Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/06/2024, 21:49

General

  • Target

    7f5qc459.jar

  • Size

    2.3MB

  • MD5

    c3233eb0f0216752a546ae6ca551ff37

  • SHA1

    66cffb233e75078558750b2b5717b448fc2a9e29

  • SHA256

    000cb4373ce83f5e828b4ed209ae85ef97a819f0d6724e27a930be7c0f589107

  • SHA512

    be4f13994490e38d031d2d1d7675e7e87e77778f619b7f77c5e7c04e1cfd566aa074ec0488cc68c5625b4492ae60ddf6e31667783a07e80d15ee2e6b221e1c6f

  • SSDEEP

    49152:vEDD8ICikBd0+gU2qw+mSUTgy+PI1FLVTxBE7a9S:vk85BYH+7Uky9FYES

Score
7/10

Malware Config

Signatures

  • Modifies file permissions 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
    java -jar C:\Users\Admin\AppData\Local\Temp\7f5qc459.jar
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3908
    • C:\Windows\system32\icacls.exe
      C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
      2⤵
      • Modifies file permissions
      PID:736

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

    Filesize

    46B

    MD5

    ffe3baf5b0b2c44fb6154da117a0a7d2

    SHA1

    7dc9a55a531493043054d997ac82a934d4b80c7b

    SHA256

    b9a7912194a03f68c0aded7d7823c33a1f7c7c3801466914abdce8d4e88d6e46

    SHA512

    5e4924cd153aee66167fe023d23c5c837e6e611d431474dfd124b16efd4f5f298206a5e3076ec69878a22f9b2c2bbe8456fd52bf0990af891392edb63f7ec6d3

  • memory/3908-2-0x00000246CA0E0000-0x00000246CA350000-memory.dmp

    Filesize

    2.4MB

  • memory/3908-21-0x00000246C7AF0000-0x00000246C7AF1000-memory.dmp

    Filesize

    4KB

  • memory/3908-24-0x00000246CA350000-0x00000246CA360000-memory.dmp

    Filesize

    64KB

  • memory/3908-26-0x00000246CA360000-0x00000246CA370000-memory.dmp

    Filesize

    64KB

  • memory/3908-29-0x00000246CA370000-0x00000246CA380000-memory.dmp

    Filesize

    64KB

  • memory/3908-31-0x00000246CA390000-0x00000246CA3A0000-memory.dmp

    Filesize

    64KB

  • memory/3908-30-0x00000246CA380000-0x00000246CA390000-memory.dmp

    Filesize

    64KB

  • memory/3908-34-0x00000246CA3A0000-0x00000246CA3B0000-memory.dmp

    Filesize

    64KB

  • memory/3908-36-0x00000246CA3B0000-0x00000246CA3C0000-memory.dmp

    Filesize

    64KB

  • memory/3908-40-0x00000246CA3D0000-0x00000246CA3E0000-memory.dmp

    Filesize

    64KB

  • memory/3908-39-0x00000246CA3C0000-0x00000246CA3D0000-memory.dmp

    Filesize

    64KB

  • memory/3908-45-0x00000246CA3F0000-0x00000246CA400000-memory.dmp

    Filesize

    64KB

  • memory/3908-44-0x00000246CA3E0000-0x00000246CA3F0000-memory.dmp

    Filesize

    64KB

  • memory/3908-48-0x00000246CA400000-0x00000246CA410000-memory.dmp

    Filesize

    64KB

  • memory/3908-50-0x00000246CA410000-0x00000246CA420000-memory.dmp

    Filesize

    64KB

  • memory/3908-57-0x00000246CA420000-0x00000246CA430000-memory.dmp

    Filesize

    64KB

  • memory/3908-59-0x00000246CA440000-0x00000246CA450000-memory.dmp

    Filesize

    64KB

  • memory/3908-62-0x00000246CA350000-0x00000246CA360000-memory.dmp

    Filesize

    64KB

  • memory/3908-61-0x00000246CA430000-0x00000246CA440000-memory.dmp

    Filesize

    64KB

  • memory/3908-60-0x00000246CA450000-0x00000246CA460000-memory.dmp

    Filesize

    64KB

  • memory/3908-58-0x00000246C7AF0000-0x00000246C7AF1000-memory.dmp

    Filesize

    4KB

  • memory/3908-56-0x00000246CA0E0000-0x00000246CA350000-memory.dmp

    Filesize

    2.4MB

  • memory/3908-65-0x00000246CA360000-0x00000246CA370000-memory.dmp

    Filesize

    64KB

  • memory/3908-66-0x00000246CA460000-0x00000246CA470000-memory.dmp

    Filesize

    64KB

  • memory/3908-72-0x00000246CA470000-0x00000246CA480000-memory.dmp

    Filesize

    64KB

  • memory/3908-71-0x00000246CA390000-0x00000246CA3A0000-memory.dmp

    Filesize

    64KB

  • memory/3908-70-0x00000246CA380000-0x00000246CA390000-memory.dmp

    Filesize

    64KB

  • memory/3908-69-0x00000246CA370000-0x00000246CA380000-memory.dmp

    Filesize

    64KB

  • memory/3908-76-0x00000246CA480000-0x00000246CA490000-memory.dmp

    Filesize

    64KB

  • memory/3908-77-0x00000246C7AF0000-0x00000246C7AF1000-memory.dmp

    Filesize

    4KB

  • memory/3908-75-0x00000246CA3A0000-0x00000246CA3B0000-memory.dmp

    Filesize

    64KB

  • memory/3908-79-0x00000246CA3B0000-0x00000246CA3C0000-memory.dmp

    Filesize

    64KB

  • memory/3908-80-0x00000246CA490000-0x00000246CA4A0000-memory.dmp

    Filesize

    64KB

  • memory/3908-89-0x00000246CA4A0000-0x00000246CA4B0000-memory.dmp

    Filesize

    64KB

  • memory/3908-88-0x00000246CA3D0000-0x00000246CA3E0000-memory.dmp

    Filesize

    64KB

  • memory/3908-87-0x00000246CA3C0000-0x00000246CA3D0000-memory.dmp

    Filesize

    64KB

  • memory/3908-91-0x00000246CA3E0000-0x00000246CA3F0000-memory.dmp

    Filesize

    64KB

  • memory/3908-93-0x00000246CA4B0000-0x00000246CA4C0000-memory.dmp

    Filesize

    64KB

  • memory/3908-92-0x00000246CA3F0000-0x00000246CA400000-memory.dmp

    Filesize

    64KB

  • memory/3908-98-0x00000246CA4C0000-0x00000246CA4D0000-memory.dmp

    Filesize

    64KB

  • memory/3908-97-0x00000246CA400000-0x00000246CA410000-memory.dmp

    Filesize

    64KB

  • memory/3908-100-0x00000246CA4D0000-0x00000246CA4E0000-memory.dmp

    Filesize

    64KB

  • memory/3908-99-0x00000246CA410000-0x00000246CA420000-memory.dmp

    Filesize

    64KB

  • memory/3908-101-0x00000246CA420000-0x00000246CA430000-memory.dmp

    Filesize

    64KB

  • memory/3908-104-0x00000246CA4E0000-0x00000246CA4F0000-memory.dmp

    Filesize

    64KB

  • memory/3908-103-0x00000246CA450000-0x00000246CA460000-memory.dmp

    Filesize

    64KB

  • memory/3908-102-0x00000246CA440000-0x00000246CA450000-memory.dmp

    Filesize

    64KB

  • memory/3908-106-0x00000246CA4F0000-0x00000246CA500000-memory.dmp

    Filesize

    64KB

  • memory/3908-108-0x00000246C9AC0000-0x00000246C9AC1000-memory.dmp

    Filesize

    4KB

  • memory/3908-116-0x00000246C7AF0000-0x00000246C7AF1000-memory.dmp

    Filesize

    4KB

  • memory/3908-119-0x00000246CA500000-0x00000246CA510000-memory.dmp

    Filesize

    64KB

  • memory/3908-118-0x00000246CA460000-0x00000246CA470000-memory.dmp

    Filesize

    64KB

  • memory/3908-120-0x00000246CA470000-0x00000246CA480000-memory.dmp

    Filesize

    64KB

  • memory/3908-121-0x00000246C7AF0000-0x00000246C7AF1000-memory.dmp

    Filesize

    4KB

  • memory/3908-122-0x00000246CA480000-0x00000246CA490000-memory.dmp

    Filesize

    64KB

  • memory/3908-124-0x00000246CA490000-0x00000246CA4A0000-memory.dmp

    Filesize

    64KB

  • memory/3908-125-0x00000246CA4A0000-0x00000246CA4B0000-memory.dmp

    Filesize

    64KB

  • memory/3908-127-0x00000246CA4B0000-0x00000246CA4C0000-memory.dmp

    Filesize

    64KB

  • memory/3908-128-0x00000246CA4C0000-0x00000246CA4D0000-memory.dmp

    Filesize

    64KB

  • memory/3908-129-0x00000246CA510000-0x00000246CA520000-memory.dmp

    Filesize

    64KB

  • memory/3908-132-0x00000246CA4D0000-0x00000246CA4E0000-memory.dmp

    Filesize

    64KB

  • memory/3908-133-0x00000246CA4E0000-0x00000246CA4F0000-memory.dmp

    Filesize

    64KB

  • memory/3908-135-0x00000246CA4F0000-0x00000246CA500000-memory.dmp

    Filesize

    64KB

  • memory/3908-136-0x00000246CA500000-0x00000246CA510000-memory.dmp

    Filesize

    64KB

  • memory/3908-137-0x00000246CA520000-0x00000246CA530000-memory.dmp

    Filesize

    64KB

  • memory/3908-146-0x00000246CA510000-0x00000246CA520000-memory.dmp

    Filesize

    64KB

  • memory/3908-147-0x00000246CA530000-0x00000246CA540000-memory.dmp

    Filesize

    64KB

  • memory/3908-152-0x00000246CA540000-0x00000246CA550000-memory.dmp

    Filesize

    64KB

  • memory/3908-151-0x00000246CA520000-0x00000246CA530000-memory.dmp

    Filesize

    64KB

  • memory/3908-154-0x00000246CA550000-0x00000246CA560000-memory.dmp

    Filesize

    64KB

  • memory/3908-157-0x00000246CA560000-0x00000246CA570000-memory.dmp

    Filesize

    64KB

  • memory/3908-160-0x00000246CA570000-0x00000246CA580000-memory.dmp

    Filesize

    64KB

  • memory/3908-163-0x00000246CA530000-0x00000246CA540000-memory.dmp

    Filesize

    64KB

  • memory/3908-164-0x00000246CA540000-0x00000246CA550000-memory.dmp

    Filesize

    64KB

  • memory/3908-166-0x00000246CA550000-0x00000246CA560000-memory.dmp

    Filesize

    64KB

  • memory/3908-167-0x00000246CA560000-0x00000246CA570000-memory.dmp

    Filesize

    64KB

  • memory/3908-168-0x00000246CA580000-0x00000246CA590000-memory.dmp

    Filesize

    64KB

  • memory/3908-169-0x00000246CA570000-0x00000246CA580000-memory.dmp

    Filesize

    64KB

  • memory/3908-172-0x00000246CA580000-0x00000246CA590000-memory.dmp

    Filesize

    64KB

  • memory/3908-175-0x00000246CA590000-0x00000246CA5A0000-memory.dmp

    Filesize

    64KB

  • memory/3908-177-0x00000246CA590000-0x00000246CA5A0000-memory.dmp

    Filesize

    64KB

  • memory/3908-182-0x00000246CA5A0000-0x00000246CA5B0000-memory.dmp

    Filesize

    64KB