Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
61s -
max time network
65s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
14/10/2024, 15:29 UTC
Static task
static1
Behavioral task
behavioral1
Sample
SKlauncher-3.2.10.jar
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
SKlauncher-3.2.10.jar
Resource
win10v2004-20241007-en
General
-
Target
SKlauncher-3.2.10.jar
-
Size
1.1MB
-
MD5
1495e81aa573744050268cb330af8281
-
SHA1
b67d9bda787a526c79128179e5000924bca11dd4
-
SHA256
3ce7e5aff85320e1d393eb34e918a6b71a667bccf08252fbdd512443e5d62f9a
-
SHA512
e321e4b9243815b4d0b3ab34c380c2b8da0e8e264b791018a4385967946e8cf320fb5bcb695b7aa75e5a9420ae6ced6ea3c05ecfaedb7a1a6e02a1438a2c9d4d
-
SSDEEP
24576:Ya8lvPepesjsvypvWM1cetaYJXChAX/ChyYOke27vLEOBqLT0:Yh3eICsa9TUYJyhmBK7vLjiA
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 4480 java.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
flow ioc 20 bitbucket.org 21 bitbucket.org 31 bitbucket.org 32 bitbucket.org -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4480 java.exe 4480 java.exe
Processes
Network
-
Remote address:8.8.8.8:53Requestfiles.skmedix.plIN AResponsefiles.skmedix.plIN A172.67.199.2files.skmedix.plIN A104.21.50.12
-
Remote address:8.8.8.8:53Requestfiles.skmedix.plIN A
-
Remote address:8.8.8.8:53Request76.32.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request88.210.23.2.in-addr.arpaIN PTRResponse88.210.23.2.in-addr.arpaIN PTRa2-23-210-88deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request2.199.67.172.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Requestbitbucket.orgIN AResponsebitbucket.orgIN A185.166.142.23bitbucket.orgIN A185.166.142.22bitbucket.orgIN A185.166.142.21
-
Remote address:8.8.8.8:53Request23.142.166.185.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestbbuseruploads.s3.amazonaws.comIN AResponsebbuseruploads.s3.amazonaws.comIN CNAMEs3-1-w.amazonaws.coms3-1-w.amazonaws.comIN CNAMEs3-w.us-east-1.amazonaws.coms3-w.us-east-1.amazonaws.comIN A3.5.30.41s3-w.us-east-1.amazonaws.comIN A52.217.0.148s3-w.us-east-1.amazonaws.comIN A54.231.230.185s3-w.us-east-1.amazonaws.comIN A52.217.37.12s3-w.us-east-1.amazonaws.comIN A52.217.231.81s3-w.us-east-1.amazonaws.comIN A54.231.140.145s3-w.us-east-1.amazonaws.comIN A16.15.177.167s3-w.us-east-1.amazonaws.comIN A52.216.60.17
-
Remote address:8.8.8.8:53Requestbbuseruploads.s3.amazonaws.comIN A
-
Remote address:8.8.8.8:53Requestbbuseruploads.s3.amazonaws.comIN A
-
Remote address:8.8.8.8:53Request41.30.5.3.in-addr.arpaIN PTRResponse41.30.5.3.in-addr.arpaIN PTRs3-1-w amazonawscom
-
Remote address:8.8.8.8:53Request41.30.5.3.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request41.30.5.3.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request41.30.5.3.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request50.23.12.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request198.187.3.20.in-addr.arpaIN PTRResponse
-
1.0kB 92 B 5 2
-
2.3kB 9.9kB 20 21
-
79.7kB 3.7MB 1581 2757
-
2.3kB 6.7kB 17 12
-
2.2kB 6.6kB 14 16
-
124 B 94 B 2 1
DNS Request
files.skmedix.pl
DNS Request
files.skmedix.pl
DNS Response
172.67.199.2104.21.50.12
-
71 B 157 B 1 1
DNS Request
76.32.126.40.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
88.210.23.2.in-addr.arpa
-
71 B 133 B 1 1
DNS Request
2.199.67.172.in-addr.arpa
-
219 B 144 B 3 1
DNS Request
95.221.229.192.in-addr.arpa
DNS Request
95.221.229.192.in-addr.arpa
DNS Request
95.221.229.192.in-addr.arpa
-
59 B 107 B 1 1
DNS Request
bitbucket.org
DNS Response
185.166.142.23185.166.142.22185.166.142.21
-
73 B 133 B 1 1
DNS Request
23.142.166.185.in-addr.arpa
-
228 B 254 B 3 1
DNS Request
bbuseruploads.s3.amazonaws.com
DNS Request
bbuseruploads.s3.amazonaws.com
DNS Request
bbuseruploads.s3.amazonaws.com
DNS Response
3.5.30.4152.217.0.14854.231.230.18552.217.37.1252.217.231.8154.231.140.14516.15.177.16752.216.60.17
-
272 B 102 B 4 1
DNS Request
41.30.5.3.in-addr.arpa
DNS Request
41.30.5.3.in-addr.arpa
DNS Request
41.30.5.3.in-addr.arpa
DNS Request
41.30.5.3.in-addr.arpa
-
70 B 156 B 1 1
DNS Request
50.23.12.20.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
198.187.3.20.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
23KB
MD58b9f16320499ece60d7ff0c1249c6df7
SHA1cd8fc57c064533df66f0ceaaf5d76f8c4f8cb3a0
SHA256f8a3af19341ac0f12f55ad28169d22b75aa66ed818692541307393c22f986727
SHA51297384ee1faa1be807388f4077fde5db94010f06420b1ff3a05edf77fb91c9a8163b0a91cb1b7e648c0cd8c4d599e552050f64b8f7c5c81c1be60cd35f062e9d3