Analysis Overview
SHA256
b568557f6219bf59cd785dd1b9f73a1ed9bf99b1f09a1b4f450a3b06214093d4
Threat Level: Known bad
The file built.jar was found to be: Known bad.
Malicious Activity Summary
Adwind family
Class file contains resources related to AdWind
Adds Run key to start application
Suspicious use of WriteProcessMemory
Views/modifies file attributes
Suspicious use of SetWindowsHookEx
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-11-16 06:15
Signatures
Adwind family
Class file contains resources related to AdWind
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-11-16 06:15
Reported
2024-11-16 06:17
Platform
win11-20241023-en
Max time kernel
146s
Max time network
152s
Command Line
Signatures
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Home = "C:\\Program Files\\Java\\jre-1.8\\bin\\javaw.exe -jar C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\.tmp\\1731737718352.tmp" | C:\Windows\system32\reg.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 1188 wrote to memory of 4268 | N/A | C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe | C:\Windows\SYSTEM32\attrib.exe |
| PID 1188 wrote to memory of 4268 | N/A | C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe | C:\Windows\SYSTEM32\attrib.exe |
| PID 1188 wrote to memory of 3408 | N/A | C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe | C:\Windows\SYSTEM32\cmd.exe |
| PID 1188 wrote to memory of 3408 | N/A | C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe | C:\Windows\SYSTEM32\cmd.exe |
| PID 3408 wrote to memory of 4568 | N/A | C:\Windows\SYSTEM32\cmd.exe | C:\Windows\system32\reg.exe |
| PID 3408 wrote to memory of 4568 | N/A | C:\Windows\SYSTEM32\cmd.exe | C:\Windows\system32\reg.exe |
Views/modifies file attributes
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SYSTEM32\attrib.exe | N/A |
Processes
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\built.jar
C:\Windows\SYSTEM32\attrib.exe
attrib +H C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1731737718352.tmp
C:\Windows\SYSTEM32\cmd.exe
cmd.exe /c "REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1731737718352.tmp" /f"
C:\Windows\system32\reg.exe
REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1731737718352.tmp" /f
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Network
| Country | Destination | Domain | Proto |
| N/A | 127.0.0.1:4411 | tcp | |
| N/A | 127.0.0.1:4411 | tcp | |
| N/A | 127.0.0.1:4411 | tcp | |
| N/A | 127.0.0.1:4411 | tcp |
Files
memory/1188-2-0x000002561F890000-0x000002561FB00000-memory.dmp
memory/1188-17-0x000002561FB10000-0x000002561FB20000-memory.dmp
memory/1188-16-0x000002561FB00000-0x000002561FB10000-memory.dmp
memory/1188-19-0x000002561FB20000-0x000002561FB30000-memory.dmp
memory/1188-21-0x000002561FB30000-0x000002561FB40000-memory.dmp
memory/1188-23-0x000002561FB40000-0x000002561FB50000-memory.dmp
memory/1188-26-0x000002561FB50000-0x000002561FB60000-memory.dmp
memory/1188-27-0x000002561FB60000-0x000002561FB70000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1731737718352.tmp
| MD5 | 6b5b829c063142549a57c945b056ad3f |
| SHA1 | 07ad97d0e1252a28ec1ab8fbfb0bddc647a3df5a |
| SHA256 | b568557f6219bf59cd785dd1b9f73a1ed9bf99b1f09a1b4f450a3b06214093d4 |
| SHA512 | 8c59065dc07ee1b3fabeefea90355cf3c361de96b094f6eee194df14afb9e87041fde8bf1d729e4fc5610a829e9382e06e9054676104ae6a7157c1deef99c44f |
memory/1188-32-0x000002561FB70000-0x000002561FB80000-memory.dmp
memory/1188-34-0x000002561E020000-0x000002561E021000-memory.dmp
memory/1188-35-0x000002561F890000-0x000002561FB00000-memory.dmp
memory/1188-36-0x000002561E020000-0x000002561E021000-memory.dmp
memory/1188-40-0x000002561FB80000-0x000002561FB90000-memory.dmp
memory/1188-39-0x000002561FB00000-0x000002561FB10000-memory.dmp
memory/1188-42-0x000002561FB10000-0x000002561FB20000-memory.dmp
memory/1188-44-0x000002561FB20000-0x000002561FB30000-memory.dmp
memory/1188-45-0x000002561FB30000-0x000002561FB40000-memory.dmp
memory/1188-46-0x000002561FB40000-0x000002561FB50000-memory.dmp
memory/1188-47-0x000002561FB50000-0x000002561FB60000-memory.dmp
memory/1188-48-0x000002561FB60000-0x000002561FB70000-memory.dmp
memory/1188-49-0x000002561FB70000-0x000002561FB80000-memory.dmp
memory/1188-50-0x000002561FB00000-0x000002561FB10000-memory.dmp
memory/1188-51-0x000002561F890000-0x000002561FB00000-memory.dmp
memory/1188-52-0x000002561FB80000-0x000002561FB90000-memory.dmp
memory/1188-53-0x000002561FB60000-0x000002561FB70000-memory.dmp