Analysis
- max time kernel
148s - max time network
96s - platform
windows10-2004_x64 - resource
win10v2004-20240910-en - resource tags
- submitted
16/09/2024, 02:26
General
- Target Important_PDF.jar
- Size 670KB
- Sample240916-cwwrhsvbph
- SHA256 bb3b600669dd97440096f39299e4d8c64bd7d6ec92769dae3c03bd0a617c58b6
Malware Config
Signatures
- AdWind
A Java-based RAT family operated as malware-as-a-service.
- Drops file in System32 directory 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 24 IoCs
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\Important_PDF.jar1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar C:\Users\Admin\AppData\Local\Temp\_0.29233490625964621922962951151936310.class2⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive6747521647600899176.vbs3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive6747521647600899176.vbs4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive444098920842823768.vbs3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive444098920842823768.vbs4⤵
-
-
-
C:\Windows\SYSTEM32\xcopy.exexcopy "C:\Program Files\Java\jre-1.8" "C:\Users\Admin\AppData\Roaming\Oracle\" /e3⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive7238051230300822917.vbs2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive7238051230300822917.vbs3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive7911343817030157525.vbs2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive7911343817030157525.vbs3⤵
-
-
-
C:\Windows\SYSTEM32\xcopy.exexcopy "C:\Program Files\Java\jre-1.8" "C:\Users\Admin\AppData\Roaming\Oracle\" /e2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
3903daac9bc4a3b7.timestamp
Retrive444098920842823768.vbs
Retrive6747521647600899176.vbs
_0.29233490625964621922962951151936310.class
83aa4cc77f591dfc2374580bbd95f6ba_83e33dcf-e635-4313-9cdc-036589dffc77
msvcp140.dll
vcruntime140.dll
vcruntime140_1.dll
messages_zh_TW.properties
win32_CopyNoDrop32x32.gif
memory/2996-113-0x00000183EF0B0000-0x00000183EF0C0000-memory.dmp
memory/2996-119-0x00000183EF110000-0x00000183EF120000-memory.dmp
memory/2996-1051-0x00000183ED5C0000-0x00000183ED5C1000-memory.dmp
memory/2996-1048-0x00000183ED5C0000-0x00000183ED5C1000-memory.dmp
memory/2996-1047-0x00000183ED5C0000-0x00000183ED5C1000-memory.dmp
memory/2996-1038-0x00000183EF140000-0x00000183EF150000-memory.dmp
memory/2996-1040-0x00000183EF150000-0x00000183EF160000-memory.dmp
memory/2996-67-0x00000183EF0A0000-0x00000183EF0B0000-memory.dmp
memory/2996-66-0x00000183EF090000-0x00000183EF0A0000-memory.dmp
memory/2996-65-0x00000183EF080000-0x00000183EF090000-memory.dmp
memory/2996-64-0x00000183EF070000-0x00000183EF080000-memory.dmp
memory/2996-1041-0x00000183EF160000-0x00000183EF170000-memory.dmp
memory/2996-1044-0x00000183EF170000-0x00000183EF180000-memory.dmp
memory/2996-56-0x00000183EEE00000-0x00000183EF070000-memory.dmp
memory/2996-1035-0x00000183ED5C0000-0x00000183ED5C1000-memory.dmp
memory/2996-1034-0x00000183EF130000-0x00000183EF140000-memory.dmp
memory/2996-1033-0x00000183EF120000-0x00000183EF130000-memory.dmp
memory/2996-71-0x00000183EF0B0000-0x00000183EF0C0000-memory.dmp
memory/2996-1030-0x00000183EF110000-0x00000183EF120000-memory.dmp
memory/2996-77-0x00000183EF0D0000-0x00000183EF0E0000-memory.dmp
memory/2996-76-0x00000183EF0C0000-0x00000183EF0D0000-memory.dmp
memory/2996-1026-0x00000183EF100000-0x00000183EF110000-memory.dmp
memory/2996-131-0x00000183EF130000-0x00000183EF140000-memory.dmp
memory/2996-1024-0x00000183ED5C0000-0x00000183ED5C1000-memory.dmp
memory/2996-892-0x00000183EF0F0000-0x00000183EF100000-memory.dmp
memory/2996-19-0x00000183EEE00000-0x00000183EF070000-memory.dmp
memory/2996-423-0x00000183EF0E0000-0x00000183EF0F0000-memory.dmp
memory/2996-410-0x00000183ED5C0000-0x00000183ED5C1000-memory.dmp
memory/2996-127-0x00000183EF120000-0x00000183EF130000-memory.dmp
memory/2996-141-0x00000183EF140000-0x00000183EF150000-memory.dmp
memory/2996-117-0x00000183EF0C0000-0x00000183EF0D0000-memory.dmp
memory/2996-91-0x00000183EF0E0000-0x00000183EF0F0000-memory.dmp
memory/2996-143-0x00000183EF150000-0x00000183EF160000-memory.dmp
memory/2996-144-0x00000183EF160000-0x00000183EF170000-memory.dmp
memory/2996-116-0x00000183ED5C0000-0x00000183ED5C1000-memory.dmp
memory/2996-147-0x00000183EF170000-0x00000183EF180000-memory.dmp
memory/2996-101-0x00000183EF0A0000-0x00000183EF0B0000-memory.dmp
memory/2996-100-0x00000183EF090000-0x00000183EF0A0000-memory.dmp
memory/2996-99-0x00000183EF080000-0x00000183EF090000-memory.dmp
memory/2996-98-0x00000183EF070000-0x00000183EF080000-memory.dmp
memory/2996-97-0x00000183EF0F0000-0x00000183EF100000-memory.dmp
memory/2996-108-0x00000183EF100000-0x00000183EF110000-memory.dmp
memory/2996-92-0x00000183ED5C0000-0x00000183ED5C1000-memory.dmp
memory/2996-118-0x00000183EF0D0000-0x00000183EF0E0000-memory.dmp
memory/3216-146-0x000002644ED10000-0x000002644ED20000-memory.dmp
memory/3216-22-0x000002644CF40000-0x000002644CF41000-memory.dmp
memory/3216-114-0x000002644ECC0000-0x000002644ECD0000-memory.dmp
memory/3216-43-0x000002644EC10000-0x000002644EC20000-memory.dmp
memory/3216-74-0x000002644EBF0000-0x000002644EC00000-memory.dmp
memory/3216-129-0x000002644EC80000-0x000002644EC90000-memory.dmp
memory/3216-148-0x000002644ECA0000-0x000002644ECB0000-memory.dmp
memory/3216-102-0x000002644ECB0000-0x000002644ECC0000-memory.dmp
memory/3216-96-0x000002644EC70000-0x000002644EC80000-memory.dmp
memory/3216-145-0x000002644ED00000-0x000002644ED10000-memory.dmp
memory/3216-82-0x000002644EC30000-0x000002644EC40000-memory.dmp
memory/3216-89-0x000002644EC50000-0x000002644EC60000-memory.dmp
memory/3216-142-0x000002644ECF0000-0x000002644ED00000-memory.dmp
memory/3216-90-0x000002644EC60000-0x000002644EC70000-memory.dmp
memory/3216-140-0x000002644ECE0000-0x000002644ECF0000-memory.dmp
memory/3216-139-0x000002644EC90000-0x000002644ECA0000-memory.dmp
memory/3216-128-0x000002644ECD0000-0x000002644ECE0000-memory.dmp
memory/3216-86-0x000002644EC40000-0x000002644EC50000-memory.dmp
memory/3216-44-0x000002644EC20000-0x000002644EC30000-memory.dmp
memory/3216-36-0x000002644EBE0000-0x000002644EBF0000-memory.dmp
memory/3216-331-0x000002644CF40000-0x000002644CF41000-memory.dmp
memory/3216-87-0x000002644ECA0000-0x000002644ECB0000-memory.dmp
memory/3216-83-0x000002644EC90000-0x000002644ECA0000-memory.dmp
memory/3216-32-0x000002644EBC0000-0x000002644EBD0000-memory.dmp
memory/3216-33-0x000002644EBD0000-0x000002644EBE0000-memory.dmp
memory/3216-2-0x000002644E950000-0x000002644EBC0000-memory.dmp
memory/3216-704-0x000002644CF40000-0x000002644CF41000-memory.dmp
memory/3216-79-0x000002644EC20000-0x000002644EC30000-memory.dmp
memory/3216-80-0x000002644EC80000-0x000002644EC90000-memory.dmp
memory/3216-11-0x000002644CF40000-0x000002644CF41000-memory.dmp
memory/3216-69-0x000002644EBE0000-0x000002644EBF0000-memory.dmp
memory/3216-1025-0x000002644ECB0000-0x000002644ECC0000-memory.dmp
memory/3216-75-0x000002644EC00000-0x000002644EC10000-memory.dmp
memory/3216-1029-0x000002644ECC0000-0x000002644ECD0000-memory.dmp
memory/3216-70-0x000002644EC10000-0x000002644EC20000-memory.dmp
memory/3216-1031-0x000002644ECD0000-0x000002644ECE0000-memory.dmp
memory/3216-48-0x000002644EC40000-0x000002644EC50000-memory.dmp
memory/3216-53-0x000002644EC50000-0x000002644EC60000-memory.dmp
memory/3216-54-0x000002644EC60000-0x000002644EC70000-memory.dmp
memory/3216-1037-0x000002644ECE0000-0x000002644ECF0000-memory.dmp
memory/3216-47-0x000002644EC30000-0x000002644EC40000-memory.dmp
memory/3216-1043-0x000002644ED10000-0x000002644ED20000-memory.dmp
memory/3216-1042-0x000002644ED00000-0x000002644ED10000-memory.dmp
memory/3216-63-0x000002644EBD0000-0x000002644EBE0000-memory.dmp
memory/3216-62-0x000002644EBC0000-0x000002644EBD0000-memory.dmp
memory/3216-1039-0x000002644ECF0000-0x000002644ED00000-memory.dmp
memory/3216-52-0x000002644E950000-0x000002644EBC0000-memory.dmp
memory/3216-55-0x000002644EC70000-0x000002644EC80000-memory.dmp
memory/3216-41-0x000002644EBF0000-0x000002644EC00000-memory.dmp
memory/3216-42-0x000002644EC00000-0x000002644EC10000-memory.dmp