Analysis

  • max time kernel
    149s
  • max time network
    138s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    06-09-2023 14:46

General

  • Target

    sample.jar

  • Size

    184KB

  • MD5

    bedcdaf50807711f4d66faf4e5a7aa21

  • SHA1

    d54da78d710d53a4d42aa8e604b1dd994febaad0

  • SHA256

    c65d3ff20b9a591b41d0b575e70167ebd8963e003f619652660d0fa7adf84c9d

  • SHA512

    625b4dd91da35daa8f5ae0148b7f004856ea5cad2208ec2a12bb7fbd0aee7e78725b88e52bd2ad37999687322daa813b4e35657a8173bf2e46390cb26a70f0b4

  • SSDEEP

    3072:PAChkMq6P6y4UqmzvrMsTcF2Ws5PhjRrszwgqFk0hF5gE2Y8w:PACu6H4UqqrMvF25PhjMb9GF5gED8w

Malware Config

Signatures

  • AdWind

    A Java-based RAT family operated as malware-as-a-service.

  • JAR file contains resources related to AdWind 1 IoCs

    This JAR file potentially contains loader stubs used by the AdWind RAT.

  • Sets file to hidden 1 TTPs 2 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops desktop.ini file(s) 2 IoCs
  • Modifies registry key 1 TTPs 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs

Processes

  • C:\Windows\system32\java.exe
    java -jar C:\Users\Admin\AppData\Local\Temp\sample.jar
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2408
    • C:\Windows\system32\java.exe
      java -jar C:\Users\Admin\AppData\Local\Temp\asdqwdoiqjwdomasdlkasmdklasd44835801984083158950exeadmis6.jar
      2⤵
        PID:2616
      • C:\Windows\system32\java.exe
        java -jar C:\Users\Admin\AppData\Local\Temp\asdqwdoiqjwdomasdlkasmdklasd28630915366792669791dede2.jar
        2⤵
        • Drops desktop.ini file(s)
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2504
        • C:\Windows\system32\reg.exe
          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v sedwsds /t REG_SZ /d "\"C:\Program Files\Java\jre7\bin\javaw.exe\" -jar \"C:\Users\Admin\AppData\Roaming\xps\swsrviaswa.jar\"" /f
          3⤵
          • Adds Run key to start application
          • Modifies registry key
          PID:2824
        • C:\Windows\system32\reg.exe
          reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v sedwsds /t REG_SZ /d "\"C:\Program Files\Java\jre7\bin\javaw.exe\" -jar \"C:\Users\Admin\AppData\Roaming\xps\swsrviaswa.jar\"" /f
          3⤵
          • Adds Run key to start application
          • Modifies registry key
          PID:1144
        • C:\Windows\system32\attrib.exe
          attrib +s +h +r "C:\Users\Admin\AppData\Roaming\xps\*.*"
          3⤵
          • Sets file to hidden
          • Drops desktop.ini file(s)
          • Views/modifies file attributes
          PID:1292
        • C:\Windows\system32\attrib.exe
          attrib +s +h +r "C:\Users\Admin\AppData\Roaming\xps"
          3⤵
          • Sets file to hidden
          • Views/modifies file attributes
          PID:2116
        • C:\Program Files\Java\jre7\bin\javaw.exe
          "C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\xps\swsrviaswa.jar"
          3⤵
            PID:1088

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\asdqwdoiqjwdomasdlkasmdklasd28630915366792669791dede2.jar

        Filesize

        59KB

        MD5

        c2c4d5760b4acd6722c6052d52fd21c0

        SHA1

        4cf6240fae1338c7eb0cf1534e7e820f57b3b9e7

        SHA256

        a7ee7cfbd2461230da7eb919f9eb58f2d3fa54a4892307cea0f339189ebede28

        SHA512

        8f34b983664635c5ec7f0af4b47a1e90ea3abac64c5f5bf62d215cef2d3c32af5438ce0576c805bc3bd1978f6cef66cd08ef80a87c4ce4b269d7a27e42bd0d1e

      • C:\Users\Admin\AppData\Local\Temp\asdqwdoiqjwdomasdlkasmdklasd44835801984083158950exeadmis6.jar

        Filesize

        101KB

        MD5

        3d95e909a81dd81283604f6fe0b909b0

        SHA1

        b6c4144f5be00ef49c47b56ff7a62b5809f8746b

        SHA256

        21a4fabdbabfbd936aa14762f2f139d3049e46812efbe3d1febd7dca1d599a54

        SHA512

        68c0a4ac0673392dfe53ae276aceb6de1e71613c74817e3eac760ecac185f6997d1346696ad5982502095e40f9dff0bbe60d36fd6f849a6211a5d061b9de80aa

      • C:\Users\Admin\AppData\Roaming\xps\Desktop.ini

        Filesize

        63B

        MD5

        e783bdd20a976eaeaae1ff4624487420

        SHA1

        c2a44fab9df00b3e11582546b16612333c2f9286

        SHA256

        2f65fa9c7ed712f493782abf91467f869419a2f8b5adf23b44019c08190fa3f3

        SHA512

        8c883678e4625ef44f4885b8c6d7485196774f9cb0b9eee7dd18711749bcae474163df9965effcd13ecd1a33cd7265010c152f8504d6013e4f4d85d68a901a80

      • C:\Users\Admin\AppData\Roaming\xps\swsrviaswa.jar

        Filesize

        59KB

        MD5

        c2c4d5760b4acd6722c6052d52fd21c0

        SHA1

        4cf6240fae1338c7eb0cf1534e7e820f57b3b9e7

        SHA256

        a7ee7cfbd2461230da7eb919f9eb58f2d3fa54a4892307cea0f339189ebede28

        SHA512

        8f34b983664635c5ec7f0af4b47a1e90ea3abac64c5f5bf62d215cef2d3c32af5438ce0576c805bc3bd1978f6cef66cd08ef80a87c4ce4b269d7a27e42bd0d1e

      • memory/1088-119-0x00000000001A0000-0x00000000001A1000-memory.dmp

        Filesize

        4KB

      • memory/1088-108-0x0000000002140000-0x0000000005140000-memory.dmp

        Filesize

        48.0MB

      • memory/2408-9-0x0000000002170000-0x0000000005170000-memory.dmp

        Filesize

        48.0MB

      • memory/2408-28-0x0000000000320000-0x0000000000321000-memory.dmp

        Filesize

        4KB

      • memory/2408-33-0x0000000000320000-0x0000000000321000-memory.dmp

        Filesize

        4KB

      • memory/2504-72-0x0000000002240000-0x0000000005240000-memory.dmp

        Filesize

        48.0MB

      • memory/2504-78-0x0000000000130000-0x0000000000131000-memory.dmp

        Filesize

        4KB

      • memory/2504-57-0x0000000000130000-0x0000000000131000-memory.dmp

        Filesize

        4KB

      • memory/2504-106-0x0000000002240000-0x0000000005240000-memory.dmp

        Filesize

        48.0MB

      • memory/2616-67-0x00000000001B0000-0x00000000001B1000-memory.dmp

        Filesize

        4KB

      • memory/2616-79-0x00000000001B0000-0x00000000001B1000-memory.dmp

        Filesize

        4KB

      • memory/2616-80-0x00000000001B0000-0x00000000001B1000-memory.dmp

        Filesize

        4KB

      • memory/2616-90-0x0000000002150000-0x0000000005150000-memory.dmp

        Filesize

        48.0MB

      • memory/2616-61-0x00000000001B0000-0x00000000001B1000-memory.dmp

        Filesize

        4KB

      • memory/2616-104-0x00000000001B0000-0x00000000001B1000-memory.dmp

        Filesize

        4KB

      • memory/2616-56-0x00000000001B0000-0x00000000001B1000-memory.dmp

        Filesize

        4KB

      • memory/2616-50-0x0000000002150000-0x0000000005150000-memory.dmp

        Filesize

        48.0MB