Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/05/2024, 22:50

General

  • Target

    OptiCraft JAVA 1.8.9/mcdata/runtime/lib/deploy/messages_fr.jnlp

  • Size

    3KB

  • MD5

    c11ab66fede3042ee75dfd19032c8a72

  • SHA1

    69bd2d03c2064f8679de5b4e430ea61b567c69c5

  • SHA256

    8deeec35ed29348f5755801f42675e3bf3fa7ad4b1e414acca283c4da40e4d77

  • SHA512

    072f8923df111f82f482d65651758b8b4ba2486cb0ea08fb8b113f472a42a1c3bcb00dae7d1780cf371e2c2bd955d8b66658d5ee15e548b1eea16b312fdcbdf9

Score
7/10

Malware Config

Signatures

  • Modifies file permissions 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
    "C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe" -securejws "C:\Users\Admin\AppData\Local\Temp\OptiCraft JAVA 1.8.9\mcdata\runtime\lib\deploy\messages_fr.jnlp"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1304
    • C:\Program Files\Java\jre-1.8\bin\javaws.exe
      "C:\Program Files\Java\jre-1.8\bin\javaws.exe" "C:\Users\Admin\AppData\Local\Temp\OptiCraft JAVA 1.8.9\mcdata\runtime\lib\deploy\messages_fr.jnlp"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3116
      • C:\Program Files\Java\jre-1.8\bin\javaws.exe
        JavaWSSplashScreen -splash 62691 "C:\Program Files\Java\jre-1.8\lib\deploy\splash.gif"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:1316
      • C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
        "C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre-1.8" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxsaWJcZGVwbG95LmphcgAtRGphdmEuc2VjdXJpdHkucG9saWN5PWZpbGU6QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZS0xLjhcbGliXHNlY3VyaXR5XGphdmF3cy5wb2xpY3kALUR0cnVzdFByb3h5PXRydWUALVh2ZXJpZnk6cmVtb3RlAC1Eam5scHguaG9tZT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURqbmxweC5vcmlnRmlsZW5hbWVBcmc9QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxUZW1wXE9wdGlDcmFmdCBKQVZBIDEuOC45XG1jZGF0YVxydW50aW1lXGxpYlxkZXBsb3lcbWVzc2FnZXNfZnIuam5scAAtRGpubHB4LnJlbW92ZT1mYWxzZQAtRHN1bi5hd3Qud2FybXVwPXRydWUALVhib290Y2xhc3NwYXRoL2E6QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZS0xLjhcbGliXGphdmF3cy5qYXI7QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZS0xLjhcbGliXGRlcGxveS5qYXI7QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZS0xLjhcbGliXHBsdWdpbi5qYXIALURqbmxweC5zcGxhc2hwb3J0PTYyNjkyAC1Eam5scHguanZtPUM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGJpblxqYXZhdy5leGU= -ma QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxUZW1wXE9wdGlDcmFmdCBKQVZBIDEuOC45XG1jZGF0YVxydW50aW1lXGxpYlxkZXBsb3lcbWVzc2FnZXNfZnIuam5scA==
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4384
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "\"everyone\":(OI)(CI)M"
          4⤵
          • Modifies file permissions
          PID:2736

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\deployment.properties

    Filesize

    713B

    MD5

    723f0bd4962f1b4b02452257e4adf632

    SHA1

    64cf01e9facfdcb08a634d1b8db2720d82c109c1

    SHA256

    2680a454f84dff8745adfa86d2ea9986acbecf78523b7a6a3e3480c0908456a4

    SHA512

    1a390702af217ce7feedeff16205613f26a8a9d59ad7ef3f8c2d9f72cc34e47935fd586b82574cc4ee7b787caae936c58cd09c9b54bc8b6bc59b53b1997cffa1

  • C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\security\securitypack.jar

    Filesize

    12KB

    MD5

    4f9f42a2c5524bf0ce187c5dcb517b89

    SHA1

    b54ff1e485ee0605753e23f254e288f9a79cc59d

    SHA256

    e271e41f800f3f25e0f9fe212f2e31e6a57b74d28b89fd3425deb42a6a1b411a

    SHA512

    45eb73dae61b6cb855a33966b6c3f1f064a15714761e3075eda105f72adf3780b05dbfbcca75fb47734ca47bb6abe4a1db075d30b1db748ffca11d9928d6cdbc

  • memory/4384-112-0x000002175E850000-0x000002175EAC0000-memory.dmp

    Filesize

    2.4MB

  • memory/4384-56-0x000002175E4C0000-0x000002175E4C1000-memory.dmp

    Filesize

    4KB

  • memory/4384-70-0x000002175E4C0000-0x000002175E4C1000-memory.dmp

    Filesize

    4KB

  • memory/4384-85-0x000002175E4C0000-0x000002175E4C1000-memory.dmp

    Filesize

    4KB

  • memory/4384-2-0x000002175E850000-0x000002175EAC0000-memory.dmp

    Filesize

    2.4MB

  • memory/4384-122-0x000002175E4C0000-0x000002175E4C1000-memory.dmp

    Filesize

    4KB

  • memory/4384-28-0x000002175E4C0000-0x000002175E4C1000-memory.dmp

    Filesize

    4KB

  • memory/4384-154-0x000002175E4C0000-0x000002175E4C1000-memory.dmp

    Filesize

    4KB

  • memory/4384-15-0x000002175E4C0000-0x000002175E4C1000-memory.dmp

    Filesize

    4KB

  • memory/4384-174-0x000002175E4C0000-0x000002175E4C1000-memory.dmp

    Filesize

    4KB

  • memory/4384-201-0x000002175E4C0000-0x000002175E4C1000-memory.dmp

    Filesize

    4KB