adwind | 7a02319dbd8e5fc7c9bc6c6377d44856229c5fbaa206b78493803a4e5a2c531d

General

Target
7a02319dbd8e5fc7c9bc6c6377d44856229c5fbaa206b78493803a4e5a2c531d.jar
Size 62KB
Sample221029-bv9fjsfbe7
SHA256 7a02319dbd8e5fc7c9bc6c6377d44856229c5fbaa206b78493803a4e5a2c531d
MD5 d9b6c899f8112a40131865f73e1ea9c9
SHA1 194e24c21f616aba91b10c9b108c22a6bdf5c497
SHA512 08548b4e90ecbb334388991faa34adea79110ce21db1054a99d284d8e476c456db8f38f27dcaf394829e43978082081ea459654b508611a86a84b5ab53afa111
SSDEEP 1536:tFaDYQKV+r8TWnf0yL84UFE0YcmF15RFA3ep/NN/wz8:tXQKVu8TWfWL1YFPbAkNlwA
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

adwind evasion persistence trojan

Malware Config

Signatures

AdWind
A Java-based RAT family operated as malware-as-a-service.
trojan adwind

JAR file contains resources related to AdWind 1 IoCs

This JAR file potentially contains loader stubs used by the AdWind RAT.

resource	yara_rule
behavioral2/files/0x0004000000022e49-147.dat	family_adwind_stub

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1158

pid	Process
3572	attrib.exe
3556	attrib.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\asdasdasd = "\"C:\\Program Files\\Java\\jre1.8.0_66\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\asdasd\\asda.jar\""	reg.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\asdasdasd = "\"C:\\Program Files\\Java\\jre1.8.0_66\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\asdasd\\asda.jar\""	reg.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\asdasd\Desktop.ini	java.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\asdasd\Desktop.ini	attrib.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
2844	reg.exe
3596	reg.exe
1396	reg.exe
3260	reg.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5020	java.exe
3152	javaw.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 5020 wrote to memory of 1396	5020	java.exe	84
PID 5020 wrote to memory of 1396	5020	java.exe	84
PID 5020 wrote to memory of 3260	5020	java.exe	86
PID 5020 wrote to memory of 3260	5020	java.exe	86
PID 5020 wrote to memory of 3572	5020	java.exe	88
PID 5020 wrote to memory of 3572	5020	java.exe	88
PID 5020 wrote to memory of 3556	5020	java.exe	89
PID 5020 wrote to memory of 3556	5020	java.exe	89
PID 5020 wrote to memory of 3152	5020	java.exe	91
PID 5020 wrote to memory of 3152	5020	java.exe	91
PID 3152 wrote to memory of 2844	3152	javaw.exe	93
PID 3152 wrote to memory of 2844	3152	javaw.exe	93
PID 3152 wrote to memory of 3596	3152	javaw.exe	95
PID 3152 wrote to memory of 3596	3152	javaw.exe	95
PID 3152 wrote to memory of 4640	3152	javaw.exe	97
PID 3152 wrote to memory of 4640	3152	javaw.exe	97

Views/modifies file attributes 1 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
3572	attrib.exe
3556	attrib.exe
4640	attrib.exe

C:\ProgramData\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\7a02319dbd8e5fc7c9bc6c6377d44856229c5fbaa206b78493803a4e5a2c531d.jar
1⤵
- Drops desktop.ini file(s)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5020
- C:\Windows\SYSTEM32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v asdasdasd /t REG_SZ /d "\"C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe\" -jar \"C:\Users\Admin\AppData\Roaming\asdasd\asda.jar\"" /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:1396
- C:\Windows\SYSTEM32\reg.exe
  reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v asdasdasd /f
  2⤵
  - Modifies registry key
  PID:3260
- C:\Windows\SYSTEM32\attrib.exe
  attrib +s +h +r "C:\Users\Admin\AppData\Roaming\asdasd\*.*"
  2⤵
  - Sets file to hidden
  - Drops desktop.ini file(s)
  - Views/modifies file attributes
  PID:3572
- C:\Windows\SYSTEM32\attrib.exe
  attrib +s +h +r "C:\Users\Admin\AppData\Roaming\asdasd"
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:3556
- C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
  "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\asdasd\asda.jar"
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3152
- - C:\Windows\SYSTEM32\reg.exe
    reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v asdasdasd /t REG_SZ /d "\"C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe\" -jar \"C:\Users\Admin\AppData\Roaming\asdasd\asda.jar\"" /f
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:2844
- - C:\Windows\SYSTEM32\reg.exe
    reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v asdasdasd /f
    3⤵
    - Modifies registry key
    PID:3596
- - C:\Windows\SYSTEM32\attrib.exe
    attrib +H C:\Users\Admin\.Plugins3
    3⤵
    - Views/modifies file attributes
    PID:4640

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

2

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

90737d32e3aba4b.timestamp

Path C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp
Size 50B
SHA256 c370312e7a14bf8a51574005d480769bcd3888506b7eb550aeb52d029bb74eca
MD5 bd9ac14bceada73341ec4d732ee8a86b
SHA1 d2c8f5fb20346a13df60f51cb02a2a8d10af0746
SHA512 d90333c715a66ae8d8c144a838df058ab189236ef3b20cbe3f4b13d7145f4298bc98acd5badd828dadb0f6130d56be3d6ea2ca480a5899c05dc56ed8b31951b5
MD5 SHA1 SHA512

Submit Download

Desktop.ini

Path C:\Users\Admin\AppData\Roaming\asdasd\Desktop.ini
Size 63B
SHA256 2f65fa9c7ed712f493782abf91467f869419a2f8b5adf23b44019c08190fa3f3
MD5 e783bdd20a976eaeaae1ff4624487420
SHA1 c2a44fab9df00b3e11582546b16612333c2f9286
SHA512 8c883678e4625ef44f4885b8c6d7485196774f9cb0b9eee7dd18711749bcae474163df9965effcd13ecd1a33cd7265010c152f8504d6013e4f4d85d68a901a80
MD5 SHA1 SHA512

Submit Download

asda.jar

Path C:\Users\Admin\AppData\Roaming\asdasd\asda.jar
Size 62KB
SHA256 7a02319dbd8e5fc7c9bc6c6377d44856229c5fbaa206b78493803a4e5a2c531d
MD5 d9b6c899f8112a40131865f73e1ea9c9
SHA1 194e24c21f616aba91b10c9b108c22a6bdf5c497
SHA512 08548b4e90ecbb334388991faa34adea79110ce21db1054a99d284d8e476c456db8f38f27dcaf394829e43978082081ea459654b508611a86a84b5ab53afa111
SSDEEP 1536:tFaDYQKV+r8TWnf0yL84UFE0YcmF15RFA3ep/NN/wz8:tXQKVu8TWfWL1YFPbAkNlwA
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3152-159-0x0000000002FD0000-0x0000000003FD0000-memory.dmp

Download

memory/3152-165-0x0000000002FD0000-0x0000000003FD0000-memory.dmp

Download

memory/5020-136-0x0000000002B70000-0x0000000003B70000-memory.dmp

Download

memory/5020-164-0x0000000002B70000-0x0000000003B70000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads