Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
13/03/2025, 14:23
General
-
Target
SHIPPING DOCS#04765342CHU.PDF.jar
-
Size
211KB
-
MD5
1d85e90da37068b469c780fc7a48e39d
-
SHA1
fd8c444b811ed76f1f21656db03fc4488cc07309
-
SHA256
5f254a78f046f08ddd45e1c1dfcdb3fe0be8258b207f874bc95bf269fe0713fa
-
SHA512
f65fae46e5a6320e052a52b5535e2c0a84b569abd4d1ea314499ec6791172492a3e4f36462bd88a22638fa75cdf2bc1049a313a7389097e66b87cbe435878e23
-
SSDEEP
3072:szR7A2Y0gUMxGZrrOVCobiBTr7zVTL8mPfiswap2OGr64BH4eyfJuoXvIFLB+yTz:4RLtMxyOVHiF75Tok7p2hNkIF1+yTbYQ
Malware Config
Signatures
-
STRRAT
STRRAT is a remote access tool than can steal credentials and log keystrokes.
-
Strrat family
-
Drops startup file 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 6 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar "C:\Users\Admin\AppData\Local\Temp\SHIPPING DOCS#04765342CHU.PDF.jar"1⤵
- Drops startup file
- Adds Run key to start application
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\SHIPPING DOCS#04765342CHU.PDF.jar"2⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\SHIPPING DOCS#04765342CHU.PDF.jar"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\SHIPPING DOCS#04765342CHU.PDF.jar"2⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
211KB
MD51d85e90da37068b469c780fc7a48e39d
SHA1fd8c444b811ed76f1f21656db03fc4488cc07309
SHA2565f254a78f046f08ddd45e1c1dfcdb3fe0be8258b207f874bc95bf269fe0713fa
SHA512f65fae46e5a6320e052a52b5535e2c0a84b569abd4d1ea314499ec6791172492a3e4f36462bd88a22638fa75cdf2bc1049a313a7389097e66b87cbe435878e23
-
Filesize
46B
MD58eaaa8c86e8159b1c54dd44ace13708a
SHA180c4cb31596051e52727ba0c23a92064ea39729e
SHA25672b1a83d5e8f27b3e4e3d21af7d4bafa83c8137acc74b5bd87d4d91b6d84b5cd
SHA5122b256f1a09da9e6996fd0c5f25651446762559658a3dd2c6f34a70c27cfcb7cd048031c8d9d3b6e4368b677a9025777b14c739325d459e59a641d260e1f727d3
-
Filesize
2.4MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.4MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB