Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

28/02/2024, 13:15

240228-qg979acd7v 7

28/02/2024, 11:41

240228-nttpxsag3v 7

28/02/2024, 10:38

240228-mplyvahe97 7

Analysis

  • max time kernel
    135s
  • max time network
    172s
  • platform
    windows10-1703_x64
  • resource
    win10-20240221-en
  • resource tags

    arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
  • submitted
    28/02/2024, 11:41

General

  • Target

    jre/lib/jrt-fs.jar

  • Size

    104KB

  • MD5

    65e610432d1b25381007a10c1a1e6892

  • SHA1

    283d633d17d9699a01b7788dc897a9d54bf03271

  • SHA256

    54aef3a5d8edd97314baa0f6132564db498bae38481eb6ee9c64346f70dbe93e

  • SHA512

    6fdadf72c2c76e4260f7f6005a0240f1c57448bf282fc4b92a41897f9606220cce300787afafb35a316b26101c422c1c1f2f2fe7ce2c2f4f4f4ec50c60c9389f

  • SSDEEP

    1536:doB0yv2bbvKO+WLGGLZbotK7+3FoTho/WoUtkOd0t+WojK4qDUe88TN:uB0kIc3uZigh6TAd0/ojKrDvzx

Score
7/10

Malware Config

Signatures

  • Modifies file permissions 1 TTPs 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
    java -jar C:\Users\Admin\AppData\Local\Temp\jre\lib\jrt-fs.jar
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4668
    • C:\Windows\system32\icacls.exe
      C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
      2⤵
      • Modifies file permissions
      PID:5044

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

    Filesize

    46B

    MD5

    d2e60cc59573596880fa5ec6457a9edf

    SHA1

    612899719551c4dffbd95ad891a32486de29b93e

    SHA256

    988aae5b466b5e03dfd442061683da9f58addb225b3f101447357c8becb0ac95

    SHA512

    54d1ea90b3ea9222949d4282aaa0f073c746f203f1fa2a9c78be94de7a06559063ac9ed419bd4118e0befd47d1dd8fb383f5bceedb64a6d217cd799c8ea61701

  • memory/4668-4-0x000001B4D0050000-0x000001B4D1050000-memory.dmp

    Filesize

    16.0MB

  • memory/4668-12-0x000001B4CE760000-0x000001B4CE761000-memory.dmp

    Filesize

    4KB