Malware Analysis Report

2025-01-02 02:01

Sample ID 220707-kl179ahdbk
Target 46764152b08a2e9b996e894101e9b35df0bfa396bc1b3d2c9e80bf11c20ac79d
SHA256 46764152b08a2e9b996e894101e9b35df0bfa396bc1b3d2c9e80bf11c20ac79d
Tags
adwind persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

46764152b08a2e9b996e894101e9b35df0bfa396bc1b3d2c9e80bf11c20ac79d

Threat Level: Known bad

The file 46764152b08a2e9b996e894101e9b35df0bfa396bc1b3d2c9e80bf11c20ac79d was found to be: Known bad.

Malicious Activity Summary

adwind persistence trojan

AdWind

Adds Run key to start application

Drops file in System32 directory

Modifies registry key

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Views/modifies file attributes

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-07-07 08:42

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-07-07 08:42

Reported

2022-07-07 09:00

Platform

win7-20220414-en

Max time kernel

149s

Max time network

175s

Command Line

java -jar C:\Users\Admin\AppData\Local\Temp\46764152b08a2e9b996e894101e9b35df0bfa396bc1b3d2c9e80bf11c20ac79d.jar

Signatures

AdWind

trojan adwind

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run C:\Windows\system32\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\itHMlsBcwAx = "\"C:\\Program Files\\Java\\jre7\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\uNHvfVunMeX\\nhXbldKHvgL.sZCpXv\"" C:\Windows\system32\reg.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\test.txt C:\Program Files\Java\jre7\bin\javaw.exe N/A
File created C:\Windows\System32\test.txt C:\Windows\system32\java.exe N/A
File opened for modification C:\Windows\System32\test.txt C:\Program Files\Java\jre7\bin\java.exe N/A
File opened for modification C:\Windows\System32\test.txt C:\Program Files\Java\jre7\bin\java.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\system32\reg.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\java.exe N/A
N/A N/A C:\Program Files\Java\jre7\bin\java.exe N/A
N/A N/A C:\Program Files\Java\jre7\bin\javaw.exe N/A
N/A N/A C:\Program Files\Java\jre7\bin\java.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1424 wrote to memory of 1824 N/A C:\Windows\system32\java.exe C:\Program Files\Java\jre7\bin\java.exe
PID 1424 wrote to memory of 1824 N/A C:\Windows\system32\java.exe C:\Program Files\Java\jre7\bin\java.exe
PID 1424 wrote to memory of 1824 N/A C:\Windows\system32\java.exe C:\Program Files\Java\jre7\bin\java.exe
PID 1424 wrote to memory of 932 N/A C:\Windows\system32\java.exe C:\Windows\system32\cmd.exe
PID 1424 wrote to memory of 932 N/A C:\Windows\system32\java.exe C:\Windows\system32\cmd.exe
PID 1424 wrote to memory of 932 N/A C:\Windows\system32\java.exe C:\Windows\system32\cmd.exe
PID 1824 wrote to memory of 1084 N/A C:\Program Files\Java\jre7\bin\java.exe C:\Windows\system32\cmd.exe
PID 1824 wrote to memory of 1084 N/A C:\Program Files\Java\jre7\bin\java.exe C:\Windows\system32\cmd.exe
PID 1824 wrote to memory of 1084 N/A C:\Program Files\Java\jre7\bin\java.exe C:\Windows\system32\cmd.exe
PID 1084 wrote to memory of 1748 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cscript.exe
PID 1084 wrote to memory of 1748 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cscript.exe
PID 1084 wrote to memory of 1748 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cscript.exe
PID 932 wrote to memory of 292 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cscript.exe
PID 932 wrote to memory of 292 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cscript.exe
PID 932 wrote to memory of 292 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cscript.exe
PID 1424 wrote to memory of 1568 N/A C:\Windows\system32\java.exe C:\Windows\system32\cmd.exe
PID 1424 wrote to memory of 1568 N/A C:\Windows\system32\java.exe C:\Windows\system32\cmd.exe
PID 1424 wrote to memory of 1568 N/A C:\Windows\system32\java.exe C:\Windows\system32\cmd.exe
PID 1824 wrote to memory of 576 N/A C:\Program Files\Java\jre7\bin\java.exe C:\Windows\system32\cmd.exe
PID 1824 wrote to memory of 576 N/A C:\Program Files\Java\jre7\bin\java.exe C:\Windows\system32\cmd.exe
PID 1824 wrote to memory of 576 N/A C:\Program Files\Java\jre7\bin\java.exe C:\Windows\system32\cmd.exe
PID 576 wrote to memory of 1572 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cscript.exe
PID 576 wrote to memory of 1572 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cscript.exe
PID 576 wrote to memory of 1572 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cscript.exe
PID 1568 wrote to memory of 1856 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cscript.exe
PID 1568 wrote to memory of 1856 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cscript.exe
PID 1568 wrote to memory of 1856 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cscript.exe
PID 1424 wrote to memory of 2004 N/A C:\Windows\system32\java.exe C:\Windows\system32\xcopy.exe
PID 1424 wrote to memory of 2004 N/A C:\Windows\system32\java.exe C:\Windows\system32\xcopy.exe
PID 1424 wrote to memory of 2004 N/A C:\Windows\system32\java.exe C:\Windows\system32\xcopy.exe
PID 1824 wrote to memory of 384 N/A C:\Program Files\Java\jre7\bin\java.exe C:\Windows\system32\xcopy.exe
PID 1824 wrote to memory of 384 N/A C:\Program Files\Java\jre7\bin\java.exe C:\Windows\system32\xcopy.exe
PID 1824 wrote to memory of 384 N/A C:\Program Files\Java\jre7\bin\java.exe C:\Windows\system32\xcopy.exe
PID 1424 wrote to memory of 1752 N/A C:\Windows\system32\java.exe C:\Windows\system32\cmd.exe
PID 1424 wrote to memory of 1752 N/A C:\Windows\system32\java.exe C:\Windows\system32\cmd.exe
PID 1424 wrote to memory of 1752 N/A C:\Windows\system32\java.exe C:\Windows\system32\cmd.exe
PID 1424 wrote to memory of 1164 N/A C:\Windows\system32\java.exe C:\Windows\system32\reg.exe
PID 1424 wrote to memory of 1164 N/A C:\Windows\system32\java.exe C:\Windows\system32\reg.exe
PID 1424 wrote to memory of 1164 N/A C:\Windows\system32\java.exe C:\Windows\system32\reg.exe
PID 1424 wrote to memory of 1364 N/A C:\Windows\system32\java.exe C:\Windows\system32\attrib.exe
PID 1424 wrote to memory of 1364 N/A C:\Windows\system32\java.exe C:\Windows\system32\attrib.exe
PID 1424 wrote to memory of 1364 N/A C:\Windows\system32\java.exe C:\Windows\system32\attrib.exe
PID 1424 wrote to memory of 1596 N/A C:\Windows\system32\java.exe C:\Windows\system32\attrib.exe
PID 1424 wrote to memory of 1596 N/A C:\Windows\system32\java.exe C:\Windows\system32\attrib.exe
PID 1424 wrote to memory of 1596 N/A C:\Windows\system32\java.exe C:\Windows\system32\attrib.exe
PID 1424 wrote to memory of 1860 N/A C:\Windows\system32\java.exe C:\Program Files\Java\jre7\bin\javaw.exe
PID 1424 wrote to memory of 1860 N/A C:\Windows\system32\java.exe C:\Program Files\Java\jre7\bin\javaw.exe
PID 1424 wrote to memory of 1860 N/A C:\Windows\system32\java.exe C:\Program Files\Java\jre7\bin\javaw.exe
PID 1860 wrote to memory of 2040 N/A C:\Program Files\Java\jre7\bin\javaw.exe C:\Program Files\Java\jre7\bin\java.exe
PID 1860 wrote to memory of 2040 N/A C:\Program Files\Java\jre7\bin\javaw.exe C:\Program Files\Java\jre7\bin\java.exe
PID 1860 wrote to memory of 2040 N/A C:\Program Files\Java\jre7\bin\javaw.exe C:\Program Files\Java\jre7\bin\java.exe
PID 1824 wrote to memory of 1468 N/A C:\Program Files\Java\jre7\bin\java.exe C:\Windows\system32\cmd.exe
PID 1824 wrote to memory of 1468 N/A C:\Program Files\Java\jre7\bin\java.exe C:\Windows\system32\cmd.exe
PID 1824 wrote to memory of 1468 N/A C:\Program Files\Java\jre7\bin\java.exe C:\Windows\system32\cmd.exe
PID 1860 wrote to memory of 1140 N/A C:\Program Files\Java\jre7\bin\javaw.exe C:\Windows\system32\cmd.exe
PID 1860 wrote to memory of 1140 N/A C:\Program Files\Java\jre7\bin\javaw.exe C:\Windows\system32\cmd.exe
PID 1860 wrote to memory of 1140 N/A C:\Program Files\Java\jre7\bin\javaw.exe C:\Windows\system32\cmd.exe
PID 2040 wrote to memory of 1056 N/A C:\Program Files\Java\jre7\bin\java.exe C:\Windows\system32\cmd.exe
PID 2040 wrote to memory of 1056 N/A C:\Program Files\Java\jre7\bin\java.exe C:\Windows\system32\cmd.exe
PID 2040 wrote to memory of 1056 N/A C:\Program Files\Java\jre7\bin\java.exe C:\Windows\system32\cmd.exe
PID 1140 wrote to memory of 1828 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cscript.exe
PID 1140 wrote to memory of 1828 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cscript.exe
PID 1140 wrote to memory of 1828 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cscript.exe
PID 1056 wrote to memory of 848 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cscript.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\attrib.exe N/A
N/A N/A C:\Windows\system32\attrib.exe N/A

Processes

C:\Windows\system32\java.exe

java -jar C:\Users\Admin\AppData\Local\Temp\46764152b08a2e9b996e894101e9b35df0bfa396bc1b3d2c9e80bf11c20ac79d.jar

C:\Program Files\Java\jre7\bin\java.exe

"C:\Program Files\Java\jre7\bin\java.exe" -jar C:\Users\Admin\AppData\Local\Temp\_0.71355141887199284146117800043813067.class

C:\Windows\system32\cmd.exe

cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive8135259803513095097.vbs

C:\Windows\system32\cmd.exe

cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive1169614437845464271.vbs

C:\Windows\system32\cscript.exe

cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive1169614437845464271.vbs

C:\Windows\system32\cscript.exe

cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive8135259803513095097.vbs

C:\Windows\system32\cscript.exe

cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive4495731531425884498.vbs

C:\Windows\system32\cmd.exe

cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive4495731531425884498.vbs

C:\Windows\system32\cmd.exe

cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive6898650587981789820.vbs

C:\Windows\system32\cscript.exe

cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive6898650587981789820.vbs

C:\Windows\system32\xcopy.exe

xcopy "C:\Program Files\Java\jre7" "C:\Users\Admin\AppData\Roaming\Oracle\" /e

C:\Windows\system32\xcopy.exe

xcopy "C:\Program Files\Java\jre7" "C:\Users\Admin\AppData\Roaming\Oracle\" /e

C:\Windows\system32\cmd.exe

cmd.exe

C:\Windows\system32\reg.exe

reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v itHMlsBcwAx /t REG_EXPAND_SZ /d "\"C:\Program Files\Java\jre7\bin\javaw.exe\" -jar \"C:\Users\Admin\uNHvfVunMeX\nhXbldKHvgL.sZCpXv\"" /f

C:\Windows\system32\attrib.exe

attrib +h "C:\Users\Admin\uNHvfVunMeX\*.*"

C:\Program Files\Java\jre7\bin\javaw.exe

"C:\Program Files\Java\jre7\bin\javaw.exe" -jar C:\Users\Admin\uNHvfVunMeX\nhXbldKHvgL.sZCpXv

C:\Windows\system32\attrib.exe

attrib +h "C:\Users\Admin\uNHvfVunMeX"

C:\Program Files\Java\jre7\bin\java.exe

"C:\Program Files\Java\jre7\bin\java.exe" -jar C:\Users\Admin\AppData\Local\Temp\_0.195436675474993668318850293763681028.class

C:\Windows\system32\cmd.exe

cmd.exe

C:\Windows\system32\cmd.exe

cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive3841709961062363217.vbs

C:\Windows\system32\cscript.exe

cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive3841709961062363217.vbs

C:\Windows\system32\cscript.exe

cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive4922660633233919627.vbs

C:\Windows\system32\cmd.exe

cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive4922660633233919627.vbs

C:\Windows\system32\cscript.exe

cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive6754387851043198437.vbs

C:\Windows\system32\cmd.exe

cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive6754387851043198437.vbs

C:\Windows\system32\cmd.exe

cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive8926421296972262748.vbs

C:\Windows\system32\cscript.exe

cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive8926421296972262748.vbs

C:\Windows\system32\cmd.exe

cmd.exe

C:\Windows\system32\cmd.exe

cmd.exe

Network

Country Destination Domain Proto
N/A 127.0.0.1:7777 tcp
N/A 127.0.0.1:7777 tcp
N/A 127.0.0.1:7777 tcp
N/A 127.0.0.1:7777 tcp
N/A 127.0.0.1:7777 tcp
BG 185.206.144.99:1030 tcp
N/A 127.0.0.1:7777 tcp
N/A 127.0.0.1:7777 tcp
N/A 127.0.0.1:7777 tcp
N/A 127.0.0.1:7777 tcp
N/A 127.0.0.1:7777 tcp
N/A 127.0.0.1:7777 tcp
N/A 127.0.0.1:7777 tcp
N/A 127.0.0.1:7777 tcp
N/A 127.0.0.1:7777 tcp
BG 185.206.144.99:1040 tcp
N/A 127.0.0.1:7777 tcp
N/A 127.0.0.1:7777 tcp
N/A 127.0.0.1:7777 tcp
N/A 127.0.0.1:7777 tcp
N/A 127.0.0.1:7777 tcp
N/A 127.0.0.1:7777 tcp
N/A 127.0.0.1:7777 tcp
N/A 127.0.0.1:7777 tcp

Files

memory/1424-54-0x000007FEFBD21000-0x000007FEFBD23000-memory.dmp

memory/1424-61-0x0000000002160000-0x0000000005160000-memory.dmp

memory/1824-65-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\_0.71355141887199284146117800043813067.class

MD5 781fb531354d6f291f1ccab48da6d39f
SHA1 9ce4518ebcb5be6d1f0b5477fa00c26860fe9a68
SHA256 97d585b6aff62fb4e43e7e6a5f816dcd7a14be11a88b109a9ba9e8cd4c456eb9
SHA512 3e6630f5feb4a3eb1dac7e9125ce14b1a2a45d7415cf44cea42bc51b2a9aa37169ee4a4c36c888c8f2696e7d6e298e2ad7b2f4c22868aaa5948210eb7db220d8

memory/1824-77-0x0000000002170000-0x0000000005170000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1083475884-596052423-1669053738-1000\83aa4cc77f591dfc2374580bbd95f6ba_206ac020-9434-4197-af4e-48c8ff9cae6c

MD5 c8366ae350e7019aefc9d1e6e6a498c6
SHA1 5731d8a3e6568a5f2dfbbc87e3db9637df280b61
SHA256 11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238
SHA512 33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd

memory/932-81-0x0000000000000000-mapping.dmp

memory/1084-82-0x0000000000000000-mapping.dmp

memory/1748-83-0x0000000000000000-mapping.dmp

memory/292-84-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\Retrive8135259803513095097.vbs

MD5 3bdfd33017806b85949b6faa7d4b98e4
SHA1 f92844fee69ef98db6e68931adfaa9a0a0f8ce66
SHA256 9da575dd2d5b7c1e9bab8b51a16cde457b3371c6dcdb0537356cf1497fa868f6
SHA512 ae5e5686ae71edef53e71cd842cb6799e4383b9c238a5c361b81647efa128d2fedf3bf464997771b5b0c47a058fecae7829aeedcd098c80a11008581e5781429

C:\Users\Admin\AppData\Local\Temp\Retrive1169614437845464271.vbs

MD5 3bdfd33017806b85949b6faa7d4b98e4
SHA1 f92844fee69ef98db6e68931adfaa9a0a0f8ce66
SHA256 9da575dd2d5b7c1e9bab8b51a16cde457b3371c6dcdb0537356cf1497fa868f6
SHA512 ae5e5686ae71edef53e71cd842cb6799e4383b9c238a5c361b81647efa128d2fedf3bf464997771b5b0c47a058fecae7829aeedcd098c80a11008581e5781429

memory/1568-87-0x0000000000000000-mapping.dmp

memory/1572-89-0x0000000000000000-mapping.dmp

memory/576-88-0x0000000000000000-mapping.dmp

memory/1856-90-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\Retrive4495731531425884498.vbs

MD5 a32c109297ed1ca155598cd295c26611
SHA1 dc4a1fdbaad15ddd6fe22d3907c6b03727b71510
SHA256 45bfe34aa3ef932f75101246eb53d032f5e7cf6d1f5b4e495334955a255f32e7
SHA512 70372552dc86fe02ece9fe3b7721463f80be07a34126b2c75b41e30078cda9e90744c7d644df623f63d4fb985482e345b3351c4d3da873162152c67fc6ecc887

C:\Users\Admin\AppData\Local\Temp\Retrive6898650587981789820.vbs

MD5 a32c109297ed1ca155598cd295c26611
SHA1 dc4a1fdbaad15ddd6fe22d3907c6b03727b71510
SHA256 45bfe34aa3ef932f75101246eb53d032f5e7cf6d1f5b4e495334955a255f32e7
SHA512 70372552dc86fe02ece9fe3b7721463f80be07a34126b2c75b41e30078cda9e90744c7d644df623f63d4fb985482e345b3351c4d3da873162152c67fc6ecc887

memory/2004-93-0x0000000000000000-mapping.dmp

memory/384-94-0x0000000000000000-mapping.dmp

memory/1752-95-0x0000000000000000-mapping.dmp

memory/1424-96-0x0000000002160000-0x0000000005160000-memory.dmp

memory/1164-97-0x0000000000000000-mapping.dmp

memory/1364-98-0x0000000000000000-mapping.dmp

memory/1860-100-0x0000000000000000-mapping.dmp

C:\Users\Admin\uNHvfVunMeX\nhXbldKHvgL.sZCpXv

MD5 291f0f05bf663ceec6441542fe13f8ce
SHA1 b1da41305a483d6a0e038d49e78153bbfc28f12b
SHA256 46764152b08a2e9b996e894101e9b35df0bfa396bc1b3d2c9e80bf11c20ac79d
SHA512 7b0196432cb43817f24f29f7fb6d0a4a37fbc19d67654b76e51e9a6579b8e1e0121eaf2b7d1d4302b6aa02f55865e67b3c6964d90faed227ed7540674340e89d

C:\Users\Admin\uNHvfVunMeX\ID.txt

MD5 aa63ea6f7e3a2038036fa6091771c360
SHA1 c19d472ffb09573f2fa4ae2a0e8bbdc068a34cde
SHA256 120e1f0e062a3209b48fa00655ad4406ee11325d58eaad546c7e6ee22108c288
SHA512 2795b780ac4e00f8ddfcb30263f8937f2ed160b28dc7a09efdaeea1d41fd69e9a1f06441e1449f7338f8a51e902389df2ebd3aa88f6b29fd7a371112c4d3928d

memory/1596-99-0x0000000000000000-mapping.dmp

memory/1860-113-0x00000000021A0000-0x00000000051A0000-memory.dmp

memory/2040-114-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\_0.195436675474993668318850293763681028.class

MD5 781fb531354d6f291f1ccab48da6d39f
SHA1 9ce4518ebcb5be6d1f0b5477fa00c26860fe9a68
SHA256 97d585b6aff62fb4e43e7e6a5f816dcd7a14be11a88b109a9ba9e8cd4c456eb9
SHA512 3e6630f5feb4a3eb1dac7e9125ce14b1a2a45d7415cf44cea42bc51b2a9aa37169ee4a4c36c888c8f2696e7d6e298e2ad7b2f4c22868aaa5948210eb7db220d8

C:\Windows\System32\test.txt

MD5 c4b4ab68d4cdc52a2de6775d22445cc7
SHA1 d04277f72306fee0eef7fbe2a4c1b7ffbf2159ae
SHA256 9eb6677a7b99883072e3ed2cf0c453b640c0c77b13d4e15a89968ee0fae3e8d4
SHA512 f4198fdefc787546e35181d60e2ab9de8be97e4aa7aa2aeaf0d1ddefabbb9f0bb15a151fdcd4c14b2da92a4508d3f576f19412690ef254e32051bbcf7716621d

memory/1468-124-0x0000000000000000-mapping.dmp

memory/1824-129-0x0000000002170000-0x0000000005170000-memory.dmp

memory/2040-131-0x0000000002310000-0x0000000005310000-memory.dmp

memory/1056-133-0x0000000000000000-mapping.dmp

memory/1828-134-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\Retrive3841709961062363217.vbs

MD5 3bdfd33017806b85949b6faa7d4b98e4
SHA1 f92844fee69ef98db6e68931adfaa9a0a0f8ce66
SHA256 9da575dd2d5b7c1e9bab8b51a16cde457b3371c6dcdb0537356cf1497fa868f6
SHA512 ae5e5686ae71edef53e71cd842cb6799e4383b9c238a5c361b81647efa128d2fedf3bf464997771b5b0c47a058fecae7829aeedcd098c80a11008581e5781429

memory/848-135-0x0000000000000000-mapping.dmp

memory/1140-132-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\Retrive4922660633233919627.vbs

MD5 3bdfd33017806b85949b6faa7d4b98e4
SHA1 f92844fee69ef98db6e68931adfaa9a0a0f8ce66
SHA256 9da575dd2d5b7c1e9bab8b51a16cde457b3371c6dcdb0537356cf1497fa868f6
SHA512 ae5e5686ae71edef53e71cd842cb6799e4383b9c238a5c361b81647efa128d2fedf3bf464997771b5b0c47a058fecae7829aeedcd098c80a11008581e5781429

memory/1768-138-0x0000000000000000-mapping.dmp

memory/1876-139-0x0000000000000000-mapping.dmp

memory/600-140-0x0000000000000000-mapping.dmp

memory/1456-141-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\Retrive8926421296972262748.vbs

MD5 a32c109297ed1ca155598cd295c26611
SHA1 dc4a1fdbaad15ddd6fe22d3907c6b03727b71510
SHA256 45bfe34aa3ef932f75101246eb53d032f5e7cf6d1f5b4e495334955a255f32e7
SHA512 70372552dc86fe02ece9fe3b7721463f80be07a34126b2c75b41e30078cda9e90744c7d644df623f63d4fb985482e345b3351c4d3da873162152c67fc6ecc887

memory/1732-145-0x0000000000000000-mapping.dmp

C:\Windows\System32\test.txt

MD5 179e78245cd14a7fbee0a211a585bffc
SHA1 f504d46be167ac74ff2335a5bf35ac1ba59e034a
SHA256 60a1a1963726ae2b71455034c04edd0e0ee778ccf5a18411c4a4582d9bdad824
SHA512 1fec366e3d40cb6e1939faff5b66a220e9053802077920388b7771d7667d0e72810f9120450f313fc10796a84fba112240b86fcf372505830c8da4a82d4db568

C:\Users\Admin\AppData\Local\Temp\Retrive6754387851043198437.vbs

MD5 a32c109297ed1ca155598cd295c26611
SHA1 dc4a1fdbaad15ddd6fe22d3907c6b03727b71510
SHA256 45bfe34aa3ef932f75101246eb53d032f5e7cf6d1f5b4e495334955a255f32e7
SHA512 70372552dc86fe02ece9fe3b7721463f80be07a34126b2c75b41e30078cda9e90744c7d644df623f63d4fb985482e345b3351c4d3da873162152c67fc6ecc887

C:\Users\Admin\fUTkALeaTxM\ID.txt

MD5 0fc47114e1e06a087d55ef8f5b413843
SHA1 d4285f61731c88d9dfd5e57ff04fccec43cbbc22
SHA256 2675298ae1180af24cf3e093936c9fdf463d185338e82a7c98654b42cdd8fbf5
SHA512 d36b932db50ab543433b22c5825051b18204bea836959d0438df5afd9cdd16d7ecf236be2c7fba7a9ad440d0901948fc6767ab2b9b81492328a2c65a1218a9c4

C:\Windows\System32\test.txt

MD5 0d3b0ce5f13895c73c22ae49a74b7e80
SHA1 68e9c46f6643e5288472f404a8c165ff8d881a10
SHA256 5329a4f3651fe45dfa86a94c298c4335bff87da441ce75b478ea01e23a9de280
SHA512 368e25a98a14b9519568fbfe6754e0c78c0501d8f57fe2128c9edb3c7f30132ace95a8d66afe5d2802d5630158935cc7312ec0682f68c52b90c82fd971010ed8

memory/384-148-0x0000000000000000-mapping.dmp

memory/1860-150-0x00000000021A0000-0x00000000051A0000-memory.dmp

memory/2040-151-0x0000000002310000-0x0000000005310000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-07-07 08:42

Reported

2022-07-07 09:01

Platform

win10v2004-20220414-en

Max time kernel

37s

Max time network

162s

Command Line

java -jar C:\Users\Admin\AppData\Local\Temp\46764152b08a2e9b996e894101e9b35df0bfa396bc1b3d2c9e80bf11c20ac79d.jar

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3176 wrote to memory of 5064 N/A C:\ProgramData\Oracle\Java\javapath\java.exe C:\Program Files\Java\jre1.8.0_66\bin\java.exe
PID 3176 wrote to memory of 5064 N/A C:\ProgramData\Oracle\Java\javapath\java.exe C:\Program Files\Java\jre1.8.0_66\bin\java.exe

Processes

C:\ProgramData\Oracle\Java\javapath\java.exe

java -jar C:\Users\Admin\AppData\Local\Temp\46764152b08a2e9b996e894101e9b35df0bfa396bc1b3d2c9e80bf11c20ac79d.jar

C:\Program Files\Java\jre1.8.0_66\bin\java.exe

"C:\Program Files\Java\jre1.8.0_66\bin\java.exe" -jar C:\Users\Admin\AppData\Local\Temp\_0.76151981562086247036341053613251019.class

Network

Country Destination Domain Proto
US 93.184.220.29:80 tcp
US 93.184.220.29:80 tcp
NL 52.178.17.2:443 tcp
US 52.152.108.96:443 tcp
US 93.184.220.29:80 tcp
US 8.8.8.8:53 96.108.152.52.in-addr.arpa udp
US 8.8.8.8:53 2.8.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.4.0.c.0.0.3.0.1.3.0.6.2.ip6.arpa udp

Files

memory/3176-134-0x0000000002FB0000-0x0000000003FB0000-memory.dmp

memory/3176-145-0x0000000002FB0000-0x0000000003FB0000-memory.dmp

memory/3176-146-0x0000000002FB0000-0x0000000003FB0000-memory.dmp

memory/3176-147-0x0000000002FB0000-0x0000000003FB0000-memory.dmp

memory/3176-148-0x0000000002FB0000-0x0000000003FB0000-memory.dmp

memory/3176-149-0x0000000002FB0000-0x0000000003FB0000-memory.dmp

memory/5064-150-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\_0.76151981562086247036341053613251019.class

MD5 781fb531354d6f291f1ccab48da6d39f
SHA1 9ce4518ebcb5be6d1f0b5477fa00c26860fe9a68
SHA256 97d585b6aff62fb4e43e7e6a5f816dcd7a14be11a88b109a9ba9e8cd4c456eb9
SHA512 3e6630f5feb4a3eb1dac7e9125ce14b1a2a45d7415cf44cea42bc51b2a9aa37169ee4a4c36c888c8f2696e7d6e298e2ad7b2f4c22868aaa5948210eb7db220d8

C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp

MD5 93f58075ffd7e5f483e12ddcdb8dc673
SHA1 796729ac27b64435e037f6e86980236b200adf57
SHA256 8b37538c3abde330de762fb7c2aa018cd3fc0180ff4eda538c16e918ab614419
SHA512 101ba97a3cec56a42587efe4b25684465a0ce9ef204777c9c37a02bef95c597c34eb8a39dc66aa8801ec013317c819d9a82c27d84aeb4e63374cff1f9d1cd691

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2632097139-1792035885-811742494-1000\83aa4cc77f591dfc2374580bbd95f6ba_2c37a701-1043-4f89-b4d1-d05ed25c6971

MD5 c8366ae350e7019aefc9d1e6e6a498c6
SHA1 5731d8a3e6568a5f2dfbbc87e3db9637df280b61
SHA256 11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238
SHA512 33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd

memory/3176-165-0x0000000002FB0000-0x0000000003FB0000-memory.dmp