Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
13/03/2025, 10:48
General
-
Target
SHIPPING DOCS#04765342CHU.PDF.jar
-
Size
211KB
-
MD5
1d85e90da37068b469c780fc7a48e39d
-
SHA1
fd8c444b811ed76f1f21656db03fc4488cc07309
-
SHA256
5f254a78f046f08ddd45e1c1dfcdb3fe0be8258b207f874bc95bf269fe0713fa
-
SHA512
f65fae46e5a6320e052a52b5535e2c0a84b569abd4d1ea314499ec6791172492a3e4f36462bd88a22638fa75cdf2bc1049a313a7389097e66b87cbe435878e23
-
SSDEEP
3072:szR7A2Y0gUMxGZrrOVCobiBTr7zVTL8mPfiswap2OGr64BH4eyfJuoXvIFLB+yTz:4RLtMxyOVHiF75Tok7p2hNkIF1+yTbYQ
Malware Config
Signatures
-
STRRAT
STRRAT is a remote access tool than can steal credentials and log keystrokes.
-
Strrat family
-
Drops startup file 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 6 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar "C:\Users\Admin\AppData\Local\Temp\SHIPPING DOCS#04765342CHU.PDF.jar"1⤵
- Drops startup file
- Adds Run key to start application
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\SHIPPING DOCS#04765342CHU.PDF.jar"2⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\SHIPPING DOCS#04765342CHU.PDF.jar"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\SHIPPING DOCS#04765342CHU.PDF.jar"2⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
211KB
MD51d85e90da37068b469c780fc7a48e39d
SHA1fd8c444b811ed76f1f21656db03fc4488cc07309
SHA2565f254a78f046f08ddd45e1c1dfcdb3fe0be8258b207f874bc95bf269fe0713fa
SHA512f65fae46e5a6320e052a52b5535e2c0a84b569abd4d1ea314499ec6791172492a3e4f36462bd88a22638fa75cdf2bc1049a313a7389097e66b87cbe435878e23
-
Filesize
46B
MD5188288f340b4887ed238615725c1f6b3
SHA118292992155341874d3227abd8e1e74eae31b86b
SHA25688a5b89b2f105b9000be26d939d638beb35851434b36cd2484768047bdea7b59
SHA51280fa6e2dde47154b4b354bd5bf7541ca559e71b617756564d06ff2ec6af451b7c6a47c5147a58857b623fdf1c16711d380beea9794bde2653a97e02d3ff8f589
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.4MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.4MB
-
Filesize
64KB
-
Filesize
2.4MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB