Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/07/2024, 22:05

General

  • Target

    1C24TYY_00001201.pdf.jar

  • Size

    400KB

  • MD5

    85ee6b284937350785d315ee74e1027d

  • SHA1

    2f7983a3b6400799f334e464923178020d1577e7

  • SHA256

    9f396dbcac9551ef1319e43ace32c0f71f808dd91c13193c1ac06f1acc1aaaf3

  • SHA512

    b8ade32ca7406803ce3ba18846b418749e1f8718844d01ad33d2b383722214afa9710327a41a855bd978d8ef67210b9fd33a61b08ba3b6e4a14c4d88b7300747

  • SSDEEP

    12288:A8a0HTP5TMssDFIwv7i3XWaDcwrP9iNIs:ABQTP5FIeH5P9QV

Malware Config

Signatures

  • STRRAT

    STRRAT is a remote access tool than can steal credentials and log keystrokes.

  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of WriteProcessMemory 8 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
    java -jar C:\Users\Admin\AppData\Local\Temp\1C24TYY_00001201.pdf.jar
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5116
    • C:\Program Files\Java\jre-1.8\bin\java.exe
      "C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\1C24TYY_00001201.pdf.jar"
      2⤵
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2520
      • C:\Windows\SYSTEM32\cmd.exe
        cmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\1C24TYY_00001201.pdf.jar"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3960
        • C:\Windows\system32\schtasks.exe
          schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\1C24TYY_00001201.pdf.jar"
          4⤵
          • Scheduled Task/Job: Scheduled Task
          PID:1992
      • C:\Program Files\Java\jre-1.8\bin\java.exe
        "C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\1C24TYY_00001201.pdf.jar"
        3⤵
        • Loads dropped DLL
        PID:844

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

    Filesize

    46B

    MD5

    562e3cb2d2ceac44ec32978c6bc3e649

    SHA1

    d5680dcfacfe1534998196fdff4677b2c378330f

    SHA256

    9923776d854e034ddf735b46b5e133f8664593b1b1a5dda8f76989a39fef9ecc

    SHA512

    8cf21a31ebb657e7adc4a96359870a4548ab17bd9710fbf2061f6b1539a1c5df9d2a40ce00c02902c7a5d857c17007befd521c23bd885e7851e1c48742796590

  • C:\Users\Admin\1C24TYY_00001201.pdf.jar

    Filesize

    400KB

    MD5

    85ee6b284937350785d315ee74e1027d

    SHA1

    2f7983a3b6400799f334e464923178020d1577e7

    SHA256

    9f396dbcac9551ef1319e43ace32c0f71f808dd91c13193c1ac06f1acc1aaaf3

    SHA512

    b8ade32ca7406803ce3ba18846b418749e1f8718844d01ad33d2b383722214afa9710327a41a855bd978d8ef67210b9fd33a61b08ba3b6e4a14c4d88b7300747

  • C:\Users\Admin\AppData\Local\Temp\jna-63116079\jna832799613739776748.dll

    Filesize

    241KB

    MD5

    e02979ecd43bcc9061eb2b494ab5af50

    SHA1

    3122ac0e751660f646c73b10c4f79685aa65c545

    SHA256

    a66959bec2ef5af730198db9f3b3f7cab0d4ae70ce01bec02bf1d738e6d1ee7a

    SHA512

    1e6f7dcb6a557c9b896412a48dd017c16f7a52fa2b9ab513593c9ecd118e86083979821ca7a3e2f098ee349200c823c759cec6599740dd391cb5f354dc29b372

  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3419463127-3903270268-2580331543-1000\83aa4cc77f591dfc2374580bbd95f6ba_da80f27c-12da-4232-b66b-1e1207d248ba

    Filesize

    45B

    MD5

    c8366ae350e7019aefc9d1e6e6a498c6

    SHA1

    5731d8a3e6568a5f2dfbbc87e3db9637df280b61

    SHA256

    11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238

    SHA512

    33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd

  • C:\Users\Admin\lib\jna-5.5.0.jar

    Filesize

    1.4MB

    MD5

    acfb5b5fd9ee10bf69497792fd469f85

    SHA1

    0e0845217c4907822403912ad6828d8e0b256208

    SHA256

    b308faebfe4ed409de8410e0a632d164b2126b035f6eacff968d3908cafb4d9e

    SHA512

    e52575f58a195ceb3bd16b9740eadf5bc5b1d4d63c0734e8e5fd1d1776aa2d068d2e4c7173b83803f95f72c0a6759ae1c9b65773c734250d4cfcdf47a19f82aa

  • C:\Users\Admin\lib\jna-platform-5.5.0.jar

    Filesize

    2.6MB

    MD5

    2f4a99c2758e72ee2b59a73586a2322f

    SHA1

    af38e7c4d0fc73c23ecd785443705bfdee5b90bf

    SHA256

    24d81621f82ac29fcdd9a74116031f5907a2343158e616f4573bbfa2434ae0d5

    SHA512

    b860459a0d3bf7ccb600a03aa1d2ac0358619ee89b2b96ed723541e182b6fdab53aefef7992acb4e03fca67aa47cbe3907b1e6060a60b57ed96c4e00c35c7494

  • C:\Users\Admin\lib\sqlite-jdbc-3.14.2.1.jar

    Filesize

    4.1MB

    MD5

    b33387e15ab150a7bf560abdc73c3bec

    SHA1

    66b8075784131f578ef893fd7674273f709b9a4c

    SHA256

    2eae3dea1c3dde6104c49f9601074b6038ff6abcf3be23f4b56f6720a4f6a491

    SHA512

    25cfb0d6ce35d0bcb18527d3aa12c63ecb2d9c1b8b78805d1306e516c13480b79bb0d74730aa93bd1752f9ac2da9fdd51781c48844cea2fd52a06c62852c8279

  • C:\Users\Admin\lib\system-hook-3.5.jar

    Filesize

    772KB

    MD5

    e1aa38a1e78a76a6de73efae136cdb3a

    SHA1

    c463da71871f780b2e2e5dba115d43953b537daf

    SHA256

    2ddda8af6faef8bde46acf43ec546603180bcf8dcb2e5591fff8ac9cd30b5609

    SHA512

    fee16fe9364926ec337e52f551fd62ed81984808a847de2fd68ff29b6c5da0dcc04ef6d8977f0fe675662a7d2ea1065cdcdd2a5259446226a7c7c5516bd7d60d

  • memory/844-328-0x0000022949AB0000-0x0000022949AB1000-memory.dmp

    Filesize

    4KB

  • memory/2520-237-0x0000021D43FA0000-0x0000021D43FA1000-memory.dmp

    Filesize

    4KB

  • memory/5116-97-0x000002570AB80000-0x000002570AB90000-memory.dmp

    Filesize

    64KB

  • memory/5116-77-0x000002570AB10000-0x000002570AB20000-memory.dmp

    Filesize

    64KB

  • memory/5116-28-0x000002570AAF0000-0x000002570AB00000-memory.dmp

    Filesize

    64KB

  • memory/5116-27-0x000002570AAE0000-0x000002570AAF0000-memory.dmp

    Filesize

    64KB

  • memory/5116-29-0x000002570AB00000-0x000002570AB10000-memory.dmp

    Filesize

    64KB

  • memory/5116-34-0x000002570AB20000-0x000002570AB30000-memory.dmp

    Filesize

    64KB

  • memory/5116-33-0x000002570AB10000-0x000002570AB20000-memory.dmp

    Filesize

    64KB

  • memory/5116-37-0x000002570AB30000-0x000002570AB40000-memory.dmp

    Filesize

    64KB

  • memory/5116-36-0x000002570A810000-0x000002570AA80000-memory.dmp

    Filesize

    2.4MB

  • memory/5116-39-0x000002570AB40000-0x000002570AB50000-memory.dmp

    Filesize

    64KB

  • memory/5116-42-0x000002570AB50000-0x000002570AB60000-memory.dmp

    Filesize

    64KB

  • memory/5116-41-0x000002570AA90000-0x000002570AAA0000-memory.dmp

    Filesize

    64KB

  • memory/5116-40-0x000002570AA80000-0x000002570AA90000-memory.dmp

    Filesize

    64KB

  • memory/5116-51-0x000002570AB70000-0x000002570AB80000-memory.dmp

    Filesize

    64KB

  • memory/5116-55-0x000002570AB80000-0x000002570AB90000-memory.dmp

    Filesize

    64KB

  • memory/5116-54-0x000002570AAC0000-0x000002570AAD0000-memory.dmp

    Filesize

    64KB

  • memory/5116-64-0x000002570ABB0000-0x000002570ABC0000-memory.dmp

    Filesize

    64KB

  • memory/5116-66-0x000002570AAE0000-0x000002570AAF0000-memory.dmp

    Filesize

    64KB

  • memory/5116-69-0x000002570ABD0000-0x000002570ABE0000-memory.dmp

    Filesize

    64KB

  • memory/5116-79-0x000002570AC00000-0x000002570AC10000-memory.dmp

    Filesize

    64KB

  • memory/5116-78-0x000002570AB20000-0x000002570AB30000-memory.dmp

    Filesize

    64KB

  • memory/5116-116-0x000002570ACB0000-0x000002570ACC0000-memory.dmp

    Filesize

    64KB

  • memory/5116-74-0x000002570ABF0000-0x000002570AC00000-memory.dmp

    Filesize

    64KB

  • memory/5116-84-0x000002570AC10000-0x000002570AC20000-memory.dmp

    Filesize

    64KB

  • memory/5116-83-0x000002570AB30000-0x000002570AB40000-memory.dmp

    Filesize

    64KB

  • memory/5116-115-0x000002570ACA0000-0x000002570ACB0000-memory.dmp

    Filesize

    64KB

  • memory/5116-72-0x000002570AB00000-0x000002570AB10000-memory.dmp

    Filesize

    64KB

  • memory/5116-68-0x000002570AAF0000-0x000002570AB00000-memory.dmp

    Filesize

    64KB

  • memory/5116-67-0x000002570ABC0000-0x000002570ABD0000-memory.dmp

    Filesize

    64KB

  • memory/5116-87-0x000002570AC20000-0x000002570AC30000-memory.dmp

    Filesize

    64KB

  • memory/5116-86-0x000002570AB40000-0x000002570AB50000-memory.dmp

    Filesize

    64KB

  • memory/5116-63-0x000002570ABA0000-0x000002570ABB0000-memory.dmp

    Filesize

    64KB

  • memory/5116-61-0x000002570AAD0000-0x000002570AAE0000-memory.dmp

    Filesize

    64KB

  • memory/5116-59-0x0000025708F80000-0x0000025708F81000-memory.dmp

    Filesize

    4KB

  • memory/5116-62-0x000002570AB90000-0x000002570ABA0000-memory.dmp

    Filesize

    64KB

  • memory/5116-50-0x000002570AB60000-0x000002570AB70000-memory.dmp

    Filesize

    64KB

  • memory/5116-49-0x000002570AAB0000-0x000002570AAC0000-memory.dmp

    Filesize

    64KB

  • memory/5116-47-0x000002570AAA0000-0x000002570AAB0000-memory.dmp

    Filesize

    64KB

  • memory/5116-89-0x000002570AC30000-0x000002570AC40000-memory.dmp

    Filesize

    64KB

  • memory/5116-88-0x000002570AB50000-0x000002570AB60000-memory.dmp

    Filesize

    64KB

  • memory/5116-117-0x000002570ACC0000-0x000002570ACD0000-memory.dmp

    Filesize

    64KB

  • memory/5116-92-0x000002570AB70000-0x000002570AB80000-memory.dmp

    Filesize

    64KB

  • memory/5116-91-0x0000025708F80000-0x0000025708F81000-memory.dmp

    Filesize

    4KB

  • memory/5116-99-0x000002570AC50000-0x000002570AC60000-memory.dmp

    Filesize

    64KB

  • memory/5116-98-0x000002570ABA0000-0x000002570ABB0000-memory.dmp

    Filesize

    64KB

  • memory/5116-22-0x000002570AAC0000-0x000002570AAD0000-memory.dmp

    Filesize

    64KB

  • memory/5116-104-0x000002570AC60000-0x000002570AC70000-memory.dmp

    Filesize

    64KB

  • memory/5116-103-0x000002570ABB0000-0x000002570ABC0000-memory.dmp

    Filesize

    64KB

  • memory/5116-106-0x000002570AC70000-0x000002570AC80000-memory.dmp

    Filesize

    64KB

  • memory/5116-102-0x000002570AB90000-0x000002570ABA0000-memory.dmp

    Filesize

    64KB

  • memory/5116-93-0x000002570AC40000-0x000002570AC50000-memory.dmp

    Filesize

    64KB

  • memory/5116-23-0x000002570AAD0000-0x000002570AAE0000-memory.dmp

    Filesize

    64KB

  • memory/5116-73-0x000002570ABE0000-0x000002570ABF0000-memory.dmp

    Filesize

    64KB

  • memory/5116-114-0x000002570AC90000-0x000002570ACA0000-memory.dmp

    Filesize

    64KB

  • memory/5116-112-0x000002570ABC0000-0x000002570ABD0000-memory.dmp

    Filesize

    64KB

  • memory/5116-113-0x000002570AC80000-0x000002570AC90000-memory.dmp

    Filesize

    64KB

  • memory/5116-120-0x0000025708F80000-0x0000025708F81000-memory.dmp

    Filesize

    4KB

  • memory/5116-127-0x0000025708F80000-0x0000025708F81000-memory.dmp

    Filesize

    4KB

  • memory/5116-125-0x000002570ACD0000-0x000002570ACE0000-memory.dmp

    Filesize

    64KB

  • memory/5116-124-0x000002570ABD0000-0x000002570ABE0000-memory.dmp

    Filesize

    64KB

  • memory/5116-131-0x000002570ACE0000-0x000002570ACF0000-memory.dmp

    Filesize

    64KB

  • memory/5116-130-0x000002570ABF0000-0x000002570AC00000-memory.dmp

    Filesize

    64KB

  • memory/5116-129-0x000002570ABE0000-0x000002570ABF0000-memory.dmp

    Filesize

    64KB

  • memory/5116-134-0x000002570ACF0000-0x000002570AD00000-memory.dmp

    Filesize

    64KB

  • memory/5116-133-0x000002570AC00000-0x000002570AC10000-memory.dmp

    Filesize

    64KB

  • memory/5116-137-0x000002570AD00000-0x000002570AD10000-memory.dmp

    Filesize

    64KB

  • memory/5116-136-0x000002570AC10000-0x000002570AC20000-memory.dmp

    Filesize

    64KB

  • memory/5116-140-0x000002570AD10000-0x000002570AD20000-memory.dmp

    Filesize

    64KB

  • memory/5116-139-0x000002570AC20000-0x000002570AC30000-memory.dmp

    Filesize

    64KB

  • memory/5116-145-0x000002570AD30000-0x000002570AD40000-memory.dmp

    Filesize

    64KB

  • memory/5116-144-0x000002570AD20000-0x000002570AD30000-memory.dmp

    Filesize

    64KB

  • memory/5116-143-0x000002570AC30000-0x000002570AC40000-memory.dmp

    Filesize

    64KB

  • memory/5116-148-0x000002570AD40000-0x000002570AD50000-memory.dmp

    Filesize

    64KB

  • memory/5116-147-0x000002570AC40000-0x000002570AC50000-memory.dmp

    Filesize

    64KB

  • memory/5116-149-0x0000025708F80000-0x0000025708F81000-memory.dmp

    Filesize

    4KB

  • memory/5116-154-0x000002570AC50000-0x000002570AC60000-memory.dmp

    Filesize

    64KB

  • memory/5116-155-0x000002570AD50000-0x000002570AD60000-memory.dmp

    Filesize

    64KB

  • memory/5116-157-0x000002570AC60000-0x000002570AC70000-memory.dmp

    Filesize

    64KB

  • memory/5116-159-0x000002570AD60000-0x000002570AD70000-memory.dmp

    Filesize

    64KB

  • memory/5116-158-0x000002570AC70000-0x000002570AC80000-memory.dmp

    Filesize

    64KB

  • memory/5116-161-0x000002570AC80000-0x000002570AC90000-memory.dmp

    Filesize

    64KB

  • memory/5116-166-0x000002570AD70000-0x000002570AD80000-memory.dmp

    Filesize

    64KB

  • memory/5116-165-0x000002570ACC0000-0x000002570ACD0000-memory.dmp

    Filesize

    64KB

  • memory/5116-164-0x000002570ACB0000-0x000002570ACC0000-memory.dmp

    Filesize

    64KB

  • memory/5116-163-0x000002570ACA0000-0x000002570ACB0000-memory.dmp

    Filesize

    64KB

  • memory/5116-162-0x000002570AC90000-0x000002570ACA0000-memory.dmp

    Filesize

    64KB

  • memory/5116-173-0x0000025708F80000-0x0000025708F81000-memory.dmp

    Filesize

    4KB

  • memory/5116-175-0x000002570ACD0000-0x000002570ACE0000-memory.dmp

    Filesize

    64KB

  • memory/5116-179-0x0000025708F80000-0x0000025708F81000-memory.dmp

    Filesize

    4KB

  • memory/5116-187-0x000002570AAE0000-0x000002570AAF0000-memory.dmp

    Filesize

    64KB

  • memory/5116-186-0x000002570AAD0000-0x000002570AAE0000-memory.dmp

    Filesize

    64KB

  • memory/5116-185-0x000002570AAC0000-0x000002570AAD0000-memory.dmp

    Filesize

    64KB

  • memory/5116-184-0x000002570AAB0000-0x000002570AAC0000-memory.dmp

    Filesize

    64KB

  • memory/5116-191-0x000002570A810000-0x000002570AA80000-memory.dmp

    Filesize

    2.4MB

  • memory/5116-18-0x000002570AAA0000-0x000002570AAB0000-memory.dmp

    Filesize

    64KB

  • memory/5116-19-0x000002570AAB0000-0x000002570AAC0000-memory.dmp

    Filesize

    64KB

  • memory/5116-14-0x000002570AA80000-0x000002570AA90000-memory.dmp

    Filesize

    64KB

  • memory/5116-15-0x000002570AA90000-0x000002570AAA0000-memory.dmp

    Filesize

    64KB

  • memory/5116-11-0x0000025708F80000-0x0000025708F81000-memory.dmp

    Filesize

    4KB

  • memory/5116-2-0x000002570A810000-0x000002570AA80000-memory.dmp

    Filesize

    2.4MB

  • memory/5116-183-0x000002570AAA0000-0x000002570AAB0000-memory.dmp

    Filesize

    64KB

  • memory/5116-182-0x000002570AA90000-0x000002570AAA0000-memory.dmp

    Filesize

    64KB

  • memory/5116-181-0x000002570AA80000-0x000002570AA90000-memory.dmp

    Filesize

    64KB

  • memory/5116-180-0x000002570AAF0000-0x000002570AB00000-memory.dmp

    Filesize

    64KB