Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05/05/2024, 04:47
Static task
static1
Behavioral task
behavioral1
Sample
d8270349b467d0755c01a11c74ea8886190eb8df48574795705928c633516e49.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d8270349b467d0755c01a11c74ea8886190eb8df48574795705928c633516e49.exe
Resource
win10v2004-20240426-en
General
-
Target
d8270349b467d0755c01a11c74ea8886190eb8df48574795705928c633516e49.exe
-
Size
1.4MB
-
MD5
f896da566264cddb1b663a8b95095336
-
SHA1
d07d833ebca01f45765273394f182e2d12229610
-
SHA256
d8270349b467d0755c01a11c74ea8886190eb8df48574795705928c633516e49
-
SHA512
7efcc663f72ca1a0e9435c31049ab3471c3888f938588fd94a8459e4f2bc0b5c460b616f8e351f2e45f2cf0ec9f21a9228ca9fd2dea4a4bdc0fcbff78ac716e5
-
SSDEEP
24576:GIeBdQNZswnFSG68kvoJ4cdVEDdmArE27ipsC/vfVm7E/vazaFN:AQNiwnFRkvoJ4cdqc/xpN/4E/vazaFN
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2932 java.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\rndkey1135596550833889669 java.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\RNDKEY1135596550833889669 java.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2932 java.exe 2932 java.exe 2932 java.exe 2932 java.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1556 wrote to memory of 1508 1556 d8270349b467d0755c01a11c74ea8886190eb8df48574795705928c633516e49.exe 28 PID 1556 wrote to memory of 1508 1556 d8270349b467d0755c01a11c74ea8886190eb8df48574795705928c633516e49.exe 28 PID 1556 wrote to memory of 1508 1556 d8270349b467d0755c01a11c74ea8886190eb8df48574795705928c633516e49.exe 28 PID 1556 wrote to memory of 1508 1556 d8270349b467d0755c01a11c74ea8886190eb8df48574795705928c633516e49.exe 28 PID 1556 wrote to memory of 2932 1556 d8270349b467d0755c01a11c74ea8886190eb8df48574795705928c633516e49.exe 30 PID 1556 wrote to memory of 2932 1556 d8270349b467d0755c01a11c74ea8886190eb8df48574795705928c633516e49.exe 30 PID 1556 wrote to memory of 2932 1556 d8270349b467d0755c01a11c74ea8886190eb8df48574795705928c633516e49.exe 30 PID 1556 wrote to memory of 2932 1556 d8270349b467d0755c01a11c74ea8886190eb8df48574795705928c633516e49.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\d8270349b467d0755c01a11c74ea8886190eb8df48574795705928c633516e49.exe"C:\Users\Admin\AppData\Local\Temp\d8270349b467d0755c01a11c74ea8886190eb8df48574795705928c633516e49.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Program Files\Java\jre7\bin\java.exe"C:\Program Files\Java\jre7\bin\java.exe" -classpath C:\Users\Admin\AppData\Local\Temp\\NBI44029.tmp TestJDK2⤵PID:1508
-
-
C:\Program Files\Java\jre7\bin\java.exe"C:\Program Files\Java\jre7\bin\java.exe" -Djava.io.tmpdir=C:\Users\Admin\AppData\Local\Temp\ -Xmx256m -Xms64m -Dnbi.local.directory.path=C:\Users\Administrator\.offlinetool-installer -classpath C:\Users\Admin\AppData\Local\Temp\\NBI44029.tmp\uninstall.jar org.netbeans.installer.Installer --target offlinetool 1.0.0.0.0 --force-uninstall2⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2932
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
612B
MD55a870d05a477bd508476c1addce46e52
SHA1d601bb6b81b7367db8a55462a4da3e8dd5f13ba7
SHA2568923583fcf65117a43ba50c979b4185821b0b9f8bbd95dccb58a307a00a9b38b
SHA512f7d079105c9c7d736e9b0f880118e0729bd29f36ce9e9440905595fb90208bbd62f71e0bf0413668fb6c01e4d2168dfff6026beeec6032c2c146a3c752849e86
-
Filesize
1.0MB
MD57dba3d0220c7e993b43a8bc0905e0e5f
SHA1b118edfa2f3a86326ff632dd7fe6a19bae890812
SHA25692da45af16c4bfb9d97739fc6c315c96d642b6d6b4945c033c747066c8827354
SHA51298cfd9659d9643aaa3f854d4fb0ef6bdf782cf93b89506e174afb1be9c9a9f32df530a44291cb6356edcc9b7bb560ef337215a3f4c0cbde99bb329851dfc4361
-
Filesize
19KB
MD51c56b6264905ad1e1a04d1c2bb445c77
SHA1fc15d4cfaf9b0b0a508543d22a3c9cab5a37cd14
SHA256e20654928a84c5b61bde154e33bdd845fac1ae8c852c1152d5608c5a15edd83a
SHA51274196770c0f487edef73a728ae65394bea9a1a30bdfad1ee690549ebcea407794be7aa4b646d5e963cf1ff4a0ceef383f4dcd3ad14967f5ef5d54a87343cb6de