Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11/05/2024, 08:49
Behavioral task
behavioral1
Sample
0fb1d11732acd516de3da578ac8d7a4a0f51684f588898bc0621fe5424cef0eb.jar
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0fb1d11732acd516de3da578ac8d7a4a0f51684f588898bc0621fe5424cef0eb.jar
Resource
win10v2004-20240426-en
General
-
Target
0fb1d11732acd516de3da578ac8d7a4a0f51684f588898bc0621fe5424cef0eb.jar
-
Size
64KB
-
MD5
8f32b6ad5a4b0bf593c5e8cfe8afd04b
-
SHA1
02623723f9a9af013df424336d45ada46abe9472
-
SHA256
0fb1d11732acd516de3da578ac8d7a4a0f51684f588898bc0621fe5424cef0eb
-
SHA512
185bb366786dc1a1a54dcb623341f7a727842685aa50d48dcc4bafe5135feaa1f6294a874faa55fdc91816a43bd60ab543c9284b7eec97d8cedf65dd62de282c
-
SSDEEP
1536:sFVl2U0Gg0HxEjXu28Gut9+gnzqYgMYw0Sr8awyvI0cNFl:sFv2U0GXUu28P7HZY84awyv3cNFl
Malware Config
Signatures
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0fb1d11732acd516de3da578ac8d7a4a0f51684f588898bc0621fe5424cef0eb.jar java.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\0fb1d11732acd516de3da578ac8d7a4a0f51684f588898bc0621fe5424cef0eb = "\"C:\\Program Files\\Java\\jre7\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\0fb1d11732acd516de3da578ac8d7a4a0f51684f588898bc0621fe5424cef0eb.jar\"" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\0fb1d11732acd516de3da578ac8d7a4a0f51684f588898bc0621fe5424cef0eb = "\"C:\\Program Files\\Java\\jre7\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\0fb1d11732acd516de3da578ac8d7a4a0f51684f588898bc0621fe5424cef0eb.jar\"" java.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2584 schtasks.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2924 wrote to memory of 624 2924 java.exe 29 PID 2924 wrote to memory of 624 2924 java.exe 29 PID 2924 wrote to memory of 624 2924 java.exe 29 PID 2924 wrote to memory of 2616 2924 java.exe 30 PID 2924 wrote to memory of 2616 2924 java.exe 30 PID 2924 wrote to memory of 2616 2924 java.exe 30 PID 624 wrote to memory of 2584 624 cmd.exe 31 PID 624 wrote to memory of 2584 624 cmd.exe 31 PID 624 wrote to memory of 2584 624 cmd.exe 31 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\0fb1d11732acd516de3da578ac8d7a4a0f51684f588898bc0621fe5424cef0eb.jar1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Windows\system32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\0fb1d11732acd516de3da578ac8d7a4a0f51684f588898bc0621fe5424cef0eb.jar"2⤵
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\0fb1d11732acd516de3da578ac8d7a4a0f51684f588898bc0621fe5424cef0eb.jar"3⤵
- Creates scheduled task(s)
PID:2584
-
-
-
C:\Program Files\Java\jre7\bin\java.exe"C:\Program Files\Java\jre7\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\0fb1d11732acd516de3da578ac8d7a4a0f51684f588898bc0621fe5424cef0eb.jar"2⤵PID:2616
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\0fb1d11732acd516de3da578ac8d7a4a0f51684f588898bc0621fe5424cef0eb.jar
Filesize64KB
MD58f32b6ad5a4b0bf593c5e8cfe8afd04b
SHA102623723f9a9af013df424336d45ada46abe9472
SHA2560fb1d11732acd516de3da578ac8d7a4a0f51684f588898bc0621fe5424cef0eb
SHA512185bb366786dc1a1a54dcb623341f7a727842685aa50d48dcc4bafe5135feaa1f6294a874faa55fdc91816a43bd60ab543c9284b7eec97d8cedf65dd62de282c