adwind | 4a21c67a66d46f626e69149edd166be362af67f632003bb02dfbf16d922edf5a

Analysis

max time kernel
96s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/04/2024, 00:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NEXT MONTH QUATATION.jar
Size 630KB
Sample240411-ae3sdsfa57
SHA256 58c1ba56c322723ffe253d1b17a88006e22e5c6970a75e75d2d6e6f1c2b7982a
MD5 1cb26ec11c4df6bc04d20aae4830a1e8
SHA1 829358de0c0cb8d94932fb1183ee6a244efc7c3f
SHA512 d5cee397d039d909d2b86ab4dc7ec4b49ea617022af32d0dc54f22a010a9f074d933bb795a344ab083f9195d545ed167f56bcdf8d82f574aead8a146d330922d
SSDEEP 12288:03hVSl7lusTldtsKWic1EX16X/55Lc67uoYsUnflaDC3zTKiAKX1ArEF:UV2luGl4ic6IL7zUD3zmbKX1A2
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

adwind discovery persistence trojan

Malware Config

Signatures

AdWind
A Java-based RAT family operated as malware-as-a-service.
trojan adwind

Class file contains resources related to AdWind 1 IoCs

resource	yara_rule
sample	family_adwind5

Blocklisted process makes network request 2 IoCs

flow	pid	Process
17	3800	WScript.exe
26	3800	WScript.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation	WScript.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zIrnwBwvKJ.vbs	WScript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zIrnwBwvKJ.vbs	WScript.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5104	icacls.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zIrnwBwvKJ = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\zIrnwBwvKJ.vbs\""	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ntfsmgr = "\"C:\\Program Files\\Java\\jre-1.8\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\ntfsmgr.jar\""	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zIrnwBwvKJ = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\zIrnwBwvKJ.vbs\""	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4448	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings	wscript.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2360	javaw.exe
3248	java.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4984 wrote to memory of 5104	4984	java.exe	86
PID 4984 wrote to memory of 5104	4984	java.exe	86
PID 4984 wrote to memory of 2020	4984	java.exe	88
PID 4984 wrote to memory of 2020	4984	java.exe	88
PID 2020 wrote to memory of 3800	2020	wscript.exe	89
PID 2020 wrote to memory of 3800	2020	wscript.exe	89
PID 2020 wrote to memory of 3596	2020	wscript.exe	90
PID 2020 wrote to memory of 3596	2020	wscript.exe	90
PID 3800 wrote to memory of 1804	3800	WScript.exe	92
PID 3800 wrote to memory of 1804	3800	WScript.exe	92
PID 3596 wrote to memory of 2444	3596	cmd.exe	94
PID 3596 wrote to memory of 2444	3596	cmd.exe	94
PID 1804 wrote to memory of 4448	1804	cmd.exe	95
PID 1804 wrote to memory of 4448	1804	cmd.exe	95
PID 2020 wrote to memory of 2360	2020	wscript.exe	96
PID 2020 wrote to memory of 2360	2020	wscript.exe	96
PID 2360 wrote to memory of 3248	2360	javaw.exe	98
PID 2360 wrote to memory of 3248	2360	javaw.exe	98

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar "C:\Users\Admin\AppData\Local\Temp\NEXT MONTH QUATATION.jar"
1⤵
- Suspicious use of WriteProcessMemory
PID:4984
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:5104
- C:\Windows\SYSTEM32\wscript.exe
  wscript C:\Users\Admin\tolpikdbqf.vbs
  2⤵
  - Checks computer location settings
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2020
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\zIrnwBwvKJ.vbs"
    3⤵
    - Blocklisted process makes network request
    - Checks computer location settings
    - Drops startup file
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3800
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c schtasks /create /sc minute /mo 30 /tn Skypee /tr "C:\Users\Admin\AppData\Local\Temp\meee.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1804
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /sc minute /mo 30 /tn Skypee /tr "C:\Users\Admin\AppData\Local\Temp\meee.vbs"
        5⤵
        Creates scheduled task(s)
        
        PID:4448
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -version 2> C:\Users\Admin\AppData\Local\Temp\output.txt
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3596
  - - C:\Program Files\Java\jre-1.8\bin\javaw.exe
      "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -version
      4⤵
      PID:2444
- - C:\Program Files\Java\jre-1.8\bin\javaw.exe
    "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\ntfsmgr.jar"
    3⤵
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2360
  - - C:\Program Files\Java\jre-1.8\bin\java.exe
      "C:\Program Files\Java\jre-1.8\bin\java.exe" -jar C:\Users\Admin\AppData\Local\Temp\_0.0147640450498123243245311602889028457.class
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:3248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 360f53cfb938383d83768cd6cd6e8c616762ac043221fe56be9494835aa9cec4
MD5 1e881adafe6e060a079014b8552c72f2
SHA1 f9ebbfe3777cb82d2c101c7a00eb9b815ed0c5c7
SHA512 b1dc0110181a5d62562287a5764f425494f0a81c942b7b7931b14ee544dc26999a770ac3360dd5c5bd97ecc768b9cb9266356920d4a992b2a51829454491b563
MD5 SHA1 SHA512

Submit Download

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 349f0db052a391d1a769d313a0ed10fdc68f8ae6b9e4c58150a3be4038068b0e
MD5 3aeb24dc0fffe8de46d65419d7d16d1a
SHA1 519fe8bf3208577d39d79b0d87ea8a72d18952f2
SHA512 520f5b73720252058d4409e2ca58eb23e899f4b30df061f8a181bc72ccc3d35e0cfb0cde76a7813e81eb05516c8ed2603802c8b856086fa8c50eec69f1d162c6
MD5 SHA1 SHA512

Submit Download

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 38e79b6134531c943a0f8b30e9f5945d6142ac7971f2726ef9a8335f486256f9
MD5 030f275b4b5e697203453ae652cc526a
SHA1 2622546263a8ba13e58b8abdd8e0a668ab337ec2
SHA512 70df770ccabbb6aea7a1b931b0f8be2ca3ecb56648481f91569bd554949dd23ecdd3362663e96bbbba1ba63803c447f8f869fb3ea05eac368cf99355f945b7a0
MD5 SHA1 SHA512

Submit Download

_0.0147640450498123243245311602889028457.class

Path C:\Users\Admin\AppData\Local\Temp\_0.0147640450498123243245311602889028457.class
Size 241KB
SHA256 97d585b6aff62fb4e43e7e6a5f816dcd7a14be11a88b109a9ba9e8cd4c456eb9
MD5 781fb531354d6f291f1ccab48da6d39f
SHA1 9ce4518ebcb5be6d1f0b5477fa00c26860fe9a68
SHA512 3e6630f5feb4a3eb1dac7e9125ce14b1a2a45d7415cf44cea42bc51b2a9aa37169ee4a4c36c888c8f2696e7d6e298e2ad7b2f4c22868aaa5948210eb7db220d8
SSDEEP 6144:WI5pxUZ7Gvi8ulm+yV/rIF0/MO2qnan1J7pXESN6U:J5pxAGqNkrIq/MO2qnA
MD5 SHA1 SHA512 SSDEEP

Submit Download

output.txt

Path C:\Users\Admin\AppData\Local\Temp\output.txt
Size 147B
SHA256 afdd2e30a49d992e02746954a658ca1d8af5460c2f70607ecdb2b68883cfc421
MD5 878f394e749aeb94775a31acccc09414
SHA1 4255a663fa9b4c141fde96869071d1d29450ced8
SHA512 23637278397943d779cab6b6f3730d5708c8374ac18bed4f4e6b69a63a7e5304d39c5c2c8c48206812d0a2f0cc209620c92c57a39bb489ec9fad63a323f5d12d
MD5 SHA1 SHA512

Submit Download

83aa4cc77f591dfc2374580bbd95f6ba_d1f2fdfb-e063-43be-88aa-b9b0326295b4

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-983155329-280873152-1838004294-1000\83aa4cc77f591dfc2374580bbd95f6ba_d1f2fdfb-e063-43be-88aa-b9b0326295b4
Size 45B
SHA256 11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238
MD5 c8366ae350e7019aefc9d1e6e6a498c6
SHA1 5731d8a3e6568a5f2dfbbc87e3db9637df280b61
SHA512 33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd
MD5 SHA1 SHA512

Submit Download

ntfsmgr.jar

Path C:\Users\Admin\AppData\Roaming\ntfsmgr.jar
Size 473KB
SHA256 a79677ffa5017c21535f60f63aecf177495e7195fc12a43297473e9466656a0d
MD5 a30fbad8205f8a82be22a7ece68d05ab
SHA1 85cdd45d955905aaa91b91e2e57f0023dd7a48cd
SHA512 ceaf6c762b1ca569319f3fb0c4ba6f158292c6037e1fdbbd749e56b08eb48cb46a3d6a9cf309dcc1c6438b9c204b1b9f207bd5b9836d5c1889f92b0e84a9091d
SSDEEP 12288:YCZKOgTrCdujMW1RH6v5pxogQNUhIK/0c2qnAv:YCN4b1IsS7B2qnK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zIrnwBwvKJ.vbs

Path C:\Users\Admin\AppData\Roaming\zIrnwBwvKJ.vbs
Size 21KB
SHA256 1bd9b6b631d33dc04b0d11abf126b99170977c55685f9b98cb4e9744ea868057
MD5 0727e1dcb41f247768f7d272746c1446
SHA1 1b092e6ad22651671e06c2f1135e84f3a373dcf2
SHA512 5173c71773ade8ddb74bcee6b8dde1bcfb58c29fbdc6e811ba7ede4765d62f8231549333e4e62f102a2a963f6cc8e740f633e345d4fa6ff3ce123424a8e3268d
SSDEEP 384:4GUCccC82W3s9X1nDI8CctEVIGz+bur+I+aBQpqdp1A/v/0GMLXJ2mGqgu6ypceY:4GUCcd3nXdtEGGTdpW/vVMJbGqgu6ki
MD5 SHA1 SHA512 SSDEEP

Submit Download

tolpikdbqf.vbs

Path C:\Users\Admin\tolpikdbqf.vbs
Size 925KB
SHA256 ca87cbfaa2b87c66b93bf761540e9dd17d39d960f43584ff783cfd9057401bf8
MD5 d1e2f086bb98c98fa0bb450eb9196e11
SHA1 109823833dcc5c59d621f6c510fe21371bcf2b26
SHA512 103e81b5297c2bd320da6be356bf5cdbaaa6763bacecc9620ad41f42f182b9da3bed5fdb10b979f7bc2fbda2fc06b70e595c68d156b3c82f3c824b6f3742323a
SSDEEP 24576:OHHa7RFlyVSoGzHztSragCXOYZzgl4thy:mCzeBuEqhy
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2360-96-0x000001B725F10000-0x000001B726F10000-memory.dmp

Download

memory/2360-91-0x000001B725F10000-0x000001B726F10000-memory.dmp

Download

memory/2360-52-0x000001B725EF0000-0x000001B725EF1000-memory.dmp

Download

memory/2360-61-0x000001B725EF0000-0x000001B725EF1000-memory.dmp

Download

memory/2360-43-0x000001B725F10000-0x000001B726F10000-memory.dmp

Download

memory/2360-77-0x000001B725F10000-0x000001B726F10000-memory.dmp

Download

memory/2360-122-0x000001B725EF0000-0x000001B725EF1000-memory.dmp

Download

memory/2360-113-0x000001B725EF0000-0x000001B725EF1000-memory.dmp

Download

memory/2360-109-0x000001B725EF0000-0x000001B725EF1000-memory.dmp

Download

memory/2444-34-0x000002C5E34F0000-0x000002C5E34F1000-memory.dmp

Download

memory/2444-26-0x000002C5E4DF0000-0x000002C5E5DF0000-memory.dmp

Download

memory/3248-62-0x0000021F00000000-0x0000021F01000000-memory.dmp

Download

memory/3248-110-0x0000021F7F100000-0x0000021F7F101000-memory.dmp

Download

memory/3248-82-0x0000021F7F100000-0x0000021F7F101000-memory.dmp

Download

memory/3248-116-0x0000021F7F100000-0x0000021F7F101000-memory.dmp

Download

memory/3248-81-0x0000021F7F100000-0x0000021F7F101000-memory.dmp

Download

memory/3248-127-0x0000021F7F100000-0x0000021F7F101000-memory.dmp

Download

memory/4984-4-0x000001D900000000-0x000001D901000000-memory.dmp

Download

memory/4984-14-0x000001D9747C0000-0x000001D9747C1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads