Analysis

  • max time kernel
    140s
  • max time network
    158s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    01-07-2022 05:25

General

  • Target

    3704a8f86fe69466491c8423500bf1385554ce9d0f0deb2a373655f3abce653b.jar

  • Size

    89KB

  • MD5

    20de1c62ba825235d8ec0a6ccebac974

  • SHA1

    53b53e50377754928990f67101d320a69442398c

  • SHA256

    3704a8f86fe69466491c8423500bf1385554ce9d0f0deb2a373655f3abce653b

  • SHA512

    25e3985ced204a05fa8cb0016b6e0fe60237fa36ffed79b9f9dfd43ed09bb72821995cc4b3bfcc22b45efe95655dddcf26656a822b72f2b6cd06e1215cc55046

Malware Config

Signatures

  • AdWind

    A Java-based RAT family operated as malware-as-a-service.

  • JAR file contains resources related to AdWind 1 IoCs

    This JAR file potentially contains loader stubs used by the AdWind RAT.

  • Sets file to hidden 1 TTPs 2 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops desktop.ini file(s) 2 IoCs
  • Modifies registry key 1 TTPs 4 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs
  • Views/modifies file attributes 1 TTPs 3 IoCs

Processes

  • C:\Windows\system32\java.exe
    java -jar C:\Users\Admin\AppData\Local\Temp\3704a8f86fe69466491c8423500bf1385554ce9d0f0deb2a373655f3abce653b.jar
    1⤵
    • Drops desktop.ini file(s)
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1880
    • C:\Windows\system32\reg.exe
      reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v asddresd /t REG_SZ /d "\"C:\Program Files\Java\jre7\bin\javaw.exe\" -jar \"C:\Users\Admin\AppData\Roaming\eqwzdd\asdwsd.jar\"" /f
      2⤵
      • Adds Run key to start application
      • Modifies registry key
      PID:1188
    • C:\Windows\system32\reg.exe
      reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v asddresd /f
      2⤵
      • Modifies registry key
      PID:2044
    • C:\Windows\system32\attrib.exe
      attrib +s +h +r "C:\Users\Admin\AppData\Roaming\eqwzdd\*.*"
      2⤵
      • Sets file to hidden
      • Drops desktop.ini file(s)
      • Views/modifies file attributes
      PID:892
    • C:\Windows\system32\attrib.exe
      attrib +s +h +r "C:\Users\Admin\AppData\Roaming\eqwzdd"
      2⤵
      • Sets file to hidden
      • Views/modifies file attributes
      PID:1956
    • C:\Program Files\Java\jre7\bin\javaw.exe
      "C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\eqwzdd\asdwsd.jar"
      2⤵
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1132
      • C:\Windows\system32\reg.exe
        reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v asddresd /t REG_SZ /d "\"C:\Program Files\Java\jre7\bin\javaw.exe\" -jar \"C:\Users\Admin\AppData\Roaming\eqwzdd\asdwsd.jar\"" /f
        3⤵
        • Adds Run key to start application
        • Modifies registry key
        PID:696
      • C:\Windows\system32\reg.exe
        reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v asddresd /f
        3⤵
        • Modifies registry key
        PID:1508
      • C:\Windows\system32\attrib.exe
        attrib +H C:\Users\Admin\.Plugins3
        3⤵
        • Views/modifies file attributes
        PID:1356

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\eqwzdd\Desktop.ini

    Filesize

    63B

    MD5

    e783bdd20a976eaeaae1ff4624487420

    SHA1

    c2a44fab9df00b3e11582546b16612333c2f9286

    SHA256

    2f65fa9c7ed712f493782abf91467f869419a2f8b5adf23b44019c08190fa3f3

    SHA512

    8c883678e4625ef44f4885b8c6d7485196774f9cb0b9eee7dd18711749bcae474163df9965effcd13ecd1a33cd7265010c152f8504d6013e4f4d85d68a901a80

  • C:\Users\Admin\AppData\Roaming\eqwzdd\asdwsd.jar

    Filesize

    89KB

    MD5

    20de1c62ba825235d8ec0a6ccebac974

    SHA1

    53b53e50377754928990f67101d320a69442398c

    SHA256

    3704a8f86fe69466491c8423500bf1385554ce9d0f0deb2a373655f3abce653b

    SHA512

    25e3985ced204a05fa8cb0016b6e0fe60237fa36ffed79b9f9dfd43ed09bb72821995cc4b3bfcc22b45efe95655dddcf26656a822b72f2b6cd06e1215cc55046

  • memory/1132-82-0x0000000002360000-0x0000000005360000-memory.dmp

    Filesize

    48.0MB

  • memory/1132-86-0x0000000002360000-0x0000000005360000-memory.dmp

    Filesize

    48.0MB

  • memory/1880-54-0x000007FEFB8B1000-0x000007FEFB8B3000-memory.dmp

    Filesize

    8KB

  • memory/1880-64-0x0000000002280000-0x0000000005280000-memory.dmp

    Filesize

    48.0MB