Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
4anylogic-p...64.exe
windows10-1703-x64
4jcef-bundl...er.dll
windows10-1703-x64
1jcef-bundl...-1.dll
windows10-1703-x64
1jre/bin/ap...-0.dll
windows10-1703-x64
1jre/bin/ap...-0.dll
windows10-1703-x64
1jre/bin/ap...-0.dll
windows10-1703-x64
1jre/bin/ap...-0.dll
windows10-1703-x64
1jre/bin/ap...-0.dll
windows10-1703-x64
1jre/bin/ap...-0.dll
windows10-1703-x64
1jre/bin/ap...-0.dll
windows10-1703-x64
1jre/bin/ap...-0.dll
windows10-1703-x64
1jre/bin/ap...-0.dll
windows10-1703-x64
1jre/bin/ap...-0.dll
windows10-1703-x64
1jre/bin/ap...-0.dll
windows10-1703-x64
1jre/bin/ap...-0.dll
windows10-1703-x64
1jre/bin/ap...-0.dll
windows10-1703-x64
1jre/bin/ap...-0.dll
windows10-1703-x64
1jre/bin/ap...-0.dll
windows10-1703-x64
1jre/bin/ap...-0.dll
windows10-1703-x64
1jre/bin/ap...-1.dll
windows10-1703-x64
1jre/bin/ap...-0.dll
windows10-1703-x64
1jre/bin/ap...-0.dll
windows10-1703-x64
1jre/bin/ap...-0.dll
windows10-1703-x64
1jre/bin/ap...-0.dll
windows10-1703-x64
1jre/bin/ap...-0.dll
windows10-1703-x64
1jre/bin/ap...-0.dll
windows10-1703-x64
1jre/bin/ap...-0.dll
windows10-1703-x64
1jre/bin/ap...-0.dll
windows10-1703-x64
1jre/bin/ap...-0.dll
windows10-1703-x64
1jre/bin/ap...-0.dll
windows10-1703-x64
1jre/bin/ap...-0.dll
windows10-1703-x64
1jre/lib/jrt-fs.jar
windows10-1703-x64
7Resubmissions
28/02/2024, 13:15
240228-qg979acd7v 728/02/2024, 11:41
240228-nttpxsag3v 728/02/2024, 10:38
240228-mplyvahe97 7Analysis
-
max time kernel
135s -
max time network
172s -
platform
windows10-1703_x64 -
resource
win10-20240221-en -
resource tags
arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system -
submitted
28/02/2024, 11:41
Behavioral task
behavioral1
Sample
anylogic-ple-8.8.6.x86_64.exe
Resource
win10-20240221-en
Behavioral task
behavioral2
Sample
jcef-bundle/vk_swiftshader.dll
Resource
win10-20240221-en
Behavioral task
behavioral3
Sample
jcef-bundle/vulkan-1.dll
Resource
win10-20240221-en
Behavioral task
behavioral4
Sample
jre/bin/api-ms-win-core-console-l1-1-0.dll
Resource
win10-20240221-en
Behavioral task
behavioral5
Sample
jre/bin/api-ms-win-core-datetime-l1-1-0.dll
Resource
win10-20240221-en
Behavioral task
behavioral6
Sample
jre/bin/api-ms-win-core-debug-l1-1-0.dll
Resource
win10-20240221-en
Behavioral task
behavioral7
Sample
jre/bin/api-ms-win-core-errorhandling-l1-1-0.dll
Resource
win10-20240221-en
Behavioral task
behavioral8
Sample
jre/bin/api-ms-win-core-file-l1-1-0.dll
Resource
win10-20240221-en
Behavioral task
behavioral9
Sample
jre/bin/api-ms-win-core-file-l1-2-0.dll
Resource
win10-20240221-en
Behavioral task
behavioral10
Sample
jre/bin/api-ms-win-core-file-l2-1-0.dll
Resource
win10-20240221-en
Behavioral task
behavioral11
Sample
jre/bin/api-ms-win-core-handle-l1-1-0.dll
Resource
win10-20240221-en
Behavioral task
behavioral12
Sample
jre/bin/api-ms-win-core-heap-l1-1-0.dll
Resource
win10-20240221-en
Behavioral task
behavioral13
Sample
jre/bin/api-ms-win-core-interlocked-l1-1-0.dll
Resource
win10-20240221-en
Behavioral task
behavioral14
Sample
jre/bin/api-ms-win-core-libraryloader-l1-1-0.dll
Resource
win10-20240221-en
Behavioral task
behavioral15
Sample
jre/bin/api-ms-win-core-localization-l1-2-0.dll
Resource
win10-20240221-en
Behavioral task
behavioral16
Sample
jre/bin/api-ms-win-core-memory-l1-1-0.dll
Resource
win10-20240221-en
Behavioral task
behavioral17
Sample
jre/bin/api-ms-win-core-namedpipe-l1-1-0.dll
Resource
win10-20240221-en
Behavioral task
behavioral18
Sample
jre/bin/api-ms-win-core-processenvironment-l1-1-0.dll
Resource
win10-20240221-en
Behavioral task
behavioral19
Sample
jre/bin/api-ms-win-core-processthreads-l1-1-0.dll
Resource
win10-20240221-en
Behavioral task
behavioral20
Sample
jre/bin/api-ms-win-core-processthreads-l1-1-1.dll
Resource
win10-20240221-en
Behavioral task
behavioral21
Sample
jre/bin/api-ms-win-core-profile-l1-1-0.dll
Resource
win10-20240221-en
Behavioral task
behavioral22
Sample
jre/bin/api-ms-win-core-rtlsupport-l1-1-0.dll
Resource
win10-20240221-en
Behavioral task
behavioral23
Sample
jre/bin/api-ms-win-core-string-l1-1-0.dll
Resource
win10-20240221-en
Behavioral task
behavioral24
Sample
jre/bin/api-ms-win-core-synch-l1-1-0.dll
Resource
win10-20240221-en
Behavioral task
behavioral25
Sample
jre/bin/api-ms-win-core-synch-l1-2-0.dll
Resource
win10-20240221-en
Behavioral task
behavioral26
Sample
jre/bin/api-ms-win-core-sysinfo-l1-1-0.dll
Resource
win10-20240221-en
Behavioral task
behavioral27
Sample
jre/bin/api-ms-win-core-timezone-l1-1-0.dll
Resource
win10-20240221-en
Behavioral task
behavioral28
Sample
jre/bin/api-ms-win-core-util-l1-1-0.dll
Resource
win10-20240221-en
Behavioral task
behavioral29
Sample
jre/bin/api-ms-win-crt-conio-l1-1-0.dll
Resource
win10-20240221-en
Behavioral task
behavioral30
Sample
jre/bin/api-ms-win-crt-convert-l1-1-0.dll
Resource
win10-20240221-en
Behavioral task
behavioral31
Sample
jre/bin/api-ms-win-crt-environment-l1-1-0.dll
Resource
win10-20240221-en
Behavioral task
behavioral32
Sample
jre/lib/jrt-fs.jar
Resource
win10-20240221-en
General
-
Target
jre/lib/jrt-fs.jar
-
Size
104KB
-
MD5
65e610432d1b25381007a10c1a1e6892
-
SHA1
283d633d17d9699a01b7788dc897a9d54bf03271
-
SHA256
54aef3a5d8edd97314baa0f6132564db498bae38481eb6ee9c64346f70dbe93e
-
SHA512
6fdadf72c2c76e4260f7f6005a0240f1c57448bf282fc4b92a41897f9606220cce300787afafb35a316b26101c422c1c1f2f2fe7ce2c2f4f4f4ec50c60c9389f
-
SSDEEP
1536:doB0yv2bbvKO+WLGGLZbotK7+3FoTho/WoUtkOd0t+WojK4qDUe88TN:uB0kIc3uZigh6TAd0/ojKrDvzx
Malware Config
Signatures
-
Modifies file permissions 1 TTPs 1 IoCs
pid Process 5044 icacls.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4668 wrote to memory of 5044 4668 java.exe 77 PID 4668 wrote to memory of 5044 4668 java.exe 77
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\jre\lib\jrt-fs.jar1⤵
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
PID:5044
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46B
MD5d2e60cc59573596880fa5ec6457a9edf
SHA1612899719551c4dffbd95ad891a32486de29b93e
SHA256988aae5b466b5e03dfd442061683da9f58addb225b3f101447357c8becb0ac95
SHA51254d1ea90b3ea9222949d4282aaa0f073c746f203f1fa2a9c78be94de7a06559063ac9ed419bd4118e0befd47d1dd8fb383f5bceedb64a6d217cd799c8ea61701