Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
18/10/2024, 19:59
241018-yqwp8axejn 718/10/2024, 19:55
241018-ynenxsvgjb 118/10/2024, 19:55
241018-ym477axcqj 712/10/2023, 23:22
231012-3cqdhaeh6t 10Analysis
-
max time kernel
129s -
max time network
137s -
platform
windows10-1703_x64 -
resource
win10-20240611-en -
resource tags
arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system -
submitted
18/10/2024, 19:59
Static task
static1
Behavioral task
behavioral1
Sample
Installer.jar
Resource
win10-20240611-en
Behavioral task
behavioral2
Sample
Installer.jar
Resource
win11-20241007-en
General
-
Target
Installer.jar
-
Size
18.4MB
-
MD5
eaf63a5d5730fcf1c8cc5cf27354e911
-
SHA1
f22c4b0a9c608ec00b6b84cabe434a240063e642
-
SHA256
f51e4d9f7907dd07ee264439433e0051c5136712cbbb0cc5a81be3b7023df585
-
SHA512
2dca09810b38664f23ca89d72f24e632d5c74874b4d9d0174dce86c30126ee1296a281da768b228840f0160ddb331e48591799799cadbf5a02d294e914a09a80
-
SSDEEP
393216:p6aRouWO9ojV8LJxXlReGOHsxoU+REFJAHYyjFRyHJpy/LAfIiMYX/rQ:PRQ+oqdxVReGksiJL4CFcH2EX/s
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2840 java.exe -
Modifies file permissions 1 TTPs 1 IoCs
pid Process 4792 icacls.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2840 java.exe 2840 java.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2840 wrote to memory of 4792 2840 java.exe 72 PID 2840 wrote to memory of 4792 2840 java.exe 72
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\Installer.jar1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
PID:4792
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46B
MD57bcf5502dba9cf74f1cc63ddf22d4db5
SHA1d3dda14405b3be87521f8839857fb4c242744d9e
SHA256a565196b0ef65a7e2f3a2c84594da583b5ffbb09a830d24ef054271cf249a077
SHA512e7ff4147f974346833e2f1a006f3fe65bf6b21c2b2be2eff1bf8133fac307c34cb0ebd13b1accf1eee0a35a6a4709243674c34348274c534245ba799fad7dada
-
Filesize
21KB
MD54ca3290a99adadde557930cd481d7539
SHA126034442a76131dd3d37c8f28b6e9bebc7c1fe7c
SHA256dd130c68dc36bcedbe51a6b8ec3b3358a460d45952f6280e12331f48850b6b3b
SHA5129341c60f92dd3f89f82555055924bdae6fcce1e4cd13a7dde5129ebdce04bae377292237a2ed6c3e7623b242e82b01c7ed1717af4d7db8ca473e9fd7b7b190d5