Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    143s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/12/2023, 13:55

General

  • Target

    W-j.jar

  • Size

    18KB

  • MD5

    fd4fec8af65aec693c35c504d9eb74e3

  • SHA1

    e26f5d45bd856d98cbe1398109d5ac219b46d125

  • SHA256

    532cb95e2ea50298afb02ab0d7ca1cb60a014dd6432b5150efcbb5237199818a

  • SHA512

    441f17a6b8d3d3351de46c463983373e8a17a83e369f0b1eb68d7f134b391c454a04a2cdd21430e338bbeba5dac927aca9a2f3d1bbf13f0df35e5a5055f90c26

  • SSDEEP

    384:nv7fagWyX/1XMDj6INAIbPvtnCdHUxDG2YBcYb/ln/ZYnP3:nv7faC/9MDjXG2GvBc0/V/k3

Score
7/10

Malware Config

Signatures

  • Modifies file permissions 1 TTPs 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
    java -jar C:\Users\Admin\AppData\Local\Temp\W-j.jar
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4380
    • C:\Windows\system32\icacls.exe
      C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
      2⤵
      • Modifies file permissions
      PID:4860

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

    Filesize

    46B

    MD5

    69573d7ac3486fd8df9b6213709ba3b4

    SHA1

    26ae17142f13c3c73f4b9d914879bcbe85545004

    SHA256

    9acb4eadbf747c191361c5b874ce3e8e61c36dd9af45b7202794637834315203

    SHA512

    3a8980661d642b9a8bf916c7c87c60274750b817ea178fd92148174e1ffaa8c602c13ffd0eac800df5fe5242afaedb4744b9c0d1ea8c3fd278008f8672b5fc1c

  • memory/4380-3-0x0000021700000000-0x0000021701000000-memory.dmp

    Filesize

    16.0MB

  • memory/4380-11-0x000002177CA30000-0x000002177CA31000-memory.dmp

    Filesize

    4KB

  • memory/4380-13-0x0000021700000000-0x0000021701000000-memory.dmp

    Filesize

    16.0MB