Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
69s -
max time network
138s -
platform
windows10_x64 -
resource
win10 -
submitted
10/07/2020, 07:19
Static task
static1
Behavioral task
behavioral1
Sample
b0a88a803f35ab00b35171aaf61e6f17.jar
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
b0a88a803f35ab00b35171aaf61e6f17.jar
Resource
win10
windows10_x64
0 signatures
0 seconds
General
-
Target
b0a88a803f35ab00b35171aaf61e6f17.jar
-
Size
437KB
-
MD5
b0a88a803f35ab00b35171aaf61e6f17
-
SHA1
f3987e79b8d2f890bd6304e19887ca08dc3e8b17
-
SHA256
0dd2914c7d8afce5153d8b1c96bc1645b91407dd636184bc13c8b6a367ef7a26
-
SHA512
9e8a618be9d12de7758210dff2b27df1b7b1eda2b109c456ad4a8188b37f5efc5dc7e3653dcff51d63bbe71e2a711c6ddfdc09475da8fb5fd2c76097ef45df60
Score
7/10
Malware Config
Signatures
-
Views/modifies file attributes 1 TTPs 8 IoCs
pid Process 1044 attrib.exe 3276 attrib.exe 3616 attrib.exe 3476 attrib.exe 3364 attrib.exe 580 attrib.exe 900 attrib.exe 1000 attrib.exe -
Adds Run entry to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\BcHSiEX = "\"C:\\Users\\Admin\\Oracle\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\PLSnk\\AMQaB.class\"" java.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run java.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\BcHSiEX = "\"C:\\Users\\Admin\\Oracle\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\PLSnk\\AMQaB.class\"" java.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce java.exe -
Drops desktop.ini file(s) 4 IoCs
description ioc Process File opened for modification C:\Users\Admin\PLSnk\Desktop.ini java.exe File created C:\Users\Admin\PLSnk\Desktop.ini java.exe File opened for modification C:\Users\Admin\PLSnk\Desktop.ini attrib.exe File opened for modification C:\Users\Admin\PLSnk\Desktop.ini attrib.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3868 java.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 3868 wrote to memory of 736 3868 java.exe 68 PID 3868 wrote to memory of 736 3868 java.exe 68 PID 3868 wrote to memory of 2640 3868 java.exe 70 PID 3868 wrote to memory of 2640 3868 java.exe 70 PID 2640 wrote to memory of 3608 2640 cmd.exe 72 PID 2640 wrote to memory of 3608 2640 cmd.exe 72 PID 3868 wrote to memory of 3044 3868 java.exe 73 PID 3868 wrote to memory of 3044 3868 java.exe 73 PID 3044 wrote to memory of 4004 3044 cmd.exe 75 PID 3044 wrote to memory of 4004 3044 cmd.exe 75 PID 3868 wrote to memory of 3276 3868 java.exe 76 PID 3868 wrote to memory of 3276 3868 java.exe 76 PID 3868 wrote to memory of 3616 3868 java.exe 78 PID 3868 wrote to memory of 3616 3868 java.exe 78 PID 3868 wrote to memory of 3476 3868 java.exe 80 PID 3868 wrote to memory of 3476 3868 java.exe 80 PID 3868 wrote to memory of 3364 3868 java.exe 81 PID 3868 wrote to memory of 3364 3868 java.exe 81 PID 3868 wrote to memory of 580 3868 java.exe 83 PID 3868 wrote to memory of 580 3868 java.exe 83 PID 3868 wrote to memory of 900 3868 java.exe 85 PID 3868 wrote to memory of 900 3868 java.exe 85 PID 3868 wrote to memory of 1000 3868 java.exe 87 PID 3868 wrote to memory of 1000 3868 java.exe 87 PID 3868 wrote to memory of 1044 3868 java.exe 89 PID 3868 wrote to memory of 1044 3868 java.exe 89 PID 3868 wrote to memory of 2012 3868 java.exe 92 PID 3868 wrote to memory of 2012 3868 java.exe 92 PID 2012 wrote to memory of 2160 2012 cmd.exe 94 PID 2012 wrote to memory of 2160 2012 cmd.exe 94 -
Suspicious use of AdjustPrivilegeToken 126 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3608 WMIC.exe Token: SeSecurityPrivilege 3608 WMIC.exe Token: SeTakeOwnershipPrivilege 3608 WMIC.exe Token: SeLoadDriverPrivilege 3608 WMIC.exe Token: SeSystemProfilePrivilege 3608 WMIC.exe Token: SeSystemtimePrivilege 3608 WMIC.exe Token: SeProfSingleProcessPrivilege 3608 WMIC.exe Token: SeIncBasePriorityPrivilege 3608 WMIC.exe Token: SeCreatePagefilePrivilege 3608 WMIC.exe Token: SeBackupPrivilege 3608 WMIC.exe Token: SeRestorePrivilege 3608 WMIC.exe Token: SeShutdownPrivilege 3608 WMIC.exe Token: SeDebugPrivilege 3608 WMIC.exe Token: SeSystemEnvironmentPrivilege 3608 WMIC.exe Token: SeRemoteShutdownPrivilege 3608 WMIC.exe Token: SeUndockPrivilege 3608 WMIC.exe Token: SeManageVolumePrivilege 3608 WMIC.exe Token: 33 3608 WMIC.exe Token: 34 3608 WMIC.exe Token: 35 3608 WMIC.exe Token: 36 3608 WMIC.exe Token: SeIncreaseQuotaPrivilege 3608 WMIC.exe Token: SeSecurityPrivilege 3608 WMIC.exe Token: SeTakeOwnershipPrivilege 3608 WMIC.exe Token: SeLoadDriverPrivilege 3608 WMIC.exe Token: SeSystemProfilePrivilege 3608 WMIC.exe Token: SeSystemtimePrivilege 3608 WMIC.exe Token: SeProfSingleProcessPrivilege 3608 WMIC.exe Token: SeIncBasePriorityPrivilege 3608 WMIC.exe Token: SeCreatePagefilePrivilege 3608 WMIC.exe Token: SeBackupPrivilege 3608 WMIC.exe Token: SeRestorePrivilege 3608 WMIC.exe Token: SeShutdownPrivilege 3608 WMIC.exe Token: SeDebugPrivilege 3608 WMIC.exe Token: SeSystemEnvironmentPrivilege 3608 WMIC.exe Token: SeRemoteShutdownPrivilege 3608 WMIC.exe Token: SeUndockPrivilege 3608 WMIC.exe Token: SeManageVolumePrivilege 3608 WMIC.exe Token: 33 3608 WMIC.exe Token: 34 3608 WMIC.exe Token: 35 3608 WMIC.exe Token: 36 3608 WMIC.exe Token: SeIncreaseQuotaPrivilege 4004 WMIC.exe Token: SeSecurityPrivilege 4004 WMIC.exe Token: SeTakeOwnershipPrivilege 4004 WMIC.exe Token: SeLoadDriverPrivilege 4004 WMIC.exe Token: SeSystemProfilePrivilege 4004 WMIC.exe Token: SeSystemtimePrivilege 4004 WMIC.exe Token: SeProfSingleProcessPrivilege 4004 WMIC.exe Token: SeIncBasePriorityPrivilege 4004 WMIC.exe Token: SeCreatePagefilePrivilege 4004 WMIC.exe Token: SeBackupPrivilege 4004 WMIC.exe Token: SeRestorePrivilege 4004 WMIC.exe Token: SeShutdownPrivilege 4004 WMIC.exe Token: SeDebugPrivilege 4004 WMIC.exe Token: SeSystemEnvironmentPrivilege 4004 WMIC.exe Token: SeRemoteShutdownPrivilege 4004 WMIC.exe Token: SeUndockPrivilege 4004 WMIC.exe Token: SeManageVolumePrivilege 4004 WMIC.exe Token: 33 4004 WMIC.exe Token: 34 4004 WMIC.exe Token: 35 4004 WMIC.exe Token: 36 4004 WMIC.exe Token: SeIncreaseQuotaPrivilege 4004 WMIC.exe Token: SeSecurityPrivilege 4004 WMIC.exe Token: SeTakeOwnershipPrivilege 4004 WMIC.exe Token: SeLoadDriverPrivilege 4004 WMIC.exe Token: SeSystemProfilePrivilege 4004 WMIC.exe Token: SeSystemtimePrivilege 4004 WMIC.exe Token: SeProfSingleProcessPrivilege 4004 WMIC.exe Token: SeIncBasePriorityPrivilege 4004 WMIC.exe Token: SeCreatePagefilePrivilege 4004 WMIC.exe Token: SeBackupPrivilege 4004 WMIC.exe Token: SeRestorePrivilege 4004 WMIC.exe Token: SeShutdownPrivilege 4004 WMIC.exe Token: SeDebugPrivilege 4004 WMIC.exe Token: SeSystemEnvironmentPrivilege 4004 WMIC.exe Token: SeRemoteShutdownPrivilege 4004 WMIC.exe Token: SeUndockPrivilege 4004 WMIC.exe Token: SeManageVolumePrivilege 4004 WMIC.exe Token: 33 4004 WMIC.exe Token: 34 4004 WMIC.exe Token: 35 4004 WMIC.exe Token: 36 4004 WMIC.exe Token: SeIncreaseQuotaPrivilege 2160 WMIC.exe Token: SeSecurityPrivilege 2160 WMIC.exe Token: SeTakeOwnershipPrivilege 2160 WMIC.exe Token: SeLoadDriverPrivilege 2160 WMIC.exe Token: SeSystemProfilePrivilege 2160 WMIC.exe Token: SeSystemtimePrivilege 2160 WMIC.exe Token: SeProfSingleProcessPrivilege 2160 WMIC.exe Token: SeIncBasePriorityPrivilege 2160 WMIC.exe Token: SeCreatePagefilePrivilege 2160 WMIC.exe Token: SeBackupPrivilege 2160 WMIC.exe Token: SeRestorePrivilege 2160 WMIC.exe Token: SeShutdownPrivilege 2160 WMIC.exe Token: SeDebugPrivilege 2160 WMIC.exe Token: SeSystemEnvironmentPrivilege 2160 WMIC.exe Token: SeRemoteShutdownPrivilege 2160 WMIC.exe Token: SeUndockPrivilege 2160 WMIC.exe Token: SeManageVolumePrivilege 2160 WMIC.exe Token: 33 2160 WMIC.exe Token: 34 2160 WMIC.exe Token: 35 2160 WMIC.exe Token: 36 2160 WMIC.exe Token: SeIncreaseQuotaPrivilege 2160 WMIC.exe Token: SeSecurityPrivilege 2160 WMIC.exe Token: SeTakeOwnershipPrivilege 2160 WMIC.exe Token: SeLoadDriverPrivilege 2160 WMIC.exe Token: SeSystemProfilePrivilege 2160 WMIC.exe Token: SeSystemtimePrivilege 2160 WMIC.exe Token: SeProfSingleProcessPrivilege 2160 WMIC.exe Token: SeIncBasePriorityPrivilege 2160 WMIC.exe Token: SeCreatePagefilePrivilege 2160 WMIC.exe Token: SeBackupPrivilege 2160 WMIC.exe Token: SeRestorePrivilege 2160 WMIC.exe Token: SeShutdownPrivilege 2160 WMIC.exe Token: SeDebugPrivilege 2160 WMIC.exe Token: SeSystemEnvironmentPrivilege 2160 WMIC.exe Token: SeRemoteShutdownPrivilege 2160 WMIC.exe Token: SeUndockPrivilege 2160 WMIC.exe Token: SeManageVolumePrivilege 2160 WMIC.exe Token: 33 2160 WMIC.exe Token: 34 2160 WMIC.exe Token: 35 2160 WMIC.exe Token: 36 2160 WMIC.exe -
Loads dropped DLL 1 IoCs
pid Process 3868 java.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\System32\IMShy java.exe File opened for modification C:\Windows\System32\IMShy java.exe
Processes
-
C:\ProgramData\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\b0a88a803f35ab00b35171aaf61e6f17.jar1⤵
- Adds Run entry to start application
- Drops desktop.ini file(s)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
- Drops file in System32 directory
PID:3868 -
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵PID:736
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3608
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /Format:List3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4004
-
-
-
C:\Windows\SYSTEM32\attrib.exeattrib +h C:\Users\Admin\Oracle2⤵
- Views/modifies file attributes
PID:3276
-
-
C:\Windows\SYSTEM32\attrib.exeattrib +h +r +s C:\Users\Admin\.ntusernt.ini2⤵
- Views/modifies file attributes
PID:3616
-
-
C:\Windows\SYSTEM32\attrib.exeattrib -s -r C:\Users\Admin\PLSnk\Desktop.ini2⤵
- Views/modifies file attributes
- Drops desktop.ini file(s)
PID:3476
-
-
C:\Windows\SYSTEM32\attrib.exeattrib +s +r C:\Users\Admin\PLSnk\Desktop.ini2⤵
- Views/modifies file attributes
- Drops desktop.ini file(s)
PID:3364
-
-
C:\Windows\SYSTEM32\attrib.exeattrib -s -r C:\Users\Admin\PLSnk2⤵
- Views/modifies file attributes
PID:580
-
-
C:\Windows\SYSTEM32\attrib.exeattrib +s +r C:\Users\Admin\PLSnk2⤵
- Views/modifies file attributes
PID:900
-
-
C:\Windows\SYSTEM32\attrib.exeattrib +h C:\Users\Admin\PLSnk2⤵
- Views/modifies file attributes
PID:1000
-
-
C:\Windows\SYSTEM32\attrib.exeattrib +h +s +r C:\Users\Admin\PLSnk\AMQaB.class2⤵
- Views/modifies file attributes
PID:1044
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Windows\System32\Wbem\WMIC.exewmic /Node:localhost /Namespace:\\root\cimv2 Path Win32_PnpSignedDriver Get /Format:List3⤵PID:2160
-
-