adwind | dbb87b3e7913ccf3c7552c9944aaa3805bfa6e34b6dd92688e74d2a3c7545201 | Triage

Resubmissions

20-12-2024 21:07

241220-zyktcstpds 10

20-12-2024 21:04

241220-zwy8zavjhl 10

Sharing

General

Target

AzureSpooferHWID.jar
Size

639KB
Sample

241220-zwy8zavjhl
MD5

ea029a25bb7bff5f342f58106321f461
SHA1

8a6c20abcc40a57f83c4554284023438ffc89596
SHA256

dbb87b3e7913ccf3c7552c9944aaa3805bfa6e34b6dd92688e74d2a3c7545201
SHA512

838a872b933de658711b5c513c0256c1064ff9e4584f7c67d21723b277e2b1e3693256c1b5bc805d28427634461b0801982ca6c109d236eb7c48fed68b1afac9
SSDEEP

12288:4X/TQv/Jd7+Nl4F7AfW3gO/jRT+dhcNmvYg+NuRz63Qus2NkSUxDMn:4XbQ3T+L41v3gONqomvlQ1QuRN3UxDMn

Score

10^/10

adwind discovery persistence

Malware Config

Targets

- Target
  
  AzureSpooferHWID.jar
- Size
  
  639KB
- MD5
  
  ea029a25bb7bff5f342f58106321f461
- SHA1
  
  8a6c20abcc40a57f83c4554284023438ffc89596
- SHA256
  
  dbb87b3e7913ccf3c7552c9944aaa3805bfa6e34b6dd92688e74d2a3c7545201
- SHA512
  
  838a872b933de658711b5c513c0256c1064ff9e4584f7c67d21723b277e2b1e3693256c1b5bc805d28427634461b0801982ca6c109d236eb7c48fed68b1afac9
- SSDEEP
  
  12288:4X/TQv/Jd7+Nl4F7AfW3gO/jRT+dhcNmvYg+NuRz63Qus2NkSUxDMn:4XbQ3T+L41v3gONqomvlQ1QuRN3UxDMn
Score

6^/10

discovery persistence
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

discoverypersistence