Analysis
- max time kernel
148s - max time network
105s - platform
windows10-2004_x64 - resource
win10v2004-20240419-en - resource tags
- submitted
07/05/2024, 16:59
General
- Target 211e58b0dc87cd73d185a010e23d11d3_JaffaCakes118.jar
- Size 473KB
- Sample240507-vhvleafd2y
- SHA256 11c04f89ef123f57f5d8b66ca719023d88315a50b4e6e263853d1c71a924d447
Malware Config
Signatures
- AdWind
A Java-based RAT family operated as malware-as-a-service.
- Modifies file permissions 1 TTPs 1 IoCs
- Drops file in System32 directory 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 26 IoCs
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\211e58b0dc87cd73d185a010e23d11d3_JaffaCakes118.jar1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
-
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar C:\Users\Admin\AppData\Local\Temp\_0.57846362200509025084006977332734481.class2⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive6729904825220217397.vbs3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive6729904825220217397.vbs4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive2247937300642771351.vbs3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive2247937300642771351.vbs4⤵
-
-
-
C:\Windows\SYSTEM32\xcopy.exexcopy "C:\Program Files\Java\jre-1.8" "C:\Users\Admin\AppData\Roaming\Oracle\" /e3⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive184151615095386950.vbs2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive184151615095386950.vbs3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive7759537575074508372.vbs2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive7759537575074508372.vbs3⤵
-
-
-
C:\Windows\SYSTEM32\xcopy.exexcopy "C:\Program Files\Java\jre-1.8" "C:\Users\Admin\AppData\Roaming\Oracle\" /e2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
3903daac9bc4a3b7.timestamp
Retrive184151615095386950.vbs
Retrive2247937300642771351.vbs
_0.57846362200509025084006977332734481.class
83aa4cc77f591dfc2374580bbd95f6ba_b14b7d45-cf6a-4517-be56-622a70b8ef33
msvcp140.dll
vcruntime140.dll
vcruntime140_1.dll
messages_zh_TW.properties
win32_CopyNoDrop32x32.gif
US_export_policy.jar
memory/400-1024-0x0000023C00330000-0x0000023C00340000-memory.dmp
memory/400-1027-0x0000023C00340000-0x0000023C00350000-memory.dmp
memory/400-40-0x0000023C00270000-0x0000023C00280000-memory.dmp
memory/400-1021-0x0000023C765C0000-0x0000023C765C1000-memory.dmp
memory/400-57-0x0000023C002C0000-0x0000023C002D0000-memory.dmp
memory/400-53-0x0000023C002B0000-0x0000023C002C0000-memory.dmp
memory/400-52-0x0000023C002A0000-0x0000023C002B0000-memory.dmp
memory/400-51-0x0000023C00290000-0x0000023C002A0000-memory.dmp
memory/400-1015-0x0000023C00320000-0x0000023C00330000-memory.dmp
memory/400-1011-0x0000023C765C0000-0x0000023C765C1000-memory.dmp
memory/400-60-0x0000023C002D0000-0x0000023C002E0000-memory.dmp
memory/400-1009-0x0000023C00310000-0x0000023C00320000-memory.dmp
memory/400-63-0x0000023C002E0000-0x0000023C002F0000-memory.dmp
memory/400-1007-0x0000023C00300000-0x0000023C00310000-memory.dmp
memory/400-69-0x0000023C765C0000-0x0000023C765C1000-memory.dmp
memory/400-1004-0x0000023C002F0000-0x0000023C00300000-memory.dmp
memory/400-74-0x0000023C00300000-0x0000023C00310000-memory.dmp
memory/400-73-0x0000023C002F0000-0x0000023C00300000-memory.dmp
memory/400-1002-0x0000023C765C0000-0x0000023C765C1000-memory.dmp
memory/400-71-0x0000023C00000000-0x0000023C00270000-memory.dmp
memory/400-86-0x0000023C00310000-0x0000023C00320000-memory.dmp
memory/400-128-0x0000023C00350000-0x0000023C00360000-memory.dmp
memory/400-42-0x0000023C00280000-0x0000023C00290000-memory.dmp
memory/400-89-0x0000023C00270000-0x0000023C00280000-memory.dmp
memory/400-869-0x0000023C765C0000-0x0000023C765C1000-memory.dmp
memory/400-1030-0x0000023C00350000-0x0000023C00360000-memory.dmp
memory/400-1033-0x0000023C00360000-0x0000023C00370000-memory.dmp
memory/400-1034-0x0000023C00370000-0x0000023C00380000-memory.dmp
memory/400-98-0x0000023C00320000-0x0000023C00330000-memory.dmp
memory/400-1042-0x0000023C765C0000-0x0000023C765C1000-memory.dmp
memory/400-96-0x0000023C00280000-0x0000023C00290000-memory.dmp
memory/400-389-0x0000023C765C0000-0x0000023C765C1000-memory.dmp
memory/400-106-0x0000023C002B0000-0x0000023C002C0000-memory.dmp
memory/400-105-0x0000023C002A0000-0x0000023C002B0000-memory.dmp
memory/400-104-0x0000023C00290000-0x0000023C002A0000-memory.dmp
memory/400-1054-0x0000023C765C0000-0x0000023C765C1000-memory.dmp
memory/400-18-0x0000023C00000000-0x0000023C00270000-memory.dmp
memory/400-114-0x0000023C002D0000-0x0000023C002E0000-memory.dmp
memory/400-113-0x0000023C00330000-0x0000023C00340000-memory.dmp
memory/400-118-0x0000023C002E0000-0x0000023C002F0000-memory.dmp
memory/400-119-0x0000023C00340000-0x0000023C00350000-memory.dmp
memory/400-110-0x0000023C002C0000-0x0000023C002D0000-memory.dmp
memory/400-132-0x0000023C00370000-0x0000023C00380000-memory.dmp
memory/400-131-0x0000023C00360000-0x0000023C00370000-memory.dmp
memory/3300-62-0x000001C8D8460000-0x000001C8D86D0000-memory.dmp
memory/3300-129-0x000001C8D87C0000-0x000001C8D87D0000-memory.dmp
memory/3300-130-0x000001C8D87D0000-0x000001C8D87E0000-memory.dmp
memory/3300-127-0x000001C8D87B0000-0x000001C8D87C0000-memory.dmp
memory/3300-126-0x000001C8D8760000-0x000001C8D8770000-memory.dmp
memory/3300-111-0x000001C8D8750000-0x000001C8D8760000-memory.dmp
memory/3300-112-0x000001C8D87A0000-0x000001C8D87B0000-memory.dmp
memory/3300-102-0x000001C8D8730000-0x000001C8D8740000-memory.dmp
memory/3300-103-0x000001C8D8740000-0x000001C8D8750000-memory.dmp
memory/3300-107-0x000001C8D8790000-0x000001C8D87A0000-memory.dmp
memory/3300-445-0x000001C8D6C60000-0x000001C8D6C61000-memory.dmp
memory/3300-97-0x000001C8D8720000-0x000001C8D8730000-memory.dmp
memory/3300-92-0x000001C8D6C60000-0x000001C8D6C61000-memory.dmp
memory/3300-88-0x000001C8D86F0000-0x000001C8D8700000-memory.dmp
memory/3300-90-0x000001C8D8710000-0x000001C8D8720000-memory.dmp
memory/3300-91-0x000001C8D8780000-0x000001C8D8790000-memory.dmp
memory/3300-84-0x000001C8D86E0000-0x000001C8D86F0000-memory.dmp
memory/3300-85-0x000001C8D8700000-0x000001C8D8710000-memory.dmp
memory/3300-72-0x000001C8D8770000-0x000001C8D8780000-memory.dmp
memory/3300-1003-0x000001C8D8770000-0x000001C8D8780000-memory.dmp
memory/3300-75-0x000001C8D86D0000-0x000001C8D86E0000-memory.dmp
memory/3300-66-0x000001C8D8760000-0x000001C8D8770000-memory.dmp
memory/3300-2-0x000001C8D8460000-0x000001C8D86D0000-memory.dmp
memory/3300-49-0x000001C8D8730000-0x000001C8D8740000-memory.dmp
memory/3300-1013-0x000001C8D8780000-0x000001C8D8790000-memory.dmp
memory/3300-50-0x000001C8D8740000-0x000001C8D8750000-memory.dmp
memory/3300-1018-0x000001C8D8790000-0x000001C8D87A0000-memory.dmp
memory/3300-58-0x000001C8D8750000-0x000001C8D8760000-memory.dmp
memory/3300-1022-0x000001C8D87A0000-0x000001C8D87B0000-memory.dmp
memory/3300-39-0x000001C8D8700000-0x000001C8D8710000-memory.dmp
memory/3300-41-0x000001C8D8710000-0x000001C8D8720000-memory.dmp
memory/3300-1029-0x000001C8D87B0000-0x000001C8D87C0000-memory.dmp
memory/3300-43-0x000001C8D8720000-0x000001C8D8730000-memory.dmp
memory/3300-1031-0x000001C8D87C0000-0x000001C8D87D0000-memory.dmp
memory/3300-1032-0x000001C8D87D0000-0x000001C8D87E0000-memory.dmp
memory/3300-38-0x000001C8D86F0000-0x000001C8D8700000-memory.dmp
memory/3300-35-0x000001C8D6C60000-0x000001C8D6C61000-memory.dmp
memory/3300-30-0x000001C8D86E0000-0x000001C8D86F0000-memory.dmp
memory/3300-28-0x000001C8D86D0000-0x000001C8D86E0000-memory.dmp