Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
3OptiCraft ...s.jnlp
windows7-x64
1OptiCraft ...s.jnlp
windows10-2004-x64
7OptiCraft ...e.jnlp
windows7-x64
1OptiCraft ...e.jnlp
windows10-2004-x64
7OptiCraft ...r.jnlp
windows7-x64
1OptiCraft ...r.jnlp
windows10-2004-x64
7OptiCraft ...a.jnlp
windows7-x64
1OptiCraft ...a.jnlp
windows10-2004-x64
7OptiCraft ...o.jnlp
windows7-x64
1OptiCraft ...o.jnlp
windows10-2004-x64
7OptiCraft ...R.jnlp
windows7-x64
1OptiCraft ...R.jnlp
windows10-2004-x64
7OptiCraft ...v.jnlp
windows7-x64
1OptiCraft ...v.jnlp
windows10-2004-x64
7OptiCraft ...N.jnlp
windows7-x64
1OptiCraft ...N.jnlp
windows10-2004-x64
7OptiCraft ...K.jnlp
windows7-x64
1OptiCraft ...K.jnlp
windows10-2004-x64
7OptiCraft ...W.jnlp
windows7-x64
1OptiCraft ...W.jnlp
windows10-2004-x64
1OptiCraft ...32.jar
windows7-x64
1OptiCraft ...32.jar
windows10-2004-x64
7OptiCraft ...ta.jar
windows7-x64
1OptiCraft ...ta.jar
windows10-2004-x64
7OptiCraft ...ns.jar
windows7-x64
1OptiCraft ...ns.jar
windows10-2004-x64
7OptiCraft ...ss.jar
windows7-x64
1OptiCraft ...ss.jar
windows10-2004-x64
7OptiCraft ...ta.jar
windows7-x64
1OptiCraft ...ta.jar
windows10-2004-x64
7OptiCraft ...rn.jar
windows7-x64
1OptiCraft ...rn.jar
windows10-2004-x64
7Analysis
-
max time kernel
144s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
03/05/2024, 22:50
Static task
static1
Behavioral task
behavioral1
Sample
OptiCraft JAVA 1.8.9/mcdata/runtime/lib/deploy/messages.jnlp
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
OptiCraft JAVA 1.8.9/mcdata/runtime/lib/deploy/messages.jnlp
Resource
win10v2004-20240419-en
Behavioral task
behavioral3
Sample
OptiCraft JAVA 1.8.9/mcdata/runtime/lib/deploy/messages_de.jnlp
Resource
win7-20240215-en
Behavioral task
behavioral4
Sample
OptiCraft JAVA 1.8.9/mcdata/runtime/lib/deploy/messages_de.jnlp
Resource
win10v2004-20240419-en
Behavioral task
behavioral5
Sample
OptiCraft JAVA 1.8.9/mcdata/runtime/lib/deploy/messages_fr.jnlp
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
OptiCraft JAVA 1.8.9/mcdata/runtime/lib/deploy/messages_fr.jnlp
Resource
win10v2004-20240419-en
Behavioral task
behavioral7
Sample
OptiCraft JAVA 1.8.9/mcdata/runtime/lib/deploy/messages_ja.jnlp
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
OptiCraft JAVA 1.8.9/mcdata/runtime/lib/deploy/messages_ja.jnlp
Resource
win10v2004-20240419-en
Behavioral task
behavioral9
Sample
OptiCraft JAVA 1.8.9/mcdata/runtime/lib/deploy/messages_ko.jnlp
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
OptiCraft JAVA 1.8.9/mcdata/runtime/lib/deploy/messages_ko.jnlp
Resource
win10v2004-20240426-en
Behavioral task
behavioral11
Sample
OptiCraft JAVA 1.8.9/mcdata/runtime/lib/deploy/messages_pt_BR.jnlp
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
OptiCraft JAVA 1.8.9/mcdata/runtime/lib/deploy/messages_pt_BR.jnlp
Resource
win10v2004-20240419-en
Behavioral task
behavioral13
Sample
OptiCraft JAVA 1.8.9/mcdata/runtime/lib/deploy/messages_sv.jnlp
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
OptiCraft JAVA 1.8.9/mcdata/runtime/lib/deploy/messages_sv.jnlp
Resource
win10v2004-20240419-en
Behavioral task
behavioral15
Sample
OptiCraft JAVA 1.8.9/mcdata/runtime/lib/deploy/messages_zh_CN.jnlp
Resource
win7-20240215-en
Behavioral task
behavioral16
Sample
OptiCraft JAVA 1.8.9/mcdata/runtime/lib/deploy/messages_zh_CN.jnlp
Resource
win10v2004-20240419-en
Behavioral task
behavioral17
Sample
OptiCraft JAVA 1.8.9/mcdata/runtime/lib/deploy/messages_zh_HK.jnlp
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
OptiCraft JAVA 1.8.9/mcdata/runtime/lib/deploy/messages_zh_HK.jnlp
Resource
win10v2004-20240419-en
Behavioral task
behavioral19
Sample
OptiCraft JAVA 1.8.9/mcdata/runtime/lib/deploy/messages_zh_TW.jnlp
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
OptiCraft JAVA 1.8.9/mcdata/runtime/lib/deploy/messages_zh_TW.jnlp
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
OptiCraft JAVA 1.8.9/mcdata/runtime/lib/ext/access-bridge-32.jar
Resource
win7-20240220-en
Behavioral task
behavioral22
Sample
OptiCraft JAVA 1.8.9/mcdata/runtime/lib/ext/access-bridge-32.jar
Resource
win10v2004-20240426-en
Behavioral task
behavioral23
Sample
OptiCraft JAVA 1.8.9/mcdata/runtime/lib/ext/cldrdata.jar
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
OptiCraft JAVA 1.8.9/mcdata/runtime/lib/ext/cldrdata.jar
Resource
win10v2004-20240419-en
Behavioral task
behavioral25
Sample
OptiCraft JAVA 1.8.9/mcdata/runtime/lib/ext/dnsns.jar
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
OptiCraft JAVA 1.8.9/mcdata/runtime/lib/ext/dnsns.jar
Resource
win10v2004-20240419-en
Behavioral task
behavioral27
Sample
OptiCraft JAVA 1.8.9/mcdata/runtime/lib/ext/jaccess.jar
Resource
win7-20240220-en
Behavioral task
behavioral28
Sample
OptiCraft JAVA 1.8.9/mcdata/runtime/lib/ext/jaccess.jar
Resource
win10v2004-20240419-en
Behavioral task
behavioral29
Sample
OptiCraft JAVA 1.8.9/mcdata/runtime/lib/ext/localedata.jar
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
OptiCraft JAVA 1.8.9/mcdata/runtime/lib/ext/localedata.jar
Resource
win10v2004-20240419-en
Behavioral task
behavioral31
Sample
OptiCraft JAVA 1.8.9/mcdata/runtime/lib/ext/nashorn.jar
Resource
win7-20240215-en
Behavioral task
behavioral32
Sample
OptiCraft JAVA 1.8.9/mcdata/runtime/lib/ext/nashorn.jar
Resource
win10v2004-20240419-en
General
-
Target
OptiCraft JAVA 1.8.9/mcdata/runtime/lib/deploy/messages_fr.jnlp
-
Size
3KB
-
MD5
c11ab66fede3042ee75dfd19032c8a72
-
SHA1
69bd2d03c2064f8679de5b4e430ea61b567c69c5
-
SHA256
8deeec35ed29348f5755801f42675e3bf3fa7ad4b1e414acca283c4da40e4d77
-
SHA512
072f8923df111f82f482d65651758b8b4ba2486cb0ea08fb8b113f472a42a1c3bcb00dae7d1780cf371e2c2bd955d8b66658d5ee15e548b1eea16b312fdcbdf9
Malware Config
Signatures
-
Modifies file permissions 1 TTPs 1 IoCs
pid Process 2736 icacls.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3116 javaws.exe 3116 javaws.exe 3116 javaws.exe 3116 javaws.exe 1316 javaws.exe 1316 javaws.exe 4384 jp2launcher.exe 4384 jp2launcher.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4384 jp2launcher.exe 4384 jp2launcher.exe 4384 jp2launcher.exe 4384 jp2launcher.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1304 wrote to memory of 3116 1304 jp2launcher.exe 88 PID 1304 wrote to memory of 3116 1304 jp2launcher.exe 88 PID 3116 wrote to memory of 1316 3116 javaws.exe 89 PID 3116 wrote to memory of 1316 3116 javaws.exe 89 PID 3116 wrote to memory of 4384 3116 javaws.exe 90 PID 3116 wrote to memory of 4384 3116 javaws.exe 90 PID 4384 wrote to memory of 2736 4384 jp2launcher.exe 91 PID 4384 wrote to memory of 2736 4384 jp2launcher.exe 91
Processes
-
C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe"C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe" -securejws "C:\Users\Admin\AppData\Local\Temp\OptiCraft JAVA 1.8.9\mcdata\runtime\lib\deploy\messages_fr.jnlp"1⤵
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Program Files\Java\jre-1.8\bin\javaws.exe"C:\Program Files\Java\jre-1.8\bin\javaws.exe" "C:\Users\Admin\AppData\Local\Temp\OptiCraft JAVA 1.8.9\mcdata\runtime\lib\deploy\messages_fr.jnlp"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Program Files\Java\jre-1.8\bin\javaws.exeJavaWSSplashScreen -splash 62691 "C:\Program Files\Java\jre-1.8\lib\deploy\splash.gif"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1316
-
-
C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe"C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre-1.8" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxsaWJcZGVwbG95LmphcgAtRGphdmEuc2VjdXJpdHkucG9saWN5PWZpbGU6QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZS0xLjhcbGliXHNlY3VyaXR5XGphdmF3cy5wb2xpY3kALUR0cnVzdFByb3h5PXRydWUALVh2ZXJpZnk6cmVtb3RlAC1Eam5scHguaG9tZT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURqbmxweC5vcmlnRmlsZW5hbWVBcmc9QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxUZW1wXE9wdGlDcmFmdCBKQVZBIDEuOC45XG1jZGF0YVxydW50aW1lXGxpYlxkZXBsb3lcbWVzc2FnZXNfZnIuam5scAAtRGpubHB4LnJlbW92ZT1mYWxzZQAtRHN1bi5hd3Qud2FybXVwPXRydWUALVhib290Y2xhc3NwYXRoL2E6QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZS0xLjhcbGliXGphdmF3cy5qYXI7QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZS0xLjhcbGliXGRlcGxveS5qYXI7QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZS0xLjhcbGliXHBsdWdpbi5qYXIALURqbmxweC5zcGxhc2hwb3J0PTYyNjkyAC1Eam5scHguanZtPUM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGJpblxqYXZhdy5leGU= -ma QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxUZW1wXE9wdGlDcmFmdCBKQVZBIDEuOC45XG1jZGF0YVxydW50aW1lXGxpYlxkZXBsb3lcbWVzc2FnZXNfZnIuam5scA==3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "\"everyone\":(OI)(CI)M"4⤵
- Modifies file permissions
PID:2736
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
713B
MD5723f0bd4962f1b4b02452257e4adf632
SHA164cf01e9facfdcb08a634d1b8db2720d82c109c1
SHA2562680a454f84dff8745adfa86d2ea9986acbecf78523b7a6a3e3480c0908456a4
SHA5121a390702af217ce7feedeff16205613f26a8a9d59ad7ef3f8c2d9f72cc34e47935fd586b82574cc4ee7b787caae936c58cd09c9b54bc8b6bc59b53b1997cffa1
-
Filesize
12KB
MD54f9f42a2c5524bf0ce187c5dcb517b89
SHA1b54ff1e485ee0605753e23f254e288f9a79cc59d
SHA256e271e41f800f3f25e0f9fe212f2e31e6a57b74d28b89fd3425deb42a6a1b411a
SHA51245eb73dae61b6cb855a33966b6c3f1f064a15714761e3075eda105f72adf3780b05dbfbcca75fb47734ca47bb6abe4a1db075d30b1db748ffca11d9928d6cdbc