Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
1NoxusMod.jar
windows10-1703-x64
7NoxusMod.jar
windows10-2004-x64
7NoxusMod.jar
windows11-21h2-x64
7NoxusMod.jar
android-13-x64
NoxusMod.jar
macos-10.15-amd64
4NoxusMod.jar
ubuntu-18.04-amd64
NoxusMod.jar
debian-9-armhf
NoxusMod.jar
debian-9-mips
NoxusMod.jar
debian-9-mipsel
Analysis
-
max time kernel
185s -
max time network
187s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
27/05/2024, 11:33
Static task
static1
Behavioral task
behavioral1
Sample
NoxusMod.jar
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
NoxusMod.jar
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
NoxusMod.jar
Resource
win11-20240508-en
Behavioral task
behavioral4
Sample
NoxusMod.jar
Resource
android-33-x64-arm64-20240514-en
Behavioral task
behavioral5
Sample
NoxusMod.jar
Resource
macos-20240410-en
Behavioral task
behavioral6
Sample
NoxusMod.jar
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral7
Sample
NoxusMod.jar
Resource
debian9-armhf-20240418-en
Behavioral task
behavioral8
Sample
NoxusMod.jar
Resource
debian9-mipsbe-20240226-en
Behavioral task
behavioral9
Sample
NoxusMod.jar
Resource
debian9-mipsel-20240418-en
General
-
Target
NoxusMod.jar
-
Size
1.4MB
-
MD5
462734450a265e297b3a3e8ebad04f25
-
SHA1
da384ae6cf08f161f7ec2bbfbd1e8598c88a7de6
-
SHA256
1179aeeafbdaeb7b6ffbc070551c440eb7dfe9786d50dc5beb415bb2f17eded4
-
SHA512
7494ee564de93139b90a4a909a3cfbf8229683f54799698b616ac9fb192f45a1667b7832eef71fb7af87fb490900c7796c2d18e1c242ce4ba10de780b4270d3f
-
SSDEEP
24576:VO+tNLEsGPiCnvnbIcDWsBCTh0z1xwRIRyzVVo719mthe5cW2RegoH9ru0:VO+wpLbbWslfZ2EXmtheyMbK0
Malware Config
Signatures
-
Modifies file permissions 1 TTPs 1 IoCs
pid Process 2704 icacls.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Home = "C:\\Program Files\\Java\\jre-1.8\\bin\\javaw.exe -jar C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\.tmp\\1716809704852.tmp" reg.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3100 java.exe 3100 java.exe 3100 java.exe 3100 java.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3100 wrote to memory of 2704 3100 java.exe 83 PID 3100 wrote to memory of 2704 3100 java.exe 83 PID 3100 wrote to memory of 5084 3100 java.exe 87 PID 3100 wrote to memory of 5084 3100 java.exe 87 PID 3100 wrote to memory of 2408 3100 java.exe 90 PID 3100 wrote to memory of 2408 3100 java.exe 90 PID 2408 wrote to memory of 3272 2408 cmd.exe 92 PID 2408 wrote to memory of 3272 2408 cmd.exe 92 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 5084 attrib.exe
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\NoxusMod.jar1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
PID:2704
-
-
C:\Windows\SYSTEM32\attrib.exeattrib +H C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1716809704852.tmp2⤵
- Views/modifies file attributes
PID:5084
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1716809704852.tmp" /f"2⤵
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\system32\reg.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1716809704852.tmp" /f3⤵
- Adds Run key to start application
PID:3272
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46B
MD5b1b408f4e764b71d6d767cc59650af90
SHA1f5dcce51787283fa79cb74f427fd054eede02b6b
SHA256ebb1bba5164e81f1c8cef52dd7cff6acd26b5b5e12626603cfd66b65c92e73c1
SHA512920154a9b8c93668b4a28065c26802457e524523bde460af807bc84f67a484ac35151bf23d3922950008333e092f6c5f50d6de4a7a2ee0fa2a667ea7d47da222
-
Filesize
1.4MB
MD5462734450a265e297b3a3e8ebad04f25
SHA1da384ae6cf08f161f7ec2bbfbd1e8598c88a7de6
SHA2561179aeeafbdaeb7b6ffbc070551c440eb7dfe9786d50dc5beb415bb2f17eded4
SHA5127494ee564de93139b90a4a909a3cfbf8229683f54799698b616ac9fb192f45a1667b7832eef71fb7af87fb490900c7796c2d18e1c242ce4ba10de780b4270d3f