adwind | a3818fe2ec28a2ef49afa34e57e840a691b1634e1d60d75645f710000fa160a9

Analysis

max time kernel
39s
max time network
69s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28/10/2022, 17:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a3818fe2ec28a2ef49afa34e57e840a691b1634e1d60d75645f710000fa160a9.js
Size 904KB
Sample221028-vvn96agbd5
SHA256 a3818fe2ec28a2ef49afa34e57e840a691b1634e1d60d75645f710000fa160a9
MD5 f9b753b61d526b2c5e4da6c6963c612b
SHA1 07bfd7a05e728b31338eedede09abd568e2f45fa
SHA512 401aec9c65ce6869282402429826b88252035764644a0c52af2dae78ae53980c7dd69b833491a5e1a37670250552046679a3ee450bf4ccd768aca109f2dece49
SSDEEP 12288:GRvFj7VCV2xYES5knAN5VBbB6UmAki8Ln+YtphwB9aJoHaZM0QAQ92+uApomkpQ5:W9jprS5Zrb0/i8LTu9aJekb6v4Qn2o
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

adwind vjw0rm trojan worm

Malware Config

Signatures

AdWind
A Java-based RAT family operated as malware-as-a-service.
trojan adwind
Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm

Blocklisted process makes network request 2 IoCs

flow	pid	Process
11	1360	WScript.exe
24	1360	WScript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	wscript.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tnbpoqxlYB.js	WScript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tnbpoqxlYB.js	WScript.exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\dll\ntdll.pdb	java.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	wscript.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2016	javaw.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1580 wrote to memory of 1360	1580	wscript.exe	83
PID 1580 wrote to memory of 1360	1580	wscript.exe	83
PID 1580 wrote to memory of 2016	1580	wscript.exe	84
PID 1580 wrote to memory of 2016	1580	wscript.exe	84
PID 2016 wrote to memory of 212	2016	javaw.exe	85
PID 2016 wrote to memory of 212	2016	javaw.exe	85
PID 2016 wrote to memory of 2476	2016	javaw.exe	87
PID 2016 wrote to memory of 2476	2016	javaw.exe	87
PID 2476 wrote to memory of 3724	2476	cmd.exe	90
PID 2476 wrote to memory of 3724	2476	cmd.exe	90
PID 2016 wrote to memory of 2664	2016	javaw.exe	91
PID 2016 wrote to memory of 2664	2016	javaw.exe	91
PID 2664 wrote to memory of 4568	2664	cmd.exe	93
PID 2664 wrote to memory of 4568	2664	cmd.exe	93

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\a3818fe2ec28a2ef49afa34e57e840a691b1634e1d60d75645f710000fa160a9.js
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1580
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\tnbpoqxlYB.js"
  2⤵
  - Blocklisted process makes network request
  - Drops startup file
  PID:1360
- C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
  "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\ntppdtf.txt"
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2016
- - C:\Program Files\Java\jre1.8.0_66\bin\java.exe
    "C:\Program Files\Java\jre1.8.0_66\bin\java.exe" -jar C:\Users\Admin\AppData\Local\Temp\_0.55353055004240345229166111290197724.class
    3⤵
    - Drops file in Program Files directory
    PID:212
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive6370629037498227656.vbs
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2476
  - - C:\Windows\system32\cscript.exe
      cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive6370629037498227656.vbs
      4⤵
      PID:3724
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive7985542135233575966.vbs
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2664
  - - C:\Windows\system32\cscript.exe
      cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive7985542135233575966.vbs
      4⤵
      PID:4568
- - C:\Windows\SYSTEM32\xcopy.exe
    xcopy "C:\Program Files\Java\jre1.8.0_66" "C:\Users\Admin\AppData\Roaming\Oracle\" /e
    3⤵
    PID:1568
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe
    3⤵
    PID:3212

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

90737d32e3aba4b.timestamp

Path C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp
Size 50B
SHA256 ff4bde16ffb53a36f3ae00e50809eaff16895c1dac19f7bc8ba5aef4dd06deae
MD5 1e5bd6ed64f8217c95b67f630a6274c8
SHA1 75fea56c4a47d0d641abb41f8ae1dd49d9a2fffe
SHA512 056a5773816450a04b93a9bd7626f6666a6b2f7ee0b9ee325e862a0d3f265405655659c463d51f2eac1fa960de72c10113e384e2a3010fbda45158f7a8a39920
MD5 SHA1 SHA512

Submit Download

Retrive6370629037498227656.vbs

Path C:\Users\Admin\AppData\Local\Temp\Retrive6370629037498227656.vbs
Size 276B
SHA256 9da575dd2d5b7c1e9bab8b51a16cde457b3371c6dcdb0537356cf1497fa868f6
MD5 3bdfd33017806b85949b6faa7d4b98e4
SHA1 f92844fee69ef98db6e68931adfaa9a0a0f8ce66
SHA512 ae5e5686ae71edef53e71cd842cb6799e4383b9c238a5c361b81647efa128d2fedf3bf464997771b5b0c47a058fecae7829aeedcd098c80a11008581e5781429
MD5 SHA1 SHA512

Submit Download

Retrive7985542135233575966.vbs

Path C:\Users\Admin\AppData\Local\Temp\Retrive7985542135233575966.vbs
Size 281B
SHA256 45bfe34aa3ef932f75101246eb53d032f5e7cf6d1f5b4e495334955a255f32e7
MD5 a32c109297ed1ca155598cd295c26611
SHA1 dc4a1fdbaad15ddd6fe22d3907c6b03727b71510
SHA512 70372552dc86fe02ece9fe3b7721463f80be07a34126b2c75b41e30078cda9e90744c7d644df623f63d4fb985482e345b3351c4d3da873162152c67fc6ecc887
MD5 SHA1 SHA512

Submit Download

_0.55353055004240345229166111290197724.class

Path C:\Users\Admin\AppData\Local\Temp\_0.55353055004240345229166111290197724.class
Size 241KB
SHA256 97d585b6aff62fb4e43e7e6a5f816dcd7a14be11a88b109a9ba9e8cd4c456eb9
MD5 781fb531354d6f291f1ccab48da6d39f
SHA1 9ce4518ebcb5be6d1f0b5477fa00c26860fe9a68
SHA512 3e6630f5feb4a3eb1dac7e9125ce14b1a2a45d7415cf44cea42bc51b2a9aa37169ee4a4c36c888c8f2696e7d6e298e2ad7b2f4c22868aaa5948210eb7db220d8
SSDEEP 6144:WI5pxUZ7Gvi8ulm+yV/rIF0/MO2qnan1J7pXESN6U:J5pxAGqNkrIq/MO2qnA
MD5 SHA1 SHA512 SSDEEP

Submit Download

83aa4cc77f591dfc2374580bbd95f6ba_e32e1c79-b88e-4709-94fb-81034ca3398e

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2629973501-4017243118-3254762364-1000\83aa4cc77f591dfc2374580bbd95f6ba_e32e1c79-b88e-4709-94fb-81034ca3398e
Size 45B
SHA256 11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238
MD5 c8366ae350e7019aefc9d1e6e6a498c6
SHA1 5731d8a3e6568a5f2dfbbc87e3db9637df280b61
SHA512 33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd
MD5 SHA1 SHA512

Submit Download

ntppdtf.txt

Path C:\Users\Admin\AppData\Roaming\ntppdtf.txt
Size 479KB
SHA256 24b6a6a2e8134ed55d008528282623f1638796a77a0a09ce247eeb70a9b89940
MD5 59eaba8d0cda7d59640941d009a3fac1
SHA1 77bd699e98ec857534d39f8a9f1348ffa16e5ecb
SHA512 27da85107431e02a61edc95518e90e6875b7fe3c5e01bcbd7e3e523e0c63ee93db31f04e3ad608285c72e22a88c080ce97919b73f25c19892a2527e21d6fa20a
SSDEEP 6144:VbrWWquHNtP76Nmm6xDsft6yTDjw+I5pxUb7gvY8ulmcCV/hIl0/0c2qna3PJ7pZ:NrtummlfsyTXK5pxogQNUhIK/0c2qnAN
MD5 SHA1 SHA512 SSDEEP

Submit Download

tnbpoqxlYB.js

Path C:\Users\Admin\AppData\Roaming\tnbpoqxlYB.js
Size 6KB
SHA256 ff40200e9ec8bb540275b45fe264d6c3cf501e3ae906293305a014afecabfd37
MD5 7a008021141e5afb53b0d95dac1b2d4d
SHA1 9b075f2e1161f228c012536f7795ac0e53a49688
SHA512 94ddb6172393205629f33d188f13433830cc827f388cd0103d844dfe5bae832f22a43756c8837413d4d04a3ff94f8fd9775a816ebeaa3b070d0fc44e7c4e0bf6
SSDEEP 96:QlAJ1wd1HdK1xfoqJJKRW5EfouR26rU9717M18jaUUsYjK3BdAiQauD71XgfC3kV:QlA4L9AtJMfA7O18jaUUsxA3pFkV
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/212-158-0x0000000003160000-0x0000000004160000-memory.dmp

Download

memory/2016-171-0x0000000002F60000-0x0000000003F60000-memory.dmp

Download

memory/2016-177-0x0000000002F60000-0x0000000003F60000-memory.dmp

Download

memory/2016-140-0x0000000002F60000-0x0000000003F60000-memory.dmp

Download

memory/2016-179-0x0000000002F60000-0x0000000003F60000-memory.dmp

Download

memory/2016-181-0x0000000002F60000-0x0000000003F60000-memory.dmp

Download

memory/2016-183-0x0000000002F60000-0x0000000003F60000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads