Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
14s -
max time network
29s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25/08/2024, 19:32
Static task
static1
Behavioral task
behavioral1
Sample
hack.jar
Resource
win10v2004-20240802-en
General
-
Target
hack.jar
-
Size
710KB
-
MD5
768a7d09d78d005de07ea4de25069452
-
SHA1
1f611d072a4a35cd4bfacbcbe77828278bd85751
-
SHA256
77d8fae64f55b116a856a374a8419ea65a984a4ba888e467a009db79f4355b8f
-
SHA512
89ad94a5ce956a5c9323cb9ebf5b0c3c744fa328755cc8e3cc88f1e1b8c1bbf437fa7cf77250ff39532182104cae3d85e6b189f07cfed0df89170edecc2544ff
-
SSDEEP
12288:8EXhAo6H5nPNu1+8qFsP+p5YUdl1Y6FpAoKZN5MDQYISufwoPDt06tqD:8EuHE+9Y+9l1JFpABf5Yc4sRvtqD
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Home = "C:\\Program Files\\Java\\jre-1.8\\bin\\javaw.exe -jar C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\.tmp\\1724614344775.tmp" reg.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4500 java.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4500 wrote to memory of 4916 4500 java.exe 89 PID 4500 wrote to memory of 4916 4500 java.exe 89 PID 4500 wrote to memory of 960 4500 java.exe 91 PID 4500 wrote to memory of 960 4500 java.exe 91 PID 960 wrote to memory of 2160 960 cmd.exe 93 PID 960 wrote to memory of 2160 960 cmd.exe 93 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 4916 attrib.exe
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\hack.jar1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Windows\SYSTEM32\attrib.exeattrib +H C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1724614344775.tmp2⤵
- Views/modifies file attributes
PID:4916
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1724614344775.tmp" /f"2⤵
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Windows\system32\reg.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1724614344775.tmp" /f3⤵
- Adds Run key to start application
PID:2160
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
710KB
MD5768a7d09d78d005de07ea4de25069452
SHA11f611d072a4a35cd4bfacbcbe77828278bd85751
SHA25677d8fae64f55b116a856a374a8419ea65a984a4ba888e467a009db79f4355b8f
SHA51289ad94a5ce956a5c9323cb9ebf5b0c3c744fa328755cc8e3cc88f1e1b8c1bbf437fa7cf77250ff39532182104cae3d85e6b189f07cfed0df89170edecc2544ff