Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    130s
  • max time network
    133s
  • platform
    windows10_x64
  • resource
    win10v200722
  • submitted
    05/10/2020, 13:12

General

  • Target

    Slip_10.1.2020.jar

  • Size

    126KB

  • MD5

    c409b8088011c0c7f0a60104856aaad0

  • SHA1

    700105ddc1b0ec309b51dbbcc3f0c4d9f4d19b51

  • SHA256

    b1c54b134f69cda656090b49dfdfc51389c0ae0c5825b2b9812d13d58d528f21

  • SHA512

    8d38452fe3d6a5f1cdad504046d211ec1acf9264f2d70aea70c715f07997f7793fbfc682321adc4d6d8ee442fc56092fcb2fcfb7e5f29b04b3806658df4990b8

Score
10/10

Malware Config

Signatures

  • QNodeService

    Trojan/stealer written in NodeJS and spread via Java downloader.

  • Executes dropped EXE 1 IoCs
  • JavaScript code in executable 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\ProgramData\Oracle\Java\javapath\java.exe
    java -jar C:\Users\Admin\AppData\Local\Temp\Slip_10.1.2020.jar
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1568
    • C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
      "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar C:\Users\Admin\AppData\Local\Temp\e4569cc6.tmp
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2904
      • C:\Users\Admin\node-v14.12.0-win-x64\node.exe
        C:\Users\Admin\node-v14.12.0-win-x64\node.exe - --hub-domain localhost --hub-domain ramos01.hopto.org
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:3676

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3676-169-0x000001763B900000-0x000001763B901000-memory.dmp

    Filesize

    4KB