Analysis
- max time kernel
148s - max time network
93s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
04/06/2024, 09:37
General
- Target 945a44e74c54496dbe2f60ca5b90dc67_JaffaCakes118.jar
- Size 473KB
- Sample240604-ll1gdscg86
- SHA256 abd7fda1c1010557c5f012d26405d68f290c29ccaa8b4f728533333f3b78c948
Malware Config
Signatures
- AdWind
A Java-based RAT family operated as malware-as-a-service.
- Modifies file permissions 1 TTPs 1 IoCs
- Drops file in System32 directory 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 26 IoCs
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\945a44e74c54496dbe2f60ca5b90dc67_JaffaCakes118.jar1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
-
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar C:\Users\Admin\AppData\Local\Temp\_0.431928235264164351337748016414175362.class2⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive1682841430391980448.vbs3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive1682841430391980448.vbs4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive3747803103855979567.vbs3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive3747803103855979567.vbs4⤵
-
-
-
C:\Windows\SYSTEM32\xcopy.exexcopy "C:\Program Files\Java\jre-1.8" "C:\Users\Admin\AppData\Roaming\Oracle\" /e3⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive2364908913528597949.vbs2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive2364908913528597949.vbs3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive1223026899184772911.vbs2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive1223026899184772911.vbs3⤵
-
-
-
C:\Windows\SYSTEM32\xcopy.exexcopy "C:\Program Files\Java\jre-1.8" "C:\Users\Admin\AppData\Roaming\Oracle\" /e2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
3903daac9bc4a3b7.timestamp
Retrive1682841430391980448.vbs
Retrive3747803103855979567.vbs
_0.431928235264164351337748016414175362.class
83aa4cc77f591dfc2374580bbd95f6ba_468f6343-c0e6-4931-9703-30c6539573cb
msvcp140.dll
vcruntime140.dll
vcruntime140_1.dll
messages_zh_TW.properties
win32_CopyNoDrop32x32.gif
US_export_policy.jar
memory/4472-111-0x000001C70F8D0000-0x000001C70F8E0000-memory.dmp
memory/4472-79-0x000001C70F640000-0x000001C70F8B0000-memory.dmp
memory/4472-52-0x000001C70F8E0000-0x000001C70F8F0000-memory.dmp
memory/4472-1043-0x000001C70DE20000-0x000001C70DE21000-memory.dmp
memory/4472-50-0x000001C70F8D0000-0x000001C70F8E0000-memory.dmp
memory/4472-49-0x000001C70F8C0000-0x000001C70F8D0000-memory.dmp
memory/4472-48-0x000001C70F8B0000-0x000001C70F8C0000-memory.dmp
memory/4472-1034-0x000001C70DE20000-0x000001C70DE21000-memory.dmp
memory/4472-61-0x000001C70F910000-0x000001C70F920000-memory.dmp
memory/4472-60-0x000001C70F900000-0x000001C70F910000-memory.dmp
memory/4472-59-0x000001C70F8F0000-0x000001C70F900000-memory.dmp
memory/4472-1031-0x000001C70DE20000-0x000001C70DE21000-memory.dmp
memory/4472-65-0x000001C70DE20000-0x000001C70DE21000-memory.dmp
memory/4472-67-0x000001C70F920000-0x000001C70F930000-memory.dmp
memory/4472-1030-0x000001C70DE20000-0x000001C70DE21000-memory.dmp
memory/4472-69-0x000001C70F930000-0x000001C70F940000-memory.dmp
memory/4472-1028-0x000001C70DE20000-0x000001C70DE21000-memory.dmp
memory/4472-1021-0x000001C70F9A0000-0x000001C70F9B0000-memory.dmp
memory/4472-86-0x000001C70DE20000-0x000001C70DE21000-memory.dmp
memory/4472-1020-0x000001C70F990000-0x000001C70F9A0000-memory.dmp
memory/4472-1017-0x000001C70F980000-0x000001C70F990000-memory.dmp
memory/4472-81-0x000001C70F940000-0x000001C70F950000-memory.dmp
memory/4472-1013-0x000001C70F970000-0x000001C70F980000-memory.dmp
memory/4472-18-0x000001C70F640000-0x000001C70F8B0000-memory.dmp
memory/4472-1012-0x000001C70F960000-0x000001C70F970000-memory.dmp
memory/4472-95-0x000001C70F970000-0x000001C70F980000-memory.dmp
memory/4472-98-0x000001C70F980000-0x000001C70F990000-memory.dmp
memory/4472-108-0x000001C70F9A0000-0x000001C70F9B0000-memory.dmp
memory/4472-107-0x000001C70F990000-0x000001C70F9A0000-memory.dmp
memory/4472-1011-0x000001C70F950000-0x000001C70F960000-memory.dmp
memory/4472-113-0x000001C70F8E0000-0x000001C70F8F0000-memory.dmp
memory/4472-1009-0x000001C70F940000-0x000001C70F950000-memory.dmp
memory/4472-1008-0x000001C70DE20000-0x000001C70DE21000-memory.dmp
memory/4472-110-0x000001C70F8C0000-0x000001C70F8D0000-memory.dmp
memory/4472-109-0x000001C70F8B0000-0x000001C70F8C0000-memory.dmp
memory/4472-1007-0x000001C70DE20000-0x000001C70DE21000-memory.dmp
memory/4472-1003-0x000001C70F930000-0x000001C70F940000-memory.dmp
memory/4472-94-0x000001C70F960000-0x000001C70F970000-memory.dmp
memory/4472-1002-0x000001C70DE20000-0x000001C70DE21000-memory.dmp
memory/4472-1001-0x000001C70DE20000-0x000001C70DE21000-memory.dmp
memory/4472-93-0x000001C70F950000-0x000001C70F960000-memory.dmp
memory/4472-1000-0x000001C70F920000-0x000001C70F930000-memory.dmp
memory/4472-378-0x000001C70DE20000-0x000001C70DE21000-memory.dmp
memory/4472-991-0x000001C70F8F0000-0x000001C70F900000-memory.dmp
memory/4472-993-0x000001C70F910000-0x000001C70F920000-memory.dmp
memory/4472-992-0x000001C70F900000-0x000001C70F910000-memory.dmp
memory/4936-83-0x000001735E200000-0x000001735E210000-memory.dmp
memory/4936-32-0x000001735E210000-0x000001735E220000-memory.dmp
memory/4936-30-0x000001735E1F0000-0x000001735E200000-memory.dmp
memory/4936-31-0x000001735E200000-0x000001735E210000-memory.dmp
memory/4936-38-0x000001735DF60000-0x000001735DF61000-memory.dmp
memory/4936-994-0x000001735E270000-0x000001735E280000-memory.dmp
memory/4936-40-0x000001735E240000-0x000001735E250000-memory.dmp
memory/4936-379-0x000001735DF60000-0x000001735DF61000-memory.dmp
memory/4936-998-0x000001735E280000-0x000001735E290000-memory.dmp
memory/4936-36-0x000001735E230000-0x000001735E240000-memory.dmp
memory/4936-35-0x000001735E220000-0x000001735E230000-memory.dmp
memory/4936-97-0x000001735E230000-0x000001735E240000-memory.dmp
memory/4936-105-0x000001735E240000-0x000001735E250000-memory.dmp
memory/4936-1006-0x000001735E290000-0x000001735E2A0000-memory.dmp
memory/4936-106-0x000001735E250000-0x000001735E260000-memory.dmp
memory/4936-2-0x000001735DF80000-0x000001735E1F0000-memory.dmp
memory/4936-112-0x000001735E260000-0x000001735E270000-memory.dmp
memory/4936-114-0x000001735E2A0000-0x000001735E2B0000-memory.dmp
memory/4936-92-0x000001735DF60000-0x000001735DF61000-memory.dmp
memory/4936-80-0x000001735E290000-0x000001735E2A0000-memory.dmp
memory/4936-82-0x000001735E1F0000-0x000001735E200000-memory.dmp
memory/4936-41-0x000001735E250000-0x000001735E260000-memory.dmp
memory/4936-84-0x000001735E210000-0x000001735E220000-memory.dmp
memory/4936-1023-0x000001735E2A0000-0x000001735E2B0000-memory.dmp
memory/4936-85-0x000001735E220000-0x000001735E230000-memory.dmp
memory/4936-68-0x000001735DF80000-0x000001735E1F0000-memory.dmp
memory/4936-63-0x000001735E280000-0x000001735E290000-memory.dmp
memory/4936-62-0x000001735E270000-0x000001735E280000-memory.dmp
memory/4936-51-0x000001735E260000-0x000001735E270000-memory.dmp