Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
23/05/2024, 09:55
240523-lx9t7sce43 123/05/2024, 09:54
240523-lw9g2sce4t 723/05/2024, 09:27
240523-lerkxabh99 7Analysis
-
max time kernel
137s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
23/05/2024, 09:54
Static task
static1
Behavioral task
behavioral1
Sample
oraxen-1.166.0.jar
Resource
win10v2004-20240426-en
Behavioral task
behavioral2
Sample
oraxen-1.166.0.jar
Resource
win11-20240508-en
General
-
Target
oraxen-1.166.0.jar
-
Size
3.3MB
-
MD5
40749750084a4c61e0cb77d651629815
-
SHA1
1ad2459615ad3f1d9a81a1ac0b842cf4e6154600
-
SHA256
21ed5d1df342b9e180c0e9ac5ab8d72aeb9e1ce70a0f90bd87198b136f169b06
-
SHA512
91e58141cd3aadeeb66c695881ed63341179f6f5adc8b3e3b1eed5af6c4f124ca11194505fab38cf97ce60b3fc1656d5ec0bb7a1ca2cf9eb163571205e8ac5c7
-
SSDEEP
49152:b3/pSLJqlqansp2zr7Wwc2+rLiohlqnbwPgq2zvwqBflgtwA6VOgneLlD7nSC9:bhSLeq2spQSG+/DvPwrveTLlXT
Malware Config
Signatures
-
Modifies file permissions 1 TTPs 1 IoCs
pid Process 2444 icacls.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4012 wrote to memory of 2444 4012 java.exe 84 PID 4012 wrote to memory of 2444 4012 java.exe 84
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\oraxen-1.166.0.jar1⤵
- Suspicious use of WriteProcessMemory
PID:4012 -
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
PID:2444
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46B
MD566dfde3d20e230d4e4ad9293dd4fa3f8
SHA142ca605f35921a662c7324a1c177e7253e806b5a
SHA256b96c9009c8f17ee13891a22c7f768a146b2f4927ccc6fc8fa24af451ce58719c
SHA5125887de3f9a128a3cba94a9564409344984d337b187f90d27e002aee1ebaba465ab84ee31ca0376dd771ce136309e258e5dc0d3308567a1fa8549cd0591b1430b