Analysis

  • max time kernel
    73s
  • max time network
    38s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    24-03-2023 01:37

General

  • Target

    b7f46caa4c8a8bdc972cc75781ad43cf8d8436a8640e24b03d34f02560643b70.jar

  • Size

    960KB

  • MD5

    66054f63d4a48886cd03fd7915eed7f6

  • SHA1

    b2024714631ce5dd5ff2e5a45b58b8c689d2c8c5

  • SHA256

    b7f46caa4c8a8bdc972cc75781ad43cf8d8436a8640e24b03d34f02560643b70

  • SHA512

    93b9138588da1aa0501f7498311002ce7ecf96bced09ec2796c64ef0070899246741f83bff1645d5c99e041fe9bc1f483735cb6e96d4527c8f6db7d317c1f3cb

  • SSDEEP

    24576:pSd+wLAE4ZpkJKmUDvWtArQUEqMgSvNriU:lwS39vWaqqMNvNx

Score
10/10

Malware Config

Signatures

  • AdWind

    A Java-based RAT family operated as malware-as-a-service.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Windows\system32\java.exe
    java -jar C:\Users\Admin\AppData\Local\Temp\b7f46caa4c8a8bdc972cc75781ad43cf8d8436a8640e24b03d34f02560643b70.jar
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1160
    • C:\Windows\system32\wscript.exe
      wscript C:\Users\Admin\erdhvdferx.js
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1068
      • C:\Program Files\Java\jre7\bin\javaw.exe
        "C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\bqimmdgghr.txt"
        3⤵
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1596
        • C:\Program Files\Java\jre7\bin\java.exe
          "C:\Program Files\Java\jre7\bin\java.exe" -jar C:\Users\Admin\AppData\Local\Temp\_0.9755262083300703814453161725911943.class
          4⤵
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1640
          • C:\Windows\system32\cmd.exe
            cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive240917199929314811.vbs
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1352
            • C:\Windows\system32\cscript.exe
              cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive240917199929314811.vbs
              6⤵
                PID:1404
            • C:\Windows\system32\cmd.exe
              cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive3636350998794951380.vbs
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:680
              • C:\Windows\system32\cscript.exe
                cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive3636350998794951380.vbs
                6⤵
                  PID:1780
              • C:\Windows\system32\xcopy.exe
                xcopy "C:\Program Files\Java\jre7" "C:\Users\Admin\AppData\Roaming\Oracle\" /e
                5⤵
                  PID:1068

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\Retrive240917199929314811.vbs

          Filesize

          276B

          MD5

          3bdfd33017806b85949b6faa7d4b98e4

          SHA1

          f92844fee69ef98db6e68931adfaa9a0a0f8ce66

          SHA256

          9da575dd2d5b7c1e9bab8b51a16cde457b3371c6dcdb0537356cf1497fa868f6

          SHA512

          ae5e5686ae71edef53e71cd842cb6799e4383b9c238a5c361b81647efa128d2fedf3bf464997771b5b0c47a058fecae7829aeedcd098c80a11008581e5781429

        • C:\Users\Admin\AppData\Local\Temp\Retrive3636350998794951380.vbs

          Filesize

          281B

          MD5

          a32c109297ed1ca155598cd295c26611

          SHA1

          dc4a1fdbaad15ddd6fe22d3907c6b03727b71510

          SHA256

          45bfe34aa3ef932f75101246eb53d032f5e7cf6d1f5b4e495334955a255f32e7

          SHA512

          70372552dc86fe02ece9fe3b7721463f80be07a34126b2c75b41e30078cda9e90744c7d644df623f63d4fb985482e345b3351c4d3da873162152c67fc6ecc887

        • C:\Users\Admin\AppData\Local\Temp\_0.9755262083300703814453161725911943.class

          Filesize

          241KB

          MD5

          781fb531354d6f291f1ccab48da6d39f

          SHA1

          9ce4518ebcb5be6d1f0b5477fa00c26860fe9a68

          SHA256

          97d585b6aff62fb4e43e7e6a5f816dcd7a14be11a88b109a9ba9e8cd4c456eb9

          SHA512

          3e6630f5feb4a3eb1dac7e9125ce14b1a2a45d7415cf44cea42bc51b2a9aa37169ee4a4c36c888c8f2696e7d6e298e2ad7b2f4c22868aaa5948210eb7db220d8

        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1283023626-844874658-3193756055-1000\83aa4cc77f591dfc2374580bbd95f6ba_97ec3239-d8ea-4bc4-8ce8-63e2080cbe23

          Filesize

          45B

          MD5

          c8366ae350e7019aefc9d1e6e6a498c6

          SHA1

          5731d8a3e6568a5f2dfbbc87e3db9637df280b61

          SHA256

          11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238

          SHA512

          33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd

        • C:\Users\Admin\AppData\Roaming\bqimmdgghr.txt

          Filesize

          479KB

          MD5

          60c30fb124adfb6da82bf66a1f784926

          SHA1

          e711e91e84b0d26f305905fde683e1534e1e3980

          SHA256

          83a0a328d4a71e95c6a17cca54ba3ee4ae26a09d10cbdc8f689ad5325a070c80

          SHA512

          37d1e47274293d3710f36137effa6584240e8435ad1d83b59e64656fd09132adc3199e5660665dcdbee4f86f569bb0f905ddbe426dda8ebba3ab0cd1c1700e91

        • C:\Users\Admin\erdhvdferx.js

          Filesize

          4.0MB

          MD5

          dec1e41985af1924c4aed1fa8435f2cb

          SHA1

          73d000d16831db3b98719ec9b0384fb138893d96

          SHA256

          7c52b9f46b624904f71f6cd6e52cbfc63288cac14ccce282daa23d575a988bde

          SHA512

          342f595e5813825e384e6b222a564e1b2caf81107da21ee1c6393aa61ee238c4102fb59f4b9f1660555b390cbc38c173fbccb344fe8c0e82598d9ce458b40a69

        • memory/1160-65-0x0000000000220000-0x0000000000221000-memory.dmp

          Filesize

          4KB

        • memory/1596-86-0x0000000000320000-0x0000000000321000-memory.dmp

          Filesize

          4KB

        • memory/1596-122-0x0000000000320000-0x0000000000321000-memory.dmp

          Filesize

          4KB

        • memory/1596-134-0x0000000000320000-0x0000000000321000-memory.dmp

          Filesize

          4KB

        • memory/1596-138-0x0000000000320000-0x0000000000321000-memory.dmp

          Filesize

          4KB

        • memory/1640-94-0x0000000000230000-0x0000000000231000-memory.dmp

          Filesize

          4KB

        • memory/1640-100-0x0000000000230000-0x0000000000231000-memory.dmp

          Filesize

          4KB

        • memory/1640-103-0x0000000000230000-0x0000000000231000-memory.dmp

          Filesize

          4KB