Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
11/09/2024, 17:15
240911-vs3d1aselj 311/09/2024, 17:12
240911-vq4t2sshle 311/09/2024, 17:09
240911-vphv7ascpp 7Analysis
-
max time kernel
124s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11/09/2024, 17:09
Static task
static1
Behavioral task
behavioral1
Sample
toaleta.jar
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
toaleta.jar
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Errors
Reason
Machine shutdown
General
-
Target
toaleta.jar
-
Size
2.2MB
-
MD5
8e48fc3bda0bc899ba7c38b5bd2ac165
-
SHA1
bff45691858d8278b55b46af99ab0b5890564e53
-
SHA256
648ca4f9c2964bea3e91685a32e0381c803d648cc358b39ae4071fd3be77fed6
-
SHA512
a807a35eee990b75d85417bdddc3aabbe1275319ccd982c08b7bd929eb175992b96d7728a4615885b1368c9693550968a899b2d308fc8a0c9c3b1420ad7bc5d0
-
SSDEEP
49152:J1dxsLIha5XhNN9gD3b+V9JqG+XFpJ7JUZRlwxBRR+IMNT58:JZJhhb+Xqd1DJmR6xHlMU
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2084 java.exe -
Suspicious behavior: EnumeratesProcesses 58 IoCs
pid Process 2084 java.exe 2084 java.exe 2084 java.exe 2084 java.exe 2084 java.exe 2084 java.exe 2084 java.exe 2084 java.exe 2084 java.exe 2084 java.exe 2084 java.exe 2084 java.exe 2084 java.exe 2084 java.exe 2084 java.exe 2084 java.exe 2084 java.exe 2084 java.exe 2084 java.exe 2084 java.exe 2084 java.exe 2084 java.exe 2084 java.exe 2084 java.exe 2084 java.exe 2084 java.exe 2084 java.exe 2084 java.exe 2084 java.exe 2084 java.exe 2084 java.exe 2084 java.exe 2084 java.exe 2084 java.exe 2084 java.exe 2084 java.exe 2084 java.exe 2084 java.exe 2084 java.exe 2084 java.exe 2084 java.exe 2084 java.exe 2084 java.exe 2084 java.exe 2084 java.exe 2084 java.exe 2084 java.exe 2084 java.exe 2084 java.exe 2084 java.exe 2084 java.exe 2084 java.exe 2084 java.exe 2084 java.exe 2084 java.exe 2084 java.exe 2084 java.exe 2084 java.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2084 java.exe Token: SeDebugPrivilege 2084 java.exe Token: SeDebugPrivilege 2084 java.exe Token: SeDebugPrivilege 2084 java.exe Token: SeDebugPrivilege 2084 java.exe Token: SeDebugPrivilege 2084 java.exe Token: SeDebugPrivilege 2084 java.exe Token: SeDebugPrivilege 2084 java.exe Token: SeDebugPrivilege 2084 java.exe Token: SeDebugPrivilege 2084 java.exe Token: SeDebugPrivilege 2084 java.exe Token: SeDebugPrivilege 2084 java.exe Token: SeDebugPrivilege 2084 java.exe Token: SeDebugPrivilege 2084 java.exe Token: SeDebugPrivilege 2084 java.exe Token: SeDebugPrivilege 2084 java.exe Token: SeDebugPrivilege 2084 java.exe Token: SeDebugPrivilege 2084 java.exe Token: SeDebugPrivilege 2084 java.exe Token: SeDebugPrivilege 2084 java.exe Token: SeDebugPrivilege 2084 java.exe Token: SeDebugPrivilege 2084 java.exe Token: SeDebugPrivilege 2084 java.exe Token: SeDebugPrivilege 2084 java.exe Token: SeDebugPrivilege 2084 java.exe Token: SeDebugPrivilege 2084 java.exe Token: SeDebugPrivilege 2084 java.exe Token: SeDebugPrivilege 2084 java.exe Token: SeDebugPrivilege 2084 java.exe Token: SeDebugPrivilege 2084 java.exe Token: SeDebugPrivilege 2084 java.exe Token: SeDebugPrivilege 2084 java.exe Token: SeDebugPrivilege 2084 java.exe Token: SeDebugPrivilege 2084 java.exe Token: SeDebugPrivilege 2084 java.exe Token: SeDebugPrivilege 2084 java.exe Token: SeDebugPrivilege 2084 java.exe Token: SeDebugPrivilege 2084 java.exe Token: SeDebugPrivilege 2084 java.exe Token: SeDebugPrivilege 2084 java.exe Token: SeDebugPrivilege 2084 java.exe Token: SeDebugPrivilege 2084 java.exe Token: SeDebugPrivilege 2084 java.exe Token: SeDebugPrivilege 2084 java.exe Token: SeDebugPrivilege 2084 java.exe Token: SeDebugPrivilege 2084 java.exe Token: SeDebugPrivilege 2084 java.exe Token: SeDebugPrivilege 2084 java.exe Token: SeDebugPrivilege 2084 java.exe Token: SeDebugPrivilege 2084 java.exe Token: SeDebugPrivilege 2084 java.exe Token: SeDebugPrivilege 2084 java.exe Token: SeDebugPrivilege 2084 java.exe Token: SeDebugPrivilege 2084 java.exe Token: SeDebugPrivilege 2084 java.exe Token: SeDebugPrivilege 2084 java.exe Token: SeDebugPrivilege 2084 java.exe Token: SeDebugPrivilege 2084 java.exe Token: SeDebugPrivilege 2084 java.exe Token: SeDebugPrivilege 2084 java.exe Token: SeDebugPrivilege 2084 java.exe Token: SeDebugPrivilege 2084 java.exe Token: SeDebugPrivilege 2084 java.exe Token: SeDebugPrivilege 2084 java.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2084 java.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2084 java.exe 2084 java.exe 2084 java.exe 2084 java.exe 2084 java.exe 2084 java.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2084 wrote to memory of 256 2084 java.exe 1 PID 2084 wrote to memory of 256 2084 java.exe 1 PID 2084 wrote to memory of 256 2084 java.exe 1 PID 2084 wrote to memory of 256 2084 java.exe 1
Processes
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe1⤵PID:256
-
C:\Windows\system32\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\toaleta.jar1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2084
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵PID:932
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5841⤵PID:2004
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵PID:872
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5732880711c61a96f90ce86da9b6c6b02
SHA15a1506124a768c6e61c7fe2629374432f2aa4327
SHA2563fac7db73b105c20465e965f0a68682166f341dfe624f7c630755e8846b8d992
SHA512e6eea645106f21d90e867f2086656ab91905e4c301bca075304cc35feff9f1e5635966f5652329ebe08f880f550d2e2e0c8079beb48c96deb9438a89d1ec3954