Analysis
- max time kernel
148s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
19/09/2024, 02:59
General
- Target ea7614c1a4f5de66f398fea623bc64cd_JaffaCakes118.jar
- Size 533KB
- Sample240919-dgs8hsxejh
- SHA256 4d8df9e320164db94291ce12d292279ef809d7eb0a85d18ebdd7826606d7bad8
Malware Config
Signatures
- AdWind
A Java-based RAT family operated as malware-as-a-service.
- Drops file in System32 directory 2 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 24 IoCs
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\ea7614c1a4f5de66f398fea623bc64cd_JaffaCakes118.jar1⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar C:\Users\Admin\AppData\Local\Temp\_0.23635774566401457995004115154962337.class2⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive5343774759460229873.vbs3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive5343774759460229873.vbs4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive2127000174655897909.vbs3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive2127000174655897909.vbs4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive1720068937395621551.vbs2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive1720068937395621551.vbs3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive4548010462987439037.vbs2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive4548010462987439037.vbs3⤵
-
-
-
C:\Windows\SYSTEM32\xcopy.exexcopy "C:\Program Files\Java\jre-1.8" "C:\Users\Admin\AppData\Roaming\Oracle\" /e2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
3903daac9bc4a3b7.timestamp
Retrive1720068937395621551.vbs
Retrive4548010462987439037.vbs
_0.23635774566401457995004115154962337.class
83aa4cc77f591dfc2374580bbd95f6ba_a5c5e2ae-85e3-447c-9e0b-c9a7b966d823
msvcp140.dll
vcruntime140.dll
vcruntime140_1.dll
messages_zh_TW.properties
win32_CopyNoDrop32x32.gif
test.txt
memory/2972-107-0x0000027E4D8A0000-0x0000027E4D8B0000-memory.dmp
memory/2972-151-0x0000027E4D8D0000-0x0000027E4D8E0000-memory.dmp
memory/2972-26-0x0000027E4D6F0000-0x0000027E4D700000-memory.dmp
memory/2972-29-0x0000027E4D710000-0x0000027E4D720000-memory.dmp
memory/2972-32-0x0000027E4D420000-0x0000027E4D690000-memory.dmp
memory/2972-36-0x0000027E4D690000-0x0000027E4D6A0000-memory.dmp
memory/2972-35-0x0000027E4D730000-0x0000027E4D740000-memory.dmp
memory/2972-34-0x0000027E4D740000-0x0000027E4D750000-memory.dmp
memory/2972-33-0x0000027E4D720000-0x0000027E4D730000-memory.dmp
memory/2972-39-0x0000027E4D750000-0x0000027E4D760000-memory.dmp
memory/2972-38-0x0000027E4D6A0000-0x0000027E4D6B0000-memory.dmp
memory/2972-42-0x0000027E4D6B0000-0x0000027E4D6C0000-memory.dmp
memory/2972-45-0x0000027E4D6C0000-0x0000027E4D6D0000-memory.dmp
memory/2972-44-0x0000027E4D770000-0x0000027E4D780000-memory.dmp
memory/2972-43-0x0000027E4D760000-0x0000027E4D770000-memory.dmp
memory/2972-46-0x0000027E4BA10000-0x0000027E4BA11000-memory.dmp
memory/2972-49-0x0000027E4D6D0000-0x0000027E4D6E0000-memory.dmp
memory/2972-50-0x0000027E4D780000-0x0000027E4D790000-memory.dmp
memory/2972-53-0x0000027E4D6E0000-0x0000027E4D6F0000-memory.dmp
memory/2972-57-0x0000027E4D700000-0x0000027E4D710000-memory.dmp
memory/2972-56-0x0000027E4D6F0000-0x0000027E4D700000-memory.dmp
memory/2972-55-0x0000027E4D7A0000-0x0000027E4D7B0000-memory.dmp
memory/2972-54-0x0000027E4D790000-0x0000027E4D7A0000-memory.dmp
memory/2972-59-0x0000027E4D7B0000-0x0000027E4D7C0000-memory.dmp
memory/2972-62-0x0000027E4D710000-0x0000027E4D720000-memory.dmp
memory/2972-63-0x0000027E4D7C0000-0x0000027E4D7D0000-memory.dmp
memory/2972-66-0x0000027E4D7D0000-0x0000027E4D7E0000-memory.dmp
memory/2972-65-0x0000027E4D740000-0x0000027E4D750000-memory.dmp
memory/2972-64-0x0000027E4D720000-0x0000027E4D730000-memory.dmp
memory/2972-68-0x0000027E4D730000-0x0000027E4D740000-memory.dmp
memory/2972-69-0x0000027E4D7E0000-0x0000027E4D7F0000-memory.dmp
memory/2972-71-0x0000027E4D750000-0x0000027E4D760000-memory.dmp
memory/2972-72-0x0000027E4D7F0000-0x0000027E4D800000-memory.dmp
memory/2972-75-0x0000027E4D770000-0x0000027E4D780000-memory.dmp
memory/2972-76-0x0000027E4D800000-0x0000027E4D810000-memory.dmp
memory/2972-74-0x0000027E4D760000-0x0000027E4D770000-memory.dmp
memory/2972-78-0x0000027E4D810000-0x0000027E4D820000-memory.dmp
memory/2972-86-0x0000027E4D790000-0x0000027E4D7A0000-memory.dmp
memory/2972-85-0x0000027E4D840000-0x0000027E4D850000-memory.dmp
memory/2972-84-0x0000027E4D830000-0x0000027E4D840000-memory.dmp
memory/2972-83-0x0000027E4D820000-0x0000027E4D830000-memory.dmp
memory/2972-82-0x0000027E4D780000-0x0000027E4D790000-memory.dmp
memory/2972-89-0x0000027E4D850000-0x0000027E4D860000-memory.dmp
memory/2972-88-0x0000027E4D7A0000-0x0000027E4D7B0000-memory.dmp
memory/2972-93-0x0000027E4D860000-0x0000027E4D870000-memory.dmp
memory/2972-92-0x0000027E4D7B0000-0x0000027E4D7C0000-memory.dmp
memory/2972-96-0x0000027E4D870000-0x0000027E4D880000-memory.dmp
memory/2972-95-0x0000027E4D7C0000-0x0000027E4D7D0000-memory.dmp
memory/2972-100-0x0000027E4D7D0000-0x0000027E4D7E0000-memory.dmp
memory/2972-101-0x0000027E4D880000-0x0000027E4D890000-memory.dmp
memory/2972-103-0x0000027E4D7E0000-0x0000027E4D7F0000-memory.dmp
memory/2972-104-0x0000027E4D890000-0x0000027E4D8A0000-memory.dmp
memory/2972-106-0x0000027E4D7F0000-0x0000027E4D800000-memory.dmp
memory/2972-23-0x0000027E4D6E0000-0x0000027E4D6F0000-memory.dmp
memory/2972-110-0x0000027E4D8B0000-0x0000027E4D8C0000-memory.dmp
memory/2972-109-0x0000027E4D800000-0x0000027E4D810000-memory.dmp
memory/2972-114-0x0000027E4D8C0000-0x0000027E4D8D0000-memory.dmp
memory/2972-113-0x0000027E4D810000-0x0000027E4D820000-memory.dmp
memory/2972-27-0x0000027E4D700000-0x0000027E4D710000-memory.dmp
memory/2972-115-0x0000027E4D820000-0x0000027E4D830000-memory.dmp
memory/2972-133-0x0000027E4D870000-0x0000027E4D880000-memory.dmp
memory/2972-117-0x0000027E4D840000-0x0000027E4D850000-memory.dmp
memory/2972-120-0x0000027E4D8E0000-0x0000027E4D8F0000-memory.dmp
memory/2972-128-0x0000027E4D8F0000-0x0000027E4D900000-memory.dmp
memory/2972-131-0x0000027E4D860000-0x0000027E4D870000-memory.dmp
memory/2972-130-0x0000027E4D910000-0x0000027E4D920000-memory.dmp
memory/2972-129-0x0000027E4D900000-0x0000027E4D910000-memory.dmp
memory/2972-127-0x0000027E4D850000-0x0000027E4D860000-memory.dmp
memory/2972-136-0x0000027E4D880000-0x0000027E4D890000-memory.dmp
memory/2972-135-0x0000027E4D930000-0x0000027E4D940000-memory.dmp
memory/2972-134-0x0000027E4D920000-0x0000027E4D930000-memory.dmp
memory/2972-118-0x0000027E4D8D0000-0x0000027E4D8E0000-memory.dmp
memory/2972-142-0x0000027E4D8A0000-0x0000027E4D8B0000-memory.dmp
memory/2972-145-0x0000027E4D8B0000-0x0000027E4D8C0000-memory.dmp
memory/2972-144-0x0000027E4D960000-0x0000027E4D970000-memory.dmp
memory/2972-143-0x0000027E4D950000-0x0000027E4D960000-memory.dmp
memory/2972-139-0x0000027E4D940000-0x0000027E4D950000-memory.dmp
memory/2972-138-0x0000027E4D890000-0x0000027E4D8A0000-memory.dmp
memory/2972-116-0x0000027E4D830000-0x0000027E4D840000-memory.dmp
memory/2972-150-0x0000027E4D980000-0x0000027E4D990000-memory.dmp
memory/2972-149-0x0000027E4D970000-0x0000027E4D980000-memory.dmp
memory/2972-148-0x0000027E4D8C0000-0x0000027E4D8D0000-memory.dmp
memory/2972-154-0x0000027E4D990000-0x0000027E4D9A0000-memory.dmp
memory/2972-153-0x0000027E4D8E0000-0x0000027E4D8F0000-memory.dmp
memory/2972-158-0x0000027E4D910000-0x0000027E4D920000-memory.dmp
memory/2972-159-0x0000027E4D9A0000-0x0000027E4D9B0000-memory.dmp
memory/2972-157-0x0000027E4D900000-0x0000027E4D910000-memory.dmp
memory/2972-156-0x0000027E4D8F0000-0x0000027E4D900000-memory.dmp
memory/2972-167-0x0000027E4D9C0000-0x0000027E4D9D0000-memory.dmp
memory/2972-169-0x0000027E4D9E0000-0x0000027E4D9F0000-memory.dmp
memory/2972-166-0x0000027E4D9B0000-0x0000027E4D9C0000-memory.dmp
memory/2972-246-0x0000027E4BA10000-0x0000027E4BA11000-memory.dmp
memory/2972-274-0x0000027E4BA10000-0x0000027E4BA11000-memory.dmp
memory/2972-291-0x0000027E4BA10000-0x0000027E4BA11000-memory.dmp
memory/2972-569-0x0000027E4BA10000-0x0000027E4BA11000-memory.dmp
memory/2972-20-0x0000027E4D6D0000-0x0000027E4D6E0000-memory.dmp
memory/2972-18-0x0000027E4D6C0000-0x0000027E4D6D0000-memory.dmp
memory/2972-16-0x0000027E4D6B0000-0x0000027E4D6C0000-memory.dmp
memory/2972-1257-0x0000027E4BA10000-0x0000027E4BA11000-memory.dmp
memory/2972-1250-0x0000027E4BA10000-0x0000027E4BA11000-memory.dmp
memory/2972-1034-0x0000027E4BA10000-0x0000027E4BA11000-memory.dmp
memory/2972-14-0x0000027E4D6A0000-0x0000027E4D6B0000-memory.dmp
memory/2972-12-0x0000027E4D690000-0x0000027E4D6A0000-memory.dmp
memory/2972-2-0x0000027E4D420000-0x0000027E4D690000-memory.dmp
memory/2972-1222-0x0000027E4BA10000-0x0000027E4BA11000-memory.dmp
memory/2972-1214-0x0000027E4BA10000-0x0000027E4BA11000-memory.dmp
memory/2972-1223-0x0000027E4BA10000-0x0000027E4BA11000-memory.dmp
memory/3884-1217-0x000002ACC11D0000-0x000002ACC11D1000-memory.dmp
memory/3884-1213-0x000002ACC11D0000-0x000002ACC11D1000-memory.dmp
memory/3884-1230-0x000002ACC11D0000-0x000002ACC11D1000-memory.dmp
memory/3884-1231-0x000002ACC11D0000-0x000002ACC11D1000-memory.dmp
memory/3884-1238-0x000002ACC11D0000-0x000002ACC11D1000-memory.dmp
memory/3884-1239-0x000002ACC11D0000-0x000002ACC11D1000-memory.dmp
memory/3884-1245-0x000002ACC11D0000-0x000002ACC11D1000-memory.dmp
memory/3884-982-0x000002ACC11D0000-0x000002ACC11D1000-memory.dmp
memory/3884-320-0x000002ACC11D0000-0x000002ACC11D1000-memory.dmp
memory/3884-1262-0x000002ACC11D0000-0x000002ACC11D1000-memory.dmp
memory/3884-1263-0x000002ACC11D0000-0x000002ACC11D1000-memory.dmp
memory/3884-1266-0x000002ACC11D0000-0x000002ACC11D1000-memory.dmp