Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
297s -
max time network
302s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
13/03/2025, 14:04
General
-
Target
SHIPPING DOCS#04765342CHU.PDF.jar
-
Size
211KB
-
MD5
1d85e90da37068b469c780fc7a48e39d
-
SHA1
fd8c444b811ed76f1f21656db03fc4488cc07309
-
SHA256
5f254a78f046f08ddd45e1c1dfcdb3fe0be8258b207f874bc95bf269fe0713fa
-
SHA512
f65fae46e5a6320e052a52b5535e2c0a84b569abd4d1ea314499ec6791172492a3e4f36462bd88a22638fa75cdf2bc1049a313a7389097e66b87cbe435878e23
-
SSDEEP
3072:szR7A2Y0gUMxGZrrOVCobiBTr7zVTL8mPfiswap2OGr64BH4eyfJuoXvIFLB+yTz:4RLtMxyOVHiF75Tok7p2hNkIF1+yTbYQ
Malware Config
Signatures
-
STRRAT
STRRAT is a remote access tool than can steal credentials and log keystrokes.
-
Strrat family
-
Drops startup file 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 6 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar "C:\Users\Admin\AppData\Local\Temp\SHIPPING DOCS#04765342CHU.PDF.jar"1⤵
- Drops startup file
- Adds Run key to start application
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\SHIPPING DOCS#04765342CHU.PDF.jar"2⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\SHIPPING DOCS#04765342CHU.PDF.jar"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\SHIPPING DOCS#04765342CHU.PDF.jar"2⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
211KB
MD51d85e90da37068b469c780fc7a48e39d
SHA1fd8c444b811ed76f1f21656db03fc4488cc07309
SHA2565f254a78f046f08ddd45e1c1dfcdb3fe0be8258b207f874bc95bf269fe0713fa
SHA512f65fae46e5a6320e052a52b5535e2c0a84b569abd4d1ea314499ec6791172492a3e4f36462bd88a22638fa75cdf2bc1049a313a7389097e66b87cbe435878e23
-
Filesize
46B
MD526035e175d678f6a91ff50d8e1a73e1e
SHA118bffacc158cdbb819b7a0374516a1e13a07bea3
SHA256410f7331ac7b35825a373af5546c2948a3d0577cb00e86c1d1d0ea7a47cfe817
SHA51281e67e741e1b1d2d049f98ed0d1eb93e9008e99f772efbeaca580959b341e333bb6d15ec9a933dccabb5661330958546e719178398564bf0d8d42e35f6f43150
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.4MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.4MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.4MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.4MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB