Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
16s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
23/10/2023, 16:10
Static task
static1
Behavioral task
behavioral1
Sample
hoplite-installer-1.0.9.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
hoplite-installer-1.0.9.exe
Resource
win10v2004-20231020-en
General
-
Target
hoplite-installer-1.0.9.exe
-
Size
5.9MB
-
MD5
3f18a99e372302985faf8948d246304d
-
SHA1
534708c9d565039417f855a8ed617eb09380237a
-
SHA256
5f407bb095071cb12ba4937eee642d209cd8504947c992f3cd9eacfc122a6a56
-
SHA512
031a6f5a68d1acccbf92ee481a3c0f5bd077d720f31d8382b62d72f261455096d4323baf343151732271195248c84bbb1bc50279b079057bd7fafd13b8f726d1
-
SSDEEP
98304:IhIQhosO00tCc0rg21bCv0LFByOVmU2Uo8Yu8WACpKZB2qI7fr+Q5QqzxWCM:AIQU00tArLfLFoOV2l8FlA8KZB2qI7fs
Malware Config
Signatures
-
Modifies file permissions 1 TTPs 1 IoCs
pid Process 4540 icacls.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1156 wrote to memory of 3264 1156 hoplite-installer-1.0.9.exe 85 PID 1156 wrote to memory of 3264 1156 hoplite-installer-1.0.9.exe 85 PID 3264 wrote to memory of 4540 3264 javaw.exe 87 PID 3264 wrote to memory of 4540 3264 javaw.exe 87 PID 1156 wrote to memory of 908 1156 hoplite-installer-1.0.9.exe 89 PID 1156 wrote to memory of 908 1156 hoplite-installer-1.0.9.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\hoplite-installer-1.0.9.exe"C:\Users\Admin\AppData\Local\Temp\hoplite-installer-1.0.9.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe"javaw.exe" "-version"2⤵
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M3⤵
- Modifies file permissions
PID:4540
-
-
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe"javaw.exe" "-jar" "C:\Users\Admin\AppData\Local\Temp\hoplite-installer-1.0.9.exe" "-fabricInstallerBootstrap" "true"2⤵PID:908
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46B
MD544beb4f2e751fbcbded98adc461ac13f
SHA1eaec353fb49bcaf324d6a063357d97360be7cc1e
SHA256f522d036759c9761fe3682a000e109b3a1bf946494c5fdb1a8123e7af13cf578
SHA51232656e26742c9abb8452119dc0366f7c7493a9872f8bcff6e7fb1b85242a15e190e40cd35e57db0716571fbe80a695a00351289e1d4e33f1c5080527774cad9f