Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/12/2023, 13:55

General

  • Target

    ssh.jar

  • Size

    36KB

  • MD5

    1cdc2c45232110551b6e21a43a067cb3

  • SHA1

    f8e661aab0e09b8d8b663d1e339cc637a6e16978

  • SHA256

    0b2c1618bab989ab3146a97b0913da5203025d7f7874d0e14fca6e1dba726615

  • SHA512

    e22293ead032ced2669e7876ade1d82f5c95e883b6916061b04d0032bad14fbfe9f6ee86e7e501da49c8fea84225c4c5604cf85d96d4000d3faeecb0614bb09d

  • SSDEEP

    768:OKjRVzZTWZ9fGguTsNhL572lQFVgHj2ckAm5hC4WX:OMiZ9GZyhlhVgKxk4G

Score
7/10

Malware Config

Signatures

  • Modifies file permissions 1 TTPs 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
    java -jar C:\Users\Admin\AppData\Local\Temp\ssh.jar
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4376
    • C:\Windows\system32\icacls.exe
      C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
      2⤵
      • Modifies file permissions
      PID:1688

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

    Filesize

    46B

    MD5

    65dd7fca6ae0614b56859420d8eb3ab7

    SHA1

    be9f4f8bfddd4f833e7cb040d094d3389cee875b

    SHA256

    976f2bab778c24645c33bc2312101efebe8d10bd124b23df5db458f1a21c9688

    SHA512

    ab585db1fe33a33011baeb7f5d0dca1c3e61e1eadfbd013feeb9256c6b7b53ecadb7cd7be5a619a15346ceb15aa4f6cdd0d4240e20b3d9eb1da8ef6ae610d1e3

  • memory/4376-4-0x0000019080000000-0x0000019081000000-memory.dmp

    Filesize

    16.0MB

  • memory/4376-11-0x00000190F4BF0000-0x00000190F4BF1000-memory.dmp

    Filesize

    4KB

  • memory/4376-13-0x0000019080000000-0x0000019081000000-memory.dmp

    Filesize

    16.0MB