Analysis

  • max time kernel
    147s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230831-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-09-2023 14:46

General

  • Target

    sample.jar

  • Size

    184KB

  • MD5

    bedcdaf50807711f4d66faf4e5a7aa21

  • SHA1

    d54da78d710d53a4d42aa8e604b1dd994febaad0

  • SHA256

    c65d3ff20b9a591b41d0b575e70167ebd8963e003f619652660d0fa7adf84c9d

  • SHA512

    625b4dd91da35daa8f5ae0148b7f004856ea5cad2208ec2a12bb7fbd0aee7e78725b88e52bd2ad37999687322daa813b4e35657a8173bf2e46390cb26a70f0b4

  • SSDEEP

    3072:PAChkMq6P6y4UqmzvrMsTcF2Ws5PhjRrszwgqFk0hF5gE2Y8w:PACu6H4UqqrMvF25PhjMb9GF5gED8w

Malware Config

Signatures

  • AdWind

    A Java-based RAT family operated as malware-as-a-service.

  • JAR file contains resources related to AdWind 2 IoCs

    This JAR file potentially contains loader stubs used by the AdWind RAT.

  • Sets file to hidden 1 TTPs 4 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops desktop.ini file(s) 4 IoCs
  • Drops file in Program Files directory 12 IoCs
  • Modifies registry key 1 TTPs 6 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs
  • Views/modifies file attributes 1 TTPs 5 IoCs

Processes

  • C:\ProgramData\Oracle\Java\javapath\java.exe
    java -jar C:\Users\Admin\AppData\Local\Temp\sample.jar
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:460
    • C:\ProgramData\Oracle\Java\javapath\java.exe
      java -jar C:\Users\Admin\AppData\Local\Temp\asdqwdoiqjwdomasdlkasmdklasd80204470572918719250exeadmis6.jar
      2⤵
      • Drops desktop.ini file(s)
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3780
      • C:\Windows\SYSTEM32\reg.exe
        reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v javasupdadtesw /t REG_SZ /d "\"C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe\" -jar \"C:\Users\Admin\AppData\Roaming\javasupdadtes\javasupdadtew.jar\"" /f
        3⤵
        • Adds Run key to start application
        • Modifies registry key
        PID:3248
      • C:\Windows\SYSTEM32\reg.exe
        reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v javasupdadtesw /f
        3⤵
        • Modifies registry key
        PID:4488
      • C:\Windows\SYSTEM32\attrib.exe
        attrib +s +h +r "C:\Users\Admin\AppData\Roaming\javasupdadtes\*.*"
        3⤵
        • Sets file to hidden
        • Drops desktop.ini file(s)
        • Views/modifies file attributes
        PID:4656
      • C:\Windows\SYSTEM32\attrib.exe
        attrib +s +h +r "C:\Users\Admin\AppData\Roaming\javasupdadtes"
        3⤵
        • Sets file to hidden
        • Views/modifies file attributes
        PID:2488
      • C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
        "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\javasupdadtes\javasupdadtew.jar"
        3⤵
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4760
        • C:\Windows\SYSTEM32\reg.exe
          reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v javasupdadtesw /t REG_SZ /d "\"C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe\" -jar \"C:\Users\Admin\AppData\Roaming\javasupdadtes\javasupdadtew.jar\"" /f
          4⤵
          • Adds Run key to start application
          • Modifies registry key
          PID:3760
        • C:\Windows\SYSTEM32\reg.exe
          reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v javasupdadtesw /f
          4⤵
          • Modifies registry key
          PID:1636
        • C:\Windows\SYSTEM32\attrib.exe
          attrib +H C:\Users\Admin\.Plugins3
          4⤵
          • Views/modifies file attributes
          PID:4512
    • C:\ProgramData\Oracle\Java\javapath\java.exe
      java -jar C:\Users\Admin\AppData\Local\Temp\asdqwdoiqjwdomasdlkasmdklasd4277562502419898061dede2.jar
      2⤵
      • Drops desktop.ini file(s)
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4632
      • C:\Windows\SYSTEM32\reg.exe
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v sedwsds /t REG_SZ /d "\"C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe\" -jar \"C:\Users\Admin\AppData\Roaming\xps\swsrviaswa.jar\"" /f
        3⤵
        • Adds Run key to start application
        • Modifies registry key
        PID:2908
      • C:\Windows\SYSTEM32\reg.exe
        reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v sedwsds /t REG_SZ /d "\"C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe\" -jar \"C:\Users\Admin\AppData\Roaming\xps\swsrviaswa.jar\"" /f
        3⤵
        • Adds Run key to start application
        • Modifies registry key
        PID:1444
      • C:\Windows\SYSTEM32\attrib.exe
        attrib +s +h +r "C:\Users\Admin\AppData\Roaming\xps\*.*"
        3⤵
        • Sets file to hidden
        • Drops desktop.ini file(s)
        • Views/modifies file attributes
        PID:3752
      • C:\Windows\SYSTEM32\attrib.exe
        attrib +s +h +r "C:\Users\Admin\AppData\Roaming\xps"
        3⤵
        • Sets file to hidden
        • Views/modifies file attributes
        PID:2412
      • C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
        "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\xps\swsrviaswa.jar"
        3⤵
        • Drops file in Program Files directory
        PID:4176

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp

    Filesize

    50B

    MD5

    4c2dc134598979669eafa82f7a7af7de

    SHA1

    a02199bac803887066316e20f8b39007e81766aa

    SHA256

    58f3d7dbe8dcfe717eb81f1d496c4a2c3c4d4b44b0770047d2aeacf514821e62

    SHA512

    e60cac58f966148cf70f938ab1b55276e5f85fce3306d480f4ae2f618ba91db3138e9913d074a9d9d92337db735ad9ee2ebd2007b40e25327308fd5114e4dae4

  • C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp

    Filesize

    50B

    MD5

    0159d8bff2a2e7bc3c14a1311671b7a5

    SHA1

    d5d2024b34b4e7a086034d116c4ae6aa34267ca5

    SHA256

    0143e9d784c90b082298e74cb0b5d34b9139a736466811a9d8115311b2048821

    SHA512

    c6947f840ba01b356489a2cd95183f087e8d40d775f0e5081ab626be51d1cd6246f10a71c481f23556aeb45c2f9fc6cdc3d8765cce6f30ad0fc2bf273e0ccc5c

  • C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp

    Filesize

    50B

    MD5

    bcdc2925291c5c868ace4644e258b61c

    SHA1

    0b19ea30a71e2a1356711e8cf67f658f485460d9

    SHA256

    2c1eb18cf9f37f0d50e5a7c8b8c2a1ab96af1bccc07e0208904a43ff8d282bf9

    SHA512

    d970c0d13b4dc7387cffc449f3e6d71bae5b3f54d4e9ea3262738fd01c8bf58546e74ca328d23009c66611e8d1000cd201aea34441391d94a61a129c4e77c2bf

  • C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp

    Filesize

    50B

    MD5

    436c8131b28c734ebc71a3865b92cc0a

    SHA1

    4141cb27b16c1e664f59cd7c68272fa5ae299b3e

    SHA256

    2588a4ec5b032295abe81fce66eae22719d8c7f3adeb9153fcfb0357c17a03fa

    SHA512

    e59985ab08e833533e566911f06ce6cf4c7c46c3de1b7613fc3a65029277a5bad1f0048ecf7c0ddb57fa7a207fbdffbb166a279b125a90176bb765daeed7296a

  • C:\Users\Admin\AppData\Local\Temp\asdqwdoiqjwdomasdlkasmdklasd4277562502419898061dede2.jar

    Filesize

    59KB

    MD5

    c2c4d5760b4acd6722c6052d52fd21c0

    SHA1

    4cf6240fae1338c7eb0cf1534e7e820f57b3b9e7

    SHA256

    a7ee7cfbd2461230da7eb919f9eb58f2d3fa54a4892307cea0f339189ebede28

    SHA512

    8f34b983664635c5ec7f0af4b47a1e90ea3abac64c5f5bf62d215cef2d3c32af5438ce0576c805bc3bd1978f6cef66cd08ef80a87c4ce4b269d7a27e42bd0d1e

  • C:\Users\Admin\AppData\Local\Temp\asdqwdoiqjwdomasdlkasmdklasd80204470572918719250exeadmis6.jar

    Filesize

    101KB

    MD5

    3d95e909a81dd81283604f6fe0b909b0

    SHA1

    b6c4144f5be00ef49c47b56ff7a62b5809f8746b

    SHA256

    21a4fabdbabfbd936aa14762f2f139d3049e46812efbe3d1febd7dca1d599a54

    SHA512

    68c0a4ac0673392dfe53ae276aceb6de1e71613c74817e3eac760ecac185f6997d1346696ad5982502095e40f9dff0bbe60d36fd6f849a6211a5d061b9de80aa

  • C:\Users\Admin\AppData\Roaming\javasupdadtes\Desktop.ini

    Filesize

    63B

    MD5

    e783bdd20a976eaeaae1ff4624487420

    SHA1

    c2a44fab9df00b3e11582546b16612333c2f9286

    SHA256

    2f65fa9c7ed712f493782abf91467f869419a2f8b5adf23b44019c08190fa3f3

    SHA512

    8c883678e4625ef44f4885b8c6d7485196774f9cb0b9eee7dd18711749bcae474163df9965effcd13ecd1a33cd7265010c152f8504d6013e4f4d85d68a901a80

  • C:\Users\Admin\AppData\Roaming\javasupdadtes\javasupdadtew.jar

    Filesize

    101KB

    MD5

    3d95e909a81dd81283604f6fe0b909b0

    SHA1

    b6c4144f5be00ef49c47b56ff7a62b5809f8746b

    SHA256

    21a4fabdbabfbd936aa14762f2f139d3049e46812efbe3d1febd7dca1d599a54

    SHA512

    68c0a4ac0673392dfe53ae276aceb6de1e71613c74817e3eac760ecac185f6997d1346696ad5982502095e40f9dff0bbe60d36fd6f849a6211a5d061b9de80aa

  • C:\Users\Admin\AppData\Roaming\xps\Desktop.ini

    Filesize

    63B

    MD5

    e783bdd20a976eaeaae1ff4624487420

    SHA1

    c2a44fab9df00b3e11582546b16612333c2f9286

    SHA256

    2f65fa9c7ed712f493782abf91467f869419a2f8b5adf23b44019c08190fa3f3

    SHA512

    8c883678e4625ef44f4885b8c6d7485196774f9cb0b9eee7dd18711749bcae474163df9965effcd13ecd1a33cd7265010c152f8504d6013e4f4d85d68a901a80

  • C:\Users\Admin\AppData\Roaming\xps\swsrviaswa.jar

    Filesize

    59KB

    MD5

    c2c4d5760b4acd6722c6052d52fd21c0

    SHA1

    4cf6240fae1338c7eb0cf1534e7e820f57b3b9e7

    SHA256

    a7ee7cfbd2461230da7eb919f9eb58f2d3fa54a4892307cea0f339189ebede28

    SHA512

    8f34b983664635c5ec7f0af4b47a1e90ea3abac64c5f5bf62d215cef2d3c32af5438ce0576c805bc3bd1978f6cef66cd08ef80a87c4ce4b269d7a27e42bd0d1e

  • memory/460-33-0x0000000002DC0000-0x0000000002DC1000-memory.dmp

    Filesize

    4KB

  • memory/460-4-0x0000000003050000-0x0000000004050000-memory.dmp

    Filesize

    16.0MB

  • memory/3780-53-0x0000000002BB0000-0x0000000002BB1000-memory.dmp

    Filesize

    4KB

  • memory/3780-154-0x0000000002BB0000-0x0000000002BB1000-memory.dmp

    Filesize

    4KB

  • memory/3780-79-0x0000000002BB0000-0x0000000002BB1000-memory.dmp

    Filesize

    4KB

  • memory/3780-74-0x0000000002BB0000-0x0000000002BB1000-memory.dmp

    Filesize

    4KB

  • memory/3780-157-0x0000000002BB0000-0x0000000002BB1000-memory.dmp

    Filesize

    4KB

  • memory/3780-56-0x0000000002BB0000-0x0000000002BB1000-memory.dmp

    Filesize

    4KB

  • memory/3780-124-0x0000000002BB0000-0x0000000002BB1000-memory.dmp

    Filesize

    4KB

  • memory/3780-47-0x0000000002EB0000-0x0000000003EB0000-memory.dmp

    Filesize

    16.0MB

  • memory/3780-123-0x0000000002BB0000-0x0000000002BB1000-memory.dmp

    Filesize

    4KB

  • memory/4176-198-0x0000000002FE0000-0x0000000003FE0000-memory.dmp

    Filesize

    16.0MB

  • memory/4176-116-0x0000000001310000-0x0000000001311000-memory.dmp

    Filesize

    4KB

  • memory/4176-121-0x0000000002FE0000-0x0000000003FE0000-memory.dmp

    Filesize

    16.0MB

  • memory/4632-114-0x00000000031E0000-0x00000000041E0000-memory.dmp

    Filesize

    16.0MB

  • memory/4632-112-0x0000000003460000-0x0000000003470000-memory.dmp

    Filesize

    64KB

  • memory/4632-104-0x0000000002DE0000-0x0000000002DE1000-memory.dmp

    Filesize

    4KB

  • memory/4632-91-0x00000000031E0000-0x00000000041E0000-memory.dmp

    Filesize

    16.0MB

  • memory/4632-61-0x00000000031E0000-0x00000000041E0000-memory.dmp

    Filesize

    16.0MB

  • memory/4632-85-0x0000000002DE0000-0x0000000002DE1000-memory.dmp

    Filesize

    4KB

  • memory/4632-197-0x00000000031E0000-0x00000000041E0000-memory.dmp

    Filesize

    16.0MB

  • memory/4632-69-0x0000000002DE0000-0x0000000002DE1000-memory.dmp

    Filesize

    4KB

  • memory/4760-164-0x0000000000E50000-0x0000000000E51000-memory.dmp

    Filesize

    4KB

  • memory/4760-158-0x0000000000E50000-0x0000000000E51000-memory.dmp

    Filesize

    4KB

  • memory/4760-175-0x0000000000E50000-0x0000000000E51000-memory.dmp

    Filesize

    4KB

  • memory/4760-177-0x0000000000E50000-0x0000000000E51000-memory.dmp

    Filesize

    4KB

  • memory/4760-182-0x0000000000E50000-0x0000000000E51000-memory.dmp

    Filesize

    4KB

  • memory/4760-186-0x0000000000E50000-0x0000000000E51000-memory.dmp

    Filesize

    4KB

  • memory/4760-156-0x0000000000E50000-0x0000000000E51000-memory.dmp

    Filesize

    4KB

  • memory/4760-153-0x0000000002B00000-0x0000000003B00000-memory.dmp

    Filesize

    16.0MB

  • memory/4760-199-0x0000000002B00000-0x0000000003B00000-memory.dmp

    Filesize

    16.0MB