Malware Analysis Report

2024-12-07 20:38

Sample ID 241116-gzw9ns1gln
Target built.jar
SHA256 b568557f6219bf59cd785dd1b9f73a1ed9bf99b1f09a1b4f450a3b06214093d4
Tags
adwind persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b568557f6219bf59cd785dd1b9f73a1ed9bf99b1f09a1b4f450a3b06214093d4

Threat Level: Known bad

The file built.jar was found to be: Known bad.

Malicious Activity Summary

adwind persistence

Adwind family

Class file contains resources related to AdWind

Adds Run key to start application

Suspicious use of WriteProcessMemory

Views/modifies file attributes

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-16 06:15

Signatures

Adwind family

adwind

Class file contains resources related to AdWind

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-16 06:15

Reported

2024-11-16 06:17

Platform

win11-20241023-en

Max time kernel

146s

Max time network

152s

Command Line

java -jar C:\Users\Admin\AppData\Local\Temp\built.jar

Signatures

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Home = "C:\\Program Files\\Java\\jre-1.8\\bin\\javaw.exe -jar C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\.tmp\\1731737718352.tmp" C:\Windows\system32\reg.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe N/A

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\attrib.exe N/A

Processes

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe

java -jar C:\Users\Admin\AppData\Local\Temp\built.jar

C:\Windows\SYSTEM32\attrib.exe

attrib +H C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1731737718352.tmp

C:\Windows\SYSTEM32\cmd.exe

cmd.exe /c "REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1731737718352.tmp" /f"

C:\Windows\system32\reg.exe

REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1731737718352.tmp" /f

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Network

Country Destination Domain Proto
N/A 127.0.0.1:4411 tcp
N/A 127.0.0.1:4411 tcp
N/A 127.0.0.1:4411 tcp
N/A 127.0.0.1:4411 tcp

Files

memory/1188-2-0x000002561F890000-0x000002561FB00000-memory.dmp

memory/1188-17-0x000002561FB10000-0x000002561FB20000-memory.dmp

memory/1188-16-0x000002561FB00000-0x000002561FB10000-memory.dmp

memory/1188-19-0x000002561FB20000-0x000002561FB30000-memory.dmp

memory/1188-21-0x000002561FB30000-0x000002561FB40000-memory.dmp

memory/1188-23-0x000002561FB40000-0x000002561FB50000-memory.dmp

memory/1188-26-0x000002561FB50000-0x000002561FB60000-memory.dmp

memory/1188-27-0x000002561FB60000-0x000002561FB70000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1731737718352.tmp

MD5 6b5b829c063142549a57c945b056ad3f
SHA1 07ad97d0e1252a28ec1ab8fbfb0bddc647a3df5a
SHA256 b568557f6219bf59cd785dd1b9f73a1ed9bf99b1f09a1b4f450a3b06214093d4
SHA512 8c59065dc07ee1b3fabeefea90355cf3c361de96b094f6eee194df14afb9e87041fde8bf1d729e4fc5610a829e9382e06e9054676104ae6a7157c1deef99c44f

memory/1188-32-0x000002561FB70000-0x000002561FB80000-memory.dmp

memory/1188-34-0x000002561E020000-0x000002561E021000-memory.dmp

memory/1188-35-0x000002561F890000-0x000002561FB00000-memory.dmp

memory/1188-36-0x000002561E020000-0x000002561E021000-memory.dmp

memory/1188-40-0x000002561FB80000-0x000002561FB90000-memory.dmp

memory/1188-39-0x000002561FB00000-0x000002561FB10000-memory.dmp

memory/1188-42-0x000002561FB10000-0x000002561FB20000-memory.dmp

memory/1188-44-0x000002561FB20000-0x000002561FB30000-memory.dmp

memory/1188-45-0x000002561FB30000-0x000002561FB40000-memory.dmp

memory/1188-46-0x000002561FB40000-0x000002561FB50000-memory.dmp

memory/1188-47-0x000002561FB50000-0x000002561FB60000-memory.dmp

memory/1188-48-0x000002561FB60000-0x000002561FB70000-memory.dmp

memory/1188-49-0x000002561FB70000-0x000002561FB80000-memory.dmp

memory/1188-50-0x000002561FB00000-0x000002561FB10000-memory.dmp

memory/1188-51-0x000002561F890000-0x000002561FB00000-memory.dmp

memory/1188-52-0x000002561FB80000-0x000002561FB90000-memory.dmp

memory/1188-53-0x000002561FB60000-0x000002561FB70000-memory.dmp