Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
1022222.jar
windows7-x64
122222.jar
windows10-2004-x64
7A.exe
windows7-x64
1A.exe
windows10-2004-x64
1ClouderaPortal.jar
windows7-x64
1ClouderaPortal.jar
windows10-2004-x64
7W-j.jar
windows7-x64
1W-j.jar
windows10-2004-x64
7ssh.jar
windows7-x64
1ssh.jar
windows10-2004-x64
7udp
ubuntu-18.04-amd64
10Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
22/12/2023, 13:55
Behavioral task
behavioral1
Sample
22222.jar
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
22222.jar
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
A.exe
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
A.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
ClouderaPortal.jar
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
ClouderaPortal.jar
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
W-j.jar
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
W-j.jar
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
ssh.jar
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
ssh.jar
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
udp
Resource
ubuntu1804-amd64-20231215-en
General
-
Target
ssh.jar
-
Size
36KB
-
MD5
1cdc2c45232110551b6e21a43a067cb3
-
SHA1
f8e661aab0e09b8d8b663d1e339cc637a6e16978
-
SHA256
0b2c1618bab989ab3146a97b0913da5203025d7f7874d0e14fca6e1dba726615
-
SHA512
e22293ead032ced2669e7876ade1d82f5c95e883b6916061b04d0032bad14fbfe9f6ee86e7e501da49c8fea84225c4c5604cf85d96d4000d3faeecb0614bb09d
-
SSDEEP
768:OKjRVzZTWZ9fGguTsNhL572lQFVgHj2ckAm5hC4WX:OMiZ9GZyhlhVgKxk4G
Malware Config
Signatures
-
Modifies file permissions 1 TTPs 1 IoCs
pid Process 1688 icacls.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4376 wrote to memory of 1688 4376 java.exe 91 PID 4376 wrote to memory of 1688 4376 java.exe 91
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\ssh.jar1⤵
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
PID:1688
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46B
MD565dd7fca6ae0614b56859420d8eb3ab7
SHA1be9f4f8bfddd4f833e7cb040d094d3389cee875b
SHA256976f2bab778c24645c33bc2312101efebe8d10bd124b23df5db458f1a21c9688
SHA512ab585db1fe33a33011baeb7f5d0dca1c3e61e1eadfbd013feeb9256c6b7b53ecadb7cd7be5a619a15346ceb15aa4f6cdd0d4240e20b3d9eb1da8ef6ae610d1e3