adwind | f1154ad2d49cd0ec55e739c53bc3cb11f889437c55ed83b9a56195d6303f3993

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/03/2024, 00:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c1f6345aa9ab72bde64692c605e8e64d.jar
Size 136KB
Sample240312-ag827ace28
SHA256 f1154ad2d49cd0ec55e739c53bc3cb11f889437c55ed83b9a56195d6303f3993
MD5 c1f6345aa9ab72bde64692c605e8e64d
SHA1 c73eaf801a1118a6205fc18e6eabe5797f5be794
SHA512 509036542a971d6bd309eb593b6f1b1c303f6acb153b1fb7044ec19c8ad2ffa618dbec1479abdfdebdf589e74dd543daa5da53240a99cf48ddbfe17b704aea25
SSDEEP 3072:ZIboS64tI9rSKbd+zxmRCS/nv/SOePCTFsUN1QlZAQvLHRzsMXPspC:ZsoS64WSGboSqO06FNN6lZAQTxzsMXEC
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

adwind discovery persistence trojan

Malware Config

Signatures

AdWind
A Java-based RAT family operated as malware-as-a-service.
trojan adwind

Executes dropped EXE 1 IoCs

pid	Process
3684	javaw.exe

Loads dropped DLL 7 IoCs

pid	Process
3684	javaw.exe
3684	javaw.exe
3684	javaw.exe
3684	javaw.exe
3684	javaw.exe
3684	javaw.exe
3684	javaw.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3248	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\brZTkLTSUtP = "\"C:\\Users\\Admin\\AppData\\Roaming\\Oracle\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\pqjlxAqAzSW\\UrDqSIuIMXE.mWSfWT\""	reg.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\test.txt	java.exe
File opened for modification	C:\Windows\System32\test.txt	java.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2780	reg.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2936	java.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 3248	2936	java.exe	88
PID 2936 wrote to memory of 3248	2936	java.exe	88
PID 2936 wrote to memory of 1680	2936	java.exe	91
PID 2936 wrote to memory of 1680	2936	java.exe	91
PID 1680 wrote to memory of 4844	1680	cmd.exe	93
PID 1680 wrote to memory of 4844	1680	cmd.exe	93
PID 2936 wrote to memory of 4608	2936	java.exe	95
PID 2936 wrote to memory of 4608	2936	java.exe	95
PID 4608 wrote to memory of 3236	4608	cmd.exe	97
PID 4608 wrote to memory of 3236	4608	cmd.exe	97
PID 2936 wrote to memory of 1444	2936	java.exe	98
PID 2936 wrote to memory of 1444	2936	java.exe	98
PID 2936 wrote to memory of 2780	2936	java.exe	106
PID 2936 wrote to memory of 2780	2936	java.exe	106
PID 2936 wrote to memory of 1924	2936	java.exe	107
PID 2936 wrote to memory of 1924	2936	java.exe	107
PID 2936 wrote to memory of 4084	2936	java.exe	108
PID 2936 wrote to memory of 4084	2936	java.exe	108
PID 2936 wrote to memory of 3684	2936	java.exe	110
PID 2936 wrote to memory of 3684	2936	java.exe	110

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1924	attrib.exe
4084	attrib.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\c1f6345aa9ab72bde64692c605e8e64d.jar
1⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:3248
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive835412245599534294.vbs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1680
- - C:\Windows\system32\cscript.exe
    cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive835412245599534294.vbs
    3⤵
    PID:4844
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive3785567330375407860.vbs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4608
- - C:\Windows\system32\cscript.exe
    cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive3785567330375407860.vbs
    3⤵
    PID:3236
- C:\Windows\SYSTEM32\xcopy.exe
  xcopy "C:\Program Files\Java\jre-1.8" "C:\Users\Admin\AppData\Roaming\Oracle\" /e
  2⤵
  PID:1444
- C:\Windows\SYSTEM32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v brZTkLTSUtP /t REG_EXPAND_SZ /d "\"C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe\" -jar \"C:\Users\Admin\pqjlxAqAzSW\UrDqSIuIMXE.mWSfWT\"" /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:2780
- C:\Windows\SYSTEM32\attrib.exe
  attrib +h "C:\Users\Admin\pqjlxAqAzSW\*.*"
  2⤵
  - Views/modifies file attributes
  PID:1924
- C:\Windows\SYSTEM32\attrib.exe
  attrib +h "C:\Users\Admin\pqjlxAqAzSW"
  2⤵
  - Views/modifies file attributes
  PID:4084
- C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe
  C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe -jar C:\Users\Admin\pqjlxAqAzSW\UrDqSIuIMXE.mWSfWT
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 eff7ace25cac3aa188e047f795c542b7680aca8145b93ea9c6eecfc8c8ec534b
MD5 dd067730a7b55715d61f394f899f3a73
SHA1 39c6fe64e9368f14010493478b30e34249a88db9
SHA512 7b939aeb1ecd869444ccad2e05c272da8549ed3ab8255b114debe2a61b2488ddf7da439a302d5096bb7ba3b3d052db86c1661a2b6fb5deb34cd0419be37d7077
MD5 SHA1 SHA512

Submit Download

Retrive3785567330375407860.vbs

Path C:\Users\Admin\AppData\Local\Temp\Retrive3785567330375407860.vbs
Size 281B
SHA256 45bfe34aa3ef932f75101246eb53d032f5e7cf6d1f5b4e495334955a255f32e7
MD5 a32c109297ed1ca155598cd295c26611
SHA1 dc4a1fdbaad15ddd6fe22d3907c6b03727b71510
SHA512 70372552dc86fe02ece9fe3b7721463f80be07a34126b2c75b41e30078cda9e90744c7d644df623f63d4fb985482e345b3351c4d3da873162152c67fc6ecc887
MD5 SHA1 SHA512

Submit Download

Retrive835412245599534294.vbs

Path C:\Users\Admin\AppData\Local\Temp\Retrive835412245599534294.vbs
Size 276B
SHA256 9da575dd2d5b7c1e9bab8b51a16cde457b3371c6dcdb0537356cf1497fa868f6
MD5 3bdfd33017806b85949b6faa7d4b98e4
SHA1 f92844fee69ef98db6e68931adfaa9a0a0f8ce66
SHA512 ae5e5686ae71edef53e71cd842cb6799e4383b9c238a5c361b81647efa128d2fedf3bf464997771b5b0c47a058fecae7829aeedcd098c80a11008581e5781429
MD5 SHA1 SHA512

Submit Download

java.dll

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\java.dll
Size 162KB
SHA256 179df744661b659d50fd6943834d81476287c2075448d2dc783fb32c69a00e54
MD5 4e6dfd5867f4cea96dad1d59a0ca43fe
SHA1 6a08abc0b5a2cab00eb6d7543c661aa6620890a1
SHA512 2565197c75eca66600a530aa6b033d4985fcb05edf73e096ebba37f06016e6ae5c4fc516a182bf674ff18e3f3b031353c9ff187a6b8804058b5d2b47c914e60b
SSDEEP 3072:dgpGH1/rHpcDJ0oL9JLVZcRysrS7DgWw2xM:Wpg0TZHQh
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe
Size 285KB
SHA256 a64ead73c06470bc5c84cfc231b0723d70d29fec7d385a268be2c590dc5eb1ef
MD5 7fb44c5bca4226d8aab7398e836807a2
SHA1 47128e4f8afabfde5037ed0fcaba8752c528ff52
SHA512 f0bd093f054c99bcc50df4005d0190bd7e3dcefea7008ae4c9b67a29e832e02ae9ff39fa75bc1352c127aeb13afdea9bfdcc238ac826ef17f288d6fbd2ec8cab
SSDEEP 6144:PAHdwS/WYoTOLHIsPPzAdnz0YutYPDvhD:PCd9/WYoaLHF3z0z04PDvhD
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\msvcp140.dll
Size 384KB
SHA256 f5ba6a8db67deaf9b86058503a9f146b301f953f7bb783f95e3e787477f86c9a
MD5 9bbb660e97a282b3313f6b24efa66124
SHA1 0a8f9436da59d62c8e5c6aaacfdf2cea6ea0fa30
SHA512 9b019958cfaee58e5260f308dd4ebe2c3ce09730d327218b9c7cbaabd651fc7b83084e30cdb06bfbfdd735079b5eb1485902cd53d1a6534556d62c5ea87d0b16
SSDEEP 6144:CZByg0r0H6ZW2QfIwKnkdmZJUbi7I0QfnnxK+pdqC+cOjfohLbnDgWMPwsarrib+:CZ+jZpQfIwKnkdmZJUbi7I0QfxK+pddr
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\plugin2\msvcp140.dll
Size 558KB
SHA256 a88b8c1c8f27bf90fe960e0e8bd56984ad48167071af92d96ec1051f89f827fb
MD5 bf78c15068d6671693dfcdfa5770d705
SHA1 4418c03c3161706a4349dfe3f97278e7a5d8962a
SHA512 5b6b0ab4e82cc979eaa619d387c6995198fd19aa0c455bef44bd37a765685575d57448b3b4accd70d3bd20a6cd408b1f518eda0f6dae5aa106f225bee8291372
SSDEEP 12288:CZ+jZpQfIwKnkdmZJUbi7I0QfxK+pdd+cOj6LbndDrUw2K1fQEKZm+jWodEEVJaP:CEtmrdcK1fQEKZm+jWodEEb
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\plugin2\vcruntime140.dll
Size 95KB
SHA256 475ab98b7722e965bd38c8fa6ed23502309582ccf294ff1061cb290c7988f0d1
MD5 7415c1cc63a0c46983e2a32581daefee
SHA1 5f8534d79c84ac45ad09b5a702c8c5c288eae240
SHA512 3d4b24061f72c0e957c7b04a0c4098c94c8f1afb4a7e159850b9939c7210d73398be6f27b5ab85073b4e8c999816e7804fef0f6115c39cd061f4aaeb4dcda8cf
SSDEEP 1536:M4h79voUUUCaisMiQFJp0hYSKnMNFYNa86ecb63UNU:M8WvicJpwYVMNFYNB6ecb63U6
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\plugin2\vcruntime140_1.dll
Size 36KB
SHA256 0579d460ea1f7e8a815fa55a8821a5ff489c8097f051765e9beaf25d8d0f27d6
MD5 fcda37abd3d9e9d8170cd1cd15bf9d3f
SHA1 b23ff3e9aa2287b9c1249a008c0ae06dc8b6fdf2
SHA512 de8be61499aaa1504dde8c19666844550c2ea7ef774ecbe26900834b252887da31d4cf4fb51338b16b6a4416de733e519ebf8c375eb03eb425232a6349da2257
SSDEEP 384:1JfphjEpTUUtKldl3864/vc5fqiu85mIlRWNQQbz6Yf7ZJA/U3qJrWr2KW8KLHR9:Phh4pTUUtmUwqiu8oSRjez6S7fqHwAb
MD5 SHA1 SHA512 SSDEEP

Submit Download

jvm.dll

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\server\jvm.dll
Size 6.1MB
SHA256 f89e36f9776f2800bbdba3fe6bf7b876d42e36e75bbe249fe23a1626e63bfda0
MD5 ad8e39ff411caa59ceff3a2c21564a76
SHA1 7767c6707ad455fd0678b877d1cc53f94cccfbb1
SHA512 f7ef5e1c2aa5e35d6f97e6e170a2d22343289b8bfe6b837a4146cd9bc3465c1cd94937c6d07ac6d33f95c146978f6ba5a5df23c343944021ea5d468d34e12d01
SSDEEP 98304:OhNdNu6fLpeSRNeOhWnaC5Qu5e9kmhRVfvLP0KsH1OID:OhNdNu6fLpDRwOhoaCyucC0RVfjPiHd
MD5 SHA1 SHA512 SSDEEP

Submit Download

jvm.dll

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\server\jvm.dll
Size 512KB
SHA256 0af210f3cec3ad20144a806c5353663fdfaa91e8534244d7deaf22437c39003d
MD5 9464ceeae267d6d5c95091f1ddbe7c35
SHA1 dff8398c857e962877d747c55eb99c40508570c4
SHA512 7c8f744f717f4d597a5e7cf6646d399f1cd1d19c09d9af5331256f9d98a9df9ed8196aad77ed97cd17e8126eb529664736a9b75149bb2b3edcaf4487f5e63683
SSDEEP 6144:zLt/XZtjiNkHNYx6zlVsJzYoxnvJsG84WEzbmL9epbrb8W9RhApB8WrfaY9M:ft/ZFHHchNsG81EmL9+TDhApBNaY9M
MD5 SHA1 SHA512 SSDEEP

Submit Download

verify.dll

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\verify.dll
Size 55KB
SHA256 9c99e6591c73eda0dfd6bb9a55d0a175cf5bdb583115477cedc627fd793c3deb
MD5 82bb3a2292372acbf8bb25e30a3e169c
SHA1 c09c134561213cd67c670f60a2c52cf947e51a74
SHA512 db4802fe0e3a6dc1678765af559e9c1f6e8639dd5c7c8f18f08296b1b4d15cfe748e391459253a3dde0ca2bda74c6772af262e5b194c78c6bdefbcc2c5377db7
SSDEEP 768:gGq5ZtjA9EC+mzTJaJSMR26WPI/hY5iX2N9mWKYilefjPxWEta:gGsTSP+mG726iI/hqPN9mWK7wjPxG
MD5 SHA1 SHA512 SSDEEP

Submit Download

zip.dll

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\zip.dll
Size 87KB
SHA256 27cf17beab60d7f9a62aac7622eefa06eee78796db585f9ae5d3a5b5022d56a9
MD5 0d56a7ff632826362768b3edd5e5174f
SHA1 8b96856f8fe3175039d1a7cf3ac0910467844a08
SHA512 b4fe51874b9ba7a2325ae3c0b96f32065f7cee7c846a9028495070f1f91cedd9445cb91248acd1ec134a72b2c07e49afcaef01b58af1dfb0ff417033c2d0e595
SSDEEP 1536:d4oESIZDpOoUQ4Ps5OwVOIOQIO6nqejL8j672PxV/:d4o5IZDZUXwV8G6nqejLY6WxV/
MD5 SHA1 SHA512 SSDEEP

Submit Download

jvm.cfg

Path C:\Users\Admin\AppData\Roaming\Oracle\lib\amd64\jvm.cfg
Size 634B
SHA256 80847ed146dbc5a9f604b07ec887737fc266699abba266177b553149487ce9eb
MD5 499f2a4e0a25a41c1ff80df2d073e4fd
SHA1 e2469cbe07e92d817637be4e889ebb74c3c46253
SHA512 7828f7b06d0f4309b9edd3aa71ae0bb7ee92d2f8df5642c13437bba2a3888e457dc9b24c16aa9e0f19231530cb44b8ccd955cbbdf5956ce8622cc208796b357d
MD5 SHA1 SHA512

Submit Download

charsets.jar

Path C:\Users\Admin\AppData\Roaming\Oracle\lib\charsets.jar
Size 2.9MB
SHA256 04a6bc7af4d41fda5ca6c7584df50c5d0881fada89b4788e8ee4e5919345f143
MD5 bfdb22624544f02100cd37cff954f64c
SHA1 f699b290845f487cb7050d41a83b85446ea202b1
SHA512 70c5f501c5e1cc67341bb3f4d190179a79fb8bee7292ff8cca0749368ae4475387ce121e8d33adc7e4e6fad5a10eab378fff17e3da0422d4cca0837c95574b95
SSDEEP 49152:WmiR2z1nkI+mstfIrIUj0z8zRnvvyllbIWLrm:WmiMzNwxN+5n32lbI/
MD5 SHA1 SHA512 SSDEEP

Submit Download

messages_zh_TW.properties

Path C:\Users\Admin\AppData\Roaming\Oracle\lib\deploy\messages_zh_TW.properties
Size 3KB
SHA256 ff4a3a92bc92cb08d2c32c435810440fd264edd63e56efa39430e0240c835620
MD5 880baacb176553deab39edbe4b74380d
SHA1 37a57aad121c14c25e149206179728fa62203bf0
SHA512 3039315bb283198af9090bd3d31cfae68ee73bc2b118bbae0b32812d4e3fd0f11ce962068d4a17b065dab9a66ef651b9cb8404c0a2defce74bb6b2d1d93646d5
MD5 SHA1 SHA512

Submit Download

win32_CopyNoDrop32x32.gif

Path C:\Users\Admin\AppData\Roaming\Oracle\lib\images\cursors\win32_CopyNoDrop32x32.gif
Size 153B
SHA256 1a1d3079d49583837662b84e11d8c0870698511d9110e710eb8e7eb20df7ae3b
MD5 1e9d8f133a442da6b0c74d49bc84a341
SHA1 259edc45b4569427e8319895a444f4295d54348f
SHA512 63d6f70c8cab9735f0f857f5bf99e319f6ae98238dc7829dd706b7d6855c70be206e32e3e55df884402483cf8bebad00d139283af5c0b85dc1c5bf8f253acd37
MD5 SHA1 SHA512

Submit Download

jce.jar

Path C:\Users\Admin\AppData\Roaming\Oracle\lib\jce.jar
Size 119KB
SHA256 4362c179bb78107777d6a0557693e65eb2b318c26642162f89509dfdab8c97fe
MD5 e0b7e0f36b9fc43d13403145db82e758
SHA1 def42078cfa315e98393c69963efb4e35e2e28a8
SHA512 5074a7ceb9621096f3bbf419d32ac260ea6d9d09c758544c2761121026c2b9db0b6617806d3b692347b685d541123f4eda99dcbaa29d9c9a2d740b22c44bf7bb
SSDEEP 3072:p+uhK+XLGLuDfH3HiMAHElMueD+UgUBvVE:/f6Y3HiLvJ+Uju
MD5 SHA1 SHA512 SSDEEP

Submit Download

jfr.jar

Path C:\Users\Admin\AppData\Roaming\Oracle\lib\jfr.jar
Size 192KB
SHA256 f8dafd9d806cb0c232eed1d62032a4a4f5309409ecf47a9eeec40888ea235148
MD5 4964aaa880633f66e0d3f12970ad5d4f
SHA1 656f6114d42fb216ef7c2e1e03161224cbcfaa43
SHA512 9e9e02f62c8d9d77677705364f19958627e04f20686b4180869c19ede204573d7f07b00b747f9a6b556f2dd8685c4a474154468d78bd3d690e211cd966e84d86
SSDEEP 3072:4r6Rgdv/h9Bx5qGQMRF4gwWWgbBnglp+8aSdj4W9wWkq62EeJHlQ6wDd/RKoqC0t:pgnwWjw465l+qU67FYWg+YWgYWeoXqgm
MD5 SHA1 SHA512 SSDEEP

Submit Download

jsse.jar

Path C:\Users\Admin\AppData\Roaming\Oracle\lib\jsse.jar
Size 1.7MB
SHA256 fffafe7e2bacef79280a4565b5d1075320a8ec38dff7978c8fe6c033b6df49d0
MD5 01408480f5c65da8c74ecfde0eed1a72
SHA1 2f1cb5df6d4879de8b0827d160e9bb281f829a3a
SHA512 ae585f4825073da19f611bb7d11a1d075b4998bc3f7d53a67cdba778e0729e0b5134ce8fc49897f67d39e46f1209524ab53ab4551defc6a4127012e332f15d61
SSDEEP 12288:HjlqLkoqdD4YH+b8RseFxOs/Mf8AMBIbvTHegwbC3:HjlnPHq8R7FX/SoBs1
MD5 SHA1 SHA512 SSDEEP

Submit Download

meta-index

Path C:\Users\Admin\AppData\Roaming\Oracle\lib\meta-index
Size 2KB
SHA256 4af21954cdf398d1eae795b6886ca2581dac9f2f1d41c98c6ed9b5dbc3e3c1d4
MD5 91aa6ea7320140f30379f758d626e59d
SHA1 3be2febe28723b1033ccdaa110eaf59bbd6d1f96
SHA512 03428803f1d644d89eb4c0dcbdea93acaac366d35fc1356ccabf83473f4fef7924edb771e44c721103cec22d94a179f092d1bfd1c0a62130f076eb82a826d7cb
MD5 SHA1 SHA512

Submit Download

resources.jar

Path C:\Users\Admin\AppData\Roaming\Oracle\lib\resources.jar
Size 3.4MB
SHA256 65a6d0d74b193af857dd5252d59e8bf9214ddb360b26c1da816b029bf0cf208c
MD5 c5152884c2676dd45109cfeba088a549
SHA1 8fe4fd1980bdc4139491b0dd963eb830b70bb8d6
SHA512 ed8d4777609024960a7037f42937de41c434df4ff7062b43f03f0060e326bdef7917e941c9d3db5a8ec7a65f4890ef3dd53c87401f9568e6f068f2930d558e61
SSDEEP 49152:V8qj1I+WQRuLxNJYtFAAkSRKPVujsdWiqUh7yloDqq59wfkOrwBnaN9R3+HgGK2w:zKlYL
MD5 SHA1 SHA512 SSDEEP

Submit Download

rt.jar

Path C:\Users\Admin\AppData\Roaming\Oracle\lib\rt.jar
Size 5.1MB
SHA256 db11a3ae18b586d0655e3d3f605af0416eef089c405053b40c054a1866173c53
MD5 6048ed6c51cefb72b50a26416cdef826
SHA1 1f48573e8a776043b4c15d9ab83b986d427bcc2f
SHA512 c552dc81bc1f448e40fd6fde8b7ddb8d55f92e60bcd6f0dcc25f94a9dbf2c78e27ab63bfacf7dbb2f36570275180622169872e858b387edc1f7de13f3d5195aa
SSDEEP 49152:YA0cK/PrSqQ2wdg9o3r8CvN8FC/9junDxbbVPoFvgnBbl8PcZi64/jxYVI0EFZbt:J0cK/PrSqQ2OjAbWae3NQLDVwp
MD5 SHA1 SHA512 SSDEEP

Submit Download

ID.txt

Path C:\Users\Admin\pqjlxAqAzSW\ID.txt
Size 47B
SHA256 3e7f2b3378b4b78785f7b6a88b417d3027805906c095f3d87f82ef5d0e614abe
MD5 4a330631a59354975b8de64ffeffa241
SHA1 18db5b20ae7a342a6dcac844603022b823becd88
SHA512 aca02ce7426a738d403f5aa5bf32ee09bd7ded5fc6a54c1b70b066cc441a978f695a9331894ba7150c44e81026e7d6fed065933de1e8a521b7382e92836faa2c
MD5 SHA1 SHA512

Submit Download

UrDqSIuIMXE.mWSfWT

Path C:\Users\Admin\pqjlxAqAzSW\UrDqSIuIMXE.mWSfWT
Size 136KB
SHA256 f1154ad2d49cd0ec55e739c53bc3cb11f889437c55ed83b9a56195d6303f3993
MD5 c1f6345aa9ab72bde64692c605e8e64d
SHA1 c73eaf801a1118a6205fc18e6eabe5797f5be794
SHA512 509036542a971d6bd309eb593b6f1b1c303f6acb153b1fb7044ec19c8ad2ffa618dbec1479abdfdebdf589e74dd543daa5da53240a99cf48ddbfe17b704aea25
SSDEEP 3072:ZIboS64tI9rSKbd+zxmRCS/nv/SOePCTFsUN1QlZAQvLHRzsMXPspC:ZsoS64WSGboSqO06FNN6lZAQTxzsMXEC
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2936-941-0x0000020898240000-0x0000020898241000-memory.dmp

Download

memory/2936-35-0x0000020898240000-0x0000020898241000-memory.dmp

Download

memory/2936-41-0x0000020899A40000-0x000002089AA40000-memory.dmp

Download

memory/2936-4-0x0000020899A40000-0x000002089AA40000-memory.dmp

Download

memory/2936-117-0x0000020899A40000-0x000002089AA40000-memory.dmp

Download

memory/2936-45-0x0000020899A40000-0x000002089AA40000-memory.dmp

Download

memory/2936-18-0x0000020899A40000-0x000002089AA40000-memory.dmp

Download

memory/2936-12-0x0000020898240000-0x0000020898241000-memory.dmp

Download

memory/2936-47-0x0000020898240000-0x0000020898241000-memory.dmp

Download

memory/2936-29-0x0000020899A40000-0x000002089AA40000-memory.dmp

Download

memory/3684-942-0x0000022BBF810000-0x0000022BC0810000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads