Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    90s
  • max time network
    140s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    02/06/2024, 21:49

General

  • Target

    7f5qc459.jar

  • Size

    2.3MB

  • MD5

    c3233eb0f0216752a546ae6ca551ff37

  • SHA1

    66cffb233e75078558750b2b5717b448fc2a9e29

  • SHA256

    000cb4373ce83f5e828b4ed209ae85ef97a819f0d6724e27a930be7c0f589107

  • SHA512

    be4f13994490e38d031d2d1d7675e7e87e77778f619b7f77c5e7c04e1cfd566aa074ec0488cc68c5625b4492ae60ddf6e31667783a07e80d15ee2e6b221e1c6f

  • SSDEEP

    49152:vEDD8ICikBd0+gU2qw+mSUTgy+PI1FLVTxBE7a9S:vk85BYH+7Uky9FYES

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 45 IoCs
  • Suspicious use of SendNotifyMessage 41 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\java.exe
    java -jar C:\Users\Admin\AppData\Local\Temp\7f5qc459.jar
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:1992
  • C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\SubmitExpand.MTS"
    1⤵
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:3052
  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1620
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef5799758,0x7fef5799768,0x7fef5799778
      2⤵
        PID:2536
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1224 --field-trial-handle=1016,i,16365072972847428357,9739724690435554494,131072 /prefetch:2
        2⤵
          PID:672
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1564 --field-trial-handle=1016,i,16365072972847428357,9739724690435554494,131072 /prefetch:8
          2⤵
            PID:1476
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1644 --field-trial-handle=1016,i,16365072972847428357,9739724690435554494,131072 /prefetch:8
            2⤵
              PID:1468
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2312 --field-trial-handle=1016,i,16365072972847428357,9739724690435554494,131072 /prefetch:1
              2⤵
                PID:1508
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2324 --field-trial-handle=1016,i,16365072972847428357,9739724690435554494,131072 /prefetch:1
                2⤵
                  PID:1980
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1420 --field-trial-handle=1016,i,16365072972847428357,9739724690435554494,131072 /prefetch:2
                  2⤵
                    PID:1680
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3208 --field-trial-handle=1016,i,16365072972847428357,9739724690435554494,131072 /prefetch:1
                    2⤵
                      PID:2616
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3440 --field-trial-handle=1016,i,16365072972847428357,9739724690435554494,131072 /prefetch:8
                      2⤵
                        PID:1904
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3592 --field-trial-handle=1016,i,16365072972847428357,9739724690435554494,131072 /prefetch:8
                        2⤵
                          PID:864
                        • C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
                          "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --reenable-autoupdates --system-level
                          2⤵
                            PID:2216
                            • C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
                              "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x154,0x158,0x15c,0x128,0x160,0x13fb17688,0x13fb17698,0x13fb176a8
                              3⤵
                                PID:2392
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3568 --field-trial-handle=1016,i,16365072972847428357,9739724690435554494,131072 /prefetch:8
                              2⤵
                                PID:2120
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3728 --field-trial-handle=1016,i,16365072972847428357,9739724690435554494,131072 /prefetch:8
                                2⤵
                                  PID:2568
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3720 --field-trial-handle=1016,i,16365072972847428357,9739724690435554494,131072 /prefetch:8
                                  2⤵
                                    PID:2736
                                • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                  "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                  1⤵
                                    PID:1820

                                  Network

                                  MITRE ATT&CK Enterprise v15

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Program Files\Google\Chrome\Application\SetupMetrics\20240602215024.pma

                                    Filesize

                                    488B

                                    MD5

                                    6d971ce11af4a6a93a4311841da1a178

                                    SHA1

                                    cbfdbc9b184f340cbad764abc4d8a31b9c250176

                                    SHA256

                                    338ddefb963d5042cae01de7b87ac40f4d78d1bfa2014ff774036f4bc7486783

                                    SHA512

                                    c58b59b9677f70a5bb5efd0ecbf59d2ac21cbc52e661980241d3be33663825e2a7a77adafbcec195e1d9d89d05b9ccb5e5be1a201f92cb1c1f54c258af16e29f

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1

                                    Filesize

                                    264KB

                                    MD5

                                    f50f89a0a91564d0b8a211f8921aa7de

                                    SHA1

                                    112403a17dd69d5b9018b8cede023cb3b54eab7d

                                    SHA256

                                    b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                    SHA512

                                    bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp

                                    Filesize

                                    16B

                                    MD5

                                    aefd77f47fb84fae5ea194496b44c67a

                                    SHA1

                                    dcfbb6a5b8d05662c4858664f81693bb7f803b82

                                    SHA256

                                    4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

                                    SHA512

                                    b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                    Filesize

                                    5KB

                                    MD5

                                    e2297fbf8385fac50484d89bb5ec8388

                                    SHA1

                                    9ee9e93bdbb08485e438736f399624848f493022

                                    SHA256

                                    652eb6c6ec4e777009f67931818663cf32202241f6d9c7323ddad64e7b56ba78

                                    SHA512

                                    51cdc457dbd60c71b45c7aa49011ebdef53103b6f2b5e6255676dd4e0f1c39cffc3c0ab61e0da4347cceeea45a4a459c6db2b00dfa4a893fac9174137f511409

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                    Filesize

                                    5KB

                                    MD5

                                    a8f2d33426c1e62c82d8d40cbabd08c7

                                    SHA1

                                    922c185b6ff1b75db4ab3f4c83cb654dc5140247

                                    SHA256

                                    933fd1d7bbcf7776c29353a4daa0a6071c6bf21a4fe3c2a701388e3fd83ced2a

                                    SHA512

                                    5bf4f0bd2dde273936535b75cd23ce3bbec2596eb20811a8ba63d47baeaf032a9d899d86679f8890ca2163154e098c0d8ff2d8a911991ede40e90ae752bdea15

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

                                    Filesize

                                    16B

                                    MD5

                                    18e723571b00fb1694a3bad6c78e4054

                                    SHA1

                                    afcc0ef32d46fe59e0483f9a3c891d3034d12f32

                                    SHA256

                                    8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

                                    SHA512

                                    43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                    Filesize

                                    140KB

                                    MD5

                                    c568085e747a19fd3b9092b0ddecd5ad

                                    SHA1

                                    1fb0bc6dfdb79b4b6efb2c6ad6e1c30d4f23877e

                                    SHA256

                                    fc72f86bf0ece3f17ee5ead5d014b36b952f382821942d090d5b73647591e1f9

                                    SHA512

                                    02d45eaa5db1f4e98d2046ef61977ec48ef9c83ff153439c06bd7ed6ddacd3591e121e2f2f32439c1b43a347d8caeb652b100c76bce29ebf27a5f06fc1a2a629

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                    Filesize

                                    300KB

                                    MD5

                                    0e532f3e72c7ee6c07648b2bfdc28b25

                                    SHA1

                                    55530f8d0d98a1af8bd6744b0d9ad2add0e88611

                                    SHA256

                                    bc211b8cb7cac42be40c0d2ab9e2a095328b259ee712d3bc73b2dfda1ed80d36

                                    SHA512

                                    b3adab15f5ba939781644a6a837cfba17177157191d80720932058c09642eaa1e5180e2e2d191570355d22a9b5a2f6624b9d6b0ab28bfe595db2abecf22fbf49

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\acbb552b-cc57-4b07-92f2-1672287fcb7f.tmp

                                    Filesize

                                    284KB

                                    MD5

                                    6474d3ce7693c5c90921750b206d6d3c

                                    SHA1

                                    8fb5593b4ece9c68947f297fbc6fea80fcccb8cd

                                    SHA256

                                    8a3d27bfd1c99dd4446aef2249c6590ce73b715ba270e94634bec122cf7fd17c

                                    SHA512

                                    1f338e5d30de9b6678c626cb1326ea3f4a1c0866e4798130c8b936b2e6c590559fcf309e47d58925f0545fbe63fd4c362a470792e98719a6fbc8c36f7ea2bee8

                                  • \Users\Admin\AppData\Local\Temp\fefb0347-205f0a30.dll

                                    Filesize

                                    5KB

                                    MD5

                                    732880711c61a96f90ce86da9b6c6b02

                                    SHA1

                                    5a1506124a768c6e61c7fe2629374432f2aa4327

                                    SHA256

                                    3fac7db73b105c20465e965f0a68682166f341dfe624f7c630755e8846b8d992

                                    SHA512

                                    e6eea645106f21d90e867f2086656ab91905e4c301bca075304cc35feff9f1e5635966f5652329ebe08f880f550d2e2e0c8079beb48c96deb9438a89d1ec3954

                                  • memory/1992-13-0x00000000005C0000-0x00000000005CA000-memory.dmp

                                    Filesize

                                    40KB

                                  • memory/1992-14-0x00000000005C0000-0x00000000005CA000-memory.dmp

                                    Filesize

                                    40KB

                                  • memory/1992-48-0x00000000005C0000-0x00000000005CA000-memory.dmp

                                    Filesize

                                    40KB

                                  • memory/1992-50-0x0000000000180000-0x0000000000181000-memory.dmp

                                    Filesize

                                    4KB

                                  • memory/1992-57-0x0000000000180000-0x0000000000181000-memory.dmp

                                    Filesize

                                    4KB

                                  • memory/1992-58-0x0000000002DF0000-0x0000000003060000-memory.dmp

                                    Filesize

                                    2.4MB

                                  • memory/1992-37-0x00000000024B0000-0x0000000002512000-memory.dmp

                                    Filesize

                                    392KB

                                  • memory/1992-35-0x00000000024B0000-0x0000000002512000-memory.dmp

                                    Filesize

                                    392KB

                                  • memory/1992-34-0x00000000024B0000-0x0000000002512000-memory.dmp

                                    Filesize

                                    392KB

                                  • memory/1992-25-0x0000000000180000-0x0000000000181000-memory.dmp

                                    Filesize

                                    4KB

                                  • memory/1992-44-0x0000000002DF0000-0x0000000003060000-memory.dmp

                                    Filesize

                                    2.4MB

                                  • memory/1992-43-0x0000000000180000-0x0000000000181000-memory.dmp

                                    Filesize

                                    4KB

                                  • memory/1992-2-0x0000000002DF0000-0x0000000003060000-memory.dmp

                                    Filesize

                                    2.4MB

                                  • memory/1992-49-0x00000000005C0000-0x00000000005CA000-memory.dmp

                                    Filesize

                                    40KB

                                  • memory/1992-41-0x0000000000180000-0x0000000000181000-memory.dmp

                                    Filesize

                                    4KB

                                  • memory/1992-21-0x0000000000180000-0x0000000000181000-memory.dmp

                                    Filesize

                                    4KB

                                  • memory/3052-74-0x000007FEF3EE0000-0x000007FEF4F90000-memory.dmp

                                    Filesize

                                    16.7MB

                                  • memory/3052-73-0x000007FEF54C0000-0x000007FEF5776000-memory.dmp

                                    Filesize

                                    2.7MB

                                  • memory/3052-72-0x000007FEF5780000-0x000007FEF57B4000-memory.dmp

                                    Filesize

                                    208KB

                                  • memory/3052-71-0x000000013F570000-0x000000013F668000-memory.dmp

                                    Filesize

                                    992KB