Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

23/05/2024, 09:55

240523-lx9t7sce43 1

23/05/2024, 09:54

240523-lw9g2sce4t 7

23/05/2024, 09:27

240523-lerkxabh99 7

Analysis

  • max time kernel
    137s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/05/2024, 09:54

General

  • Target

    oraxen-1.166.0.jar

  • Size

    3.3MB

  • MD5

    40749750084a4c61e0cb77d651629815

  • SHA1

    1ad2459615ad3f1d9a81a1ac0b842cf4e6154600

  • SHA256

    21ed5d1df342b9e180c0e9ac5ab8d72aeb9e1ce70a0f90bd87198b136f169b06

  • SHA512

    91e58141cd3aadeeb66c695881ed63341179f6f5adc8b3e3b1eed5af6c4f124ca11194505fab38cf97ce60b3fc1656d5ec0bb7a1ca2cf9eb163571205e8ac5c7

  • SSDEEP

    49152:b3/pSLJqlqansp2zr7Wwc2+rLiohlqnbwPgq2zvwqBflgtwA6VOgneLlD7nSC9:bhSLeq2spQSG+/DvPwrveTLlXT

Score
7/10

Malware Config

Signatures

  • Modifies file permissions 1 TTPs 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
    java -jar C:\Users\Admin\AppData\Local\Temp\oraxen-1.166.0.jar
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4012
    • C:\Windows\system32\icacls.exe
      C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
      2⤵
      • Modifies file permissions
      PID:2444

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

    Filesize

    46B

    MD5

    66dfde3d20e230d4e4ad9293dd4fa3f8

    SHA1

    42ca605f35921a662c7324a1c177e7253e806b5a

    SHA256

    b96c9009c8f17ee13891a22c7f768a146b2f4927ccc6fc8fa24af451ce58719c

    SHA512

    5887de3f9a128a3cba94a9564409344984d337b187f90d27e002aee1ebaba465ab84ee31ca0376dd771ce136309e258e5dc0d3308567a1fa8549cd0591b1430b

  • memory/4012-2-0x0000020D8C520000-0x0000020D8C790000-memory.dmp

    Filesize

    2.4MB

  • memory/4012-12-0x0000020D8C500000-0x0000020D8C501000-memory.dmp

    Filesize

    4KB

  • memory/4012-13-0x0000020D8C520000-0x0000020D8C790000-memory.dmp

    Filesize

    2.4MB