adwind | 51972cdfbac717c54e61ac7d6a8c4aecf08882cc7b8312926d1fed0819a4f032

Analysis

max time kernel
45s
max time network
83s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/10/2022, 16:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
51972cdfbac717c54e61ac7d6a8c4aecf08882cc7b8312926d1fed0819a4f032.jar
Size 628KB
Sample221019-vazv6agfdr
SHA256 51972cdfbac717c54e61ac7d6a8c4aecf08882cc7b8312926d1fed0819a4f032
MD5 47372205fdddbb3876b74d3a45ffe9f7
SHA1 9cd8805ceee8a34f26f42bdc3774b64b094dcf6e
SHA512 8fdce25c620e2c564af682218ccce36a9afe746cd2568a79b79cd43631c67fb5a4658079ae39ea8ac18c3d324b86f1bbd7b7bbead909e2fb53747a2f4651ae32
SSDEEP 12288:jRhpMaetWhLAo1HV4T3ZRpyrrPYAF/VcWQ2VpMxk/4OAqSRAH:3pFetzo1HuDZRpyHPYsVd9Vp5SRW
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

adwind vjw0rm trojan worm

Malware Config

Signatures

AdWind
A Java-based RAT family operated as malware-as-a-service.
trojan adwind
Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm

Blocklisted process makes network request 1 IoCs

flow	pid	Process
17	4320	WScript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	wscript.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sKRKHAWFXl.js	WScript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sKRKHAWFXl.js	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	wscript.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3348	javaw.exe
3092	java.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 2128	1748	java.exe	83
PID 1748 wrote to memory of 2128	1748	java.exe	83
PID 2128 wrote to memory of 4320	2128	wscript.exe	84
PID 2128 wrote to memory of 4320	2128	wscript.exe	84
PID 2128 wrote to memory of 3348	2128	wscript.exe	85
PID 2128 wrote to memory of 3348	2128	wscript.exe	85
PID 3348 wrote to memory of 3092	3348	javaw.exe	86
PID 3348 wrote to memory of 3092	3348	javaw.exe	86
PID 3092 wrote to memory of 3516	3092	java.exe	89
PID 3092 wrote to memory of 3516	3092	java.exe	89
PID 3348 wrote to memory of 580	3348	javaw.exe	90
PID 3348 wrote to memory of 580	3348	javaw.exe	90
PID 580 wrote to memory of 4812	580	cmd.exe	93
PID 580 wrote to memory of 4812	580	cmd.exe	93
PID 3516 wrote to memory of 4892	3516	cmd.exe	94
PID 3516 wrote to memory of 4892	3516	cmd.exe	94

C:\ProgramData\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\51972cdfbac717c54e61ac7d6a8c4aecf08882cc7b8312926d1fed0819a4f032.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Windows\SYSTEM32\wscript.exe
  wscript C:\Users\Admin\zxlxuisuth.js
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2128
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\sKRKHAWFXl.js"
    3⤵
    - Blocklisted process makes network request
    - Drops startup file
    PID:4320
- - C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
    "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\oalidkicmk.txt"
    3⤵
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3348
  - - C:\Program Files\Java\jre1.8.0_66\bin\java.exe
      "C:\Program Files\Java\jre1.8.0_66\bin\java.exe" -jar C:\Users\Admin\AppData\Local\Temp\_0.5416766773625051938608954734814843.class
      4⤵
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3092
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive2042429161477410507.vbs
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3516
      - C:\Windows\system32\cscript.exe
        
        cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive2042429161477410507.vbs
        6⤵
        
        PID:4892
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive7066039210547909682.vbs
        5⤵
        
        PID:4224
      - C:\Windows\system32\cscript.exe
        
        cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive7066039210547909682.vbs
        6⤵
        
        PID:2332
    - - C:\Windows\SYSTEM32\xcopy.exe
        
        xcopy "C:\Program Files\Java\jre1.8.0_66" "C:\Users\Admin\AppData\Roaming\Oracle\" /e
        5⤵
        
        PID:2720
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive8510697921114441242.vbs
      4⤵
      Suspicious use of WriteProcessMemory
      PID:580
    - - C:\Windows\system32\cscript.exe
        
        cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive8510697921114441242.vbs
        5⤵
        
        PID:4812
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive39406086277375755.vbs
      4⤵
      PID:1800
    - - C:\Windows\system32\cscript.exe
        
        cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive39406086277375755.vbs
        5⤵
        
        PID:3628
  - - C:\Windows\SYSTEM32\xcopy.exe
      xcopy "C:\Program Files\Java\jre1.8.0_66" "C:\Users\Admin\AppData\Roaming\Oracle\" /e
      4⤵
      PID:2172

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

90737d32e3aba4b.timestamp

Path C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp
Size 50B
SHA256 b2a330b1bfcf85356ebffb233ee9eecba05d8ce288f03a45b0d3d1c257f94d87
MD5 e856aa78e0b230bd88c8e10b745a229a
SHA1 9475d374c0c5d80c6c1d6ece0f9570676193ac05
SHA512 22fbbcbd76e4ad4d73aff3790bec4bca6c5040ddb0348e29e0561ecefb23ec9d08361603c7e0fcad20d8f7f6a635431434a1e2004bc6de476d5272ba89abcaaf
MD5 SHA1 SHA512

Submit Download

90737d32e3aba4b.timestamp

Path C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp
Size 50B
SHA256 6b30ca4c79dd09631b4edd8057f562c829db61127384e5a0cbf1d921685a3303
MD5 2a3b5a0294703608d8f00efed984cda7
SHA1 92c745bcb3223bd8c4a8071e62b4e30a1b8392f5
SHA512 35f56f33c8993bd3e7c350334d4f805cfbc828846271c7d925e8c2a5cf7124edce7f55aad89e1910a266b248df9b14a64a4b59b614114af812d4387c34cd8862
MD5 SHA1 SHA512

Submit Download

Retrive2042429161477410507.vbs

Path C:\Users\Admin\AppData\Local\Temp\Retrive2042429161477410507.vbs
Size 276B
SHA256 9da575dd2d5b7c1e9bab8b51a16cde457b3371c6dcdb0537356cf1497fa868f6
MD5 3bdfd33017806b85949b6faa7d4b98e4
SHA1 f92844fee69ef98db6e68931adfaa9a0a0f8ce66
SHA512 ae5e5686ae71edef53e71cd842cb6799e4383b9c238a5c361b81647efa128d2fedf3bf464997771b5b0c47a058fecae7829aeedcd098c80a11008581e5781429
MD5 SHA1 SHA512

Submit Download

Retrive39406086277375755.vbs

Path C:\Users\Admin\AppData\Local\Temp\Retrive39406086277375755.vbs
Size 281B
SHA256 45bfe34aa3ef932f75101246eb53d032f5e7cf6d1f5b4e495334955a255f32e7
MD5 a32c109297ed1ca155598cd295c26611
SHA1 dc4a1fdbaad15ddd6fe22d3907c6b03727b71510
SHA512 70372552dc86fe02ece9fe3b7721463f80be07a34126b2c75b41e30078cda9e90744c7d644df623f63d4fb985482e345b3351c4d3da873162152c67fc6ecc887
MD5 SHA1 SHA512

Submit Download

Retrive7066039210547909682.vbs

Path C:\Users\Admin\AppData\Local\Temp\Retrive7066039210547909682.vbs
Size 281B
SHA256 45bfe34aa3ef932f75101246eb53d032f5e7cf6d1f5b4e495334955a255f32e7
MD5 a32c109297ed1ca155598cd295c26611
SHA1 dc4a1fdbaad15ddd6fe22d3907c6b03727b71510
SHA512 70372552dc86fe02ece9fe3b7721463f80be07a34126b2c75b41e30078cda9e90744c7d644df623f63d4fb985482e345b3351c4d3da873162152c67fc6ecc887
MD5 SHA1 SHA512

Submit Download

Retrive8510697921114441242.vbs

Path C:\Users\Admin\AppData\Local\Temp\Retrive8510697921114441242.vbs
Size 276B
SHA256 9da575dd2d5b7c1e9bab8b51a16cde457b3371c6dcdb0537356cf1497fa868f6
MD5 3bdfd33017806b85949b6faa7d4b98e4
SHA1 f92844fee69ef98db6e68931adfaa9a0a0f8ce66
SHA512 ae5e5686ae71edef53e71cd842cb6799e4383b9c238a5c361b81647efa128d2fedf3bf464997771b5b0c47a058fecae7829aeedcd098c80a11008581e5781429
MD5 SHA1 SHA512

Submit Download

_0.5416766773625051938608954734814843.class

Path C:\Users\Admin\AppData\Local\Temp\_0.5416766773625051938608954734814843.class
Size 241KB
SHA256 97d585b6aff62fb4e43e7e6a5f816dcd7a14be11a88b109a9ba9e8cd4c456eb9
MD5 781fb531354d6f291f1ccab48da6d39f
SHA1 9ce4518ebcb5be6d1f0b5477fa00c26860fe9a68
SHA512 3e6630f5feb4a3eb1dac7e9125ce14b1a2a45d7415cf44cea42bc51b2a9aa37169ee4a4c36c888c8f2696e7d6e298e2ad7b2f4c22868aaa5948210eb7db220d8
SSDEEP 6144:WI5pxUZ7Gvi8ulm+yV/rIF0/MO2qnan1J7pXESN6U:J5pxAGqNkrIq/MO2qnA
MD5 SHA1 SHA512 SSDEEP

Submit Download

83aa4cc77f591dfc2374580bbd95f6ba_e32e1c79-b88e-4709-94fb-81034ca3398e

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2629973501-4017243118-3254762364-1000\83aa4cc77f591dfc2374580bbd95f6ba_e32e1c79-b88e-4709-94fb-81034ca3398e
Size 45B
SHA256 11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238
MD5 c8366ae350e7019aefc9d1e6e6a498c6
SHA1 5731d8a3e6568a5f2dfbbc87e3db9637df280b61
SHA512 33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd
MD5 SHA1 SHA512

Submit Download

oalidkicmk.txt

Path C:\Users\Admin\AppData\Roaming\oalidkicmk.txt
Size 479KB
SHA256 54b9e5a81f02ba69a79fd6128eb72ef81d798bbab4005c2c050a68698bfa7a3c
MD5 e42d71e4eb16e1f66b74eaa1227727ce
SHA1 702aed8a2e3488d29e5f3b1864bc873ed29f6b47
SHA512 d1645485863b0455bc12d4c5a1f17dcba11648a15cee1fc0ea34f3c6b8529c095f765e162f5734ef60ba744320d23fb934dda8d477380c43f6612a98531f9bf9
SSDEEP 12288:kcweFlPoKHUqPrwfxlD5pxogQNUhIK/0c2qnAn:kcwejrHtz2xjsS7B2qnU
MD5 SHA1 SHA512 SSDEEP

Submit Download

sKRKHAWFXl.js

Path C:\Users\Admin\AppData\Roaming\sKRKHAWFXl.js
Size 9KB
SHA256 95a3ac7d19d1f6bc8f3bec39ad271c856ec4a4f6993f21801c18419df536a353
MD5 fa9a7a5a75ba42ef2ac32de2cf007f38
SHA1 ca01307c6404967ffb10561a99b752bcdde9c50c
SHA512 9b49c985c31687bcb37d29a33ae2c2948b77ef11d7fa8fec882e2f9739974476aff32cb6eab9a40197b22142a49606d7e6c2eb9cba4e0ebd0aefa8b826fac0d5
SSDEEP 192:Im6Vzg5y/GHr7Q1wLe8sJoJCk9WbbqsLk/8tdYPIVZnLoit+:Ego/I7QRLJJbGOkodYPITnLoio
MD5 SHA1 SHA512 SSDEEP

Submit Download

zxlxuisuth.js

Path C:\Users\Admin\zxlxuisuth.js
Size 911KB
SHA256 0e4d33ae86c881e0b841e9480e572b73bf4e9c3094305d6c1a01e013e05a0873
MD5 28ecf4d7083d907caf763580d0e28638
SHA1 63e535ec14d6cc1c8e6a209ebe7648762fcafad2
SHA512 eec7b4a74747970cc139c2be4780fa0604415bb39bd41fb7543cd1b2e554e7bd36d8c094810a36f06e91b410b9a3054e1d824f39f4d96440674ba3a10a68a708
SSDEEP 12288:SIXM1ErIbi/nNPNOflGWTlXhME0ZjvAyT600O8lh6DaAeHfZpQfGsEH5w3JbzOAF:pXMqui/N6lXzWAye00vlhsKBhsHaG
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1748-141-0x0000000003470000-0x0000000004470000-memory.dmp

Download

memory/3092-172-0x0000000002E70000-0x0000000003E70000-memory.dmp

Download

memory/3092-189-0x0000000002E70000-0x0000000003E70000-memory.dmp

Download

memory/3092-203-0x0000000002E70000-0x0000000003E70000-memory.dmp

Download

memory/3348-159-0x0000000002A90000-0x0000000003A90000-memory.dmp

Download

memory/3348-194-0x0000000002A90000-0x0000000003A90000-memory.dmp

Download

memory/3348-197-0x0000000002A90000-0x0000000003A90000-memory.dmp

Download

memory/3348-180-0x0000000002A90000-0x0000000003A90000-memory.dmp

Download

memory/3348-162-0x0000000002A90000-0x0000000003A90000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads