Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
3install_ch...rl.exe
windows7-x64
3install_ch...rl.exe
windows10-2004-x64
7install_ch...db.exe
windows7-x64
3install_ch...db.exe
windows10-2004-x64
3install_ch...dk.exe
windows7-x64
3install_ch...dk.exe
windows10-2004-x64
3install_ch...ta.exe
windows7-x64
3install_ch...ta.exe
windows10-2004-x64
3restart.exe
windows7-x64
3restart.exe
windows10-2004-x64
7startup.exe
windows7-x64
3startup.exe
windows10-2004-x64
3stop.exe
windows7-x64
3stop.exe
windows10-2004-x64
7Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
13/09/2024, 08:01
Static task
static1
Behavioral task
behavioral1
Sample
install_check/check_curl.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
install_check/check_curl.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
install_check/check_db.exe
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
install_check/check_db.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
install_check/check_jdk.exe
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
install_check/check_jdk.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
install_check/check_meta.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
install_check/check_meta.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
restart.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
restart.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
startup.exe
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
startup.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
stop.exe
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
stop.exe
Resource
win10v2004-20240802-en
General
-
Target
install_check/check_jdk.exe
-
Size
88KB
-
MD5
2cc7e692ecd242bbed9ed3b58b877794
-
SHA1
471b9d4f4c1fc9272102bacb25f94a63941d8bed
-
SHA256
48415e6f7410d56e3b85115bbf9ccaa6be6918d5be7ca433cf38ec4e457f93a3
-
SHA512
db212b4eb94bb2386cfd0f9fef54ebc4d23db84751d5f5ee991a19e39fcdc99089ebcea074a05f19fae79546cecb8c77ea8d104027bfa766748132a822a6a044
-
SSDEEP
1536:rL7ftfkS5g9YOms+gZcQipICdXkNDqLLZX9lItVGL++eIOlnToIf5w2OO:rHFfHgTWmCRkGbKGLeNTBf5N
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language check_jdk.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4968 wrote to memory of 732 4968 check_jdk.exe 85 PID 4968 wrote to memory of 732 4968 check_jdk.exe 85 PID 732 wrote to memory of 1492 732 cmd.exe 86 PID 732 wrote to memory of 1492 732 cmd.exe 86 PID 1492 wrote to memory of 3808 1492 cmd.exe 87 PID 1492 wrote to memory of 3808 1492 cmd.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\install_check\check_jdk.exe"C:\Users\Admin\AppData\Local\Temp\install_check\check_jdk.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\9B27.tmp\9B28.tmp\9B29.bat C:\Users\Admin\AppData\Local\Temp\install_check\check_jdk.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:732 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c java -fullversion 2>&13⤵
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -fullversion4⤵PID:3808
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
222B
MD56111d96c145373275c1ac7c351edc55d
SHA1499b3fff55060bca6398d61a84b61080883583d6
SHA256281483647a94ceab185e8503ab9b235695ae45cdc02042fa14d8abca7d8a97a2
SHA5129fb15ed64a3ae71f222d1f2d2c49d6ff6ac0d24f9244ff8ef53898c6ba36d949d9133616e70e0705467c65d3da6dfc5bf9e99abadb2f2e823bd665acfff5ee17