Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    14s
  • max time network
    29s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/08/2024, 19:32

General

  • Target

    hack.jar

  • Size

    710KB

  • MD5

    768a7d09d78d005de07ea4de25069452

  • SHA1

    1f611d072a4a35cd4bfacbcbe77828278bd85751

  • SHA256

    77d8fae64f55b116a856a374a8419ea65a984a4ba888e467a009db79f4355b8f

  • SHA512

    89ad94a5ce956a5c9323cb9ebf5b0c3c744fa328755cc8e3cc88f1e1b8c1bbf437fa7cf77250ff39532182104cae3d85e6b189f07cfed0df89170edecc2544ff

  • SSDEEP

    12288:8EXhAo6H5nPNu1+8qFsP+p5YUdl1Y6FpAoKZN5MDQYISufwoPDt06tqD:8EuHE+9Y+9l1JFpABf5Yc4sRvtqD

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
    java -jar C:\Users\Admin\AppData\Local\Temp\hack.jar
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4500
    • C:\Windows\SYSTEM32\attrib.exe
      attrib +H C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1724614344775.tmp
      2⤵
      • Views/modifies file attributes
      PID:4916
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c "REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1724614344775.tmp" /f"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:960
      • C:\Windows\system32\reg.exe
        REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1724614344775.tmp" /f
        3⤵
        • Adds Run key to start application
        PID:2160

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1724614344775.tmp

    Filesize

    710KB

    MD5

    768a7d09d78d005de07ea4de25069452

    SHA1

    1f611d072a4a35cd4bfacbcbe77828278bd85751

    SHA256

    77d8fae64f55b116a856a374a8419ea65a984a4ba888e467a009db79f4355b8f

    SHA512

    89ad94a5ce956a5c9323cb9ebf5b0c3c744fa328755cc8e3cc88f1e1b8c1bbf437fa7cf77250ff39532182104cae3d85e6b189f07cfed0df89170edecc2544ff

  • memory/4500-52-0x0000025EB7F90000-0x0000025EB7F91000-memory.dmp

    Filesize

    4KB

  • memory/4500-57-0x0000025EB9B00000-0x0000025EB9B10000-memory.dmp

    Filesize

    64KB

  • memory/4500-19-0x0000025EB9A60000-0x0000025EB9A70000-memory.dmp

    Filesize

    64KB

  • memory/4500-23-0x0000025EB9A80000-0x0000025EB9A90000-memory.dmp

    Filesize

    64KB

  • memory/4500-22-0x0000025EB9A70000-0x0000025EB9A80000-memory.dmp

    Filesize

    64KB

  • memory/4500-56-0x0000025EB9A70000-0x0000025EB9A80000-memory.dmp

    Filesize

    64KB

  • memory/4500-27-0x0000025EB7F90000-0x0000025EB7F91000-memory.dmp

    Filesize

    4KB

  • memory/4500-28-0x0000025EB9AA0000-0x0000025EB9AB0000-memory.dmp

    Filesize

    64KB

  • memory/4500-16-0x0000025EB9A40000-0x0000025EB9A50000-memory.dmp

    Filesize

    64KB

  • memory/4500-32-0x0000025EB9AB0000-0x0000025EB9AC0000-memory.dmp

    Filesize

    64KB

  • memory/4500-36-0x0000025EB9AC0000-0x0000025EB9AD0000-memory.dmp

    Filesize

    64KB

  • memory/4500-35-0x0000025EB97D0000-0x0000025EB9A40000-memory.dmp

    Filesize

    2.4MB

  • memory/4500-40-0x0000025EB9AD0000-0x0000025EB9AE0000-memory.dmp

    Filesize

    64KB

  • memory/4500-46-0x0000025EB9A50000-0x0000025EB9A60000-memory.dmp

    Filesize

    64KB

  • memory/4500-47-0x0000025EB9AE0000-0x0000025EB9AF0000-memory.dmp

    Filesize

    64KB

  • memory/4500-45-0x0000025EB9A40000-0x0000025EB9A50000-memory.dmp

    Filesize

    64KB

  • memory/4500-49-0x0000025EB7F90000-0x0000025EB7F91000-memory.dmp

    Filesize

    4KB

  • memory/4500-2-0x0000025EB97D0000-0x0000025EB9A40000-memory.dmp

    Filesize

    2.4MB

  • memory/4500-17-0x0000025EB9A50000-0x0000025EB9A60000-memory.dmp

    Filesize

    64KB

  • memory/4500-53-0x0000025EB9AF0000-0x0000025EB9B00000-memory.dmp

    Filesize

    64KB

  • memory/4500-25-0x0000025EB9A90000-0x0000025EB9AA0000-memory.dmp

    Filesize

    64KB

  • memory/4500-55-0x0000025EB9A60000-0x0000025EB9A70000-memory.dmp

    Filesize

    64KB

  • memory/4500-63-0x0000025EB9B10000-0x0000025EB9B20000-memory.dmp

    Filesize

    64KB

  • memory/4500-68-0x0000025EB9B20000-0x0000025EB9B30000-memory.dmp

    Filesize

    64KB

  • memory/4500-65-0x0000025EB9A80000-0x0000025EB9A90000-memory.dmp

    Filesize

    64KB

  • memory/4500-70-0x0000025EB7F90000-0x0000025EB7F91000-memory.dmp

    Filesize

    4KB

  • memory/4500-71-0x0000025EB9A90000-0x0000025EB9AA0000-memory.dmp

    Filesize

    64KB

  • memory/4500-72-0x0000025EB7F90000-0x0000025EB7F91000-memory.dmp

    Filesize

    4KB

  • memory/4500-73-0x0000025EB9AA0000-0x0000025EB9AB0000-memory.dmp

    Filesize

    64KB

  • memory/4500-74-0x0000025EB9AB0000-0x0000025EB9AC0000-memory.dmp

    Filesize

    64KB

  • memory/4500-75-0x0000025EB9AC0000-0x0000025EB9AD0000-memory.dmp

    Filesize

    64KB

  • memory/4500-76-0x0000025EB9AD0000-0x0000025EB9AE0000-memory.dmp

    Filesize

    64KB

  • memory/4500-77-0x0000025EB9AE0000-0x0000025EB9AF0000-memory.dmp

    Filesize

    64KB

  • memory/4500-78-0x0000025EB9AF0000-0x0000025EB9B00000-memory.dmp

    Filesize

    64KB

  • memory/4500-79-0x0000025EB9B00000-0x0000025EB9B10000-memory.dmp

    Filesize

    64KB

  • memory/4500-80-0x0000025EB9B10000-0x0000025EB9B20000-memory.dmp

    Filesize

    64KB

  • memory/4500-81-0x0000025EB9B20000-0x0000025EB9B30000-memory.dmp

    Filesize

    64KB