adwind | 071139434ad4b9707acced6db81d31707bb01b6697bbdff4c30c4b17462cf90d

Analysis

max time kernel
144s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 16:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8b1ebe7e2113d8351d831a276babcea0_JaffaCakes118.jar
Size 629KB
Sample240601-vgnfpshh22
SHA256 071139434ad4b9707acced6db81d31707bb01b6697bbdff4c30c4b17462cf90d
MD5 8b1ebe7e2113d8351d831a276babcea0
SHA1 567dc27a9bd06519d2b23d11d7a2acda6c419948
SHA512 8070252d98d611f90ff2ea7bdd48d9758c4b53481a461f83e4ea1a07abaf7bfa8d58ef0661e867b0c17d071efa71a8ba87a8963d510784cfc243321a9e084ff3
SSDEEP 12288:nr7IJIlm7nK/uqSIAnNhoa/GBTzxdVkql6/J7iV21syI6q3t5xh8:nwIlmGqN5uBTVdVkWV219IZd5xh8
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

adwind discovery persistence trojan

Malware Config

Signatures

AdWind
A Java-based RAT family operated as malware-as-a-service.
trojan adwind

Class file contains resources related to AdWind 1 IoCs

resource	yara_rule
sample	family_adwind5

Blocklisted process makes network request 20 IoCs

flow	pid	Process
7	620	WScript.exe
30	620	WScript.exe
40	620	WScript.exe
41	620	WScript.exe
52	620	WScript.exe
54	620	WScript.exe
55	620	WScript.exe
57	620	WScript.exe
58	620	WScript.exe
67	620	WScript.exe
69	620	WScript.exe
70	620	WScript.exe
75	620	WScript.exe
89	620	WScript.exe
90	620	WScript.exe
91	620	WScript.exe
93	620	WScript.exe
94	620	WScript.exe
95	620	WScript.exe
97	620	WScript.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	WScript.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HTJbbGeMzm.vbs	WScript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HTJbbGeMzm.vbs	WScript.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4680	icacls.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HTJbbGeMzm = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\HTJbbGeMzm.vbs\""	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ntfsmgr = "\"C:\\Program Files\\Java\\jre-1.8\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\ntfsmgr.jar\""	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HTJbbGeMzm = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\HTJbbGeMzm.vbs\""	WScript.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\test.txt	javaw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4016	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings	wscript.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
312	javaw.exe
4260	java.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 4736 wrote to memory of 4680	4736	java.exe	84
PID 4736 wrote to memory of 4680	4736	java.exe	84
PID 4736 wrote to memory of 4280	4736	java.exe	86
PID 4736 wrote to memory of 4280	4736	java.exe	86
PID 4280 wrote to memory of 620	4280	wscript.exe	90
PID 4280 wrote to memory of 620	4280	wscript.exe	90
PID 4280 wrote to memory of 2272	4280	wscript.exe	91
PID 4280 wrote to memory of 2272	4280	wscript.exe	91
PID 620 wrote to memory of 1648	620	WScript.exe	93
PID 620 wrote to memory of 1648	620	WScript.exe	93
PID 2272 wrote to memory of 3124	2272	cmd.exe	95
PID 2272 wrote to memory of 3124	2272	cmd.exe	95
PID 1648 wrote to memory of 4016	1648	cmd.exe	96
PID 1648 wrote to memory of 4016	1648	cmd.exe	96
PID 4280 wrote to memory of 312	4280	wscript.exe	97
PID 4280 wrote to memory of 312	4280	wscript.exe	97
PID 312 wrote to memory of 4260	312	javaw.exe	99
PID 312 wrote to memory of 4260	312	javaw.exe	99
PID 312 wrote to memory of 3220	312	javaw.exe	101
PID 312 wrote to memory of 3220	312	javaw.exe	101
PID 4260 wrote to memory of 1412	4260	java.exe	102
PID 4260 wrote to memory of 1412	4260	java.exe	102
PID 3220 wrote to memory of 2780	3220	cmd.exe	105
PID 3220 wrote to memory of 2780	3220	cmd.exe	105
PID 1412 wrote to memory of 716	1412	cmd.exe	106
PID 1412 wrote to memory of 716	1412	cmd.exe	106
PID 312 wrote to memory of 4192	312	javaw.exe	107
PID 312 wrote to memory of 4192	312	javaw.exe	107
PID 4260 wrote to memory of 2696	4260	java.exe	109
PID 4260 wrote to memory of 2696	4260	java.exe	109
PID 4192 wrote to memory of 4404	4192	cmd.exe	111
PID 4192 wrote to memory of 4404	4192	cmd.exe	111
PID 2696 wrote to memory of 756	2696	cmd.exe	112
PID 2696 wrote to memory of 756	2696	cmd.exe	112
PID 312 wrote to memory of 2336	312	javaw.exe	113
PID 312 wrote to memory of 2336	312	javaw.exe	113
PID 4260 wrote to memory of 116	4260	java.exe	115
PID 4260 wrote to memory of 116	4260	java.exe	115
PID 312 wrote to memory of 4092	312	javaw.exe	117
PID 312 wrote to memory of 4092	312	javaw.exe	117

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\8b1ebe7e2113d8351d831a276babcea0_JaffaCakes118.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:4680
- C:\Windows\SYSTEM32\wscript.exe
  wscript C:\Users\Admin/ssfhwudrcy.vbs
  2⤵
  - Checks computer location settings
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4280
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\HTJbbGeMzm.vbs"
    3⤵
    - Blocklisted process makes network request
    - Checks computer location settings
    - Drops startup file
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:620
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c schtasks /create /sc minute /mo 30 /tn Skypee /tr "C:\Users\Admin\AppData\Local\Temp\meee.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1648
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /sc minute /mo 30 /tn Skypee /tr "C:\Users\Admin\AppData\Local\Temp\meee.vbs"
        5⤵
        Creates scheduled task(s)
        
        PID:4016
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -version 2> C:\Users\Admin\AppData\Local\Temp\output.txt
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2272
  - - C:\Program Files\Java\jre-1.8\bin\javaw.exe
      "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -version
      4⤵
      PID:3124
- - C:\Program Files\Java\jre-1.8\bin\javaw.exe
    "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\ntfsmgr.jar"
    3⤵
    - Drops file in System32 directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:312
  - - C:\Program Files\Java\jre-1.8\bin\java.exe
      "C:\Program Files\Java\jre-1.8\bin\java.exe" -jar C:\Users\Admin\AppData\Local\Temp\_0.397023889012019247533195367840199833.class
      4⤵
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4260
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive6763755716098785050.vbs
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1412
      - C:\Windows\system32\cscript.exe
        
        cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive6763755716098785050.vbs
        6⤵
        
        PID:716
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive2348237123727186031.vbs
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2696
      - C:\Windows\system32\cscript.exe
        
        cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive2348237123727186031.vbs
        6⤵
        
        PID:756
    - - C:\Windows\SYSTEM32\xcopy.exe
        
        xcopy "C:\Program Files\Java\jre-1.8" "C:\Users\Admin\AppData\Roaming\Oracle\" /e
        5⤵
        
        PID:116
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive7764393222117294411.vbs
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3220
    - - C:\Windows\system32\cscript.exe
        
        cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive7764393222117294411.vbs
        5⤵
        
        PID:2780
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive4657840704231588424.vbs
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4192
    - - C:\Windows\system32\cscript.exe
        
        cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive4657840704231588424.vbs
        5⤵
        
        PID:4404
  - - C:\Windows\SYSTEM32\xcopy.exe
      xcopy "C:\Program Files\Java\jre-1.8" "C:\Users\Admin\AppData\Roaming\Oracle\" /e
      4⤵
      PID:2336
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe
      4⤵
      PID:4092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 afe277f9f05021b959dc934d8edaccf0a24bb02699aa80abfac51509f79bf405
MD5 597654d622f281ba22beeb0f0f331f98
SHA1 fb87904352fe347a6581affc23845ba0fc89d98b
SHA512 aa15ca29fd9f4e154811e0c753b9643c99110d084e5186eec0ae515e649c8e3b4e08c21614f4bc6f2b0688435facb03ffb3dfe387174abecbf8bdf464b9d72ed
MD5 SHA1 SHA512

Submit Download

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 b02ec8182f3feacb78d3f161a6cd341a79cc12606e9f0652e5889d6d63d88c2d
MD5 543a5be10efd4ca53c4bdc28dc73bc0b
SHA1 96d5252bef4ba25e5890f52e90f56987dffb0a2c
SHA512 e3eeb8807427b69fcab652ab0dff6d88209a20294ea2fb9a906b440f8265dbf8649066a3bb1939ef23d2399cf7d0b6b64805c6c8add79e483624b3744b8fa002
MD5 SHA1 SHA512

Submit Download

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 2445a8b42194fc4cd220221032f257ca90801b52c3095ef0f436510481d3ef1b
MD5 e84322284dd62e5bdfcd1acce6c94b2b
SHA1 24bd133ca71c41830449a165b5045fc08eb49866
SHA512 cdac6ef79c482c3416c52acf7426e9645fb9785195fabac44859072c3207383ffd274312145554e8917ea43c76015f57ee23cbdd794fdbb113aa56e5de7a8a58
MD5 SHA1 SHA512

Submit Download

Retrive4657840704231588424.vbs

Path C:\Users\Admin\AppData\Local\Temp\Retrive4657840704231588424.vbs
Size 281B
SHA256 45bfe34aa3ef932f75101246eb53d032f5e7cf6d1f5b4e495334955a255f32e7
MD5 a32c109297ed1ca155598cd295c26611
SHA1 dc4a1fdbaad15ddd6fe22d3907c6b03727b71510
SHA512 70372552dc86fe02ece9fe3b7721463f80be07a34126b2c75b41e30078cda9e90744c7d644df623f63d4fb985482e345b3351c4d3da873162152c67fc6ecc887
MD5 SHA1 SHA512

Submit Download

Retrive7764393222117294411.vbs

Path C:\Users\Admin\AppData\Local\Temp\Retrive7764393222117294411.vbs
Size 276B
SHA256 9da575dd2d5b7c1e9bab8b51a16cde457b3371c6dcdb0537356cf1497fa868f6
MD5 3bdfd33017806b85949b6faa7d4b98e4
SHA1 f92844fee69ef98db6e68931adfaa9a0a0f8ce66
SHA512 ae5e5686ae71edef53e71cd842cb6799e4383b9c238a5c361b81647efa128d2fedf3bf464997771b5b0c47a058fecae7829aeedcd098c80a11008581e5781429
MD5 SHA1 SHA512

Submit Download

_0.397023889012019247533195367840199833.class

Path C:\Users\Admin\AppData\Local\Temp\_0.397023889012019247533195367840199833.class
Size 241KB
SHA256 97d585b6aff62fb4e43e7e6a5f816dcd7a14be11a88b109a9ba9e8cd4c456eb9
MD5 781fb531354d6f291f1ccab48da6d39f
SHA1 9ce4518ebcb5be6d1f0b5477fa00c26860fe9a68
SHA512 3e6630f5feb4a3eb1dac7e9125ce14b1a2a45d7415cf44cea42bc51b2a9aa37169ee4a4c36c888c8f2696e7d6e298e2ad7b2f4c22868aaa5948210eb7db220d8
SSDEEP 6144:WI5pxUZ7Gvi8ulm+yV/rIF0/MO2qnan1J7pXESN6U:J5pxAGqNkrIq/MO2qnA
MD5 SHA1 SHA512 SSDEEP

Submit Download

output.txt

Path C:\Users\Admin\AppData\Local\Temp\output.txt
Size 147B
SHA256 4ebfda517657bcc9f2b2e3c3cd13e58e9adef320c0ca1a8ac9aee888d4e1ef8e
MD5 faf2f8b188047379978915849af13d28
SHA1 42ecb6f269f3dc3183d3b72b4216010f106d3317
SHA512 85c3afedfda0aa63edab3b1c5ed7ef8b06e392d387ea3c16bd28c66a54f72c7cbdd14b8af9428168402313f8a4d203be7e5f8a6732d0d8d52d46fe3963ebde79
MD5 SHA1 SHA512

Submit Download

HTJbbGeMzm.vbs

Path C:\Users\Admin\AppData\Roaming\HTJbbGeMzm.vbs
Size 21KB
SHA256 652493711e06fc5935446d9b15750db2cca32ceba31a5577499863638d8cf8ce
MD5 026c453bd784ef19119f7b2e26f4f05d
SHA1 fb52cad7a83259a77016bed9a66d6826bdf42976
SHA512 312d3aa3dee8708a2cc381df8a3bde9cb8e3cb5e195b5fc4191e927368d98f6971d398c4f2418bc716fee96d9248b7a9453b2bb0a7261721ef7c0504030fa99e
SSDEEP 384:nNvdCOg03P6iyOs6XZK8CXI7/BEzw0t3VH/jo49HXoYgyTye8F2:nRdC7AX+I7Zrsfj1hgPI
MD5 SHA1 SHA512 SSDEEP

Submit Download

83aa4cc77f591dfc2374580bbd95f6ba_39fbc0df-d496-4ae0-b1d7-bde60e245d90

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3558294865-3673844354-2255444939-1000\83aa4cc77f591dfc2374580bbd95f6ba_39fbc0df-d496-4ae0-b1d7-bde60e245d90
Size 45B
SHA256 11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238
MD5 c8366ae350e7019aefc9d1e6e6a498c6
SHA1 5731d8a3e6568a5f2dfbbc87e3db9637df280b61
SHA512 33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd
MD5 SHA1 SHA512

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\plugin2\msvcp140.dll
Size 558KB
SHA256 a88b8c1c8f27bf90fe960e0e8bd56984ad48167071af92d96ec1051f89f827fb
MD5 bf78c15068d6671693dfcdfa5770d705
SHA1 4418c03c3161706a4349dfe3f97278e7a5d8962a
SHA512 5b6b0ab4e82cc979eaa619d387c6995198fd19aa0c455bef44bd37a765685575d57448b3b4accd70d3bd20a6cd408b1f518eda0f6dae5aa106f225bee8291372
SSDEEP 12288:CZ+jZpQfIwKnkdmZJUbi7I0QfxK+pdd+cOj6LbndDrUw2K1fQEKZm+jWodEEVJaP:CEtmrdcK1fQEKZm+jWodEEb
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\plugin2\vcruntime140.dll
Size 95KB
SHA256 475ab98b7722e965bd38c8fa6ed23502309582ccf294ff1061cb290c7988f0d1
MD5 7415c1cc63a0c46983e2a32581daefee
SHA1 5f8534d79c84ac45ad09b5a702c8c5c288eae240
SHA512 3d4b24061f72c0e957c7b04a0c4098c94c8f1afb4a7e159850b9939c7210d73398be6f27b5ab85073b4e8c999816e7804fef0f6115c39cd061f4aaeb4dcda8cf
SSDEEP 1536:M4h79voUUUCaisMiQFJp0hYSKnMNFYNa86ecb63UNU:M8WvicJpwYVMNFYNB6ecb63U6
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\plugin2\vcruntime140_1.dll
Size 36KB
SHA256 0579d460ea1f7e8a815fa55a8821a5ff489c8097f051765e9beaf25d8d0f27d6
MD5 fcda37abd3d9e9d8170cd1cd15bf9d3f
SHA1 b23ff3e9aa2287b9c1249a008c0ae06dc8b6fdf2
SHA512 de8be61499aaa1504dde8c19666844550c2ea7ef774ecbe26900834b252887da31d4cf4fb51338b16b6a4416de733e519ebf8c375eb03eb425232a6349da2257
SSDEEP 384:1JfphjEpTUUtKldl3864/vc5fqiu85mIlRWNQQbz6Yf7ZJA/U3qJrWr2KW8KLHR9:Phh4pTUUtmUwqiu8oSRjez6S7fqHwAb
MD5 SHA1 SHA512 SSDEEP

Submit Download

messages_zh_TW.properties

Path C:\Users\Admin\AppData\Roaming\Oracle\lib\deploy\messages_zh_TW.properties
Size 3KB
SHA256 ff4a3a92bc92cb08d2c32c435810440fd264edd63e56efa39430e0240c835620
MD5 880baacb176553deab39edbe4b74380d
SHA1 37a57aad121c14c25e149206179728fa62203bf0
SHA512 3039315bb283198af9090bd3d31cfae68ee73bc2b118bbae0b32812d4e3fd0f11ce962068d4a17b065dab9a66ef651b9cb8404c0a2defce74bb6b2d1d93646d5
MD5 SHA1 SHA512

Submit Download

win32_CopyNoDrop32x32.gif

Path C:\Users\Admin\AppData\Roaming\Oracle\lib\images\cursors\win32_CopyNoDrop32x32.gif
Size 153B
SHA256 1a1d3079d49583837662b84e11d8c0870698511d9110e710eb8e7eb20df7ae3b
MD5 1e9d8f133a442da6b0c74d49bc84a341
SHA1 259edc45b4569427e8319895a444f4295d54348f
SHA512 63d6f70c8cab9735f0f857f5bf99e319f6ae98238dc7829dd706b7d6855c70be206e32e3e55df884402483cf8bebad00d139283af5c0b85dc1c5bf8f253acd37
MD5 SHA1 SHA512

Submit Download

US_export_policy.jar

Path C:\Users\Admin\AppData\Roaming\Oracle\lib\security\policy\unlimited\US_export_policy.jar
Size 7KB
SHA256 84e035372ca8979bb4a387428a74942ffc7248a0e61988b7033b5b266cd187c8
MD5 12f971b6e65cbc7184701235469f0339
SHA1 06cb165157c5e0078b872c48707a1328b1dcba19
SHA512 58646fc81de2e4750a3259d79a207a8cff2dc6692f178a63d92a453fc408c8d1088007ef4e93157d1017be706565716a0236039dbac848c40745a0ad89c4d0de
SSDEEP 192:7W3/Oi76M94KjPIsmnOyxRDuQe80clILkwwGDrRZ7exi1O:7W3/Oi7NefiQeClIwG/jqKO
MD5 SHA1 SHA512 SSDEEP

Submit Download

ntfsmgr.jar

Path C:\Users\Admin\AppData\Roaming\ntfsmgr.jar
Size 473KB
SHA256 9eaf0bb4fd5eb9860d3afd3f1561a9294e9276cd108a87df3dea98be288a2b50
MD5 391fb12ff60f4628c5d93be224e9e836
SHA1 92d183db7443ba79a82f2390ea7fa28b76d183a8
SHA512 4744e0bc46aa32f7bfb822d4d2efb1dda3e4ff542d3960eb3e9c1731c4465d2b7efdacc9baa69243fa703147238d9628482907242e090273a2f3d89f64131a03
SSDEEP 12288:mAyoge0EyFJFW7z1vemQS5pxogQNUhIK/0c2qnAz:Fyoge0VFbWHZsS7B2qnS
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssfhwudrcy.vbs

Path C:\Users\Admin\ssfhwudrcy.vbs
Size 919KB
SHA256 3dd8110a62a75dcd3a1356873bb0f4d8cb1aa8ab7b852f34ac09b58e689485ea
MD5 252a1d8261c66c4d41fa997f326c27f2
SHA1 7b6c0f05fb3408f0f1d9e6401526048a9be1740a
SHA512 91354cc3af4493680311e1980db9340095bddb81fff40dec825952b5cb6e892cfd4519777910df29ee96460a2406f975558db09edd1085a6afef194a0a6dc7fd
SSDEEP 12288:3mUEiyYQaHTgeCFoGdNPEAGxr4MBhoQX8OApUj7S2wMLv11Ws9xdSdNk29gZzOgT:3mRdazXGdZNMR9j71LjdSdMfrULidIa
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/312-84-0x0000023143B90000-0x0000023143B91000-memory.dmp

Download

memory/312-997-0x0000023143B90000-0x0000023143B91000-memory.dmp

Download

memory/312-996-0x0000023143B90000-0x0000023143B91000-memory.dmp

Download

memory/312-407-0x0000023143B90000-0x0000023143B91000-memory.dmp

Download

memory/312-985-0x0000023143B90000-0x0000023143B91000-memory.dmp

Download

memory/312-980-0x0000023143B90000-0x0000023143B91000-memory.dmp

Download

memory/3124-33-0x000001811DD80000-0x000001811DD81000-memory.dmp

Download

memory/4260-552-0x0000026E9F0F0000-0x0000026E9F0F1000-memory.dmp

Download

memory/4260-100-0x0000026E9F0F0000-0x0000026E9F0F1000-memory.dmp

Download

memory/4260-87-0x0000026E9F0F0000-0x0000026E9F0F1000-memory.dmp

Download

memory/4736-2-0x0000018207180000-0x00000182073F0000-memory.dmp

Download

memory/4736-14-0x0000018205890000-0x0000018205891000-memory.dmp

Download

memory/4736-15-0x0000018207180000-0x00000182073F0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads