Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25/10/2024, 21:14
Static task
static1
Behavioral task
behavioral1
Sample
200586ab70e871fc27aa6006b8c842d289e766a714d7b14280a2ced4220d43db.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
200586ab70e871fc27aa6006b8c842d289e766a714d7b14280a2ced4220d43db.exe
Resource
win10v2004-20241007-en
General
-
Target
200586ab70e871fc27aa6006b8c842d289e766a714d7b14280a2ced4220d43db.exe
-
Size
1.7MB
-
MD5
79d3e6f983ec766ed32d5b2f8325470b
-
SHA1
6d5784345d8e06810ce419b3fd81b48d582fadb1
-
SHA256
200586ab70e871fc27aa6006b8c842d289e766a714d7b14280a2ced4220d43db
-
SHA512
d8e21211a2c348c07d5ebcd5d12c2268afc38e9a208210f3b0ded76af136df8f32f15a651453ea8aaf9c2f34810f61619e3a7b0af07decf5ae524adb548e3b5d
-
SSDEEP
49152:/KxNuLkTcKb4rSUfkVFj0ErvL73RLSo+2fhl:SfuLkT5NUQ3rvvRe12fD
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 200586ab70e871fc27aa6006b8c842d289e766a714d7b14280a2ced4220d43db.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3060 javaws.exe 3060 javaws.exe 4564 jp2launcher.exe 4564 jp2launcher.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4820 200586ab70e871fc27aa6006b8c842d289e766a714d7b14280a2ced4220d43db.exe 4820 200586ab70e871fc27aa6006b8c842d289e766a714d7b14280a2ced4220d43db.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 4820 200586ab70e871fc27aa6006b8c842d289e766a714d7b14280a2ced4220d43db.exe 4820 200586ab70e871fc27aa6006b8c842d289e766a714d7b14280a2ced4220d43db.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4564 jp2launcher.exe 4820 200586ab70e871fc27aa6006b8c842d289e766a714d7b14280a2ced4220d43db.exe 4820 200586ab70e871fc27aa6006b8c842d289e766a714d7b14280a2ced4220d43db.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4820 wrote to memory of 3060 4820 200586ab70e871fc27aa6006b8c842d289e766a714d7b14280a2ced4220d43db.exe 84 PID 4820 wrote to memory of 3060 4820 200586ab70e871fc27aa6006b8c842d289e766a714d7b14280a2ced4220d43db.exe 84 PID 3060 wrote to memory of 4564 3060 javaws.exe 85 PID 3060 wrote to memory of 4564 3060 javaws.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\200586ab70e871fc27aa6006b8c842d289e766a714d7b14280a2ced4220d43db.exe"C:\Users\Admin\AppData\Local\Temp\200586ab70e871fc27aa6006b8c842d289e766a714d7b14280a2ced4220d43db.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Program Files\Java\jre-1.8\bin\javaws.exe"C:\Program Files\Java\jre-1.8\bin\javaws.exe" -J-Djdk.disableLastUsageTracking=true -SSVBaselineUpdate2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe"C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre-1.8" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxsaWJcZGVwbG95LmphcgAtRGphdmEuc2VjdXJpdHkucG9saWN5PWZpbGU6QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZS0xLjhcbGliXHNlY3VyaXR5XGphdmF3cy5wb2xpY3kALUR0cnVzdFByb3h5PXRydWUALVh2ZXJpZnk6cmVtb3RlAC1Eam5scHguaG9tZT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxqYXZhd3MuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxkZXBsb3kuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxwbHVnaW4uamFyAC1EamRrLmRpc2FibGVMYXN0VXNhZ2VUcmFja2luZz10cnVlAC1Eam5scHguanZtPUM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGJpblxqYXZhdy5leGUALURqbmxweC52bWFyZ3M9TFVScVpHc3VaR2x6WVdKc1pVeGhjM1JWYzJGblpWUnlZV05yYVc1blBYUnlkV1VB -ma LVNTVkJhc2VsaW5lVXBkYXRlAC1ub3RXZWJKYXZh3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4564
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
896B
MD5a07b0c00ced11f704988c27d6ece2d52
SHA1fe6e956f3d4a0ba146b9fbd10439aec743805982
SHA256e99a00057c90aee9a37a7988497229f680259ae465bcceece39b22120a1417fb
SHA5120f9bb82d7e3f1f839ec15bf5bb9f3d0c1845af7f96d7d2f95b6d9e726412d165f933fd54a403abc9e4dc2be97928561a632f2f8c8444e0a558db81861fb5e05f
-
Filesize
12KB
MD5a66e19c05f3e0b24ac077a37c2b7589e
SHA18b9ad1517985c48c0bd11670fabd3648bac9d1ff
SHA2569771364d53fa9b1bd14cef7e48be1f5df23b11aac9f5cb6763a4934b3190e126
SHA5120876a0072ac19f03818a2e5d77cec638470a09e40cd3794d901f1625c3f701f7b37a5cc6e23057a53e62d6e936f5c90bdd4a2c811c64dcfaa20dca5fdf63565f
-
Filesize
164KB
MD5e48677c5f4a5bd97da0c7d28adc6b1a2
SHA10bbbdc8a8e244dbc1fe26c4898973f987c8ee5b5
SHA2564581794ad169666d576fb56250de04c453400097c7e0b0af9799de65a1a8e17c
SHA5129993ed8c23a517cdfccdf9ec264542ef1c00cb38b4465d9fe023c3589f91b796a4ecdf7b841e4b5590d036bef925926d6b67c6ce967fa72f42eda41af35d36f0