Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
27s -
max time network
112s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
19/11/2020, 07:29
Static task
static1
Behavioral task
behavioral1
Sample
PO Quotation.jar
Resource
win7v20201028
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
PO Quotation.jar
Resource
win10v20201028
0 signatures
0 seconds
General
-
Target
PO Quotation.jar
-
Size
89KB
-
MD5
1cc049bd0c76d165ac6f78afd0474c6f
-
SHA1
38503f829afd9f9e17d2f72fda89adab6e598129
-
SHA256
c79a8f611b934f2630d4b6fb91240048cc85ecb354f75e01d6a2c444e8c12eed
-
SHA512
60753e595658dda0d91cb358c2fe3b84137ce11e0d814fbd1a99cd32d7d0ae06a04ea37a228b1665de73d4bed43e88b7a36961eb5b40c67e335b5adb4270a16d
Score
10/10
Malware Config
Signatures
-
QNodeService
Trojan/stealer written in NodeJS and spread via Java downloader.
-
Executes dropped EXE 1 IoCs
pid Process 1564 node.exe -
JavaScript code in executable 1 IoCs
resource yara_rule behavioral2/files/0x000100000001ab81-179.dat js -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1564 node.exe 1564 node.exe 1564 node.exe 1564 node.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 656 wrote to memory of 3488 656 java.exe 76 PID 656 wrote to memory of 3488 656 java.exe 76 PID 3488 wrote to memory of 1564 3488 javaw.exe 80 PID 3488 wrote to memory of 1564 3488 javaw.exe 80
Processes
-
C:\ProgramData\Oracle\Java\javapath\java.exejava -jar "C:\Users\Admin\AppData\Local\Temp\PO Quotation.jar"1⤵
- Suspicious use of WriteProcessMemory
PID:656 -
C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe"C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar C:\Users\Admin\AppData\Local\Temp\6dc06c06.tmp2⤵
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Users\Admin\node-v14.12.0-win-x64\node.exeC:\Users\Admin\node-v14.12.0-win-x64\node.exe - --hub-domain marshost.publicvm.com3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1564
-
-