Malware Analysis Report

2024-11-13 18:35

Sample ID 230324-b14ggsbd82
Target 66054f63d4a48886cd03fd7915eed7f6.bin
SHA256 476a90ffffa6c1c05916df01b972ed6e895ac55fc5f25e0e5541bf3737a078b4
Tags
adwind trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

476a90ffffa6c1c05916df01b972ed6e895ac55fc5f25e0e5541bf3737a078b4

Threat Level: Known bad

The file 66054f63d4a48886cd03fd7915eed7f6.bin was found to be: Known bad.

Malicious Activity Summary

adwind trojan

AdWind

Checks computer location settings

Enumerates physical storage devices

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-03-24 01:37

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-03-24 01:37

Reported

2023-03-24 01:40

Platform

win7-20230220-en

Max time kernel

73s

Max time network

38s

Command Line

java -jar C:\Users\Admin\AppData\Local\Temp\b7f46caa4c8a8bdc972cc75781ad43cf8d8436a8640e24b03d34f02560643b70.jar

Signatures

AdWind

trojan adwind

Enumerates physical storage devices

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\Java\jre7\bin\java.exe N/A
N/A N/A C:\Program Files\Java\jre7\bin\javaw.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1160 wrote to memory of 1068 N/A C:\Windows\system32\java.exe C:\Windows\system32\wscript.exe
PID 1160 wrote to memory of 1068 N/A C:\Windows\system32\java.exe C:\Windows\system32\wscript.exe
PID 1160 wrote to memory of 1068 N/A C:\Windows\system32\java.exe C:\Windows\system32\wscript.exe
PID 1068 wrote to memory of 1596 N/A C:\Windows\system32\wscript.exe C:\Program Files\Java\jre7\bin\javaw.exe
PID 1068 wrote to memory of 1596 N/A C:\Windows\system32\wscript.exe C:\Program Files\Java\jre7\bin\javaw.exe
PID 1068 wrote to memory of 1596 N/A C:\Windows\system32\wscript.exe C:\Program Files\Java\jre7\bin\javaw.exe
PID 1596 wrote to memory of 1640 N/A C:\Program Files\Java\jre7\bin\javaw.exe C:\Program Files\Java\jre7\bin\java.exe
PID 1596 wrote to memory of 1640 N/A C:\Program Files\Java\jre7\bin\javaw.exe C:\Program Files\Java\jre7\bin\java.exe
PID 1596 wrote to memory of 1640 N/A C:\Program Files\Java\jre7\bin\javaw.exe C:\Program Files\Java\jre7\bin\java.exe
PID 1640 wrote to memory of 1352 N/A C:\Program Files\Java\jre7\bin\java.exe C:\Windows\system32\cmd.exe
PID 1640 wrote to memory of 1352 N/A C:\Program Files\Java\jre7\bin\java.exe C:\Windows\system32\cmd.exe
PID 1640 wrote to memory of 1352 N/A C:\Program Files\Java\jre7\bin\java.exe C:\Windows\system32\cmd.exe
PID 1352 wrote to memory of 1404 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cscript.exe
PID 1352 wrote to memory of 1404 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cscript.exe
PID 1352 wrote to memory of 1404 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cscript.exe
PID 1640 wrote to memory of 680 N/A C:\Program Files\Java\jre7\bin\java.exe C:\Windows\system32\cmd.exe
PID 1640 wrote to memory of 680 N/A C:\Program Files\Java\jre7\bin\java.exe C:\Windows\system32\cmd.exe
PID 1640 wrote to memory of 680 N/A C:\Program Files\Java\jre7\bin\java.exe C:\Windows\system32\cmd.exe
PID 680 wrote to memory of 1780 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cscript.exe
PID 680 wrote to memory of 1780 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cscript.exe
PID 680 wrote to memory of 1780 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cscript.exe
PID 1640 wrote to memory of 1068 N/A C:\Program Files\Java\jre7\bin\java.exe C:\Windows\system32\xcopy.exe
PID 1640 wrote to memory of 1068 N/A C:\Program Files\Java\jre7\bin\java.exe C:\Windows\system32\xcopy.exe
PID 1640 wrote to memory of 1068 N/A C:\Program Files\Java\jre7\bin\java.exe C:\Windows\system32\xcopy.exe

Processes

C:\Windows\system32\java.exe

java -jar C:\Users\Admin\AppData\Local\Temp\b7f46caa4c8a8bdc972cc75781ad43cf8d8436a8640e24b03d34f02560643b70.jar

C:\Windows\system32\wscript.exe

wscript C:\Users\Admin\erdhvdferx.js

C:\Program Files\Java\jre7\bin\javaw.exe

"C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\bqimmdgghr.txt"

C:\Program Files\Java\jre7\bin\java.exe

"C:\Program Files\Java\jre7\bin\java.exe" -jar C:\Users\Admin\AppData\Local\Temp\_0.9755262083300703814453161725911943.class

C:\Windows\system32\cmd.exe

cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive240917199929314811.vbs

C:\Windows\system32\cscript.exe

cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive240917199929314811.vbs

C:\Windows\system32\cmd.exe

cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive3636350998794951380.vbs

C:\Windows\system32\cscript.exe

cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive3636350998794951380.vbs

C:\Windows\system32\xcopy.exe

xcopy "C:\Program Files\Java\jre7" "C:\Users\Admin\AppData\Roaming\Oracle\" /e

Network

N/A

Files

memory/1160-65-0x0000000000220000-0x0000000000221000-memory.dmp

C:\Users\Admin\erdhvdferx.js

MD5 dec1e41985af1924c4aed1fa8435f2cb
SHA1 73d000d16831db3b98719ec9b0384fb138893d96
SHA256 7c52b9f46b624904f71f6cd6e52cbfc63288cac14ccce282daa23d575a988bde
SHA512 342f595e5813825e384e6b222a564e1b2caf81107da21ee1c6393aa61ee238c4102fb59f4b9f1660555b390cbc38c173fbccb344fe8c0e82598d9ce458b40a69

C:\Users\Admin\AppData\Roaming\bqimmdgghr.txt

MD5 60c30fb124adfb6da82bf66a1f784926
SHA1 e711e91e84b0d26f305905fde683e1534e1e3980
SHA256 83a0a328d4a71e95c6a17cca54ba3ee4ae26a09d10cbdc8f689ad5325a070c80
SHA512 37d1e47274293d3710f36137effa6584240e8435ad1d83b59e64656fd09132adc3199e5660665dcdbee4f86f569bb0f905ddbe426dda8ebba3ab0cd1c1700e91

C:\Users\Admin\AppData\Local\Temp\_0.9755262083300703814453161725911943.class

MD5 781fb531354d6f291f1ccab48da6d39f
SHA1 9ce4518ebcb5be6d1f0b5477fa00c26860fe9a68
SHA256 97d585b6aff62fb4e43e7e6a5f816dcd7a14be11a88b109a9ba9e8cd4c456eb9
SHA512 3e6630f5feb4a3eb1dac7e9125ce14b1a2a45d7415cf44cea42bc51b2a9aa37169ee4a4c36c888c8f2696e7d6e298e2ad7b2f4c22868aaa5948210eb7db220d8

memory/1596-86-0x0000000000320000-0x0000000000321000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1283023626-844874658-3193756055-1000\83aa4cc77f591dfc2374580bbd95f6ba_97ec3239-d8ea-4bc4-8ce8-63e2080cbe23

MD5 c8366ae350e7019aefc9d1e6e6a498c6
SHA1 5731d8a3e6568a5f2dfbbc87e3db9637df280b61
SHA256 11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238
SHA512 33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd

memory/1640-94-0x0000000000230000-0x0000000000231000-memory.dmp

memory/1640-100-0x0000000000230000-0x0000000000231000-memory.dmp

memory/1640-103-0x0000000000230000-0x0000000000231000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Retrive240917199929314811.vbs

MD5 3bdfd33017806b85949b6faa7d4b98e4
SHA1 f92844fee69ef98db6e68931adfaa9a0a0f8ce66
SHA256 9da575dd2d5b7c1e9bab8b51a16cde457b3371c6dcdb0537356cf1497fa868f6
SHA512 ae5e5686ae71edef53e71cd842cb6799e4383b9c238a5c361b81647efa128d2fedf3bf464997771b5b0c47a058fecae7829aeedcd098c80a11008581e5781429

memory/1596-122-0x0000000000320000-0x0000000000321000-memory.dmp

memory/1596-134-0x0000000000320000-0x0000000000321000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Retrive3636350998794951380.vbs

MD5 a32c109297ed1ca155598cd295c26611
SHA1 dc4a1fdbaad15ddd6fe22d3907c6b03727b71510
SHA256 45bfe34aa3ef932f75101246eb53d032f5e7cf6d1f5b4e495334955a255f32e7
SHA512 70372552dc86fe02ece9fe3b7721463f80be07a34126b2c75b41e30078cda9e90744c7d644df623f63d4fb985482e345b3351c4d3da873162152c67fc6ecc887

memory/1596-138-0x0000000000320000-0x0000000000321000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-03-24 01:37

Reported

2023-03-24 01:40

Platform

win10v2004-20230220-en

Max time kernel

152s

Max time network

155s

Command Line

java -jar C:\Users\Admin\AppData\Local\Temp\b7f46caa4c8a8bdc972cc75781ad43cf8d8436a8640e24b03d34f02560643b70.jar

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation C:\Windows\SYSTEM32\wscript.exe N/A

Enumerates physical storage devices

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe N/A
N/A N/A C:\Program Files\Java\jre1.8.0_66\bin\java.exe N/A

Processes

C:\ProgramData\Oracle\Java\javapath\java.exe

java -jar C:\Users\Admin\AppData\Local\Temp\b7f46caa4c8a8bdc972cc75781ad43cf8d8436a8640e24b03d34f02560643b70.jar

C:\Windows\SYSTEM32\wscript.exe

wscript C:\Users\Admin\erdhvdferx.js

C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe

"C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\nfwdfnq.txt"

C:\Program Files\Java\jre1.8.0_66\bin\java.exe

"C:\Program Files\Java\jre1.8.0_66\bin\java.exe" -jar C:\Users\Admin\AppData\Local\Temp\_0.408462355819950834733559423992243997.class

Network

Country Destination Domain Proto
IE 20.54.89.15:443 tcp
US 8.8.8.8:53 210.81.184.52.in-addr.arpa udp
US 8.8.8.8:53 164.113.223.173.in-addr.arpa udp
US 117.18.237.29:80 tcp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 2.36.159.162.in-addr.arpa udp
US 52.152.110.14:443 tcp
US 20.189.173.3:443 tcp
US 8.8.8.8:53 176.122.125.40.in-addr.arpa udp
US 8.8.8.8:53 76.38.195.152.in-addr.arpa udp
US 8.8.8.8:53 176.122.125.40.in-addr.arpa udp
US 117.18.237.29:80 tcp
US 209.197.3.8:80 tcp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp

Files

memory/4632-143-0x0000000002990000-0x0000000002991000-memory.dmp

memory/4632-147-0x0000000002990000-0x0000000002991000-memory.dmp

C:\Users\Admin\erdhvdferx.js

MD5 dec1e41985af1924c4aed1fa8435f2cb
SHA1 73d000d16831db3b98719ec9b0384fb138893d96
SHA256 7c52b9f46b624904f71f6cd6e52cbfc63288cac14ccce282daa23d575a988bde
SHA512 342f595e5813825e384e6b222a564e1b2caf81107da21ee1c6393aa61ee238c4102fb59f4b9f1660555b390cbc38c173fbccb344fe8c0e82598d9ce458b40a69

C:\Users\Admin\AppData\Roaming\nfwdfnq.txt

MD5 60c30fb124adfb6da82bf66a1f784926
SHA1 e711e91e84b0d26f305905fde683e1534e1e3980
SHA256 83a0a328d4a71e95c6a17cca54ba3ee4ae26a09d10cbdc8f689ad5325a070c80
SHA512 37d1e47274293d3710f36137effa6584240e8435ad1d83b59e64656fd09132adc3199e5660665dcdbee4f86f569bb0f905ddbe426dda8ebba3ab0cd1c1700e91

C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp

MD5 06c648e2a6477ec7c902e470adab9ca3
SHA1 0520db9c012dbe756b41e6e83d70fa625f52a554
SHA256 e437a9056669bc612b7b4581476951223810e561334a01b7a133dd1aa88cb4f7
SHA512 e8539f94bdad9331f023dd1bf28118948b72813a24c0f0bc41bd4f3d267e886c8767c5769d55157c4458207bc26acfa2a5e5887b15502ff4d56c88addb429a60

memory/4968-165-0x0000000002440000-0x0000000002441000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_0.408462355819950834733559423992243997.class

MD5 781fb531354d6f291f1ccab48da6d39f
SHA1 9ce4518ebcb5be6d1f0b5477fa00c26860fe9a68
SHA256 97d585b6aff62fb4e43e7e6a5f816dcd7a14be11a88b109a9ba9e8cd4c456eb9
SHA512 3e6630f5feb4a3eb1dac7e9125ce14b1a2a45d7415cf44cea42bc51b2a9aa37169ee4a4c36c888c8f2696e7d6e298e2ad7b2f4c22868aaa5948210eb7db220d8

memory/4968-167-0x0000000002440000-0x0000000002441000-memory.dmp

C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp

MD5 1a502dd280c9d9a055db8fc4b1810669
SHA1 1f7ed9f61385f5792cb073f6f6906a5a46773334
SHA256 a376c5cc5df1943f3d4a3fa8e9b57f47aa6b476c31147e14c2d5a960aaa0b10f
SHA512 5158753023288514e11850edc2b621b5715b28140b3b4548961854556ce827a5c1a7fc31f052ab7b77f00899dbe67bf91e95e3cc2633b19ed204f0556809c835

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2275444769-3691835758-4097679484-1000\83aa4cc77f591dfc2374580bbd95f6ba_6d187d53-139c-415c-b71c-a4b59992e636

MD5 c8366ae350e7019aefc9d1e6e6a498c6
SHA1 5731d8a3e6568a5f2dfbbc87e3db9637df280b61
SHA256 11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238
SHA512 33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd

memory/1360-183-0x0000000001550000-0x0000000001551000-memory.dmp

memory/4968-206-0x0000000002440000-0x0000000002441000-memory.dmp

memory/1360-209-0x0000000001550000-0x0000000001551000-memory.dmp

memory/4968-210-0x0000000002440000-0x0000000002441000-memory.dmp

memory/4968-224-0x0000000002440000-0x0000000002441000-memory.dmp