Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25/10/2024, 21:17
Static task
static1
Behavioral task
behavioral1
Sample
b9ed958906bc1a83f4fe2923e7909460cbacce311ca710da704a793a00ca9acc.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
b9ed958906bc1a83f4fe2923e7909460cbacce311ca710da704a793a00ca9acc.exe
Resource
win10v2004-20241007-en
General
-
Target
b9ed958906bc1a83f4fe2923e7909460cbacce311ca710da704a793a00ca9acc.exe
-
Size
1.7MB
-
MD5
88a9a25f3c2831430ad0a51465f89a44
-
SHA1
2f8c5adcae7c063233c342ad073be2270a985719
-
SHA256
b9ed958906bc1a83f4fe2923e7909460cbacce311ca710da704a793a00ca9acc
-
SHA512
6d0d65f58c3d3706e5b48b3618245f4d253c9003c2521b160d1c9764815f4c6b2a5d8e3b78c9af69328d193fe471adbcc66ff691c31d8969a0f0635faf244b9e
-
SSDEEP
49152:rKxNuLkTcKb4rSUfkVFjAErvL73RLSo+2fhl:OfuLkT5NUQXrvvRe12fD
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b9ed958906bc1a83f4fe2923e7909460cbacce311ca710da704a793a00ca9acc.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 116 javaws.exe 116 javaws.exe 1432 jp2launcher.exe 1432 jp2launcher.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4820 b9ed958906bc1a83f4fe2923e7909460cbacce311ca710da704a793a00ca9acc.exe 4820 b9ed958906bc1a83f4fe2923e7909460cbacce311ca710da704a793a00ca9acc.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 4820 b9ed958906bc1a83f4fe2923e7909460cbacce311ca710da704a793a00ca9acc.exe 4820 b9ed958906bc1a83f4fe2923e7909460cbacce311ca710da704a793a00ca9acc.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1432 jp2launcher.exe 4820 b9ed958906bc1a83f4fe2923e7909460cbacce311ca710da704a793a00ca9acc.exe 4820 b9ed958906bc1a83f4fe2923e7909460cbacce311ca710da704a793a00ca9acc.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4820 wrote to memory of 116 4820 b9ed958906bc1a83f4fe2923e7909460cbacce311ca710da704a793a00ca9acc.exe 86 PID 4820 wrote to memory of 116 4820 b9ed958906bc1a83f4fe2923e7909460cbacce311ca710da704a793a00ca9acc.exe 86 PID 116 wrote to memory of 1432 116 javaws.exe 87 PID 116 wrote to memory of 1432 116 javaws.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\b9ed958906bc1a83f4fe2923e7909460cbacce311ca710da704a793a00ca9acc.exe"C:\Users\Admin\AppData\Local\Temp\b9ed958906bc1a83f4fe2923e7909460cbacce311ca710da704a793a00ca9acc.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Program Files\Java\jre-1.8\bin\javaws.exe"C:\Program Files\Java\jre-1.8\bin\javaws.exe" -J-Djdk.disableLastUsageTracking=true -SSVBaselineUpdate2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe"C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre-1.8" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxsaWJcZGVwbG95LmphcgAtRGphdmEuc2VjdXJpdHkucG9saWN5PWZpbGU6QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZS0xLjhcbGliXHNlY3VyaXR5XGphdmF3cy5wb2xpY3kALUR0cnVzdFByb3h5PXRydWUALVh2ZXJpZnk6cmVtb3RlAC1Eam5scHguaG9tZT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxqYXZhd3MuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxkZXBsb3kuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxwbHVnaW4uamFyAC1EamRrLmRpc2FibGVMYXN0VXNhZ2VUcmFja2luZz10cnVlAC1Eam5scHguanZtPUM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGJpblxqYXZhdy5leGUALURqbmxweC52bWFyZ3M9TFVScVpHc3VaR2x6WVdKc1pVeGhjM1JWYzJGblpWUnlZV05yYVc1blBYUnlkV1VB -ma LVNTVkJhc2VsaW5lVXBkYXRlAC1ub3RXZWJKYXZh3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1432
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
896B
MD5ed3a995720d8f4ec7ce3aa8bfb2d034b
SHA118e8542a911f1da1d0488d454297c33f914733b9
SHA25690a081cb0a1936b339a0e804bee5211e65775cf3cfd526ff0120c8bb831fb4a4
SHA5122a64636204ef0b9ee59166681cf13e1142020df91d504a7f06d2db7ee4fee2ad7cfaad8ed367f24b0cb9cec98fe72a000b9ea96a7542d01316230fba7815051e
-
Filesize
12KB
MD5a66e19c05f3e0b24ac077a37c2b7589e
SHA18b9ad1517985c48c0bd11670fabd3648bac9d1ff
SHA2569771364d53fa9b1bd14cef7e48be1f5df23b11aac9f5cb6763a4934b3190e126
SHA5120876a0072ac19f03818a2e5d77cec638470a09e40cd3794d901f1625c3f701f7b37a5cc6e23057a53e62d6e936f5c90bdd4a2c811c64dcfaa20dca5fdf63565f
-
Filesize
164KB
MD5ae749e534544d4464fcfdd283c3d59b3
SHA1778f5715ac8501a0167551a0ba55db068e06491d
SHA256baa0b9b5dfcb3605650268f616350dff315ccb7e596a55aeba374ac2f0f5175f
SHA51201aaf24f3d3e10f30aa336fd904ee7ce02410004162009e843b24f48851f5bab91e4491c5ba54d6af6990e4e75b75de6cba48ad08892511e688e0c382c337c80