adwind | 734fde0b60146fce48528e12d7d166c5d958dfd72e5d1d0b840508487713914d

Analysis

max time kernel
148s
max time network
163s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
27/07/2024, 16:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
JsqInjectionPro.exe
Size 19.0MB
Sample240727-tl6bmsxcnp
SHA256 734fde0b60146fce48528e12d7d166c5d958dfd72e5d1d0b840508487713914d
MD5 9aa9aec912e0a6fd8627f2c929091de2
SHA1 9ebe9df20e6f53b5ce07bab8e3ea5163f84d1c0f
SHA512 d72ea51549c47fa2af5f2f91afe51bfe156890e4f3f031aaa32d54fcfdd87d53dcef7a622831745586d458cf72aa4f5f9c4407fefab4d775020b617436661b60
SSDEEP 393216:jsuDbtDXBVDOuQP/dLOrggCc+OaiuJstWem6NiQrmel4TryEeo9NSmilkpYTAqEs:jNDbFzOuFggc3iEAmQrEjSmi6OTA
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

adwind persistence trojan

Malware Config

Signatures

AdWind
A Java-based RAT family operated as malware-as-a-service.
trojan adwind

Class file contains resources related to AdWind 1 IoCs

resource	yara_rule
sample	family_adwind4

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Home = "C:\\Program Files\\Java\\jre-1.8\\bin\\javaw.exe -jar C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\.tmp\\1722096645562.tmp"	reg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000_Classes\Local Settings	JsqInjectionPro.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4800	javaw.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4940 wrote to memory of 3460	4940	JsqInjectionPro.exe	82
PID 4940 wrote to memory of 3460	4940	JsqInjectionPro.exe	82
PID 4940 wrote to memory of 4800	4940	JsqInjectionPro.exe	83
PID 4940 wrote to memory of 4800	4940	JsqInjectionPro.exe	83
PID 4800 wrote to memory of 4208	4800	javaw.exe	84
PID 4800 wrote to memory of 4208	4800	javaw.exe	84
PID 4800 wrote to memory of 248	4800	javaw.exe	86
PID 4800 wrote to memory of 248	4800	javaw.exe	86
PID 248 wrote to memory of 976	248	cmd.exe	88
PID 248 wrote to memory of 976	248	cmd.exe	88

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
4208	attrib.exe

C:\Users\Admin\AppData\Local\Temp\JsqInjectionPro.exe
"C:\Users\Admin\AppData\Local\Temp\JsqInjectionPro.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Program Files\Java\jre-1.8\bin\javaw.exe
  "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\jsql-injection-v0.101.jar"
  2⤵
  PID:3460
- C:\Program Files\Java\jre-1.8\bin\javaw.exe
  "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\javaupdate.jar"
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4800
- - C:\Windows\SYSTEM32\attrib.exe
    attrib +H C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1722096645562.tmp
    3⤵
    - Views/modifies file attributes
    PID:4208
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1722096645562.tmp" /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:248
  - - C:\Windows\system32\reg.exe
      REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1722096645562.tmp" /f
      4⤵
      Adds Run key to start application
      PID:976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jsql-injection-v0.101.jar

Path C:\Users\Admin\AppData\Local\Temp\jsql-injection-v0.101.jar
Size 19.6MB
SHA256 d1cbf938b159862300719b2874a1676ade521af64731a7406793c4883de0e1dd
MD5 5575c6fe60e265f9e548dfbf07fe892e
SHA1 2b6f3ee52a58b61d556cb4dc9059e3d778d423df
SHA512 d2804e9b316b56773b3c36124b0c06fece41cfc355536f555aea5dedf5db51d44adc2aa5f55c1bf7e2c201d9c64db462dbd6325b43298d3ace7e9d734b84338c
SSDEEP 393216:QCIT+Hs7l/8ICXieKJj+LMYqjAYpvruEQF+ldpZbyirFzIaenB2GuDb8amXAS/:Q0sQieKJjAqjAYhPuirFzIaYB2XqAS/
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaupdate.jar

Path C:\Users\Admin\AppData\Roaming\javaupdate.jar
Size 653KB
SHA256 b2d5ff465c51d8eca639623805ac51f6404c138926dca9446a6799b32477885a
MD5 d18196b79e098d8ac79d5f69aeb17195
SHA1 e1254141a4868e4f9f3d333afec70c09e431a03e
SHA512 b3e846092fa8e9f6817b0132ce7db342f3a8726129f470235cdf9e41fbde3135e4b433b228725c3e4e03922f6e0b8445a5ea3a00d0f0304ae84096ac9058b61a
SSDEEP 12288:fHtEQO/uU+pAb4fwUIfbgU/JR7+tyuNupLgY9aRE132uE2xES5TDQi:fHuQiCpU44TbgUbiTupMu/2uZxX5TDQi
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3460-46-0x0000026A2CC20000-0x0000026A2CE90000-memory.dmp

Download

memory/3460-45-0x0000026A2B360000-0x0000026A2B361000-memory.dmp

Download

memory/3460-44-0x000000E388600000-0x000000E388700000-memory.dmp

Download

memory/3460-34-0x0000026A2B360000-0x0000026A2B361000-memory.dmp

Download

memory/3460-17-0x0000026A2CC20000-0x0000026A2CE90000-memory.dmp

Download

memory/4800-16-0x000002D180000000-0x000002D180270000-memory.dmp

Download

memory/4800-35-0x000002D1FE0D0000-0x000002D1FE0D1000-memory.dmp

Download

memory/4800-43-0x000002D1FE0D0000-0x000002D1FE0D1000-memory.dmp

Download

memory/4800-65-0x000002D1FE0D0000-0x000002D1FE0D1000-memory.dmp

Download

memory/4800-76-0x000002D1FE0D0000-0x000002D1FE0D1000-memory.dmp

Download

memory/4800-88-0x000002D1FE0D0000-0x000002D1FE0D1000-memory.dmp

Download

memory/4800-90-0x000002D1FE0D0000-0x000002D1FE0D1000-memory.dmp

Download

memory/4800-101-0x000002D180000000-0x000002D180270000-memory.dmp

Download

memory/4940-11-0x00007FF9C72C0000-0x00007FF9C7D82000-memory.dmp

Download

memory/4940-2-0x00007FF9C72C0000-0x00007FF9C7D82000-memory.dmp

Download

memory/4940-0-0x00007FF9C72C3000-0x00007FF9C72C5000-memory.dmp

Download

memory/4940-1-0x0000000000BB0000-0x0000000001EBA000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads