Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/06/2024, 20:31

General

  • Target

    world-downloader.jar

  • Size

    13.3MB

  • MD5

    79230998e545a82c339dcb4a067c0c96

  • SHA1

    30e60fe68c973ed13028cb851720293b00bbe792

  • SHA256

    26eba4ba23eb76fda50e2197989b4acc570717907b9333c67f122504c379cc35

  • SHA512

    ec8e896f995cac1dc699db191bfd1015b5e2f9db5b6fc2d2a02a949010265747a397a87cce428afed567c53c823a1e2902df490861d9c422d2b64856e30bfd95

  • SSDEEP

    196608:Z7xfxAe9wyhqAxuOIB9VbdmXxxRL5zVXAkutqyNVAxz2ZDnvGSU5IWxJzAPv8WB:Z7xl72RdbkXdbAkiNGEGX6WxJzAX8WB

Score
7/10

Malware Config

Signatures

  • Modifies file permissions 1 TTPs 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
    java -jar C:\Users\Admin\AppData\Local\Temp\world-downloader.jar
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3048
    • C:\Windows\system32\icacls.exe
      C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
      2⤵
      • Modifies file permissions
      PID:2532

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

    Filesize

    46B

    MD5

    a0d146291e41d93542b014b4128fb158

    SHA1

    42315460e3a8e3f32f2a8438e179be0c11315bd0

    SHA256

    aeb2091638c09b334e005a465296f68ebb0eeec6585ace0cd8b61dcbffd8b732

    SHA512

    9fcbf493ebd13aa85d70b07e4bd8933c54b54e3716ef861dbc00f663a79868788f0be5a83c1734def61c4adf18db3c01e7343caddf69163d08d1d2e5442686ff

  • memory/3048-2-0x0000029590DA0000-0x0000029591010000-memory.dmp

    Filesize

    2.4MB

  • memory/3048-13-0x000002958F390000-0x000002958F391000-memory.dmp

    Filesize

    4KB

  • memory/3048-14-0x0000029590DA0000-0x0000029591010000-memory.dmp

    Filesize

    2.4MB