Overview

overview

10

Static

static

1

ORDER-2452298.XLS.js

windows7-x64

10

ORDER-2452298.XLS.js

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bc4332dccc1fa3c7c057435036712aa886316ec7091b94f5ce33cb852ae13a29.tar

  • Size

    516KB

  • Sample

    240523-ceefxahg94

  • MD5

    f58b56d4859b9e818494672a2bcfeb55

  • SHA1

    9778b908fe4b5f7ccc7a0dcd49d5c27018471a2a

  • SHA256

    bc4332dccc1fa3c7c057435036712aa886316ec7091b94f5ce33cb852ae13a29

  • SHA512

    d2b9af98de431b631857ae6ded6786444deb45c067e4e270d7dfda1f624e52fe5a5fbb9cb17885bf224d1f90085df86d498f0adaeb30b8d76ae8998ebd992c41

  • SSDEEP

    12288:jPagaCuoaFOuWj5RDF4chps/AjsfPEnfaD4t:qCmFOPNRDzhpeA4Enfact

Score
10/10
adwinddiscoveryexecutionpersistencetrojan

Malware Config

Targets

    • Target

      ORDER-2452298.XLS.js

    • Size

      721KB

    • MD5

      aea8cd84b955bbcb32afc1689859b4e8

    • SHA1

      51571e4e76b3c3ec9c998eebf90c49461dab6b19

    • SHA256

      44ef24d5b5f3dd42944b06dcbc7778fee151dedbb005673b683831040315d34c

    • SHA512

      9b71ad0bc516da946d88f8d0aad3a54556ab256db367fe0d7d63c88ae18388dc5fb823c4f8bc6b8ef247c33331d7baf7229dcb391dbfef2c9fb1265d273b5ed5

    • SSDEEP

      12288:XgKde2i4XlRhaklFFm7Bpr1QkTt4awZdpF878NSTrQFerz0Ov+0cFYLvvdQIqjkn:X1deEXlBlvqLHmdpF87aMXZ/cFavykrr

    Score
    10/10
    adwindexecutionpersistencetrojandiscovery

    • AdWind

      A Java-based RAT family operated as malware-as-a-service.

      trojanadwind

    • Class file contains resources related to AdWind

    • Detect jar appended to MSI

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks