adwind | a175d061fa3d3a6263d165c7f95261ac69d464bb744ca789a9c005abad8d026d

General

Target

a175d061fa3d3a6263d165c7f95261ac69d464bb744ca789a9c005abad8d026d.jar
Size

62KB
MD5

115902df0ff3992041223e42adb10e8b
SHA1

f8acdddddd88089357be77788355b2377ee9e6f5
SHA256

a175d061fa3d3a6263d165c7f95261ac69d464bb744ca789a9c005abad8d026d
SHA512

fa9da64b5eeebbc51d097657e016492f001befacc6f7b54b4ef0548ced1603dfbfc80873d2880dd1058aef5bd4f52874d32b1cd5dc96ad2524fe6ea583a906ae
SSDEEP

1536:WxvJQnmTJxrYolc/4aAi6s1kV6Y99mJ4f6fZwle:W5JQnmTP3lc/4qPKyfZwle

Score

10^/10

adwind evasion persistence trojan

Malware Config

Signatures

AdWind
A Java-based RAT family operated as malware-as-a-service.
trojan adwind

JAR file contains resources related to AdWind 1 IoCs

This JAR file potentially contains loader stubs used by the AdWind RAT.

resource	yara_rule
behavioral2/files/0x0002000000022de6-148.dat	family_adwind_stub

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1158

pid	Process
744	attrib.exe
1296	attrib.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Java Update = "\"C:\\Program Files\\Java\\jre1.8.0_66\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\Java Update\\Java Update.jar\""	reg.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Java Update = "\"C:\\Program Files\\Java\\jre1.8.0_66\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\Java Update\\Java Update.jar\""	reg.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Java Update\Desktop.ini	java.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Java Update\Desktop.ini	attrib.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
1384	reg.exe
4496	reg.exe
4948	reg.exe
2792	reg.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1804	java.exe
2376	javaw.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1804 wrote to memory of 1384	1804	java.exe	84
PID 1804 wrote to memory of 1384	1804	java.exe	84
PID 1804 wrote to memory of 4496	1804	java.exe	86
PID 1804 wrote to memory of 4496	1804	java.exe	86
PID 1804 wrote to memory of 744	1804	java.exe	88
PID 1804 wrote to memory of 744	1804	java.exe	88
PID 1804 wrote to memory of 1296	1804	java.exe	89
PID 1804 wrote to memory of 1296	1804	java.exe	89
PID 1804 wrote to memory of 2376	1804	java.exe	92
PID 1804 wrote to memory of 2376	1804	java.exe	92
PID 2376 wrote to memory of 4948	2376	javaw.exe	95
PID 2376 wrote to memory of 4948	2376	javaw.exe	95
PID 2376 wrote to memory of 2792	2376	javaw.exe	97
PID 2376 wrote to memory of 2792	2376	javaw.exe	97
PID 2376 wrote to memory of 1144	2376	javaw.exe	99
PID 2376 wrote to memory of 1144	2376	javaw.exe	99

Views/modifies file attributes 1 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
744	attrib.exe
1296	attrib.exe
1144	attrib.exe

C:\ProgramData\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\a175d061fa3d3a6263d165c7f95261ac69d464bb744ca789a9c005abad8d026d.jar
1⤵
- Drops desktop.ini file(s)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1804
- C:\Windows\SYSTEM32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "Java Update" /t REG_SZ /d "\"C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe\" -jar \"C:\Users\Admin\AppData\Roaming\Java Update\Java Update.jar\"" /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:1384
- C:\Windows\SYSTEM32\reg.exe
  reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "Java Update" /f
  2⤵
  - Modifies registry key
  PID:4496
- C:\Windows\SYSTEM32\attrib.exe
  attrib +s +h +r "C:\Users\Admin\AppData\Roaming\Java Update\*.*"
  2⤵
  - Sets file to hidden
  - Drops desktop.ini file(s)
  - Views/modifies file attributes
  PID:744
- C:\Windows\SYSTEM32\attrib.exe
  attrib +s +h +r "C:\Users\Admin\AppData\Roaming\Java Update"
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:1296
- C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
  "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\Java Update\Java Update.jar"
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2376
- - C:\Windows\SYSTEM32\reg.exe
    reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "Java Update" /t REG_SZ /d "\"C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe\" -jar \"C:\Users\Admin\AppData\Roaming\Java Update\Java Update.jar\"" /f
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:4948
- - C:\Windows\SYSTEM32\reg.exe
    reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "Java Update" /f
    3⤵
    - Modifies registry key
    PID:2792
- - C:\Windows\SYSTEM32\attrib.exe
    attrib +H "C:\Users\Admin\.Java Update"
    3⤵
    - Views/modifies file attributes
    PID:1144

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

2

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp

Filesize
50B

MD5
f370eeebb18900ed0132acde7f9fcdc2

SHA1
332f7be7e6073a409e817eb1d925f6f534da5924

SHA256
5658f570b94627fc42677f6388e7c13e25cc13d7dc79cf7359e7cab3996f7155

SHA512
a399ffce27d66bb48c8f842b568aeb6dec99dd5868188c084c9ae605fb0c689590aa72dfee3785aa4cef0beac239069d9dad3170e2460e9ca0573b596c960158

Download Submit
C:\Users\Admin\AppData\Roaming\Java Update\Desktop.ini

Filesize
63B

MD5
e783bdd20a976eaeaae1ff4624487420

SHA1
c2a44fab9df00b3e11582546b16612333c2f9286

SHA256
2f65fa9c7ed712f493782abf91467f869419a2f8b5adf23b44019c08190fa3f3

SHA512
8c883678e4625ef44f4885b8c6d7485196774f9cb0b9eee7dd18711749bcae474163df9965effcd13ecd1a33cd7265010c152f8504d6013e4f4d85d68a901a80

Download Submit
C:\Users\Admin\AppData\Roaming\Java Update\Java Update.jar

Filesize
62KB

MD5
115902df0ff3992041223e42adb10e8b

SHA1
f8acdddddd88089357be77788355b2377ee9e6f5

SHA256
a175d061fa3d3a6263d165c7f95261ac69d464bb744ca789a9c005abad8d026d

SHA512
fa9da64b5eeebbc51d097657e016492f001befacc6f7b54b4ef0548ced1603dfbfc80873d2880dd1058aef5bd4f52874d32b1cd5dc96ad2524fe6ea583a906ae

Download Submit
memory/1804-137-0x0000000003250000-0x0000000004250000-memory.dmp

Filesize
16.0MB

Download
memory/1804-165-0x0000000003250000-0x0000000004250000-memory.dmp

Filesize
16.0MB

Download
memory/2376-160-0x0000000002F80000-0x0000000003F80000-memory.dmp

Filesize
16.0MB

Download
memory/2376-166-0x0000000002F80000-0x0000000003F80000-memory.dmp

Filesize
16.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads