adwind | b2a1773caec13fa7ec948a7c19f5f2cb5a92af3b67265cf6fa644c5de577dc4d | Triage

Sharing

Copy URL Twitter E-mail

General

Target

svchost.jar
Size

639KB
Sample

240810-djr38sshrm
MD5

74f1b462a479a53559ea1577bf25353a
SHA1

1d076a6b7d4578fa40195f0036ce297ed57df4da
SHA256

b2a1773caec13fa7ec948a7c19f5f2cb5a92af3b67265cf6fa644c5de577dc4d
SHA512

af557174fdf31e30acc3f9444cff724d5c14e6d2b9e00ea1ff84299132be418f84d106af569f65fff5ff78aadf208d4bea20990dcbb86828f70f63021d1a4b96
SSDEEP

12288:rrxcQC/OEG58P4LEg4j7gM/xRv+NiONipfgARORgp3qu02BoSRLDEe:rrqQGu5E4In7gMTGjip4i3qupBzRLDEe

Score

10^/10

adwind discovery persistence

Malware Config

Targets

- Target
  
  svchost.jar
- Size
  
  639KB
- MD5
  
  74f1b462a479a53559ea1577bf25353a
- SHA1
  
  1d076a6b7d4578fa40195f0036ce297ed57df4da
- SHA256
  
  b2a1773caec13fa7ec948a7c19f5f2cb5a92af3b67265cf6fa644c5de577dc4d
- SHA512
  
  af557174fdf31e30acc3f9444cff724d5c14e6d2b9e00ea1ff84299132be418f84d106af569f65fff5ff78aadf208d4bea20990dcbb86828f70f63021d1a4b96
- SSDEEP
  
  12288:rrxcQC/OEG58P4LEg4j7gM/xRv+NiONipfgARORgp3qu02BoSRLDEe:rrqQGu5E4In7gMTGjip4i3qupBzRLDEe
Score

6^/10

discovery persistence
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Browser Information Discovery

Peripheral Device Discovery

Query Registry

Remote System Discovery

System Information Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence