Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
154s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
27/03/2024, 17:39
Static task
static1
Behavioral task
behavioral1
Sample
h2.jar
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
h2.jar
Resource
win10v2004-20240226-en
General
-
Target
h2.jar
-
Size
1.6MB
-
MD5
86de8952f48764286c83e1ec6e9679bc
-
SHA1
e5c635f2a87b601382ba9e071d2df857f106a929
-
SHA256
c32dafd1e713c467e4635a5b1896631f11af7d427be1b141b359e203afe3bce1
-
SHA512
5920daf00fa9303fb865c54520f17adff3a939dc5477ffc028f2432202a3fa51efbf9d094b1a4ac23ecd52e4db87a260285552243547055d1cfa732c276cf31c
-
SSDEEP
49152:YBVVmtubLiaGifD9xXobnvc+cKoynE7jiCg:YDAubL9G2Ybv1cK3FCg
Malware Config
Signatures
-
Modifies file permissions 1 TTPs 1 IoCs
pid Process 2580 icacls.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 3940 java.exe 3940 java.exe 3940 java.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 3940 java.exe 3940 java.exe 3940 java.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3940 java.exe 3940 java.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3940 wrote to memory of 2580 3940 java.exe 89 PID 3940 wrote to memory of 2580 3940 java.exe 89
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\h2.jar1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
PID:2580
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46B
MD5988cc8e3dc5dd71dc63015c5aef2bd63
SHA1e3ce645ead818ece5a997eb4298356a4bf81d247
SHA256c58df2ad14f6d7d897a69c1136ec08339c9ea6208fa6d3e4e3b8c1a77882b1ec
SHA512a62064ea37a1e7b8cc6c77a7ec698563e131855c6d060f9d38a4ae245f68209a3511f9966ddd06f48eeb2f33eef7d9dcf6aa7776975451c8fba1856c7ae447d5