Analysis

  • max time kernel
    139s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    01-07-2022 05:25

General

  • Target

    3704a8f86fe69466491c8423500bf1385554ce9d0f0deb2a373655f3abce653b.jar

  • Size

    89KB

  • MD5

    20de1c62ba825235d8ec0a6ccebac974

  • SHA1

    53b53e50377754928990f67101d320a69442398c

  • SHA256

    3704a8f86fe69466491c8423500bf1385554ce9d0f0deb2a373655f3abce653b

  • SHA512

    25e3985ced204a05fa8cb0016b6e0fe60237fa36ffed79b9f9dfd43ed09bb72821995cc4b3bfcc22b45efe95655dddcf26656a822b72f2b6cd06e1215cc55046

Malware Config

Signatures

  • AdWind

    A Java-based RAT family operated as malware-as-a-service.

  • JAR file contains resources related to AdWind 1 IoCs

    This JAR file potentially contains loader stubs used by the AdWind RAT.

  • Sets file to hidden 1 TTPs 2 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops desktop.ini file(s) 2 IoCs
  • Modifies registry key 1 TTPs 4 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs
  • Views/modifies file attributes 1 TTPs 3 IoCs

Processes

  • C:\ProgramData\Oracle\Java\javapath\java.exe
    java -jar C:\Users\Admin\AppData\Local\Temp\3704a8f86fe69466491c8423500bf1385554ce9d0f0deb2a373655f3abce653b.jar
    1⤵
    • Drops desktop.ini file(s)
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2112
    • C:\Windows\SYSTEM32\reg.exe
      reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v asddresd /t REG_SZ /d "\"C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe\" -jar \"C:\Users\Admin\AppData\Roaming\eqwzdd\asdwsd.jar\"" /f
      2⤵
      • Adds Run key to start application
      • Modifies registry key
      PID:1004
    • C:\Windows\SYSTEM32\reg.exe
      reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v asddresd /f
      2⤵
      • Modifies registry key
      PID:672
    • C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
      "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\eqwzdd\asdwsd.jar"
      2⤵
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1988
      • C:\Windows\SYSTEM32\reg.exe
        reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v asddresd /t REG_SZ /d "\"C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe\" -jar \"C:\Users\Admin\AppData\Roaming\eqwzdd\asdwsd.jar\"" /f
        3⤵
        • Adds Run key to start application
        • Modifies registry key
        PID:2632
      • C:\Windows\SYSTEM32\reg.exe
        reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v asddresd /f
        3⤵
        • Modifies registry key
        PID:3724
      • C:\Windows\SYSTEM32\attrib.exe
        attrib +H C:\Users\Admin\.Plugins3
        3⤵
        • Views/modifies file attributes
        PID:4016
    • C:\Windows\SYSTEM32\attrib.exe
      attrib +s +h +r "C:\Users\Admin\AppData\Roaming\eqwzdd"
      2⤵
      • Sets file to hidden
      • Views/modifies file attributes
      PID:1832
    • C:\Windows\SYSTEM32\attrib.exe
      attrib +s +h +r "C:\Users\Admin\AppData\Roaming\eqwzdd\*.*"
      2⤵
      • Sets file to hidden
      • Drops desktop.ini file(s)
      • Views/modifies file attributes
      PID:2536

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp

    Filesize

    50B

    MD5

    f8db06f3d4369b96093fc7e93e5b5f5b

    SHA1

    5ddbbd4dc0abd12b88ef165ba2b42e81afd5d9b6

    SHA256

    79701f8236b53898027290686c6f762e9223781ca84866276cf174a5180a6eac

    SHA512

    36ead269e0cdf360a408c73dc4ab08d7eebe04c68994394c738f5e34405172ca3e995d54ac27e394a417e877ad310c2ce5b2500bafd7aa690ef3c4d501674608

  • C:\Users\Admin\AppData\Roaming\eqwzdd\Desktop.ini

    Filesize

    63B

    MD5

    e783bdd20a976eaeaae1ff4624487420

    SHA1

    c2a44fab9df00b3e11582546b16612333c2f9286

    SHA256

    2f65fa9c7ed712f493782abf91467f869419a2f8b5adf23b44019c08190fa3f3

    SHA512

    8c883678e4625ef44f4885b8c6d7485196774f9cb0b9eee7dd18711749bcae474163df9965effcd13ecd1a33cd7265010c152f8504d6013e4f4d85d68a901a80

  • C:\Users\Admin\AppData\Roaming\eqwzdd\asdwsd.jar

    Filesize

    89KB

    MD5

    20de1c62ba825235d8ec0a6ccebac974

    SHA1

    53b53e50377754928990f67101d320a69442398c

    SHA256

    3704a8f86fe69466491c8423500bf1385554ce9d0f0deb2a373655f3abce653b

    SHA512

    25e3985ced204a05fa8cb0016b6e0fe60237fa36ffed79b9f9dfd43ed09bb72821995cc4b3bfcc22b45efe95655dddcf26656a822b72f2b6cd06e1215cc55046

  • memory/1988-157-0x0000000002940000-0x0000000003940000-memory.dmp

    Filesize

    16.0MB

  • memory/1988-162-0x0000000002940000-0x0000000003940000-memory.dmp

    Filesize

    16.0MB

  • memory/2112-139-0x0000000002EB0000-0x0000000003EB0000-memory.dmp

    Filesize

    16.0MB