\Desktop\75Doc 0.26777400 15041397050000000jpg.jar' OnayiZufuhugu.OgiyizEfahiGu.Main
Source: C:\Program Files\Java\jre1.8.0_40\bin\java.exe	Process created: C:\Program Files\Java\jre1.8.0_40\bin\java.exe 'C:\Program Files\Java\jre1.8.0_40\bin\java.exe' -jar C:\Users\LUKETA~1\AppData\Local\Temp\_0.4312212827200392546983382786626386.class
Source: C:\Program Files\Java\jre1.8.0_40\bin\java.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C cscript.exe C:\Users\LUKETA~1\AppData\Local\Temp\Retrive2520289818372255555.vbs
Source: C:\Program Files\Java\jre1.8.0_40\bin\java.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C cscript.exe C:\Users\LUKETA~1\AppData\Local\Temp\Retrive194914766236682624.vbs
Source: C:\Program Files\Java\jre1.8.0_40\bin\java.exe	Process created: C:\Windows\System32\xcopy.exe xcopy 'C:\Program Files\Java\jre1.8.0_40' 'C:\Users\user\AppData\Roaming\Oracle\' /e
Source: C:\Program Files\Java\jre1.8.0_40\bin\java.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe
Source: C:\Program Files\Java\jre1.8.0_40\bin\java.exe	Process created: C:\Windows\System32\reg.exe reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v GboKDMbfKti /t REG_EXPAND_SZ /d '\'C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe\' -jar \'C:\Users\user\eDdlsoVKfgW\AknzQIkoyKh.qmSBQy\'' /f
Source: C:\Program Files\Java\jre1.8.0_40\bin\java.exe	Process created: C:\Windows\System32\attrib.exe attrib +h 'C:\Users\user\eDdlsoVKfgW\.'
Source: C:\Program Files\Java\jre1.8.0_40\bin\java.exe	Process created: C:\Windows\System32\attrib.exe attrib +h 'C:\Users\user\eDdlsoVKfgW'
Source: C:\Program Files\Java\jre1.8.0_40\bin\java.exe	Process created: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe -jar C:\Users\user\eDdlsoVKfgW\AknzQIkoyKh.qmSBQy
Source: C:\Program Files\Java\jre1.8.0_40\bin\java.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C cscript.exe C:\Users\LUKETA~1\AppData\Local\Temp\Retrive3159448250120760692.vbs
Source: C:\Program Files\Java\jre1.8.0_40\bin\java.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C cscript.exe C:\Users\LUKETA~1\AppData\Local\Temp\Retrive8817309470254096997.vbs
Source: C:\Program Files\Java\jre1.8.0_40\bin\java.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript.exe C:\Users\LUKETA~1\AppData\Local\Temp\Retrive2520289818372255555.vbs
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript.exe C:\Users\LUKETA~1\AppData\Local\Temp\Retrive194914766236682624.vbs
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript.exe C:\Users\LUKETA~1\AppData\Local\Temp\Retrive3159448250120760692.vbs
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript.exe C:\Users\LUKETA~1\AppData\Local\Temp\Retrive8817309470254096997.vbs
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: C:\Users\user\AppData\Roaming\Oracle\bin\java.exe C:\Users\user\AppData\Roaming\Oracle\bin\java.exe -jar C:\Users\LUKETA~1\AppData\Local\Temp\_0.94322696032766358809744035144248591.class
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C cscript.exe C:\Users\LUKETA~1\AppData\Local\Temp\Retrive6799039488535261462.vbs
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C cscript.exe C:\Users\LUKETA~1\AppData\Local\Temp\Retrive3450254285310729085.vbs
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C cscript.exe C:\Users\LUKETA~1\AppData\Local\Temp\Retrive2857528709846908978.vbs
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: C:\Windows\System32\cscript.exe cscript.exe C:\Users\LUKETA~1\AppData\Local\Temp\Retrive2857528709846908978.vbs
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\java.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C cscript.exe C:\Users\LUKETA~1\AppData\Local\Temp\Retrive6418174406144645399.vbs
Source: C:\Users\user\AppData\Roaming\Oracle\bin\java.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C cscript.exe C:\Users\LUKETA~1\AppData\Local\Temp\Retrive2857528709846908978.vbs
Source: C:\Users\user\AppData\Roaming\Oracle\bin\java.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript.exe C:\Users\LUKETA~1\AppData\Local\Temp\Retrive6799039488535261462.vbs
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript.exe C:\Users\LUKETA~1\AppData\Local\Temp\Retrive6418174406144645399.vbs
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript.exe C:\Users\LUKETA~1\AppData\Local\Temp\Retrive3450254285310729085.vbs
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript.exe C:\Users\LUKETA~1\AppData\Local\Temp\Retrive2857528709846908978.vbs

Uses an in-process (OLE) Automation server

Show sources

Source: C:\Windows\System32\cscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Creates files inside the system directory

Show sources

Source: C:\Program Files\Java\jre1.8.0_40\bin\java.exe

File created: C:\Windows\System32\test.txt

Reads the hosts file

Show sources

Source: C:\Program Files\Java\jre1.8.0_40\bin\java.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Program Files\Java\jre1.8.0_40\bin\java.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Oracle\bin\java.exe	File read: C:\Windows\System32\drivers\etc\hosts

Uses reg.exe to modify the Windows registry

Show sources

Source: unknown

Process created: C:\Windows\System32\reg.exe reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v GboKDMbfKti /t REG_EXPAND_SZ /d '\'C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe\' -jar \'C:\Users\user\eDdlsoVKfgW\AknzQIkoyKh.qmSBQy\'' /f

HIPS / PFW / Operating System Protection Evasion:

May try to detect the Windows Explorer process (often used for injection)

Show sources

Source: javaw.exe	Binary or memory string: F{"ACTIVE_WINDOW":"Program Manager","COMMAND":5}
Source: javaw.exe	Binary or memory string: /{"ACTIVE_WINDOW":"Program Manager","COMMAND":5}
Source: javaw.exe	Binary or memory string: t/{"ACTIVE_WINDOW":"Program Manager","COMMAND":5}R7Df:5
Source: javaw.exe	Binary or memory string: /{"ACTIVE_WINDOW":"Program Manager","COMMAND":5}R7Df:5
Source: javaw.exe	Binary or memory string: t/{"ACTIVE_WINDOW":"Program Manager","COMMAND":5}^
Source: javaw.exe	Binary or memory string: "{"ACTIVE_WINDOW":"Program Manager"
Source: javaw.exe	Binary or memory string: t/{"ACTIVE_WINDOW":"Program Manager","COMMAND":5}]h
Source: javaw.exe	Binary or memory string: /{"ACTIVE_WINDOW":"Program Manager","COMMAND":5}^
Source: javaw.exe	Binary or memory string: {"ACTIVE_WINDOW":"Program Manager","COMMAND":5}can.exe","twssrv.exe","UserReg.exe"],"NAME":"Twister Antivirus"}],"DELAY_CONNECT":1,"SERVER_PATH":"C:\\Users\\user\\eDdlsoVKfgW\\AknzQIkoyKh.qmSBQy","VBOX":false,"RAM":"511.6 MB"},"psview.exe","quamgr.ex
Source: javaw.exe	Binary or memory string: t/{"ACTIVE_WINDOW":"Program Manager","COMMAND":5}.exe","Bav.exe","BavWebClient.exe","BavUpdater.exe"],"NAME":"Baidu Antivirus 2015"},{"PROCESS":["MCShieldCCC.exe","MCShieldRTM.exe","MCShieldDS.exe","MCS-Uninstall.exe"],"NAME":"MCShield Anti-Malware Tool"},{"PROCESS":["SDScan.exe","SDFSSvc.exe","SDWelcome.exe","SDTray.exe"],"NAME":"SPYBOT AntiMalware"},{"PROCESS":["UnThreat.exe","utsvc.exe"],"NAME":"UnThreat Antivirus"},{"PROCESS":["FortiClient.exe","fcappdb.exe","FCDBlog.exe","FCHelper64.exe","fmon.exe","FortiESNAC.exe","FortiProxy.exe","FortiSSLVPNdaemon.exe","FortiTray.exe","FortiFW.exe","FortiClient_Diagnostic_Tool.exe","av_task.exe"],"NAME":"FortiClient"},{"PROCESS":["CertReg.exe","FilMsg.exe","FilUp.exe","filwscc.exe","filwscc.exe","psview.exe","quamgr.exe","quamgr.exe","schmgr.exe","schmgr.exe","twsscan.exe","twssrv.exe","UserReg.exe"],"NAME":"Twister Antivirus"}],"DELAY_CONNECT":1,"SERVER_PATH":"C:\\Users\\user\\eDdlsoVKfgW\\AknzQIkoyKh.qmSBQy","VBOX":false,"RAM":"511.6 MB"}E":"VIPRE Security 20
Source: java.exe, javaw.exe	Binary or memory string: Progman
Source: javaw.exe	Binary or memory string: /{"ACTIVE_WINDOW":"Program Manager","COMMAND":5}]h
Source: javaw.exe	Binary or memory string: /{"ACTIVE_WINDOW":"Program Manager","COMMAND":5}.exe","Bav.exe","BavWebClient.exe","BavUpdater.exe"],"NAME":"Baidu Antivirus 2015"},{"PROCESS":["MCShieldCCC.exe","MCShieldRTM.exe","MCShieldDS.exe","MCS-Uninstall.exe"],"NAME":"MCShield Anti-Malware Tool"},{"PROCESS":["SDScan.exe","SDFSSvc.exe","SDWelcome.exe","SDTray.exe"],"NAME":"SPYBOT AntiMalware"},{"PROCESS":["UnThreat.exe","utsvc.exe"],"NAME":"UnThreat Antivirus"},{"PROCESS":["FortiClient.exe","fcappdb.exe","FCDBlog.exe","FCHelper64.exe","fmon.exe","FortiESNAC.exe","FortiProxy.exe","FortiSSLVPNdaemon.exe","FortiTray.exe","FortiFW.exe","FortiClient_Diagnostic_Tool.exe","av_task.exe"],"NAME":"FortiClient"},{"PROCESS":["CertReg.exe","FilMsg.exe","FilUp.exe","filwscc.exe","filwscc.exe","psview.exe","quamgr.exe","quamgr.exe","schmgr.exe","schmgr.exe","twsscan.exe","twssrv.exe","UserReg.exe"],"NAME":"Twister Antivirus"}],"DELAY_CONNECT":1,"SERVER_PATH":"C:\\Users\\user\\eDdlsoVKfgW\\AknzQIkoyKh.qmSBQy","VBOX":false,"RAM":"511.6 MB"}E":"VIPRE Security 20
Source: javaw.exe	Binary or memory string: t/{"ACTIVE_WINDOW":"Program Manager","COMMAND":5}
Source: java.exe, javaw.exe	Binary or memory string: Program Manager
Source: java.exe, javaw.exe	Binary or memory string: Shell_TrayWnd

Anti Debugging:

Creates guard pages, often used to prevent reverse engineering and debugging

Show sources

Source: C:\Program Files\Java\jre1.8.0_40\bin\java.exe

Memory protected: page read and write and page guard

Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))

Show sources

Source: C:\Program Files\Java\jre1.8.0_40\bin\java.exe

System information queried: KernelDebuggerInformation

Malware Analysis System Evasion:

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Show sources

Source: java.exe	Binary or memory string: {"NETWORK":[{"PORT":7777,"DNS":"127.0.0.1"}],"INSTALL":false,"MODULE_PATH":"zS/lq/BTk.GI","PLUGIN_FOLDER":"DdWDtpinxpf","JRE_FOLDER":"HSIROD","JAR_FOLDER":"fUTkALeaTxM","JAR_EXTENSION":"Vybgol","ENCRYPT_KEY":"cPFjgddXIBcXBCIseEuXTZjwi","DELAY_INSTALL":2,"NICKNAME":"User","VMWARE":false,"PLUGIN_EXTENSION":"DhjWU","WEBSITE_PROJECT":"https://jrat.io","JAR_NAME":"uiylKSALYJr","JAR_REGISTRY":"WLyQyhWoosi","DELAY_CONNECT":2,"VBOX":false}
Source: java.exe	Binary or memory string: VMWARE[@p
Source: javaw.exe	Binary or memory string: _well_known_klasses[SystemDictionary::VirtualMachineError_klass_knum]
Source: javaw.exe	Binary or memory string: VMWARE
Source: javaw.exe	Binary or memory string: Unable to link/verify VirtualMachineError class
Source: javaw.exe	Binary or memory string: java/lang/VirtualMachineError
Source: java.exe	Binary or memory string: VMWARE#H~
Source: java.exe, javaw.exe	Binary or memory string: cjava/lang/VirtualMachineError
Source: javaw.exe	Binary or memory string: k{constant pool}code cache C-heap hand metaspace chunks dict zone strs syms heap threads [Verifying Genesis-2147483648Unable to link/verify Finalizer.register methodUnable to link/verify ClassLoader.addClass methodProtectionDomain.impliesCreateAccessControlContext() has the wrong linkageUnable to link/verify Unsafe.throwIllegalAccessError methodJava heap space: failed reallocation of scalar replaced objectsGC overhead limit exceededRequested array size exceeds VM limitCompressed class spaceJava heap spaceUnable to link/verify VirtualMachineError classD:\re\puppet\workspace\8-2-build-windows-i586-cygwin\jdk8u40\2855\hotspot\src\share\vm\oops\arrayKlass.cpp[]guarantee(component_mirror()->klass() != NULL) failedshould have a classD:\re\puppet\workspace\8-2-build-windows-i586-cygwin\jdk8u40\2855\hotspot\src\share\vm\gc_interface/collectedHeap.inline.hpp - length: %dguarantee(a->length() >= 0) failedarray with negative length?guarantee(obj->is_array()) failedmust be arrayshould be klassguarantee(is_constantPool())
Source: java.exe	Binary or memory string: {"NETWORK":[{"PORT":7777,"DNS":"127.0.0.1"}],"INSTALL":false,"MODULE_PATH":"zS/lq/BTk.GI","PLUGIN_FOLDER":"DdWDtpinxpf","JRE_FOLDER":"HSIROD","JAR_FOLDER":"fUTkALeaTxM","JAR_EXTENSION":"Vybgol","ENCRYPT_KEY":"cPFjgddXIBcXBCIseEuXTZjwi","DELAY_INSTALL":2,"NICKNAME":"User","VMWARE":false,"PLUGIN_EXTENSION":"DhjWU","WEBSITE_PROJECT":"https://jrat.io","JAR_NAME":"uiylKSALYJr","JAR_REGISTRY":"WLyQyhWoosi","DELAY_CONNECT":2,"VBOX":false}
Source: java.exe, javaw.exe	Binary or memory string: $[Ljava/lang/VirtualMachineError;
Source: java.exe	Binary or memory string: VMWARE;

Enumerates the file system

Show sources

Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	File opened: C:\Users\user\AppData\Roaming\Oracle\lib\
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	File opened: C:\Users\user\AppData\Roaming\Oracle\lib\ext\
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	File opened: C:\Users\user\AppData\Roaming\
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	File opened: C:\Users\user\
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	File opened: C:\Users\user\AppData\Roaming\Oracle\
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	File opened: C:\Users\user\AppData\

Found dropped PE file which has not been started or loaded

Show sources

Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\hprof.dll
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\keytool.exe
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\instrument.dll
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\wsdetect.dll
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\tnameserv.exe
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\glass.dll
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\gstreamer-lite.dll
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\java_crw_demo.dll
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\unpack200.exe
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\jp2native.dll
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\unpack.dll
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\jsoundds.dll
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\deploy.dll
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\sunmscapi.dll
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\pack200.exe
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\splashscreen.dll
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\javafx_iio.dll
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\decora_sse.dll
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\javafx_font_t2k.dll
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\ktab.exe
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\rmiregistry.exe
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\javacpl.exe
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\dtplugin\npdeployJava1.dll
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\rmid.exe
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\java-rmi.exe
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\resource.dll
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\jabswitch.exe
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\dcpr.dll
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\t2k.dll
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\kcms.dll
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\prism_sw.dll
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\orbd.exe
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\jsdt.dll
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\jfxmedia.dll
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\JAWTAccessBridge.dll
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\mlib_image.dll
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\fxplugins.dll
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\prism_d3d.dll
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\WindowsAccessBridge.dll
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\jaas_nt.dll
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\w2k_lsa_auth.dll
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\kinit.exe
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\klist.exe
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\jp2iexp.dll
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\jsound.dll
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\npt.dll
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\dtplugin\deployJava1.dll
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\javaws.exe
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\jdwp.dll
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\dt_shmem.dll
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\jfr.dll
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\jfxwebkit.dll
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\fontmanager.dll
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\dt_socket.dll
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\ssv.dll
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\prism_es2.dll
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\javacpl.cpl
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\prism_common.dll
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\jp2launcher.exe
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\JavaAccessBridge.dll
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\servertool.exe
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\plugin2\npjp2.dll
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\bci.dll
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\j2pcsc.dll
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\jp2ssv.dll
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\lcms.dll
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\jpeg.dll
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\glib-lite.dll
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\ssvagent.exe
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\j2pkcs11.dll
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\eula.dll
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\policytool.exe
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\javafx_font.dll
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\jjs.exe
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\jli.dll

May sleep (evasive loops) to hinder dynamic analysis

Show sources

Source: C:\Program Files\Java\jre1.8.0_40\bin\java.exe TID: 3832	Thread sleep time: -100s >= -60s
Source: C:\Windows\System32\cscript.exe TID: 3508	Thread sleep time: -60000s >= -60s
Source: C:\Windows\System32\cscript.exe TID: 3568	Thread sleep time: -60000s >= -60s
Source: C:\Windows\System32\cscript.exe TID: 3640	Thread sleep time: -60000s >= -60s
Source: C:\Windows\System32\cscript.exe TID: 3700	Thread sleep time: -60000s >= -60s
Source: C:\Windows\System32\cscript.exe TID: 4068	Thread sleep time: -60000s >= -60s
Source: C:\Windows\System32\cscript.exe TID: 2232	Thread sleep time: -60000s >= -60s
Source: C:\Windows\System32\cscript.exe TID: 2200	Thread sleep time: -60000s >= -60s
Source: C:\Windows\System32\cscript.exe TID: 772	Thread sleep time: -60000s >= -60s

Tries to detect sandboxes and other dynamic analysis tools (process name)

Show sources

Source: java.exe, javaw.exe	Binary or memory string: WIRESHARK.EXE
Source: java.exe, javaw.exe	Binary or memory string: PROCEXP.EXE
Source: java.exe, javaw.exe	Binary or memory string: SUPERANTISPYWARE.EXE
Source: java.exe, javaw.exe	Binary or memory string: DUMPCAP.EXE

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Show sources

Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Java\jre1.8.0_40\bin\java.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Java\jre1.8.0_40\bin\java.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Java\jre1.8.0_40\bin\java.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Java\jre1.8.0_40\bin\java.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Java\jre1.8.0_40\bin\java.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX

Lowering of HIPS / PFW / Operating System Security Settings:

AV process strings found (often used to terminate AV products)

Show sources

Source: java.exe, javaw.exe	Binary or memory string: K7TSMngr.exe
Source: java.exe, javaw.exe	Binary or memory string: SCANWSCS.EXE
Source: java.exe, javaw.exe	Binary or memory string: FSMA32.EXE
Source: java.exe, javaw.exe	Binary or memory string: K7PSSrvc.exe
Source: java.exe, javaw.exe	Binary or memory string: SBAMSvc.exe
Source: java.exe, javaw.exe	Binary or memory string: procexp.exe
Source: java.exe, javaw.exe	Binary or memory string: FPWin.exe
Source: java.exe, javaw.exe	Binary or memory string: MSASCui.exe
Source: java.exe, javaw.exe	Binary or memory string: QUHLPSVC.EXE
Source: java.exe, javaw.exe	Binary or memory string: wireshark.exe
Source: java.exe, javaw.exe	Binary or memory string: EMLPROXY.EXE
Source: java.exe, javaw.exe	Binary or memory string: BullGuard.exe
Source: java.exe, javaw.exe	Binary or memory string: guardxservice.exe
Source: java.exe, javaw.exe	Binary or memory string: acs.exe
Source: java.exe, javaw.exe	Binary or memory string: K7TSecurity.exe
Source: java.exe, javaw.exe	Binary or memory string: FProtTray.exe
Source: java.exe, javaw.exe	Binary or memory string: op_mon.exe
Source: java.exe, javaw.exe	Binary or memory string: AVKService.exe
Source: java.exe, javaw.exe	Binary or memory string: fsgk32.exe
Source: java.exe, javaw.exe	Binary or memory string: virusutilities.exe
Source: java.exe, javaw.exe	Binary or memory string: FPAVServer.exe
Source: java.exe, javaw.exe	Binary or memory string: K7RTScan.exe
Source: java.exe, javaw.exe	Binary or memory string: cmdagent.exe
Source: java.exe, javaw.exe	Binary or memory string: ONLINENT.EXE
Source: java.exe, javaw.exe	Binary or memory string: SUPERAntiSpyware.exe
Source: java.exe, javaw.exe	Binary or memory string: MsMpEng.exe
Source: java.exe, javaw.exe	Binary or memory string: AVKTray.exe
Source: java.exe, javaw.exe	Binary or memory string: ClamTray.exe
Source: java.exe, javaw.exe	Binary or memory string: K7EmlPxy.EXE
Source: java.exe, javaw.exe	Binary or memory string: ClamWin.exe
Source: java.exe, javaw.exe	Binary or memory string: FSM32.EXE
Source: java.exe, javaw.exe	Binary or memory string: SBAMTray.exe
Source: java.exe, javaw.exe	Binary or memory string: K7FWSrvc.exe
Source: java.exe, javaw.exe	Binary or memory string: mbam.exe
Source: java.exe, javaw.exe	Binary or memory string: AVKProxy.exe
Source: java.exe, javaw.exe	Binary or memory string: FilMsg.exe

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Show sources

Source: C:\Windows\System32\cscript.exe	WMI Queries: IWbemServices::ExecQuery - Select * from AntiVirusProduct
Source: C:\Windows\System32\cscript.exe	WMI Queries: IWbemServices::ExecQuery - Select * from FirewallProduct
Source: C:\Windows\System32\cscript.exe	WMI Queries: IWbemServices::ExecQuery - Select * from AntiVirusProduct
Source: C:\Windows\System32\cscript.exe	WMI Queries: IWbemServices::ExecQuery - Select * from FirewallProduct
Source: C:\Windows\System32\cscript.exe	WMI Queries: IWbemServices::ExecQuery - Select * from AntiVirusProduct
Source: C:\Windows\System32\cscript.exe	WMI Queries: IWbemServices::ExecQuery - Select * from AntiVirusProduct
Source: C:\Windows\System32\cscript.exe	WMI Queries: IWbemServices::ExecQuery - Select * from FirewallProduct
Source: C:\Windows\System32\cscript.exe	WMI Queries: IWbemServices::ExecQuery - Select * from FirewallProduct

Language, Device and Operating System Detection:

Queries the cryptographic machine GUID

Show sources

Source: C:\Program Files\Java\jre1.8.0_40\bin\java.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Queries time zone information

Show sources

Source: C:\Program Files\Java\jre1.8.0_40\bin\java.exe

Key value queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\TimeZoneInformation DynamicDaylightTimeDisabled

Behavior Graph

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report

Overview

General Information

Detection

Confidence

Classification

Analysis Advice

Signature Overview

DDoS:

Software Vulnerabilities:

Networking:

Boot Survival:

Remote Access Functionality:

Persistence and Installation Behavior:

Spreading:

System Summary:

HIPS / PFW / Operating System Protection Evasion:

Anti Debugging:

Malware Analysis System Evasion:

Hooking and other Techniques for Hiding and Protection:

Lowering of HIPS / PFW / Operating System Security Settings:

Language, Device and Operating System Detection:

Behavior Graph