Analysis Overview
SHA256
476a90ffffa6c1c05916df01b972ed6e895ac55fc5f25e0e5541bf3737a078b4
Threat Level: Known bad
The file 66054f63d4a48886cd03fd7915eed7f6.bin was found to be: Known bad.
Malicious Activity Summary
AdWind
Checks computer location settings
Enumerates physical storage devices
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V6
Analysis: static1
Detonation Overview
Reported
2023-03-24 01:37
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2023-03-24 01:37
Reported
2023-03-24 01:40
Platform
win7-20230220-en
Max time kernel
73s
Max time network
38s
Command Line
Signatures
AdWind
Enumerates physical storage devices
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Java\jre7\bin\java.exe | N/A |
| N/A | N/A | C:\Program Files\Java\jre7\bin\javaw.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Windows\system32\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\b7f46caa4c8a8bdc972cc75781ad43cf8d8436a8640e24b03d34f02560643b70.jar
C:\Windows\system32\wscript.exe
wscript C:\Users\Admin\erdhvdferx.js
C:\Program Files\Java\jre7\bin\javaw.exe
"C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\bqimmdgghr.txt"
C:\Program Files\Java\jre7\bin\java.exe
"C:\Program Files\Java\jre7\bin\java.exe" -jar C:\Users\Admin\AppData\Local\Temp\_0.9755262083300703814453161725911943.class
C:\Windows\system32\cmd.exe
cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive240917199929314811.vbs
C:\Windows\system32\cscript.exe
cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive240917199929314811.vbs
C:\Windows\system32\cmd.exe
cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive3636350998794951380.vbs
C:\Windows\system32\cscript.exe
cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive3636350998794951380.vbs
C:\Windows\system32\xcopy.exe
xcopy "C:\Program Files\Java\jre7" "C:\Users\Admin\AppData\Roaming\Oracle\" /e
Network
Files
memory/1160-65-0x0000000000220000-0x0000000000221000-memory.dmp
C:\Users\Admin\erdhvdferx.js
| MD5 | dec1e41985af1924c4aed1fa8435f2cb |
| SHA1 | 73d000d16831db3b98719ec9b0384fb138893d96 |
| SHA256 | 7c52b9f46b624904f71f6cd6e52cbfc63288cac14ccce282daa23d575a988bde |
| SHA512 | 342f595e5813825e384e6b222a564e1b2caf81107da21ee1c6393aa61ee238c4102fb59f4b9f1660555b390cbc38c173fbccb344fe8c0e82598d9ce458b40a69 |
C:\Users\Admin\AppData\Roaming\bqimmdgghr.txt
| MD5 | 60c30fb124adfb6da82bf66a1f784926 |
| SHA1 | e711e91e84b0d26f305905fde683e1534e1e3980 |
| SHA256 | 83a0a328d4a71e95c6a17cca54ba3ee4ae26a09d10cbdc8f689ad5325a070c80 |
| SHA512 | 37d1e47274293d3710f36137effa6584240e8435ad1d83b59e64656fd09132adc3199e5660665dcdbee4f86f569bb0f905ddbe426dda8ebba3ab0cd1c1700e91 |
C:\Users\Admin\AppData\Local\Temp\_0.9755262083300703814453161725911943.class
| MD5 | 781fb531354d6f291f1ccab48da6d39f |
| SHA1 | 9ce4518ebcb5be6d1f0b5477fa00c26860fe9a68 |
| SHA256 | 97d585b6aff62fb4e43e7e6a5f816dcd7a14be11a88b109a9ba9e8cd4c456eb9 |
| SHA512 | 3e6630f5feb4a3eb1dac7e9125ce14b1a2a45d7415cf44cea42bc51b2a9aa37169ee4a4c36c888c8f2696e7d6e298e2ad7b2f4c22868aaa5948210eb7db220d8 |
memory/1596-86-0x0000000000320000-0x0000000000321000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1283023626-844874658-3193756055-1000\83aa4cc77f591dfc2374580bbd95f6ba_97ec3239-d8ea-4bc4-8ce8-63e2080cbe23
| MD5 | c8366ae350e7019aefc9d1e6e6a498c6 |
| SHA1 | 5731d8a3e6568a5f2dfbbc87e3db9637df280b61 |
| SHA256 | 11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238 |
| SHA512 | 33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd |
memory/1640-94-0x0000000000230000-0x0000000000231000-memory.dmp
memory/1640-100-0x0000000000230000-0x0000000000231000-memory.dmp
memory/1640-103-0x0000000000230000-0x0000000000231000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\Retrive240917199929314811.vbs
| MD5 | 3bdfd33017806b85949b6faa7d4b98e4 |
| SHA1 | f92844fee69ef98db6e68931adfaa9a0a0f8ce66 |
| SHA256 | 9da575dd2d5b7c1e9bab8b51a16cde457b3371c6dcdb0537356cf1497fa868f6 |
| SHA512 | ae5e5686ae71edef53e71cd842cb6799e4383b9c238a5c361b81647efa128d2fedf3bf464997771b5b0c47a058fecae7829aeedcd098c80a11008581e5781429 |
memory/1596-122-0x0000000000320000-0x0000000000321000-memory.dmp
memory/1596-134-0x0000000000320000-0x0000000000321000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\Retrive3636350998794951380.vbs
| MD5 | a32c109297ed1ca155598cd295c26611 |
| SHA1 | dc4a1fdbaad15ddd6fe22d3907c6b03727b71510 |
| SHA256 | 45bfe34aa3ef932f75101246eb53d032f5e7cf6d1f5b4e495334955a255f32e7 |
| SHA512 | 70372552dc86fe02ece9fe3b7721463f80be07a34126b2c75b41e30078cda9e90744c7d644df623f63d4fb985482e345b3351c4d3da873162152c67fc6ecc887 |
memory/1596-138-0x0000000000320000-0x0000000000321000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2023-03-24 01:37
Reported
2023-03-24 01:40
Platform
win10v2004-20230220-en
Max time kernel
152s
Max time network
155s
Command Line
Signatures
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation | C:\Windows\SYSTEM32\wscript.exe | N/A |
Enumerates physical storage devices
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe | N/A |
| N/A | N/A | C:\Program Files\Java\jre1.8.0_66\bin\java.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 4632 wrote to memory of 2680 | N/A | C:\ProgramData\Oracle\Java\javapath\java.exe | C:\Windows\SYSTEM32\wscript.exe |
| PID 4632 wrote to memory of 2680 | N/A | C:\ProgramData\Oracle\Java\javapath\java.exe | C:\Windows\SYSTEM32\wscript.exe |
| PID 2680 wrote to memory of 4968 | N/A | C:\Windows\SYSTEM32\wscript.exe | C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe |
| PID 2680 wrote to memory of 4968 | N/A | C:\Windows\SYSTEM32\wscript.exe | C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe |
| PID 4968 wrote to memory of 1360 | N/A | C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe | C:\Program Files\Java\jre1.8.0_66\bin\java.exe |
| PID 4968 wrote to memory of 1360 | N/A | C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe | C:\Program Files\Java\jre1.8.0_66\bin\java.exe |
Processes
C:\ProgramData\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\b7f46caa4c8a8bdc972cc75781ad43cf8d8436a8640e24b03d34f02560643b70.jar
C:\Windows\SYSTEM32\wscript.exe
wscript C:\Users\Admin\erdhvdferx.js
C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
"C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\nfwdfnq.txt"
C:\Program Files\Java\jre1.8.0_66\bin\java.exe
"C:\Program Files\Java\jre1.8.0_66\bin\java.exe" -jar C:\Users\Admin\AppData\Local\Temp\_0.408462355819950834733559423992243997.class
Network
| Country | Destination | Domain | Proto |
| IE | 20.54.89.15:443 | tcp | |
| US | 8.8.8.8:53 | 210.81.184.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 164.113.223.173.in-addr.arpa | udp |
| US | 117.18.237.29:80 | tcp | |
| US | 8.8.8.8:53 | 217.106.137.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 56.126.166.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 73.31.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 2.36.159.162.in-addr.arpa | udp |
| US | 52.152.110.14:443 | tcp | |
| US | 20.189.173.3:443 | tcp | |
| US | 8.8.8.8:53 | 176.122.125.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 76.38.195.152.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 176.122.125.40.in-addr.arpa | udp |
| US | 117.18.237.29:80 | tcp | |
| US | 209.197.3.8:80 | tcp | |
| US | 8.8.8.8:53 | 73.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 103.169.127.40.in-addr.arpa | udp |
Files
memory/4632-143-0x0000000002990000-0x0000000002991000-memory.dmp
memory/4632-147-0x0000000002990000-0x0000000002991000-memory.dmp
C:\Users\Admin\erdhvdferx.js
| MD5 | dec1e41985af1924c4aed1fa8435f2cb |
| SHA1 | 73d000d16831db3b98719ec9b0384fb138893d96 |
| SHA256 | 7c52b9f46b624904f71f6cd6e52cbfc63288cac14ccce282daa23d575a988bde |
| SHA512 | 342f595e5813825e384e6b222a564e1b2caf81107da21ee1c6393aa61ee238c4102fb59f4b9f1660555b390cbc38c173fbccb344fe8c0e82598d9ce458b40a69 |
C:\Users\Admin\AppData\Roaming\nfwdfnq.txt
| MD5 | 60c30fb124adfb6da82bf66a1f784926 |
| SHA1 | e711e91e84b0d26f305905fde683e1534e1e3980 |
| SHA256 | 83a0a328d4a71e95c6a17cca54ba3ee4ae26a09d10cbdc8f689ad5325a070c80 |
| SHA512 | 37d1e47274293d3710f36137effa6584240e8435ad1d83b59e64656fd09132adc3199e5660665dcdbee4f86f569bb0f905ddbe426dda8ebba3ab0cd1c1700e91 |
C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp
| MD5 | 06c648e2a6477ec7c902e470adab9ca3 |
| SHA1 | 0520db9c012dbe756b41e6e83d70fa625f52a554 |
| SHA256 | e437a9056669bc612b7b4581476951223810e561334a01b7a133dd1aa88cb4f7 |
| SHA512 | e8539f94bdad9331f023dd1bf28118948b72813a24c0f0bc41bd4f3d267e886c8767c5769d55157c4458207bc26acfa2a5e5887b15502ff4d56c88addb429a60 |
memory/4968-165-0x0000000002440000-0x0000000002441000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_0.408462355819950834733559423992243997.class
| MD5 | 781fb531354d6f291f1ccab48da6d39f |
| SHA1 | 9ce4518ebcb5be6d1f0b5477fa00c26860fe9a68 |
| SHA256 | 97d585b6aff62fb4e43e7e6a5f816dcd7a14be11a88b109a9ba9e8cd4c456eb9 |
| SHA512 | 3e6630f5feb4a3eb1dac7e9125ce14b1a2a45d7415cf44cea42bc51b2a9aa37169ee4a4c36c888c8f2696e7d6e298e2ad7b2f4c22868aaa5948210eb7db220d8 |
memory/4968-167-0x0000000002440000-0x0000000002441000-memory.dmp
C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp
| MD5 | 1a502dd280c9d9a055db8fc4b1810669 |
| SHA1 | 1f7ed9f61385f5792cb073f6f6906a5a46773334 |
| SHA256 | a376c5cc5df1943f3d4a3fa8e9b57f47aa6b476c31147e14c2d5a960aaa0b10f |
| SHA512 | 5158753023288514e11850edc2b621b5715b28140b3b4548961854556ce827a5c1a7fc31f052ab7b77f00899dbe67bf91e95e3cc2633b19ed204f0556809c835 |
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2275444769-3691835758-4097679484-1000\83aa4cc77f591dfc2374580bbd95f6ba_6d187d53-139c-415c-b71c-a4b59992e636
| MD5 | c8366ae350e7019aefc9d1e6e6a498c6 |
| SHA1 | 5731d8a3e6568a5f2dfbbc87e3db9637df280b61 |
| SHA256 | 11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238 |
| SHA512 | 33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd |
memory/1360-183-0x0000000001550000-0x0000000001551000-memory.dmp
memory/4968-206-0x0000000002440000-0x0000000002441000-memory.dmp
memory/1360-209-0x0000000001550000-0x0000000001551000-memory.dmp
memory/4968-210-0x0000000002440000-0x0000000002441000-memory.dmp
memory/4968-224-0x0000000002440000-0x0000000002441000-memory.dmp