Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
3Static
static
Struts2神...XP.exe
windows7-x64
1Struts2神...XP.exe
windows10-2004-x64
1Struts2神...it.exe
windows7-x64
1Struts2神...it.exe
windows10-2004-x64
1Struts2神...xp.jar
windows7-x64
1Struts2神...xp.jar
windows10-2004-x64
1Struts2神....class
windows7-x64
3Struts2神....class
windows10-2004-x64
3Struts2神....class
windows7-x64
3Struts2神....class
windows10-2004-x64
3Struts2神....class
windows7-x64
3Struts2神....class
windows10-2004-x64
3Struts2神....class
windows7-x64
3Struts2神....class
windows10-2004-x64
3Struts2神....class
windows7-x64
3Struts2神....class
windows10-2004-x64
3Struts2神....class
windows7-x64
3Struts2神....class
windows10-2004-x64
3Struts2神....class
windows7-x64
3Struts2神....class
windows10-2004-x64
3Struts2神....class
windows7-x64
3Struts2神....class
windows10-2004-x64
3Struts2神....class
windows7-x64
3Struts2神....class
windows10-2004-x64
3Struts2神....class
windows7-x64
3Struts2神....class
windows10-2004-x64
3Struts2神....class
windows7-x64
3Struts2神....class
windows10-2004-x64
3Struts2神....class
windows7-x64
3Struts2神....class
windows10-2004-x64
3Struts2神....class
windows7-x64
3Struts2神....class
windows10-2004-x64
3Analysis
-
max time kernel
147s -
max time network
194s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23/11/2022, 19:20
Static task
static1
Behavioral task
behavioral1
Sample
Struts2神器集合/K8_Struts2.3.1.4 利用工具/K8_Struts2_EXP.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Struts2神器集合/K8_Struts2.3.1.4 利用工具/K8_Struts2_EXP.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
Struts2神器集合/Structs2 Exploit.exe
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
Struts2神器集合/Structs2 Exploit.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral5
Sample
Struts2神器集合/struts2漏洞利用/Jar版/Struts2Exp.jar
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
Struts2神器集合/struts2漏洞利用/Jar版/Struts2Exp.jar
Resource
win10v2004-20221111-en
Behavioral task
behavioral7
Sample
Struts2神器集合/struts2漏洞利用/Jar版/Struts2Exp/Main.class
Resource
win7-20221111-en
Behavioral task
behavioral8
Sample
Struts2神器集合/struts2漏洞利用/Jar版/Struts2Exp/Main.class
Resource
win10v2004-20221111-en
Behavioral task
behavioral9
Sample
Struts2神器集合/struts2漏洞利用/Jar版/Struts2Exp/Shell$StreamConnector.class
Resource
win7-20221111-en
Behavioral task
behavioral10
Sample
Struts2神器集合/struts2漏洞利用/Jar版/Struts2Exp/Shell$StreamConnector.class
Resource
win10v2004-20221111-en
Behavioral task
behavioral11
Sample
Struts2神器集合/struts2漏洞利用/Jar版/Struts2Exp/Shell.class
Resource
win7-20221111-en
Behavioral task
behavioral12
Sample
Struts2神器集合/struts2漏洞利用/Jar版/Struts2Exp/Shell.class
Resource
win10v2004-20220901-en
Behavioral task
behavioral13
Sample
Struts2神器集合/struts2漏洞利用/Jar版/Struts2Exp/Struts2Exploit$1.class
Resource
win7-20220901-en
Behavioral task
behavioral14
Sample
Struts2神器集合/struts2漏洞利用/Jar版/Struts2Exp/Struts2Exploit$1.class
Resource
win10v2004-20220812-en
Behavioral task
behavioral15
Sample
Struts2神器集合/struts2漏洞利用/Jar版/Struts2Exp/Struts2Exploit$10.class
Resource
win7-20221111-en
Behavioral task
behavioral16
Sample
Struts2神器集合/struts2漏洞利用/Jar版/Struts2Exp/Struts2Exploit$10.class
Resource
win10v2004-20221111-en
Behavioral task
behavioral17
Sample
Struts2神器集合/struts2漏洞利用/Jar版/Struts2Exp/Struts2Exploit$11.class
Resource
win7-20220901-en
Behavioral task
behavioral18
Sample
Struts2神器集合/struts2漏洞利用/Jar版/Struts2Exp/Struts2Exploit$11.class
Resource
win10v2004-20220901-en
Behavioral task
behavioral19
Sample
Struts2神器集合/struts2漏洞利用/Jar版/Struts2Exp/Struts2Exploit$12.class
Resource
win7-20220812-en
Behavioral task
behavioral20
Sample
Struts2神器集合/struts2漏洞利用/Jar版/Struts2Exp/Struts2Exploit$12.class
Resource
win10v2004-20220812-en
Behavioral task
behavioral21
Sample
Struts2神器集合/struts2漏洞利用/Jar版/Struts2Exp/Struts2Exploit$13.class
Resource
win7-20221111-en
Behavioral task
behavioral22
Sample
Struts2神器集合/struts2漏洞利用/Jar版/Struts2Exp/Struts2Exploit$13.class
Resource
win10v2004-20221111-en
Behavioral task
behavioral23
Sample
Struts2神器集合/struts2漏洞利用/Jar版/Struts2Exp/Struts2Exploit$14.class
Resource
win7-20221111-en
Behavioral task
behavioral24
Sample
Struts2神器集合/struts2漏洞利用/Jar版/Struts2Exp/Struts2Exploit$14.class
Resource
win10v2004-20220901-en
Behavioral task
behavioral25
Sample
Struts2神器集合/struts2漏洞利用/Jar版/Struts2Exp/Struts2Exploit$15.class
Resource
win7-20221111-en
Behavioral task
behavioral26
Sample
Struts2神器集合/struts2漏洞利用/Jar版/Struts2Exp/Struts2Exploit$15.class
Resource
win10v2004-20221111-en
Behavioral task
behavioral27
Sample
Struts2神器集合/struts2漏洞利用/Jar版/Struts2Exp/Struts2Exploit$16.class
Resource
win7-20221111-en
Behavioral task
behavioral28
Sample
Struts2神器集合/struts2漏洞利用/Jar版/Struts2Exp/Struts2Exploit$16.class
Resource
win10v2004-20221111-en
Behavioral task
behavioral29
Sample
Struts2神器集合/struts2漏洞利用/Jar版/Struts2Exp/Struts2Exploit$17.class
Resource
win7-20221111-en
Behavioral task
behavioral30
Sample
Struts2神器集合/struts2漏洞利用/Jar版/Struts2Exp/Struts2Exploit$17.class
Resource
win10v2004-20221111-en
Behavioral task
behavioral31
Sample
Struts2神器集合/struts2漏洞利用/Jar版/Struts2Exp/Struts2Exploit$18.class
Resource
win7-20221111-en
Behavioral task
behavioral32
Sample
Struts2神器集合/struts2漏洞利用/Jar版/Struts2Exp/Struts2Exploit$18.class
Resource
win10v2004-20221111-en
General
-
Target
Struts2神器集合/struts2漏洞利用/Jar版/Struts2Exp/Main.class
-
Size
1KB
-
MD5
b131da4c6f99773b0e69b6bffeaa61df
-
SHA1
384d6076a30750e0d8226f3c087bf2243843a486
-
SHA256
8b5fa767ecd68f3056b4b62d1d71f270cc1987a27a5716bfc218762491aa2622
-
SHA512
1b393c95199b5451f6c279922f242e2aa0f3db6f602c52b63187474f3edc3f2e51232ee6b27d4eb3e0aa931063df51c26cd08d3532ef4837d56fd4b129aa5db0
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2780 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Struts2神器集合\struts2漏洞利用\Jar版\Struts2Exp\Main.class1⤵
- Modifies registry class
PID:1904
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2780