Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    61s
  • max time network
    65s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/10/2024, 15:29 UTC

General

  • Target

    SKlauncher-3.2.10.jar

  • Size

    1.1MB

  • MD5

    1495e81aa573744050268cb330af8281

  • SHA1

    b67d9bda787a526c79128179e5000924bca11dd4

  • SHA256

    3ce7e5aff85320e1d393eb34e918a6b71a667bccf08252fbdd512443e5d62f9a

  • SHA512

    e321e4b9243815b4d0b3ab34c380c2b8da0e8e264b791018a4385967946e8cf320fb5bcb695b7aa75e5a9420ae6ced6ea3c05ecfaedb7a1a6e02a1438a2c9d4d

  • SSDEEP

    24576:Ya8lvPepesjsvypvWM1cetaYJXChAX/ChyYOke27vLEOBqLT0:Yh3eICsa9TUYJyhmBK7vLjiA

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
    java -jar C:\Users\Admin\AppData\Local\Temp\SKlauncher-3.2.10.jar
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    PID:4480

Network

  • flag-us
    DNS
    files.skmedix.pl
    java.exe
    Remote address:
    8.8.8.8:53
    Request
    files.skmedix.pl
    IN A
    Response
    files.skmedix.pl
    IN A
    172.67.199.2
    files.skmedix.pl
    IN A
    104.21.50.12
  • flag-us
    DNS
    files.skmedix.pl
    java.exe
    Remote address:
    8.8.8.8:53
    Request
    files.skmedix.pl
    IN A
  • flag-us
    DNS
    76.32.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    76.32.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    88.210.23.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    88.210.23.2.in-addr.arpa
    IN PTR
    Response
    88.210.23.2.in-addr.arpa
    IN PTR
    a2-23-210-88deploystaticakamaitechnologiescom
  • flag-us
    DNS
    2.199.67.172.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    2.199.67.172.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    bitbucket.org
    java.exe
    Remote address:
    8.8.8.8:53
    Request
    bitbucket.org
    IN A
    Response
    bitbucket.org
    IN A
    185.166.142.23
    bitbucket.org
    IN A
    185.166.142.22
    bitbucket.org
    IN A
    185.166.142.21
  • flag-us
    DNS
    23.142.166.185.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    23.142.166.185.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    bbuseruploads.s3.amazonaws.com
    java.exe
    Remote address:
    8.8.8.8:53
    Request
    bbuseruploads.s3.amazonaws.com
    IN A
    Response
    bbuseruploads.s3.amazonaws.com
    IN CNAME
    s3-1-w.amazonaws.com
    s3-1-w.amazonaws.com
    IN CNAME
    s3-w.us-east-1.amazonaws.com
    s3-w.us-east-1.amazonaws.com
    IN A
    3.5.30.41
    s3-w.us-east-1.amazonaws.com
    IN A
    52.217.0.148
    s3-w.us-east-1.amazonaws.com
    IN A
    54.231.230.185
    s3-w.us-east-1.amazonaws.com
    IN A
    52.217.37.12
    s3-w.us-east-1.amazonaws.com
    IN A
    52.217.231.81
    s3-w.us-east-1.amazonaws.com
    IN A
    54.231.140.145
    s3-w.us-east-1.amazonaws.com
    IN A
    16.15.177.167
    s3-w.us-east-1.amazonaws.com
    IN A
    52.216.60.17
  • flag-us
    DNS
    bbuseruploads.s3.amazonaws.com
    java.exe
    Remote address:
    8.8.8.8:53
    Request
    bbuseruploads.s3.amazonaws.com
    IN A
  • flag-us
    DNS
    bbuseruploads.s3.amazonaws.com
    java.exe
    Remote address:
    8.8.8.8:53
    Request
    bbuseruploads.s3.amazonaws.com
    IN A
  • flag-us
    DNS
    41.30.5.3.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    41.30.5.3.in-addr.arpa
    IN PTR
    Response
    41.30.5.3.in-addr.arpa
    IN PTR
    s3-1-w amazonawscom
  • flag-us
    DNS
    41.30.5.3.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    41.30.5.3.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    41.30.5.3.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    41.30.5.3.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    41.30.5.3.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    41.30.5.3.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    50.23.12.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    50.23.12.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    198.187.3.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    198.187.3.20.in-addr.arpa
    IN PTR
    Response
  • 172.67.199.2:443
    files.skmedix.pl
    tls
    java.exe
    1.0kB
    92 B
    5
    2
  • 185.166.142.23:443
    bitbucket.org
    tls
    java.exe
    2.3kB
    9.9kB
    20
    21
  • 3.5.30.41:443
    bbuseruploads.s3.amazonaws.com
    tls
    java.exe
    79.7kB
    3.7MB
    1581
    2757
  • 185.166.142.23:443
    bitbucket.org
    tls
    java.exe
    2.3kB
    6.7kB
    17
    12
  • 185.166.142.23:443
    bitbucket.org
    tls
    java.exe
    2.2kB
    6.6kB
    14
    16
  • 8.8.8.8:53
    files.skmedix.pl
    dns
    java.exe
    124 B
    94 B
    2
    1

    DNS Request

    files.skmedix.pl

    DNS Request

    files.skmedix.pl

    DNS Response

    172.67.199.2
    104.21.50.12

  • 8.8.8.8:53
    76.32.126.40.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    76.32.126.40.in-addr.arpa

  • 8.8.8.8:53
    88.210.23.2.in-addr.arpa
    dns
    70 B
    133 B
    1
    1

    DNS Request

    88.210.23.2.in-addr.arpa

  • 8.8.8.8:53
    2.199.67.172.in-addr.arpa
    dns
    71 B
    133 B
    1
    1

    DNS Request

    2.199.67.172.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    219 B
    144 B
    3
    1

    DNS Request

    95.221.229.192.in-addr.arpa

    DNS Request

    95.221.229.192.in-addr.arpa

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    bitbucket.org
    dns
    java.exe
    59 B
    107 B
    1
    1

    DNS Request

    bitbucket.org

    DNS Response

    185.166.142.23
    185.166.142.22
    185.166.142.21

  • 8.8.8.8:53
    23.142.166.185.in-addr.arpa
    dns
    73 B
    133 B
    1
    1

    DNS Request

    23.142.166.185.in-addr.arpa

  • 8.8.8.8:53
    bbuseruploads.s3.amazonaws.com
    dns
    java.exe
    228 B
    254 B
    3
    1

    DNS Request

    bbuseruploads.s3.amazonaws.com

    DNS Request

    bbuseruploads.s3.amazonaws.com

    DNS Request

    bbuseruploads.s3.amazonaws.com

    DNS Response

    3.5.30.41
    52.217.0.148
    54.231.230.185
    52.217.37.12
    52.217.231.81
    54.231.140.145
    16.15.177.167
    52.216.60.17

  • 8.8.8.8:53
    41.30.5.3.in-addr.arpa
    dns
    272 B
    102 B
    4
    1

    DNS Request

    41.30.5.3.in-addr.arpa

    DNS Request

    41.30.5.3.in-addr.arpa

    DNS Request

    41.30.5.3.in-addr.arpa

    DNS Request

    41.30.5.3.in-addr.arpa

  • 8.8.8.8:53
    50.23.12.20.in-addr.arpa
    dns
    70 B
    156 B
    1
    1

    DNS Request

    50.23.12.20.in-addr.arpa

  • 8.8.8.8:53
    198.187.3.20.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    198.187.3.20.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\flatlaf.temp\flatlaf-windows-x86_64-4674859394400.dll

    Filesize

    23KB

    MD5

    8b9f16320499ece60d7ff0c1249c6df7

    SHA1

    cd8fc57c064533df66f0ceaaf5d76f8c4f8cb3a0

    SHA256

    f8a3af19341ac0f12f55ad28169d22b75aa66ed818692541307393c22f986727

    SHA512

    97384ee1faa1be807388f4077fde5db94010f06420b1ff3a05edf77fb91c9a8163b0a91cb1b7e648c0cd8c4d599e552050f64b8f7c5c81c1be60cd35f062e9d3

  • memory/4480-2-0x000001D92C900000-0x000001D92CB70000-memory.dmp

    Filesize

    2.4MB

  • memory/4480-11-0x000001D92C8E0000-0x000001D92C8E1000-memory.dmp

    Filesize

    4KB

  • memory/4480-15-0x000001D92C8E0000-0x000001D92C8E1000-memory.dmp

    Filesize

    4KB

  • memory/4480-22-0x000001D92CB70000-0x000001D92CB80000-memory.dmp

    Filesize

    64KB

  • memory/4480-25-0x000001D92CB80000-0x000001D92CB90000-memory.dmp

    Filesize

    64KB

  • memory/4480-29-0x000001D92CB90000-0x000001D92CBA0000-memory.dmp

    Filesize

    64KB

  • memory/4480-37-0x000001D92CBA0000-0x000001D92CBB0000-memory.dmp

    Filesize

    64KB

  • memory/4480-42-0x000001D92CBB0000-0x000001D92CBC0000-memory.dmp

    Filesize

    64KB

  • memory/4480-45-0x000001D92CBC0000-0x000001D92CBD0000-memory.dmp

    Filesize

    64KB

  • memory/4480-48-0x000001D92CBD0000-0x000001D92CBE0000-memory.dmp

    Filesize

    64KB

  • memory/4480-52-0x000001D92CBE0000-0x000001D92CBF0000-memory.dmp

    Filesize

    64KB

  • memory/4480-57-0x000001D92C8E0000-0x000001D92C8E1000-memory.dmp

    Filesize

    4KB

  • memory/4480-55-0x000001D92CBF0000-0x000001D92CC00000-memory.dmp

    Filesize

    64KB

  • memory/4480-65-0x000001D92CC20000-0x000001D92CC30000-memory.dmp

    Filesize

    64KB

  • memory/4480-64-0x000001D92CB80000-0x000001D92CB90000-memory.dmp

    Filesize

    64KB

  • memory/4480-63-0x000001D92CB70000-0x000001D92CB80000-memory.dmp

    Filesize

    64KB

  • memory/4480-62-0x000001D92CC10000-0x000001D92CC20000-memory.dmp

    Filesize

    64KB

  • memory/4480-61-0x000001D92CC00000-0x000001D92CC10000-memory.dmp

    Filesize

    64KB

  • memory/4480-59-0x000001D92C900000-0x000001D92CB70000-memory.dmp

    Filesize

    2.4MB

  • memory/4480-74-0x000001D92CBA0000-0x000001D92CBB0000-memory.dmp

    Filesize

    64KB

  • memory/4480-76-0x000001D92CC60000-0x000001D92CC70000-memory.dmp

    Filesize

    64KB

  • memory/4480-75-0x000001D92CBB0000-0x000001D92CBC0000-memory.dmp

    Filesize

    64KB

  • memory/4480-73-0x000001D92CC50000-0x000001D92CC60000-memory.dmp

    Filesize

    64KB

  • memory/4480-71-0x000001D92CC40000-0x000001D92CC50000-memory.dmp

    Filesize

    64KB

  • memory/4480-70-0x000001D92CC30000-0x000001D92CC40000-memory.dmp

    Filesize

    64KB

  • memory/4480-69-0x000001D92CB90000-0x000001D92CBA0000-memory.dmp

    Filesize

    64KB

  • memory/4480-79-0x000001D92CBC0000-0x000001D92CBD0000-memory.dmp

    Filesize

    64KB

  • memory/4480-82-0x000001D92CBD0000-0x000001D92CBE0000-memory.dmp

    Filesize

    64KB

  • memory/4480-81-0x000001D92CC80000-0x000001D92CC90000-memory.dmp

    Filesize

    64KB

  • memory/4480-80-0x000001D92CC70000-0x000001D92CC80000-memory.dmp

    Filesize

    64KB

  • memory/4480-92-0x000001D92CCC0000-0x000001D92CCD0000-memory.dmp

    Filesize

    64KB

  • memory/4480-91-0x000001D92CBF0000-0x000001D92CC00000-memory.dmp

    Filesize

    64KB

  • memory/4480-90-0x000001D92CCB0000-0x000001D92CCC0000-memory.dmp

    Filesize

    64KB

  • memory/4480-89-0x000001D92CCA0000-0x000001D92CCB0000-memory.dmp

    Filesize

    64KB

  • memory/4480-88-0x000001D92CC90000-0x000001D92CCA0000-memory.dmp

    Filesize

    64KB

  • memory/4480-87-0x000001D92CBE0000-0x000001D92CBF0000-memory.dmp

    Filesize

    64KB

  • memory/4480-96-0x000001D92CCD0000-0x000001D92CCE0000-memory.dmp

    Filesize

    64KB

  • memory/4480-95-0x000001D92CC00000-0x000001D92CC10000-memory.dmp

    Filesize

    64KB

  • memory/4480-99-0x000001D92CCE0000-0x000001D92CCF0000-memory.dmp

    Filesize

    64KB

  • memory/4480-98-0x000001D92CC10000-0x000001D92CC20000-memory.dmp

    Filesize

    64KB

  • memory/4480-101-0x000001D92CCF0000-0x000001D92CD00000-memory.dmp

    Filesize

    64KB

  • memory/4480-100-0x000001D92CC20000-0x000001D92CC30000-memory.dmp

    Filesize

    64KB

  • memory/4480-106-0x000001D92CD00000-0x000001D92CD10000-memory.dmp

    Filesize

    64KB

  • memory/4480-105-0x000001D92CC50000-0x000001D92CC60000-memory.dmp

    Filesize

    64KB

  • memory/4480-104-0x000001D92CC40000-0x000001D92CC50000-memory.dmp

    Filesize

    64KB

  • memory/4480-103-0x000001D92CC30000-0x000001D92CC40000-memory.dmp

    Filesize

    64KB

  • memory/4480-108-0x000001D92CD10000-0x000001D92CD20000-memory.dmp

    Filesize

    64KB

  • memory/4480-111-0x000001D92CD20000-0x000001D92CD30000-memory.dmp

    Filesize

    64KB

  • memory/4480-110-0x000001D92CC60000-0x000001D92CC70000-memory.dmp

    Filesize

    64KB

  • memory/4480-116-0x000001D92CD30000-0x000001D92CD40000-memory.dmp

    Filesize

    64KB

  • memory/4480-115-0x000001D92CC80000-0x000001D92CC90000-memory.dmp

    Filesize

    64KB

  • memory/4480-114-0x000001D92CC70000-0x000001D92CC80000-memory.dmp

    Filesize

    64KB

  • memory/4480-118-0x000001D92CCA0000-0x000001D92CCB0000-memory.dmp

    Filesize

    64KB

  • memory/4480-122-0x000001D92CCB0000-0x000001D92CCC0000-memory.dmp

    Filesize

    64KB

  • memory/4480-121-0x000001D92CC90000-0x000001D92CCA0000-memory.dmp

    Filesize

    64KB

  • memory/4480-120-0x000001D92CD50000-0x000001D92CD60000-memory.dmp

    Filesize

    64KB

  • memory/4480-119-0x000001D92CD40000-0x000001D92CD50000-memory.dmp

    Filesize

    64KB

  • memory/4480-124-0x000001D92CCC0000-0x000001D92CCD0000-memory.dmp

    Filesize

    64KB

  • memory/4480-125-0x000001D92CD60000-0x000001D92CD70000-memory.dmp

    Filesize

    64KB

  • memory/4480-128-0x000001D92CD70000-0x000001D92CD80000-memory.dmp

    Filesize

    64KB

  • memory/4480-127-0x000001D92CCD0000-0x000001D92CCE0000-memory.dmp

    Filesize

    64KB

  • memory/4480-130-0x000001D92CCE0000-0x000001D92CCF0000-memory.dmp

    Filesize

    64KB

  • memory/4480-131-0x000001D92CD80000-0x000001D92CD90000-memory.dmp

    Filesize

    64KB

  • memory/4480-133-0x000001D92CCF0000-0x000001D92CD00000-memory.dmp

    Filesize

    64KB

  • memory/4480-134-0x000001D92CD90000-0x000001D92CDA0000-memory.dmp

    Filesize

    64KB

  • memory/4480-136-0x000001D92CD00000-0x000001D92CD10000-memory.dmp

    Filesize

    64KB

  • memory/4480-137-0x000001D92CDA0000-0x000001D92CDB0000-memory.dmp

    Filesize

    64KB

  • memory/4480-140-0x000001D92CD10000-0x000001D92CD20000-memory.dmp

    Filesize

    64KB

  • memory/4480-141-0x000001D92CDB0000-0x000001D92CDC0000-memory.dmp

    Filesize

    64KB

  • memory/4480-143-0x000001D92CD20000-0x000001D92CD30000-memory.dmp

    Filesize

    64KB

  • memory/4480-144-0x000001D92CDC0000-0x000001D92CDD0000-memory.dmp

    Filesize

    64KB

  • memory/4480-146-0x000001D92CD30000-0x000001D92CD40000-memory.dmp

    Filesize

    64KB

  • memory/4480-147-0x000001D92CDD0000-0x000001D92CDE0000-memory.dmp

    Filesize

    64KB

  • memory/4480-149-0x000001D92CD40000-0x000001D92CD50000-memory.dmp

    Filesize

    64KB

  • memory/4480-151-0x000001D92CDE0000-0x000001D92CDF0000-memory.dmp

    Filesize

    64KB

  • memory/4480-150-0x000001D92CD50000-0x000001D92CD60000-memory.dmp

    Filesize

    64KB

  • memory/4480-153-0x000001D92CDF0000-0x000001D92CE00000-memory.dmp

    Filesize

    64KB

  • memory/4480-155-0x000001D92CD60000-0x000001D92CD70000-memory.dmp

    Filesize

    64KB

  • memory/4480-156-0x000001D92CE00000-0x000001D92CE10000-memory.dmp

    Filesize

    64KB

  • memory/4480-158-0x000001D92CD70000-0x000001D92CD80000-memory.dmp

    Filesize

    64KB

  • memory/4480-159-0x000001D92CE10000-0x000001D92CE20000-memory.dmp

    Filesize

    64KB

  • memory/4480-162-0x000001D92CD80000-0x000001D92CD90000-memory.dmp

    Filesize

    64KB

  • memory/4480-163-0x000001D92CE20000-0x000001D92CE30000-memory.dmp

    Filesize

    64KB

  • memory/4480-165-0x000001D92CD90000-0x000001D92CDA0000-memory.dmp

    Filesize

    64KB

  • memory/4480-166-0x000001D92CE30000-0x000001D92CE40000-memory.dmp

    Filesize

    64KB

  • memory/4480-169-0x000001D92CDA0000-0x000001D92CDB0000-memory.dmp

    Filesize

    64KB

  • memory/4480-170-0x000001D92CE40000-0x000001D92CE50000-memory.dmp

    Filesize

    64KB

  • memory/4480-172-0x000001D92CDB0000-0x000001D92CDC0000-memory.dmp

    Filesize

    64KB

  • memory/4480-173-0x000001D92CE50000-0x000001D92CE60000-memory.dmp

    Filesize

    64KB

  • memory/4480-175-0x000001D92CDC0000-0x000001D92CDD0000-memory.dmp

    Filesize

    64KB

  • memory/4480-176-0x000001D92CE60000-0x000001D92CE70000-memory.dmp

    Filesize

    64KB

  • memory/4480-181-0x000001D92CE70000-0x000001D92CE80000-memory.dmp

    Filesize

    64KB

  • memory/4480-180-0x000001D92CDD0000-0x000001D92CDE0000-memory.dmp

    Filesize

    64KB

  • memory/4480-185-0x000001D92CDE0000-0x000001D92CDF0000-memory.dmp

    Filesize

    64KB

  • memory/4480-189-0x000001D92CDF0000-0x000001D92CE00000-memory.dmp

    Filesize

    64KB

  • memory/4480-187-0x000001D92CE90000-0x000001D92CEA0000-memory.dmp

    Filesize

    64KB

  • memory/4480-191-0x000001D92CEA0000-0x000001D92CEB0000-memory.dmp

    Filesize

    64KB

  • memory/4480-190-0x000001D92CE00000-0x000001D92CE10000-memory.dmp

    Filesize

    64KB

  • memory/4480-186-0x000001D92CE80000-0x000001D92CE90000-memory.dmp

    Filesize

    64KB

  • memory/4480-248-0x000001D92C8E0000-0x000001D92C8E1000-memory.dmp

    Filesize

    4KB

  • memory/4480-250-0x000001D92C8E0000-0x000001D92C8E1000-memory.dmp

    Filesize

    4KB

  • memory/4480-268-0x000001D92C8E0000-0x000001D92C8E1000-memory.dmp

    Filesize

    4KB

  • memory/4480-272-0x000001D92C8E0000-0x000001D92C8E1000-memory.dmp

    Filesize

    4KB

  • memory/4480-271-0x000001D92C8E0000-0x000001D92C8E1000-memory.dmp

    Filesize

    4KB

  • memory/4480-286-0x000001D92C8E0000-0x000001D92C8E1000-memory.dmp

    Filesize

    4KB

  • memory/4480-300-0x000001D92C8E0000-0x000001D92C8E1000-memory.dmp

    Filesize

    4KB

  • memory/4480-301-0x000001D92C8E0000-0x000001D92C8E1000-memory.dmp

    Filesize

    4KB

  • memory/4480-305-0x000001D92C8E0000-0x000001D92C8E1000-memory.dmp

    Filesize

    4KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.