Overview

overview

10

Static

static

1

ORDER-2452298.XLS.js

windows7-x64

10

ORDER-2452298.XLS.js

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ORDER-2452298.XLS.js

  • Size

    721KB

  • Sample

    240523-hx74tsha7y

  • MD5

    aea8cd84b955bbcb32afc1689859b4e8

  • SHA1

    51571e4e76b3c3ec9c998eebf90c49461dab6b19

  • SHA256

    44ef24d5b5f3dd42944b06dcbc7778fee151dedbb005673b683831040315d34c

  • SHA512

    9b71ad0bc516da946d88f8d0aad3a54556ab256db367fe0d7d63c88ae18388dc5fb823c4f8bc6b8ef247c33331d7baf7229dcb391dbfef2c9fb1265d273b5ed5

  • SSDEEP

    12288:XgKde2i4XlRhaklFFm7Bpr1QkTt4awZdpF878NSTrQFerz0Ov+0cFYLvvdQIqjkn:X1deEXlBlvqLHmdpF87aMXZ/cFavykrr

Score
10/10
adwinddiscoveryexecutionpersistencetrojan

Malware Config

Targets

    • Target

      ORDER-2452298.XLS.js

    • Size

      721KB

    • MD5

      aea8cd84b955bbcb32afc1689859b4e8

    • SHA1

      51571e4e76b3c3ec9c998eebf90c49461dab6b19

    • SHA256

      44ef24d5b5f3dd42944b06dcbc7778fee151dedbb005673b683831040315d34c

    • SHA512

      9b71ad0bc516da946d88f8d0aad3a54556ab256db367fe0d7d63c88ae18388dc5fb823c4f8bc6b8ef247c33331d7baf7229dcb391dbfef2c9fb1265d273b5ed5

    • SSDEEP

      12288:XgKde2i4XlRhaklFFm7Bpr1QkTt4awZdpF878NSTrQFerz0Ov+0cFYLvvdQIqjkn:X1deEXlBlvqLHmdpF87aMXZ/cFavykrr

    Score
    10/10
    adwindexecutionpersistencetrojandiscovery

    • AdWind

      A Java-based RAT family operated as malware-as-a-service.

      trojanadwind

    • Class file contains resources related to AdWind

    • Detect jar appended to MSI

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks