Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    154s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20241023-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    28/10/2024, 19:40

General

  • Target

    7a11f106c159e995601f6acf7cb5bf9a78f9e766a97eb63502cb9666febc7a6e.jar

  • Size

    23.4MB

  • MD5

    f476422a60511cd61f6754728580ce34

  • SHA1

    370946c72b96148d33fb436a527becc9ab291b03

  • SHA256

    7a11f106c159e995601f6acf7cb5bf9a78f9e766a97eb63502cb9666febc7a6e

  • SHA512

    8fae7bc1a0a568b0dd4a30c21be8d8d9da1fcdc6dcc3fd5ee1c5dab940ecf2539b9fadc2e5a597d0177c19a6cad27e7619ed7174f54e0d390e5fb419b7d49d48

  • SSDEEP

    393216:Uj2fnuMWx2Y+fTS66Na4CUid5EYa9fL8kE/Yiuyw6iPhRD/IBRsme1eZrWl+9p:CquP2Y/fDCdfElCV/tw6i5qBioKUP

Malware Config

Signatures

  • Drops startup file 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
    java -jar C:\Users\Admin\AppData\Local\Temp\7a11f106c159e995601f6acf7cb5bf9a78f9e766a97eb63502cb9666febc7a6e.jar
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3856
    • C:\Program Files\Java\jre-1.8\bin\javaw.exe
      "C:\Program Files\Java\jre-1.8\bin\javaw" -jar "C:\Users\Admin\AppData\Local\Temp\7a11f106c159e995601f6acf7cb5bf9a78f9e766a97eb63502cb9666febc7a6e.jar" DELAY:3
      2⤵
      • Drops startup file
      • Loads dropped DLL
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4092
      • C:\Windows\SYSTEM32\netsh.exe
        netsh wlan show networks mode=bssid
        3⤵
        • Event Triggered Execution: Netsh Helper DLL
        PID:2112
      • C:\Windows\SYSTEM32\netsh.exe
        netsh wlan show networks mode=bssid
        3⤵
        • Event Triggered Execution: Netsh Helper DLL
        PID:4912

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\6EE4CCA47C.sql

    Filesize

    40KB

    MD5

    a182561a527f929489bf4b8f74f65cd7

    SHA1

    8cd6866594759711ea1836e86a5b7ca64ee8911f

    SHA256

    42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

    SHA512

    9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

  • C:\Users\Admin\AppData\Local\Temp\JNativeHook-385777659FA84E94A3812EB9A8AFAD27AE3CEED4.x86_64.dll

    Filesize

    80KB

    MD5

    e9a449971b9efb0a2e12b9cfdd95c076

    SHA1

    385777659fa84e94a3812eb9a8afad27ae3ceed4

    SHA256

    b8c331c9f915960201da9af9c9dc8309e95e7d533741e71f4a5d13ca007d3e18

    SHA512

    bbcaf66b316cb60c63bb190099bee36a0059f13fa35fdf3a9a3e7e9a5304abe57acd71d644cde554427825249b460d58f0aba79f599f0c6fa40d23ea21aa941d

  • C:\Users\Admin\AppData\Local\Temp\jna-63116079\jna8080594210789284345.dll

    Filesize

    248KB

    MD5

    4de85f9679c3a75f6d7d3e56094aa106

    SHA1

    052f62fb2ebec89fbe412db480865910eab693ad

    SHA256

    3d1b2427b45ff5178bbb4db395758bedd3a1e91121ebb3e3640b5c4e20eb22cc

    SHA512

    e8357eabd548ffeba42715d891b9e1ed22b7bf720f48b1888407b9ebe7a796719c60a38f4fb8bb1cf32d3c9bed210a07cc227424ef991d356ec3acef9e6223ab

  • C:\Users\Admin\AppData\Local\Temp\sqlite-3.36.0.3-88a2734d-bef3-4012-9618-2fd08bc33caa-sqlitejdbc.dll

    Filesize

    847KB

    MD5

    71eb6b5dbae2f9266a876be1af8dc00c

    SHA1

    364b79fe0a21c9f9827b298d187b493f5f14ce71

    SHA256

    b0c53ebfcddc4031daad36aac9a2967921703431deba5e51234da5008ae45b2a

    SHA512

    0a27205fcc33f482f59aea22de02ba3a9a1981bd28adee97ba3702026f27c760350f5df34e5982f763b608867892d5d4cebb1e13efb159fc3eef431772e37b12

  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-87863914-780023816-688321450-1000\83aa4cc77f591dfc2374580bbd95f6ba_0a8972c4-89ee-4afc-bd36-e7fd9fc6198b

    Filesize

    45B

    MD5

    c8366ae350e7019aefc9d1e6e6a498c6

    SHA1

    5731d8a3e6568a5f2dfbbc87e3db9637df280b61

    SHA256

    11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238

    SHA512

    33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd

  • memory/3856-31-0x0000025B56DF0000-0x0000025B56E00000-memory.dmp

    Filesize

    64KB

  • memory/3856-68-0x0000025B56DC0000-0x0000025B56DD0000-memory.dmp

    Filesize

    64KB

  • memory/3856-23-0x0000025B56DB0000-0x0000025B56DC0000-memory.dmp

    Filesize

    64KB

  • memory/3856-21-0x0000025B56DA0000-0x0000025B56DB0000-memory.dmp

    Filesize

    64KB

  • memory/3856-11-0x0000025B56B10000-0x0000025B56B11000-memory.dmp

    Filesize

    4KB

  • memory/3856-26-0x0000025B56DC0000-0x0000025B56DD0000-memory.dmp

    Filesize

    64KB

  • memory/3856-27-0x0000025B56DD0000-0x0000025B56DE0000-memory.dmp

    Filesize

    64KB

  • memory/3856-48-0x0000025B56B10000-0x0000025B56B11000-memory.dmp

    Filesize

    4KB

  • memory/3856-2-0x0000025B56B30000-0x0000025B56DA0000-memory.dmp

    Filesize

    2.4MB

  • memory/3856-29-0x0000025B56DE0000-0x0000025B56DF0000-memory.dmp

    Filesize

    64KB

  • memory/3856-57-0x0000025B56B30000-0x0000025B56DA0000-memory.dmp

    Filesize

    2.4MB

  • memory/3856-70-0x0000025B56DE0000-0x0000025B56DF0000-memory.dmp

    Filesize

    64KB

  • memory/3856-62-0x0000025B56DA0000-0x0000025B56DB0000-memory.dmp

    Filesize

    64KB

  • memory/3856-69-0x0000025B56B30000-0x0000025B56DA0000-memory.dmp

    Filesize

    2.4MB

  • memory/3856-64-0x0000025B56DB0000-0x0000025B56DC0000-memory.dmp

    Filesize

    64KB

  • memory/3856-66-0x0000025B56B10000-0x0000025B56B11000-memory.dmp

    Filesize

    4KB

  • memory/3856-67-0x0000025B56DD0000-0x0000025B56DE0000-memory.dmp

    Filesize

    64KB

  • memory/4092-96-0x00000194EF350000-0x00000194EF360000-memory.dmp

    Filesize

    64KB

  • memory/4092-114-0x00000194EF3A0000-0x00000194EF3B0000-memory.dmp

    Filesize

    64KB

  • memory/4092-60-0x00000194EF2D0000-0x00000194EF2E0000-memory.dmp

    Filesize

    64KB

  • memory/4092-72-0x00000194EF2F0000-0x00000194EF300000-memory.dmp

    Filesize

    64KB

  • memory/4092-56-0x00000194EF2C0000-0x00000194EF2D0000-memory.dmp

    Filesize

    64KB

  • memory/4092-80-0x00000194EF300000-0x00000194EF310000-memory.dmp

    Filesize

    64KB

  • memory/4092-82-0x00000194EF310000-0x00000194EF320000-memory.dmp

    Filesize

    64KB

  • memory/4092-89-0x00000194EF2C0000-0x00000194EF2D0000-memory.dmp

    Filesize

    64KB

  • memory/4092-88-0x00000194EF2B0000-0x00000194EF2C0000-memory.dmp

    Filesize

    64KB

  • memory/4092-87-0x00000194EF330000-0x00000194EF340000-memory.dmp

    Filesize

    64KB

  • memory/4092-86-0x00000194EF320000-0x00000194EF330000-memory.dmp

    Filesize

    64KB

  • memory/4092-85-0x00000194EF040000-0x00000194EF2B0000-memory.dmp

    Filesize

    2.4MB

  • memory/4092-91-0x00000194EF340000-0x00000194EF350000-memory.dmp

    Filesize

    64KB

  • memory/4092-55-0x00000194EF2B0000-0x00000194EF2C0000-memory.dmp

    Filesize

    64KB

  • memory/4092-95-0x00000194EF2E0000-0x00000194EF2F0000-memory.dmp

    Filesize

    64KB

  • memory/4092-94-0x00000194EF2D0000-0x00000194EF2E0000-memory.dmp

    Filesize

    64KB

  • memory/4092-101-0x00000194EF360000-0x00000194EF370000-memory.dmp

    Filesize

    64KB

  • memory/4092-103-0x00000194EF370000-0x00000194EF380000-memory.dmp

    Filesize

    64KB

  • memory/4092-107-0x00000194EF390000-0x00000194EF3A0000-memory.dmp

    Filesize

    64KB

  • memory/4092-108-0x00000194EF2F0000-0x00000194EF300000-memory.dmp

    Filesize

    64KB

  • memory/4092-106-0x00000194EF380000-0x00000194EF390000-memory.dmp

    Filesize

    64KB

  • memory/4092-118-0x00000194EF020000-0x00000194EF021000-memory.dmp

    Filesize

    4KB

  • memory/4092-117-0x00000194EF310000-0x00000194EF320000-memory.dmp

    Filesize

    64KB

  • memory/4092-116-0x00000194EF3C0000-0x00000194EF3D0000-memory.dmp

    Filesize

    64KB

  • memory/4092-115-0x00000194EF3B0000-0x00000194EF3C0000-memory.dmp

    Filesize

    64KB

  • memory/4092-61-0x00000194EF2E0000-0x00000194EF2F0000-memory.dmp

    Filesize

    64KB

  • memory/4092-113-0x00000194EF300000-0x00000194EF310000-memory.dmp

    Filesize

    64KB

  • memory/4092-120-0x00000194EF330000-0x00000194EF340000-memory.dmp

    Filesize

    64KB

  • memory/4092-121-0x00000194EF3D0000-0x00000194EF3E0000-memory.dmp

    Filesize

    64KB

  • memory/4092-119-0x00000194EF320000-0x00000194EF330000-memory.dmp

    Filesize

    64KB

  • memory/4092-127-0x00000194EF020000-0x00000194EF021000-memory.dmp

    Filesize

    4KB

  • memory/4092-128-0x00000194EF020000-0x00000194EF021000-memory.dmp

    Filesize

    4KB

  • memory/4092-156-0x00000194EF020000-0x00000194EF021000-memory.dmp

    Filesize

    4KB

  • memory/4092-164-0x00000194EF020000-0x00000194EF021000-memory.dmp

    Filesize

    4KB

  • memory/4092-167-0x00000194EF020000-0x00000194EF021000-memory.dmp

    Filesize

    4KB

  • memory/4092-169-0x00000194EF020000-0x00000194EF021000-memory.dmp

    Filesize

    4KB

  • memory/4092-172-0x00000194EF020000-0x00000194EF021000-memory.dmp

    Filesize

    4KB

  • memory/4092-174-0x00000194EF020000-0x00000194EF021000-memory.dmp

    Filesize

    4KB

  • memory/4092-176-0x00000194EF020000-0x00000194EF021000-memory.dmp

    Filesize

    4KB

  • memory/4092-178-0x00000194EF020000-0x00000194EF021000-memory.dmp

    Filesize

    4KB

  • memory/4092-44-0x00000194EF020000-0x00000194EF021000-memory.dmp

    Filesize

    4KB

  • memory/4092-34-0x00000194EF040000-0x00000194EF2B0000-memory.dmp

    Filesize

    2.4MB

  • memory/4092-253-0x00000194EF340000-0x00000194EF350000-memory.dmp

    Filesize

    64KB

  • memory/4092-255-0x00000194EF350000-0x00000194EF360000-memory.dmp

    Filesize

    64KB

  • memory/4092-259-0x00000194EF360000-0x00000194EF370000-memory.dmp

    Filesize

    64KB

  • memory/4092-261-0x00000194EF370000-0x00000194EF380000-memory.dmp

    Filesize

    64KB

  • memory/4092-265-0x00000194EF380000-0x00000194EF390000-memory.dmp

    Filesize

    64KB

  • memory/4092-266-0x00000194EF390000-0x00000194EF3A0000-memory.dmp

    Filesize

    64KB

  • memory/4092-270-0x00000194EF3A0000-0x00000194EF3B0000-memory.dmp

    Filesize

    64KB

  • memory/4092-272-0x00000194EF3C0000-0x00000194EF3D0000-memory.dmp

    Filesize

    64KB

  • memory/4092-271-0x00000194EF3B0000-0x00000194EF3C0000-memory.dmp

    Filesize

    64KB

  • memory/4092-276-0x00000194EF3D0000-0x00000194EF3E0000-memory.dmp

    Filesize

    64KB