Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
24/06/2024, 20:31
Static task
static1
Behavioral task
behavioral1
Sample
world-downloader.jar
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
world-downloader.jar
Resource
win10v2004-20240611-en
General
-
Target
world-downloader.jar
-
Size
13.3MB
-
MD5
79230998e545a82c339dcb4a067c0c96
-
SHA1
30e60fe68c973ed13028cb851720293b00bbe792
-
SHA256
26eba4ba23eb76fda50e2197989b4acc570717907b9333c67f122504c379cc35
-
SHA512
ec8e896f995cac1dc699db191bfd1015b5e2f9db5b6fc2d2a02a949010265747a397a87cce428afed567c53c823a1e2902df490861d9c422d2b64856e30bfd95
-
SSDEEP
196608:Z7xfxAe9wyhqAxuOIB9VbdmXxxRL5zVXAkutqyNVAxz2ZDnvGSU5IWxJzAPv8WB:Z7xl72RdbkXdbAkiNGEGX6WxJzAX8WB
Malware Config
Signatures
-
Modifies file permissions 1 TTPs 1 IoCs
pid Process 2532 icacls.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3048 wrote to memory of 2532 3048 java.exe 85 PID 3048 wrote to memory of 2532 3048 java.exe 85
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\world-downloader.jar1⤵
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
PID:2532
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46B
MD5a0d146291e41d93542b014b4128fb158
SHA142315460e3a8e3f32f2a8438e179be0c11315bd0
SHA256aeb2091638c09b334e005a465296f68ebb0eeec6585ace0cd8b61dcbffd8b732
SHA5129fcbf493ebd13aa85d70b07e4bd8933c54b54e3716ef861dbc00f663a79868788f0be5a83c1734def61c4adf18db3c01e7343caddf69163d08d1d2e5442686ff