Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
25/05/2024, 16:07
General
- Target 728334ea74c5d269af77fbd400d974e2_JaffaCakes118.jar
- Size 499KB
- Sample240525-tkmg5saa4x
- SHA256 d801b08d9fa088c66f8da4b3fe49861e8524e6289e41faf9c153cfa2af535628
Malware Config
Signatures
- AdWind
A Java-based RAT family operated as malware-as-a-service.
- Modifies file permissions 1 TTPs 1 IoCs
- Drops file in System32 directory 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 26 IoCs
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\728334ea74c5d269af77fbd400d974e2_JaffaCakes118.jar1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
-
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar C:\Users\Admin\AppData\Local\Temp\_0.33776876146290867433883882708124893.class2⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive8414076168496143933.vbs3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive8414076168496143933.vbs4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive7678576743461825216.vbs3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive7678576743461825216.vbs4⤵
-
-
-
C:\Windows\SYSTEM32\xcopy.exexcopy "C:\Program Files\Java\jre-1.8" "C:\Users\Admin\AppData\Roaming\Oracle\" /e3⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive3230120483752177055.vbs2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive3230120483752177055.vbs3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive8303722144880240789.vbs2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive8303722144880240789.vbs3⤵
-
-
-
C:\Windows\SYSTEM32\xcopy.exexcopy "C:\Program Files\Java\jre-1.8" "C:\Users\Admin\AppData\Roaming\Oracle\" /e2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
3903daac9bc4a3b7.timestamp
Retrive3230120483752177055.vbs
Retrive7678576743461825216.vbs
_0.33776876146290867433883882708124893.class
83aa4cc77f591dfc2374580bbd95f6ba_39fbc0df-d496-4ae0-b1d7-bde60e245d90
msvcp140.dll
vcruntime140.dll
vcruntime140_1.dll
messages_zh_TW.properties
win32_CopyNoDrop32x32.gif
US_export_policy.jar
memory/848-70-0x000002ECAEF50000-0x000002ECAEF60000-memory.dmp
memory/848-38-0x000002ECAEEC0000-0x000002ECAEED0000-memory.dmp
memory/848-53-0x000002ECAEC50000-0x000002ECAEEC0000-memory.dmp
memory/848-1141-0x000002ECAEFC0000-0x000002ECAEFD0000-memory.dmp
memory/848-1142-0x000002ECAEFD0000-0x000002ECAEFE0000-memory.dmp
memory/848-1135-0x000002ECAEFB0000-0x000002ECAEFC0000-memory.dmp
memory/848-62-0x000002ECAEF40000-0x000002ECAEF50000-memory.dmp
memory/848-1132-0x000002ECAEFA0000-0x000002ECAEFB0000-memory.dmp
memory/848-1131-0x000002ECAEF90000-0x000002ECAEFA0000-memory.dmp
memory/848-1126-0x000002ECAEF80000-0x000002ECAEF90000-memory.dmp
memory/848-2-0x000002ECAEC50000-0x000002ECAEEC0000-memory.dmp
memory/848-1119-0x000002ECAEF70000-0x000002ECAEF80000-memory.dmp
memory/848-48-0x000002ECAEF10000-0x000002ECAEF20000-memory.dmp
memory/848-73-0x000002ECAEF60000-0x000002ECAEF70000-memory.dmp
memory/848-12-0x000002ECAD480000-0x000002ECAD481000-memory.dmp
memory/848-50-0x000002ECAEF30000-0x000002ECAEF40000-memory.dmp
memory/848-44-0x000002ECAEF00000-0x000002ECAEF10000-memory.dmp
memory/848-88-0x000002ECAD480000-0x000002ECAD481000-memory.dmp
memory/848-87-0x000002ECAD480000-0x000002ECAD481000-memory.dmp
memory/848-115-0x000002ECAEEE0000-0x000002ECAEEF0000-memory.dmp
memory/848-114-0x000002ECAEED0000-0x000002ECAEEE0000-memory.dmp
memory/848-113-0x000002ECAEEC0000-0x000002ECAEED0000-memory.dmp
memory/848-112-0x000002ECAEF70000-0x000002ECAEF80000-memory.dmp
memory/848-43-0x000002ECAEEF0000-0x000002ECAEF00000-memory.dmp
memory/848-40-0x000002ECAEEE0000-0x000002ECAEEF0000-memory.dmp
memory/848-124-0x000002ECAEF00000-0x000002ECAEF10000-memory.dmp
memory/848-39-0x000002ECAEED0000-0x000002ECAEEE0000-memory.dmp
memory/848-182-0x000002ECAEF10000-0x000002ECAEF20000-memory.dmp
memory/848-188-0x000002ECAEF30000-0x000002ECAEF40000-memory.dmp
memory/848-49-0x000002ECAEF20000-0x000002ECAEF30000-memory.dmp
memory/848-123-0x000002ECAEEF0000-0x000002ECAEF00000-memory.dmp
memory/848-240-0x000002ECAEF60000-0x000002ECAEF70000-memory.dmp
memory/848-127-0x000002ECAD480000-0x000002ECAD481000-memory.dmp
memory/848-235-0x000002ECAEF50000-0x000002ECAEF60000-memory.dmp
memory/848-183-0x000002ECAEF20000-0x000002ECAEF30000-memory.dmp
memory/848-233-0x000002ECAEFD0000-0x000002ECAEFE0000-memory.dmp
memory/848-232-0x000002ECAEFC0000-0x000002ECAEFD0000-memory.dmp
memory/848-185-0x000002ECAEF80000-0x000002ECAEF90000-memory.dmp
memory/848-187-0x000002ECAEF90000-0x000002ECAEFA0000-memory.dmp
memory/848-205-0x000002ECAEFA0000-0x000002ECAEFB0000-memory.dmp
memory/848-206-0x000002ECAEFB0000-0x000002ECAEFC0000-memory.dmp
memory/848-226-0x000002ECAEF40000-0x000002ECAEF50000-memory.dmp
memory/3120-78-0x0000015A5C6E0000-0x0000015A5C6F0000-memory.dmp
memory/3120-25-0x0000015A5C3F0000-0x0000015A5C660000-memory.dmp
memory/3120-201-0x0000015A5C660000-0x0000015A5C670000-memory.dmp
memory/3120-228-0x0000015A5C6A0000-0x0000015A5C6B0000-memory.dmp
memory/3120-229-0x0000015A5C730000-0x0000015A5C740000-memory.dmp
memory/3120-186-0x0000015A5C720000-0x0000015A5C730000-memory.dmp
memory/3120-231-0x0000015A5C740000-0x0000015A5C750000-memory.dmp
memory/3120-184-0x0000015A5C710000-0x0000015A5C720000-memory.dmp
memory/3120-234-0x0000015A5C6B0000-0x0000015A5C6C0000-memory.dmp
memory/3120-236-0x0000015A5C6C0000-0x0000015A5C6D0000-memory.dmp
memory/3120-241-0x0000015A5C750000-0x0000015A5C760000-memory.dmp
memory/3120-225-0x0000015A5C680000-0x0000015A5C690000-memory.dmp
memory/3120-125-0x0000015A5C700000-0x0000015A5C710000-memory.dmp
memory/3120-110-0x0000015A5C3F0000-0x0000015A5C660000-memory.dmp
memory/3120-111-0x0000015A5C6F0000-0x0000015A5C700000-memory.dmp
memory/3120-77-0x0000015A5C6D0000-0x0000015A5C6E0000-memory.dmp
memory/3120-227-0x0000015A5C690000-0x0000015A5C6A0000-memory.dmp
memory/3120-220-0x0000015A5C670000-0x0000015A5C680000-memory.dmp
memory/3120-75-0x0000015A5C3D0000-0x0000015A5C3D1000-memory.dmp
memory/3120-1112-0x0000015A5C6D0000-0x0000015A5C6E0000-memory.dmp
memory/3120-1113-0x0000015A5C6E0000-0x0000015A5C6F0000-memory.dmp
memory/3120-1117-0x0000015A5C6F0000-0x0000015A5C700000-memory.dmp
memory/3120-69-0x0000015A5C6B0000-0x0000015A5C6C0000-memory.dmp
memory/3120-1123-0x0000015A5C700000-0x0000015A5C710000-memory.dmp
memory/3120-1125-0x0000015A5C710000-0x0000015A5C720000-memory.dmp
memory/3120-71-0x0000015A5C6C0000-0x0000015A5C6D0000-memory.dmp
memory/3120-1127-0x0000015A5C720000-0x0000015A5C730000-memory.dmp
memory/3120-60-0x0000015A5C670000-0x0000015A5C680000-memory.dmp
memory/3120-61-0x0000015A5C680000-0x0000015A5C690000-memory.dmp
memory/3120-63-0x0000015A5C690000-0x0000015A5C6A0000-memory.dmp
memory/3120-1137-0x0000015A5C730000-0x0000015A5C740000-memory.dmp
memory/3120-1140-0x0000015A5C740000-0x0000015A5C750000-memory.dmp
memory/3120-64-0x0000015A5C6A0000-0x0000015A5C6B0000-memory.dmp
memory/3120-54-0x0000015A5C660000-0x0000015A5C670000-memory.dmp
memory/3120-1144-0x0000015A5C750000-0x0000015A5C760000-memory.dmp