Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
2s -
max time network
6s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
28/06/2024, 00:45
Static task
static1
Behavioral task
behavioral1
Sample
preview_OptiFine_1.20.6_HD_U_I9_pre1.jar
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
preview_OptiFine_1.20.6_HD_U_I9_pre1.jar
Resource
win10v2004-20240508-en
General
-
Target
preview_OptiFine_1.20.6_HD_U_I9_pre1.jar
-
Size
7.0MB
-
MD5
b2d278d1d763e4896d88e4fd5aa3bb4d
-
SHA1
0d62c5e2abd5ecc860c678298618fb61200a4558
-
SHA256
cc460a49a3aa9f20e73212371a0a7ab1291cdb853fbfc8af7cf1da6b4f0d1c8e
-
SHA512
db7f491446cfa5deb5a9b37be1bead231e1fe9fdb7c31026415412789353e115cd82976f5a2101685a10e05c6d6f987b765daa246bc7fc13df121972d81baf0a
-
SSDEEP
196608:SL45p+3iP/0MWD47+auAIdiqzoK0F+652:SLupxHHCk+3AI8DK60
Malware Config
Signatures
-
Modifies file permissions 1 TTPs 1 IoCs
pid Process 3080 icacls.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4728 java.exe 4728 java.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4728 wrote to memory of 3080 4728 java.exe 82 PID 4728 wrote to memory of 3080 4728 java.exe 82
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\preview_OptiFine_1.20.6_HD_U_I9_pre1.jar1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
PID:3080
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46B
MD52ad5ed5de7d72fdeaeb70a368d661160
SHA1046fcd1c5974f83554c9ac275767651febd271e7
SHA2564db4ce855b3fd097a7be408308ac11965a664ccef056a69426ccbcaa369a8130
SHA512d7b715ef902f2b80811ace2ed3d8debfa4abcd16e6e691e819ed260b3395ee8661fa884f198bf19ae9b5376f85baaa60dc97c07250030a0a82ae17a7d2717ea7