Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
34s -
max time network
39s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
21/10/2023, 12:39
Static task
static1
Behavioral task
behavioral1
Sample
Pizza_Loader_V2.jar
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
Pizza_Loader_V2.jar
Resource
win10v2004-20231020-en
General
-
Target
Pizza_Loader_V2.jar
-
Size
265KB
-
MD5
dbeb760882f19bc1c2805ff91ae9f46f
-
SHA1
1eff0c45fe24adcfa3dcd4eaac3c9919c5fd0886
-
SHA256
b1431f72e44f71eb646cc0cb0dd55536427e56883ce8d850f11a38a684a2aff8
-
SHA512
5879916166861a91dd1b5d09f3ef9e64c86ac71f297e30aa7f46e3f29b864dff4516190f9985ac8e0c140063cbfd8e5516c98a49834adc83623325ded0d09050
-
SSDEEP
6144:mYLXsP+rk7gbFYXW3LSdicFPFl/EyJlxsAnViW2tQyp:zbsP+nmXZDFNxXVmthp
Malware Config
Signatures
-
Modifies file permissions 1 TTPs 1 IoCs
pid Process 4076 icacls.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3128 wrote to memory of 4076 3128 java.exe 85 PID 3128 wrote to memory of 4076 3128 java.exe 85
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\Pizza_Loader_V2.jar1⤵
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
PID:4076
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46B
MD578a868cf6ac16dd34a091721834003d3
SHA180bc0ec148faaed5d1c375b306b5d2df77b1b7c6
SHA256346746e9edfee3240b739fdc7a5bbd46e52b87b6f25ede49692168b34c04c1d8
SHA512cab0553a37e442a30337124a9bf079771728b90c747d6ee12456717919fa3329053fc6aa724f426a64771fc22ccb965fb61c4b297c1e3962c62b2fd0eb9aebf5