adwind | 012d2fcae6942de8aa569557c3b95ba0434f66e7ae2bfe35b0a800d3e99a4cfc

General

Target

expensive crack.zip
Size

6.8MB
MD5

ba38a6d34c3e2674b6160ae8d1c1a2d4
SHA1

0e851ec1602e1fb80083a8d20b6b6aba225a9d04
SHA256

012d2fcae6942de8aa569557c3b95ba0434f66e7ae2bfe35b0a800d3e99a4cfc
SHA512

684e89bde6fe0da9a4b58911fba3e8a7c3653dff7915f8d9382265b5ec6976909a218d516aa669196f289664f5236b23f13bbe4d9ef5fb31430799303d41460e
SSDEEP

196608:dXE4PwPjhDcjIAXsDvI/9fNipnptqvRYj8mgJriQ+C:pENjyR/9lbRC8rm6

Score

10^/10

adwind persistence trojan

Malware Config

Signatures

AdWind
A Java-based RAT family operated as malware-as-a-service.
trojan adwind
Adwind family
adwind

Class file contains resources related to AdWind 1 IoCs

resource	yara_rule
sample	family_adwind4

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000\Software\Microsoft\Windows\CurrentVersion\Run\Home = "C:\\Program Files\\Java\\jre-1.8\\bin\\javaw.exe -jar C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\.tmp\\1731705340316.tmp"	reg.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3500	7zFM.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	3500	7zFM.exe
Token: 35	3500	7zFM.exe
Token: SeSecurityPrivilege	3500	7zFM.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3500	7zFM.exe
3500	7zFM.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4692	java.exe
4692	java.exe
4692	java.exe
4692	java.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 5816 wrote to memory of 5080	5816	cmd.exe	85
PID 5816 wrote to memory of 5080	5816	cmd.exe	85
PID 5816 wrote to memory of 4692	5816	cmd.exe	86
PID 5816 wrote to memory of 4692	5816	cmd.exe	86
PID 4692 wrote to memory of 2932	4692	java.exe	87
PID 4692 wrote to memory of 2932	4692	java.exe	87
PID 4692 wrote to memory of 1540	4692	java.exe	89
PID 4692 wrote to memory of 1540	4692	java.exe	89
PID 1540 wrote to memory of 2136	1540	cmd.exe	91
PID 1540 wrote to memory of 2136	1540	cmd.exe	91

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2932	attrib.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\expensive crack.zip"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3500

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1928

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\expensive 3.2 crack\start.cmd" "
1⤵
- Suspicious use of WriteProcessMemory
PID:5816
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:5080
- C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
  java -jar expapasta.jar
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4692
- - C:\Windows\SYSTEM32\attrib.exe
    attrib +H C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1731705340316.tmp
    3⤵
    - Views/modifies file attributes
    PID:2932
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1731705340316.tmp" /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1540
  - - C:\Windows\system32\reg.exe
      REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1731705340316.tmp" /f
      4⤵
      Adds Run key to start application
      PID:2136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Desktop\expensive 3.2 crack\expapasta.jar

Filesize
6.9MB

MD5
0d086bd973376fccd4a544a2413a8669

SHA1
7e7f37a586c0cc0cf76d9ac89d4aa3accac73b63

SHA256
56e11160890d361c8175760ac8ad16dc46d8e35dc18caf3d3e64b8fbd83ba6bd

SHA512
8b8b2eeea1dbc7a1722ed099ac113a50a80ba8b2a260e6a342ce527086bbf2b18d72705a5e9fb0593a1d964ea01c66f246bbfea821aa90dfa85fec3d90d5f1f0

Download Submit
C:\Users\Admin\Desktop\expensive 3.2 crack\start.cmd

Filesize
764B

MD5
01b8ed92434e95a011e8e8dacba2fd68

SHA1
d1f538dfbab7a19c792b8325b2e9cbcc3cd9937d

SHA256
59a12fd47b56fa697512484117f37bd4a69b733c44614c13153e955581eb6799

SHA512
ce14085421d4902b300370896048a3e901508def1bdd5158a7df286cbc9de32163e3ef67afe416a5879816915ec75badf6604adaf19218b6343467c9391d1f9a

Download Submit
memory/4692-10-0x0000026B07F10000-0x0000026B08180000-memory.dmp

Filesize
2.4MB

Download
memory/4692-32-0x0000026B066D0000-0x0000026B066D1000-memory.dmp

Filesize
4KB

Download
memory/4692-39-0x0000026B066D0000-0x0000026B066D1000-memory.dmp

Filesize
4KB

Download
memory/4692-48-0x0000026B066D0000-0x0000026B066D1000-memory.dmp

Filesize
4KB

Download
memory/4692-52-0x0000026B066D0000-0x0000026B066D1000-memory.dmp

Filesize
4KB

Download
memory/4692-53-0x0000026B07F10000-0x0000026B08180000-memory.dmp

Filesize
2.4MB

Download
memory/4692-56-0x0000026B066D0000-0x0000026B066D1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads