Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    16s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231020-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/10/2023, 16:10

General

  • Target

    hoplite-installer-1.0.9.exe

  • Size

    5.9MB

  • MD5

    3f18a99e372302985faf8948d246304d

  • SHA1

    534708c9d565039417f855a8ed617eb09380237a

  • SHA256

    5f407bb095071cb12ba4937eee642d209cd8504947c992f3cd9eacfc122a6a56

  • SHA512

    031a6f5a68d1acccbf92ee481a3c0f5bd077d720f31d8382b62d72f261455096d4323baf343151732271195248c84bbb1bc50279b079057bd7fafd13b8f726d1

  • SSDEEP

    98304:IhIQhosO00tCc0rg21bCv0LFByOVmU2Uo8Yu8WACpKZB2qI7fr+Q5QqzxWCM:AIQU00tArLfLFoOV2l8FlA8KZB2qI7fs

Score
7/10

Malware Config

Signatures

  • Modifies file permissions 1 TTPs 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\hoplite-installer-1.0.9.exe
    "C:\Users\Admin\AppData\Local\Temp\hoplite-installer-1.0.9.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1156
    • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe
      "javaw.exe" "-version"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3264
      • C:\Windows\system32\icacls.exe
        C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
        3⤵
        • Modifies file permissions
        PID:4540
    • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe
      "javaw.exe" "-jar" "C:\Users\Admin\AppData\Local\Temp\hoplite-installer-1.0.9.exe" "-fabricInstallerBootstrap" "true"
      2⤵
        PID:908

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

      Filesize

      46B

      MD5

      44beb4f2e751fbcbded98adc461ac13f

      SHA1

      eaec353fb49bcaf324d6a063357d97360be7cc1e

      SHA256

      f522d036759c9761fe3682a000e109b3a1bf946494c5fdb1a8123e7af13cf578

      SHA512

      32656e26742c9abb8452119dc0366f7c7493a9872f8bcff6e7fb1b85242a15e190e40cd35e57db0716571fbe80a695a00351289e1d4e33f1c5080527774cad9f

    • memory/3264-2-0x0000019680000000-0x0000019681000000-memory.dmp

      Filesize

      16.0MB

    • memory/3264-12-0x00000196F8420000-0x00000196F8421000-memory.dmp

      Filesize

      4KB