Analysis

  • max time kernel
    58s
  • max time network
    31s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    16-12-2022 07:55

General

  • Target

    Payment Swift.jar

  • Size

    631KB

  • MD5

    a610242a0b3b54cab36a82c544194359

  • SHA1

    757ad55aca925ae83146400d27468ef2ff1f6bc6

  • SHA256

    ebb080655706287f25fa86d155d27265594051b40325fa72bb9bffc89f2ef6d9

  • SHA512

    27cbca2372bef04f2f6d4ebbc7e4ff95dccf47fe9aa3fcd7864018ef0143c0a738e148a47da69d8f1320282479165818f082e81a8b75996b6a9cede9789d8a7d

  • SSDEEP

    12288:X0vtjud9VUl9NeSMjTG7KGB6jB4S3PnGoDzKFT6Xss/Aq4DIup:X0ljy9VYeSsmKm6N4WnGo/mc/P48A

Malware Config

Signatures

  • AdWind

    A Java-based RAT family operated as malware-as-a-service.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 5 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 54 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs

Processes

  • C:\Windows\system32\java.exe
    java -jar "C:\Users\Admin\AppData\Local\Temp\Payment Swift.jar"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2044
    • C:\Windows\system32\wscript.exe
      wscript C:\Users\Admin\jkmwpmerza.js
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:320
      • C:\Program Files\Java\jre7\bin\javaw.exe
        "C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\owecdeoqqd.txt"
        3⤵
        • Loads dropped DLL
        • Drops file in System32 directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1400
        • C:\Program Files\Java\jre7\bin\java.exe
          "C:\Program Files\Java\jre7\bin\java.exe" -jar C:\Users\Admin\AppData\Local\Temp\_0.74671067809216818695675441026346267.class
          4⤵
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1532
          • C:\Windows\system32\cmd.exe
            cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive4094559531361707748.vbs
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1592
            • C:\Windows\system32\cscript.exe
              cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive4094559531361707748.vbs
              6⤵
                PID:1756
            • C:\Windows\system32\cmd.exe
              cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive4127116403960697975.vbs
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:268
              • C:\Windows\system32\cscript.exe
                cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive4127116403960697975.vbs
                6⤵
                  PID:1112
              • C:\Windows\system32\xcopy.exe
                xcopy "C:\Program Files\Java\jre7" "C:\Users\Admin\AppData\Roaming\Oracle\" /e
                5⤵
                  PID:852
              • C:\Windows\system32\cmd.exe
                cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive5355799146908432959.vbs
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:1360
                • C:\Windows\system32\cscript.exe
                  cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive5355799146908432959.vbs
                  5⤵
                    PID:1156
                • C:\Windows\system32\cmd.exe
                  cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive3993667689917920958.vbs
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1980
                  • C:\Windows\system32\cscript.exe
                    cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive3993667689917920958.vbs
                    5⤵
                      PID:2028
                  • C:\Windows\system32\xcopy.exe
                    xcopy "C:\Program Files\Java\jre7" "C:\Users\Admin\AppData\Roaming\Oracle\" /e
                    4⤵
                      PID:584
                    • C:\Windows\system32\cmd.exe
                      cmd.exe
                      4⤵
                        PID:1860
                      • C:\Windows\system32\reg.exe
                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v lMpweJSGDjr /t REG_EXPAND_SZ /d "\"C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe\" -jar \"C:\Users\Admin\JVlpBjOuqsQ\.jar.Bttolj\"" /f
                        4⤵
                        • Adds Run key to start application
                        • Modifies registry key
                        PID:1312
                      • C:\Windows\system32\attrib.exe
                        attrib +h "C:\Users\Admin\JVlpBjOuqsQ\*.*"
                        4⤵
                        • Views/modifies file attributes
                        PID:1524
                      • C:\Windows\system32\attrib.exe
                        attrib +h "C:\Users\Admin\JVlpBjOuqsQ"
                        4⤵
                        • Views/modifies file attributes
                        PID:1920
                      • C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe
                        C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe -jar C:\Users\Admin\JVlpBjOuqsQ\.jar.Bttolj
                        4⤵
                        • Executes dropped EXE
                        PID:1072

                Network

                MITRE ATT&CK Enterprise v6

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Temp\Retrive3993667689917920958.vbs

                  Filesize

                  281B

                  MD5

                  a32c109297ed1ca155598cd295c26611

                  SHA1

                  dc4a1fdbaad15ddd6fe22d3907c6b03727b71510

                  SHA256

                  45bfe34aa3ef932f75101246eb53d032f5e7cf6d1f5b4e495334955a255f32e7

                  SHA512

                  70372552dc86fe02ece9fe3b7721463f80be07a34126b2c75b41e30078cda9e90744c7d644df623f63d4fb985482e345b3351c4d3da873162152c67fc6ecc887

                • C:\Users\Admin\AppData\Local\Temp\Retrive4094559531361707748.vbs

                  Filesize

                  276B

                  MD5

                  3bdfd33017806b85949b6faa7d4b98e4

                  SHA1

                  f92844fee69ef98db6e68931adfaa9a0a0f8ce66

                  SHA256

                  9da575dd2d5b7c1e9bab8b51a16cde457b3371c6dcdb0537356cf1497fa868f6

                  SHA512

                  ae5e5686ae71edef53e71cd842cb6799e4383b9c238a5c361b81647efa128d2fedf3bf464997771b5b0c47a058fecae7829aeedcd098c80a11008581e5781429

                • C:\Users\Admin\AppData\Local\Temp\Retrive4127116403960697975.vbs

                  Filesize

                  281B

                  MD5

                  a32c109297ed1ca155598cd295c26611

                  SHA1

                  dc4a1fdbaad15ddd6fe22d3907c6b03727b71510

                  SHA256

                  45bfe34aa3ef932f75101246eb53d032f5e7cf6d1f5b4e495334955a255f32e7

                  SHA512

                  70372552dc86fe02ece9fe3b7721463f80be07a34126b2c75b41e30078cda9e90744c7d644df623f63d4fb985482e345b3351c4d3da873162152c67fc6ecc887

                • C:\Users\Admin\AppData\Local\Temp\Retrive5355799146908432959.vbs

                  Filesize

                  276B

                  MD5

                  3bdfd33017806b85949b6faa7d4b98e4

                  SHA1

                  f92844fee69ef98db6e68931adfaa9a0a0f8ce66

                  SHA256

                  9da575dd2d5b7c1e9bab8b51a16cde457b3371c6dcdb0537356cf1497fa868f6

                  SHA512

                  ae5e5686ae71edef53e71cd842cb6799e4383b9c238a5c361b81647efa128d2fedf3bf464997771b5b0c47a058fecae7829aeedcd098c80a11008581e5781429

                • C:\Users\Admin\AppData\Local\Temp\_0.74671067809216818695675441026346267.class

                  Filesize

                  241KB

                  MD5

                  781fb531354d6f291f1ccab48da6d39f

                  SHA1

                  9ce4518ebcb5be6d1f0b5477fa00c26860fe9a68

                  SHA256

                  97d585b6aff62fb4e43e7e6a5f816dcd7a14be11a88b109a9ba9e8cd4c456eb9

                  SHA512

                  3e6630f5feb4a3eb1dac7e9125ce14b1a2a45d7415cf44cea42bc51b2a9aa37169ee4a4c36c888c8f2696e7d6e298e2ad7b2f4c22868aaa5948210eb7db220d8

                • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3385717845-2518323428-350143044-1000\83aa4cc77f591dfc2374580bbd95f6ba_dae2938e-27ce-4a80-bf74-6da89b87415b

                  Filesize

                  45B

                  MD5

                  c8366ae350e7019aefc9d1e6e6a498c6

                  SHA1

                  5731d8a3e6568a5f2dfbbc87e3db9637df280b61

                  SHA256

                  11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238

                  SHA512

                  33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd

                • C:\Users\Admin\AppData\Roaming\Oracle\bin\java.dll

                  Filesize

                  148KB

                  MD5

                  ae42860afe3a2843efa9849263bd0c21

                  SHA1

                  1df534b0ee936b8d5446490dc48f326f64547ff6

                  SHA256

                  f8d4f05526d9700346cedd556649ad786ac2d1e21c0d669ddddb980e6b44414d

                  SHA512

                  c34f92de61236ccd5d8ebd4212ef87ee44ef23897e172023b9e859fe530b0e9d6e864620aa99cc5b1506b2c6327d12ac9ec2f7afafd646115a92b4537ffc4ca9

                • C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe

                  Filesize

                  185KB

                  MD5

                  846245142683adc04baf77c6e29063db

                  SHA1

                  6a1b06baf85419b7345520d78ee416ce06747473

                  SHA256

                  c860377e71c0bae6821f9083123f55974a549e2c57ff50cec572d18ed06f2d6c

                  SHA512

                  e0a7c9d9da3d062245718bb54553170857f647798308e4e28e5b5fbf3ac2a0496cf55bfc7a7663810113cf71807923bb365b27652a12c106e1908a89ec12cbaa

                • C:\Users\Admin\AppData\Roaming\owecdeoqqd.txt

                  Filesize

                  473KB

                  MD5

                  6737bfe4fcbd42c5c2523f9a2c1e2bd0

                  SHA1

                  2717a70cd27e1efa7a7cc133859c23165c690546

                  SHA256

                  e7205e4ac04d9429510d0afa66acc703cf20fd608b19b8202e9a211dae6a4214

                  SHA512

                  62a752a5a5af6dcc9643b29fe72a2f64704d4bf780ab0c80707c82691b6ed8ff762aaf353703402d40d0df0c0966fc5ce3377a17ceafc7a2c7c5eee7051a2209

                • C:\Users\Admin\JVlpBjOuqsQ\.jar.Bttolj

                  Filesize

                  473KB

                  MD5

                  6737bfe4fcbd42c5c2523f9a2c1e2bd0

                  SHA1

                  2717a70cd27e1efa7a7cc133859c23165c690546

                  SHA256

                  e7205e4ac04d9429510d0afa66acc703cf20fd608b19b8202e9a211dae6a4214

                  SHA512

                  62a752a5a5af6dcc9643b29fe72a2f64704d4bf780ab0c80707c82691b6ed8ff762aaf353703402d40d0df0c0966fc5ce3377a17ceafc7a2c7c5eee7051a2209

                • C:\Users\Admin\JVlpBjOuqsQ\ID.txt

                  Filesize

                  47B

                  MD5

                  6dd9aa31079ea260e1c37a62f4d7c00d

                  SHA1

                  f96fbe41a6e7029226fb38ebef0ef95bfad5e8bb

                  SHA256

                  7b8669c4ab91d2fec2232346414437f9d0368fd2741b5ea4ef9480d1ded194c4

                  SHA512

                  5f510cec58c572839f6cb20e13890e8de29ddc88ce111f02e6c836e014745745cdf61f6d4f94078170dd7f8f2faf0e6a90fcd12f7234ec188e72ded1c920ca8a

                • C:\Users\Admin\jkmwpmerza.js

                  Filesize

                  976KB

                  MD5

                  475d259a768146b6794815b8dbcbbc76

                  SHA1

                  7dc0ecb338d4e0ab37921e72d70a87e7dc7e55b0

                  SHA256

                  0315d00f0ba6540860aff75b9ef7564cd115c28281a5e2c4db8c3622f411448d

                  SHA512

                  c8479be0eee6bcdcff336940e4b1eaf482d910ef3afca73432f8ac16c948178082f5a3417d5baaec61e7aac30c67c82f3b79770b34beb4eb3ccd164761d109c2

                • \Users\Admin\AppData\Roaming\Oracle\bin\java.dll

                  Filesize

                  148KB

                  MD5

                  ae42860afe3a2843efa9849263bd0c21

                  SHA1

                  1df534b0ee936b8d5446490dc48f326f64547ff6

                  SHA256

                  f8d4f05526d9700346cedd556649ad786ac2d1e21c0d669ddddb980e6b44414d

                  SHA512

                  c34f92de61236ccd5d8ebd4212ef87ee44ef23897e172023b9e859fe530b0e9d6e864620aa99cc5b1506b2c6327d12ac9ec2f7afafd646115a92b4537ffc4ca9

                • \Users\Admin\AppData\Roaming\Oracle\bin\java.dll

                  Filesize

                  148KB

                  MD5

                  ae42860afe3a2843efa9849263bd0c21

                  SHA1

                  1df534b0ee936b8d5446490dc48f326f64547ff6

                  SHA256

                  f8d4f05526d9700346cedd556649ad786ac2d1e21c0d669ddddb980e6b44414d

                  SHA512

                  c34f92de61236ccd5d8ebd4212ef87ee44ef23897e172023b9e859fe530b0e9d6e864620aa99cc5b1506b2c6327d12ac9ec2f7afafd646115a92b4537ffc4ca9

                • \Users\Admin\AppData\Roaming\Oracle\bin\java.dll

                  Filesize

                  148KB

                  MD5

                  ae42860afe3a2843efa9849263bd0c21

                  SHA1

                  1df534b0ee936b8d5446490dc48f326f64547ff6

                  SHA256

                  f8d4f05526d9700346cedd556649ad786ac2d1e21c0d669ddddb980e6b44414d

                  SHA512

                  c34f92de61236ccd5d8ebd4212ef87ee44ef23897e172023b9e859fe530b0e9d6e864620aa99cc5b1506b2c6327d12ac9ec2f7afafd646115a92b4537ffc4ca9

                • \Users\Admin\AppData\Roaming\Oracle\bin\java.dll

                  Filesize

                  148KB

                  MD5

                  ae42860afe3a2843efa9849263bd0c21

                  SHA1

                  1df534b0ee936b8d5446490dc48f326f64547ff6

                  SHA256

                  f8d4f05526d9700346cedd556649ad786ac2d1e21c0d669ddddb980e6b44414d

                  SHA512

                  c34f92de61236ccd5d8ebd4212ef87ee44ef23897e172023b9e859fe530b0e9d6e864620aa99cc5b1506b2c6327d12ac9ec2f7afafd646115a92b4537ffc4ca9

                • \Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe

                  Filesize

                  185KB

                  MD5

                  846245142683adc04baf77c6e29063db

                  SHA1

                  6a1b06baf85419b7345520d78ee416ce06747473

                  SHA256

                  c860377e71c0bae6821f9083123f55974a549e2c57ff50cec572d18ed06f2d6c

                  SHA512

                  e0a7c9d9da3d062245718bb54553170857f647798308e4e28e5b5fbf3ac2a0496cf55bfc7a7663810113cf71807923bb365b27652a12c106e1908a89ec12cbaa

                • memory/268-106-0x0000000000000000-mapping.dmp

                • memory/320-65-0x0000000000000000-mapping.dmp

                • memory/584-107-0x0000000000000000-mapping.dmp

                • memory/852-110-0x0000000000000000-mapping.dmp

                • memory/1072-119-0x0000000000000000-mapping.dmp

                • memory/1112-108-0x0000000000000000-mapping.dmp

                • memory/1156-98-0x0000000000000000-mapping.dmp

                • memory/1312-112-0x0000000000000000-mapping.dmp

                • memory/1360-97-0x0000000000000000-mapping.dmp

                • memory/1400-81-0x0000000002180000-0x0000000005180000-memory.dmp

                  Filesize

                  48.0MB

                • memory/1400-69-0x0000000000000000-mapping.dmp

                • memory/1400-126-0x0000000002180000-0x0000000005180000-memory.dmp

                  Filesize

                  48.0MB

                • memory/1524-113-0x0000000000000000-mapping.dmp

                • memory/1532-82-0x0000000000000000-mapping.dmp

                • memory/1532-94-0x0000000002150000-0x0000000005150000-memory.dmp

                  Filesize

                  48.0MB

                • memory/1532-127-0x0000000002150000-0x0000000005150000-memory.dmp

                  Filesize

                  48.0MB

                • memory/1592-102-0x0000000000000000-mapping.dmp

                • memory/1756-103-0x0000000000000000-mapping.dmp

                • memory/1860-111-0x0000000000000000-mapping.dmp

                • memory/1920-114-0x0000000000000000-mapping.dmp

                • memory/1980-100-0x0000000000000000-mapping.dmp

                • memory/2028-101-0x0000000000000000-mapping.dmp

                • memory/2044-54-0x000007FEFC1B1000-0x000007FEFC1B3000-memory.dmp

                  Filesize

                  8KB

                • memory/2044-64-0x00000000021C0000-0x00000000051C0000-memory.dmp

                  Filesize

                  48.0MB