Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
22/12/2023, 15:47
General
-
Target
vivecraft-1.16.5-jrbudda-NONVR-7-8b-installer (1).exe
-
Size
2.7MB
-
MD5
34593f04779ea997e964be6f9bb5e42d
-
SHA1
3a3a6c5df6a9909f3f761606a129d69a0173cafc
-
SHA256
70b7a95c367f712ee990d171da3365c310f169e9bc7190ab2c1c64f7e657630f
-
SHA512
30f761ea6dfc092e93a5b61540e5a6fd4fa5a5d613066b172defd0fc84eb5849b6bf1fb199524ba3edc88209b140dba7a7188e9b131cb40ca305c75d1dcf96f7
-
SSDEEP
49152:Uufu9pEFBdsBjgDWnq4xrsnVzpRk2UArlg5x4SMlPagFdIrmGuT+ge8hwvTAv4BT:uczIIWTrsbRHdg5magEn8mvEvZHMH
Malware Config
Signatures
-
Modifies file permissions 1 TTPs 1 IoCs
-
Drops file in Program Files directory 12 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of FindShellTrayWindow 8 IoCs
-
Suspicious use of SendNotifyMessage 7 IoCs
-
Suspicious use of SetWindowsHookEx 5 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\vivecraft-1.16.5-jrbudda-NONVR-7-8b-installer (1).exe"C:\Users\Admin\AppData\Local\Temp\vivecraft-1.16.5-jrbudda-NONVR-7-8b-installer (1).exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\vivecraft-1.16.5-jrbudda-NONVR-7-8b-installer (1).exe" -Djava.net.preferIPv4Stack=true2⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M3⤵
- Modifies file permissions
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\SelectCopy.mid"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46B
MD5d552850d630e2ab76597c5359dfb0038
SHA1f68868fc79874a59a0830a7af763861c73d6b748
SHA256c1db0a8f2e0784718a21d517788f5e572727faf5fb87e3f9a725eac7945f389e
SHA512bb9279fa28243a4e47b6aeda2458226b35f97d73993832b8cd4ce8eb850935846dc9c4d5fb9bf291eac8b01e383d82096889d10514cd769f9ddc86489ce3e9b7
-
Filesize
92KB
-
Filesize
68KB
-
Filesize
2.7MB
-
Filesize
2.0MB
-
Filesize
96KB
-
Filesize
92KB
-
Filesize
68KB
-
Filesize
144KB
-
Filesize
92KB
-
Filesize
992KB
-
Filesize
68KB
-
Filesize
72KB
-
Filesize
1.7MB
-
Filesize
368KB
-
Filesize
176KB
-
Filesize
68KB
-
Filesize
212KB
-
Filesize
1.1MB
-
Filesize
2.2MB
-
Filesize
72KB
-
Filesize
604KB
-
Filesize
1.2MB
-
Filesize
76KB
-
Filesize
132KB
-
Filesize
72KB
-
Filesize
68KB
-
Filesize
208KB
-
Filesize
140KB
-
Filesize
116KB
-
Filesize
160KB
-
Filesize
344KB
-
Filesize
68KB
-
Filesize
444KB
-
Filesize
412KB
-
Filesize
192KB
-
Filesize
96KB
-
Filesize
68KB
-
Filesize
108KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
96KB
-
Filesize
132KB
-
Filesize
252KB
-
Filesize
16.7MB
-
Filesize
76KB
-
Filesize
4KB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
4KB
-
Filesize
16.0MB
-
Filesize
4KB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB