Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05/10/2024, 14:33
Static task
static1
Behavioral task
behavioral1
Sample
185.jar
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
185.jar
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
185.jar
Resource
win10v2004-20240802-en
Behavioral task
behavioral4
Sample
185.jar
Resource
win11-20240802-en
General
-
Target
185.jar
-
Size
14.5MB
-
MD5
29fd6772aafb08c90b1ff9a91f48ecff
-
SHA1
39628a8412e0a14126da2bfa5fbe7af5069e1eec
-
SHA256
287e892aeb4be05c881e19da227d0398cd321d5a9af837932c12dfaab641b4cb
-
SHA512
4d75584621d843d16ed97986e123be2751478e8047ac43a8a722daa3a548a2833293f0cc86ae9c229b4a2df2ae9a69e7e3ce3333da3696c48a4712d52950173e
-
SSDEEP
393216:hU+MrvMUXlIm0QEiK4JISelo4pOT0w03Bl:hSIelIvgJYlIIF3/
Malware Config
Signatures
-
Dynamic RAT payload 1 IoCs
resource yara_rule behavioral3/files/0x000700000002349a-98.dat family_dynamicrat -
DynamicRat
DynamicRat is a remote access trojan malware written in Java.
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jre-8u371-windows-x64.jar javaw.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jre-8u371-windows-x64.jar javaw.exe -
Loads dropped DLL 3 IoCs
pid Process 3668 java.exe 1092 javaw.exe 1092 javaw.exe -
Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1092 javaw.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 3668 java.exe 3668 java.exe 3668 java.exe 3668 java.exe 1092 javaw.exe 1092 javaw.exe 1092 javaw.exe 1092 javaw.exe 1092 javaw.exe 1092 javaw.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3668 wrote to memory of 1092 3668 java.exe 83 PID 3668 wrote to memory of 1092 3668 java.exe 83 PID 1092 wrote to memory of 4048 1092 javaw.exe 84 PID 1092 wrote to memory of 4048 1092 javaw.exe 84 PID 1092 wrote to memory of 1116 1092 javaw.exe 86 PID 1092 wrote to memory of 1116 1092 javaw.exe 86
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\185.jar1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw" -jar "C:\Users\Admin\AppData\Local\Temp\m17281388419936734206489595053474.tmp" DELAY:32⤵
- Drops startup file
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Windows\SYSTEM32\netsh.exenetsh wlan show networks mode=bssid3⤵
- Event Triggered Execution: Netsh Helper DLL
PID:4048
-
-
C:\Windows\SYSTEM32\netsh.exenetsh wlan show networks mode=bssid3⤵
- Event Triggered Execution: Netsh Helper DLL
PID:1116
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46B
MD5b03d358b46832bde724326d3bf1778b1
SHA14eeffcd8b5fbc7a3ab47b26d698ef2c0a4b96013
SHA256a3837a7bd3031919cd4a8d62c745c1638e87b6a2376e48211b6f1047dd9cb38d
SHA512c8097817bd5c6dfad0ccc956959b20aeb8ca838372c6c4ca8712250c1b907a40ec8d87be2ff192cfe4b6e1f4f06080bb3a9e254e4c8e19c63f97864aff4c8cd2
-
Filesize
80KB
MD5e9a449971b9efb0a2e12b9cfdd95c076
SHA1385777659fa84e94a3812eb9a8afad27ae3ceed4
SHA256b8c331c9f915960201da9af9c9dc8309e95e7d533741e71f4a5d13ca007d3e18
SHA512bbcaf66b316cb60c63bb190099bee36a0059f13fa35fdf3a9a3e7e9a5304abe57acd71d644cde554427825249b460d58f0aba79f599f0c6fa40d23ea21aa941d
-
Filesize
248KB
MD54de85f9679c3a75f6d7d3e56094aa106
SHA1052f62fb2ebec89fbe412db480865910eab693ad
SHA2563d1b2427b45ff5178bbb4db395758bedd3a1e91121ebb3e3640b5c4e20eb22cc
SHA512e8357eabd548ffeba42715d891b9e1ed22b7bf720f48b1888407b9ebe7a796719c60a38f4fb8bb1cf32d3c9bed210a07cc227424ef991d356ec3acef9e6223ab
-
Filesize
13.9MB
MD5a74e3a679307d0c527f75e471229a6b0
SHA1aea3fe7535be76a64ad06292dae50595abf5e3a8
SHA256cc1f7f46569c47b6aaf3000374073e30f92350b876d69bc02771664fa5212014
SHA512bfd7c2ea7e31b404d70d68e21f3e597cc8a548be4ecc745a795106fa946f15b67636598a8c78fc8f8d7e1bbe226982cabbfc8169cbe20d2548ca7478589d018d
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-523280732-2327480845-3730041215-1000\83aa4cc77f591dfc2374580bbd95f6ba_a5c5e2ae-85e3-447c-9e0b-c9a7b966d823
Filesize45B
MD5c8366ae350e7019aefc9d1e6e6a498c6
SHA15731d8a3e6568a5f2dfbbc87e3db9637df280b61
SHA25611e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238
SHA51233c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd