Analysis

  • max time kernel
    148s
  • max time network
    148s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    21-04-2021 14:08

General

  • Target

    67020079517_20210419_16324653_HesapOzeti PDF.jar

  • Size

    641KB

  • MD5

    2292ed191b66e4746ac4d930aa413143

  • SHA1

    7c6c9fa4968c5f7351fa9e6faba8f1c719df74e9

  • SHA256

    3f4d49818d707c08f06e326f317e3353143be6d94d516600c9cd8d3612fd1900

  • SHA512

    c85bde3c9471269c02f35c2461c9998da0727fdb0ccd517ad6fc123931e31a404cb7f44570c12eb1089511f1952234e514ca026fdf2ace11dbbb5abd91b64e07

Malware Config

Signatures

  • AdWind

    A Java-based RAT family operated as malware-as-a-service.

  • UAC bypass 3 TTPs
  • Disables Task Manager via registry modification
  • Disables use of System Restore points 1 TTPs
  • Sets file execution options in registry 2 TTPs
  • Loads dropped DLL 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 12 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Kills process with taskkill 5 IoCs
  • Runs .reg file with regedit 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 47 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 44 IoCs

Processes

  • C:\ProgramData\Oracle\Java\javapath\java.exe
    java -jar "C:\Users\Admin\AppData\Local\Temp\67020079517_20210419_16324653_HesapOzeti PDF.jar"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:416
    • C:\Windows\SYSTEM32\wscript.exe
      wscript C:\Users\Admin\vkbgeuykwd.js
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3884
      • C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
        "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\fdk.txt"
        3⤵
        • Loads dropped DLL
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:360
        • C:\Program Files\Java\jre1.8.0_66\bin\java.exe
          "C:\Program Files\Java\jre1.8.0_66\bin\java.exe" -jar C:\Users\Admin\AppData\Local\Temp\_0.48709007445743591856222342821651776.class
          4⤵
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4080
          • C:\Windows\SYSTEM32\cmd.exe
            cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive4721605749494060708.vbs
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1848
            • C:\Windows\system32\cscript.exe
              cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive4721605749494060708.vbs
              6⤵
                PID:2076
            • C:\Windows\SYSTEM32\cmd.exe
              cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive7375855904832545529.vbs
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:1464
              • C:\Windows\system32\cscript.exe
                cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive7375855904832545529.vbs
                6⤵
                  PID:1068
              • C:\Windows\SYSTEM32\xcopy.exe
                xcopy "C:\Program Files\Java\jre1.8.0_66" "C:\Users\Admin\AppData\Roaming\Oracle\" /e
                5⤵
                  PID:204
              • C:\Windows\SYSTEM32\cmd.exe
                cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive6887551686303183452.vbs
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:3464
                • C:\Windows\system32\cscript.exe
                  cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive6887551686303183452.vbs
                  5⤵
                    PID:2344
                • C:\Windows\SYSTEM32\cmd.exe
                  cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive3551620834831939302.vbs
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1396
                  • C:\Windows\system32\cscript.exe
                    cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive3551620834831939302.vbs
                    5⤵
                      PID:1524
                  • C:\Windows\SYSTEM32\xcopy.exe
                    xcopy "C:\Program Files\Java\jre1.8.0_66" "C:\Users\Admin\AppData\Roaming\Oracle\" /e
                    4⤵
                      PID:2024
                    • C:\Windows\SYSTEM32\cmd.exe
                      cmd.exe
                      4⤵
                        PID:412
                      • C:\Windows\SYSTEM32\taskkill.exe
                        taskkill /IM UserAccountControlSettings.exe /T /F
                        4⤵
                        • Kills process with taskkill
                        • Suspicious use of AdjustPrivilegeToken
                        PID:416
                      • C:\Windows\SYSTEM32\cmd.exe
                        cmd.exe /c regedit.exe /s C:\Users\Admin\AppData\Local\Temp\fAsEsYFgoS6892628016163733830.reg
                        4⤵
                        • Suspicious use of WriteProcessMemory
                        PID:2420
                        • C:\Windows\regedit.exe
                          regedit.exe /s C:\Users\Admin\AppData\Local\Temp\fAsEsYFgoS6892628016163733830.reg
                          5⤵
                          • Runs .reg file with regedit
                          PID:3444
                      • C:\Windows\SYSTEM32\taskkill.exe
                        taskkill /IM Taskmgr.exe /T /F
                        4⤵
                        • Kills process with taskkill
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2196
                      • C:\Windows\SYSTEM32\taskkill.exe
                        taskkill /IM ProcessHacker.exe /T /F
                        4⤵
                        • Kills process with taskkill
                        • Suspicious use of AdjustPrivilegeToken
                        PID:928
                      • C:\Windows\SYSTEM32\taskkill.exe
                        taskkill /IM procexp.exe /T /F
                        4⤵
                        • Kills process with taskkill
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1552
                      • C:\Windows\System32\Wbem\WMIC.exe
                        WMIC /Node:localhost /Namespace:\\root\cimv2 Path Win32_PnpSignedDriver Get /Format:List
                        4⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:540
                      • C:\Windows\SYSTEM32\taskkill.exe
                        taskkill /IM MSASCui.exe /T /F
                        4⤵
                        • Kills process with taskkill
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2088

                Network

                MITRE ATT&CK Matrix ATT&CK v6

                Persistence

                Registry Run Keys / Startup Folder

                1
                T1060

                Privilege Escalation

                Bypass User Account Control

                1
                T1088

                Defense Evasion

                Bypass User Account Control

                1
                T1088

                Disabling Security Tools

                1
                T1089

                Modify Registry

                2
                T1112

                Discovery

                System Information Discovery

                1
                T1082

                Impact

                Inhibit System Recovery

                1
                T1490

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp
                  MD5

                  d41d8cd98f00b204e9800998ecf8427e

                  SHA1

                  da39a3ee5e6b4b0d3255bfef95601890afd80709

                  SHA256

                  e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                  SHA512

                  cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                • C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp
                  MD5

                  4f17a5888a1465f93a78fa160b272ef0

                  SHA1

                  777c022d001793fcc491607b24b20623bf28bd40

                  SHA256

                  0a26c4ae72e6a45746f5abf0e2cfb255cf3afb7b5f384997518ff46f69b8a1d8

                  SHA512

                  b30a5bbaa8c7385d67babf5b308798452340795bfd5a5602730ad02ef1b4ea8cb7fb8423cb262165ddf04f24043d796e51b22bdb7d8978e971a104280d8bb62f

                • C:\Users\Admin\AppData\Local\Temp\Retrive3551620834831939302.vbs
                  MD5

                  a32c109297ed1ca155598cd295c26611

                  SHA1

                  dc4a1fdbaad15ddd6fe22d3907c6b03727b71510

                  SHA256

                  45bfe34aa3ef932f75101246eb53d032f5e7cf6d1f5b4e495334955a255f32e7

                  SHA512

                  70372552dc86fe02ece9fe3b7721463f80be07a34126b2c75b41e30078cda9e90744c7d644df623f63d4fb985482e345b3351c4d3da873162152c67fc6ecc887

                • C:\Users\Admin\AppData\Local\Temp\Retrive4721605749494060708.vbs
                  MD5

                  3bdfd33017806b85949b6faa7d4b98e4

                  SHA1

                  f92844fee69ef98db6e68931adfaa9a0a0f8ce66

                  SHA256

                  9da575dd2d5b7c1e9bab8b51a16cde457b3371c6dcdb0537356cf1497fa868f6

                  SHA512

                  ae5e5686ae71edef53e71cd842cb6799e4383b9c238a5c361b81647efa128d2fedf3bf464997771b5b0c47a058fecae7829aeedcd098c80a11008581e5781429

                • C:\Users\Admin\AppData\Local\Temp\Retrive6887551686303183452.vbs
                  MD5

                  3bdfd33017806b85949b6faa7d4b98e4

                  SHA1

                  f92844fee69ef98db6e68931adfaa9a0a0f8ce66

                  SHA256

                  9da575dd2d5b7c1e9bab8b51a16cde457b3371c6dcdb0537356cf1497fa868f6

                  SHA512

                  ae5e5686ae71edef53e71cd842cb6799e4383b9c238a5c361b81647efa128d2fedf3bf464997771b5b0c47a058fecae7829aeedcd098c80a11008581e5781429

                • C:\Users\Admin\AppData\Local\Temp\Retrive7375855904832545529.vbs
                  MD5

                  a32c109297ed1ca155598cd295c26611

                  SHA1

                  dc4a1fdbaad15ddd6fe22d3907c6b03727b71510

                  SHA256

                  45bfe34aa3ef932f75101246eb53d032f5e7cf6d1f5b4e495334955a255f32e7

                  SHA512

                  70372552dc86fe02ece9fe3b7721463f80be07a34126b2c75b41e30078cda9e90744c7d644df623f63d4fb985482e345b3351c4d3da873162152c67fc6ecc887

                • C:\Users\Admin\AppData\Local\Temp\_0.48709007445743591856222342821651776.class
                  MD5

                  781fb531354d6f291f1ccab48da6d39f

                  SHA1

                  9ce4518ebcb5be6d1f0b5477fa00c26860fe9a68

                  SHA256

                  97d585b6aff62fb4e43e7e6a5f816dcd7a14be11a88b109a9ba9e8cd4c456eb9

                  SHA512

                  3e6630f5feb4a3eb1dac7e9125ce14b1a2a45d7415cf44cea42bc51b2a9aa37169ee4a4c36c888c8f2696e7d6e298e2ad7b2f4c22868aaa5948210eb7db220d8

                • C:\Users\Admin\AppData\Local\Temp\fAsEsYFgoS6892628016163733830.reg
                  MD5

                  7f97f5f336944d427c03cc730c636b8f

                  SHA1

                  8a50c72b4580c20d4a7bfc7af8f12671bf6715ae

                  SHA256

                  9613caed306e9a267c62c56506985ef99ea2bee6e11afc185b8133dda37cbc57

                  SHA512

                  8f8b5dc16f087bdc73a134b76fd1063765e3c049baca4873d1b9eb30ba59f418395490cafc78a93b1cdcc20461e73c96de34475669715d6ddb93d0b56e6e6c54

                • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3686645723-710336880-414668232-1000\83aa4cc77f591dfc2374580bbd95f6ba_89bbad60-16d5-41c2-ad8d-716f4ac5f4c2
                  MD5

                  c8366ae350e7019aefc9d1e6e6a498c6

                  SHA1

                  5731d8a3e6568a5f2dfbbc87e3db9637df280b61

                  SHA256

                  11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238

                  SHA512

                  33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd

                • C:\Users\Admin\AppData\Roaming\fdk.txt
                  MD5

                  13eeb0433ba85e43be118a4ecbc7b3d5

                  SHA1

                  83de6af4a162629e97ecfc995eae92c2ea23c88c

                  SHA256

                  a6b8c5fac31c8e56bbcc2e4b68bc2b3a132782fb3177945ce2cb565702208b56

                  SHA512

                  0b13ec24704fad737cfbe14d04f2bec5d38ab13250c194f522f5645d426794a222ccc942c878f691e0a847411200a8a50bbeef89d56a017e1632d952b20b3a5e

                • C:\Users\Admin\vkbgeuykwd.js
                  MD5

                  a91f15fe07084dac06c6255a08021112

                  SHA1

                  0d3c528f9313c3ac73fb4fe309ecfef14bec51e2

                  SHA256

                  e9010d382bde6b21b989388ee98f3db387da55b5e64ee8cba4c34ba824025a06

                  SHA512

                  9085f93e0aec02c99aedf59cd03f47e14adfe59b4eb9fe0621f335356b2d0a720a1e62a1d1fd60ba809efad5debe7aeac9c98b7ceedbb4d4345d8fc5cb514930

                • \Users\Admin\AppData\Local\Temp\Windows8321070525309191503.dll
                  MD5

                  0ad1fc3ddb524c21c9b31cbe3fd57780

                  SHA1

                  70fef487a61944ef9ce9399a83e7be84f6cad58f

                  SHA256

                  7da7e2e66b5b79123f9d731d60be76787b6374681e614099f18571a4c4463798

                  SHA512

                  62e038824bbb30da6449ac15ed5309aef32a06161acf22d55e02adb998e1705eb293b78a91600552fcc178b9d711fb94eca0d6e78593ad174a14f7fc76f3da18

                • memory/204-215-0x0000000000000000-mapping.dmp
                • memory/360-217-0x0000000002FE0000-0x0000000002FF0000-memory.dmp
                  Filesize

                  64KB

                • memory/360-224-0x0000000003000000-0x0000000003010000-memory.dmp
                  Filesize

                  64KB

                • memory/360-131-0x0000000002FA0000-0x0000000002FB0000-memory.dmp
                  Filesize

                  64KB

                • memory/360-133-0x0000000002F80000-0x0000000002F90000-memory.dmp
                  Filesize

                  64KB

                • memory/360-134-0x0000000002F90000-0x0000000002FA0000-memory.dmp
                  Filesize

                  64KB

                • memory/360-135-0x0000000000DE0000-0x0000000000DE1000-memory.dmp
                  Filesize

                  4KB

                • memory/360-129-0x0000000002F70000-0x0000000002F80000-memory.dmp
                  Filesize

                  64KB

                • memory/360-137-0x0000000000DE0000-0x0000000000DE1000-memory.dmp
                  Filesize

                  4KB

                • memory/360-141-0x0000000002FB0000-0x0000000002FC0000-memory.dmp
                  Filesize

                  64KB

                • memory/360-144-0x0000000002FC0000-0x0000000002FD0000-memory.dmp
                  Filesize

                  64KB

                • memory/360-123-0x0000000002D00000-0x0000000002F70000-memory.dmp
                  Filesize

                  2.4MB

                • memory/360-227-0x0000000003030000-0x0000000003040000-memory.dmp
                  Filesize

                  64KB

                • memory/360-226-0x0000000003020000-0x0000000003030000-memory.dmp
                  Filesize

                  64KB

                • memory/360-125-0x0000000000DE0000-0x0000000000DE1000-memory.dmp
                  Filesize

                  4KB

                • memory/360-225-0x0000000003010000-0x0000000003020000-memory.dmp
                  Filesize

                  64KB

                • memory/360-223-0x0000000002FF0000-0x0000000003000000-memory.dmp
                  Filesize

                  64KB

                • memory/360-118-0x0000000000000000-mapping.dmp
                • memory/360-216-0x0000000002FD0000-0x0000000002FE0000-memory.dmp
                  Filesize

                  64KB

                • memory/412-218-0x0000000000000000-mapping.dmp
                • memory/416-114-0x0000000002F30000-0x00000000031A0000-memory.dmp
                  Filesize

                  2.4MB

                • memory/416-219-0x0000000000000000-mapping.dmp
                • memory/416-116-0x0000000002BE0000-0x0000000002BE1000-memory.dmp
                  Filesize

                  4KB

                • memory/540-231-0x0000000000000000-mapping.dmp
                • memory/928-229-0x0000000000000000-mapping.dmp
                • memory/1068-212-0x0000000000000000-mapping.dmp
                • memory/1396-207-0x0000000000000000-mapping.dmp
                • memory/1464-210-0x0000000000000000-mapping.dmp
                • memory/1524-209-0x0000000000000000-mapping.dmp
                • memory/1552-230-0x0000000000000000-mapping.dmp
                • memory/1848-205-0x0000000000000000-mapping.dmp
                • memory/2024-213-0x0000000000000000-mapping.dmp
                • memory/2076-206-0x0000000000000000-mapping.dmp
                • memory/2088-233-0x0000000000000000-mapping.dmp
                • memory/2196-228-0x0000000000000000-mapping.dmp
                • memory/2344-189-0x0000000000000000-mapping.dmp
                • memory/2420-220-0x0000000000000000-mapping.dmp
                • memory/3444-221-0x0000000000000000-mapping.dmp
                • memory/3464-178-0x0000000000000000-mapping.dmp
                • memory/3884-115-0x0000000000000000-mapping.dmp
                • memory/4080-177-0x0000000000400000-0x0000000000401000-memory.dmp
                  Filesize

                  4KB

                • memory/4080-167-0x0000000000400000-0x0000000000401000-memory.dmp
                  Filesize

                  4KB

                • memory/4080-164-0x0000000000400000-0x0000000000401000-memory.dmp
                  Filesize

                  4KB

                • memory/4080-162-0x00000000026B0000-0x00000000026C0000-memory.dmp
                  Filesize

                  64KB

                • memory/4080-152-0x0000000002680000-0x0000000002690000-memory.dmp
                  Filesize

                  64KB

                • memory/4080-148-0x0000000002670000-0x0000000002680000-memory.dmp
                  Filesize

                  64KB

                • memory/4080-149-0x00000000026A0000-0x00000000026B0000-memory.dmp
                  Filesize

                  64KB

                • memory/4080-179-0x0000000000400000-0x0000000000401000-memory.dmp
                  Filesize

                  4KB

                • memory/4080-146-0x0000000002690000-0x00000000026A0000-memory.dmp
                  Filesize

                  64KB

                • memory/4080-188-0x00000000026C0000-0x00000000026D0000-memory.dmp
                  Filesize

                  64KB

                • memory/4080-128-0x0000000000400000-0x0000000000401000-memory.dmp
                  Filesize

                  4KB

                • memory/4080-121-0x0000000000000000-mapping.dmp
                • memory/4080-126-0x0000000002400000-0x0000000002670000-memory.dmp
                  Filesize

                  2.4MB