adwind | 72fa918ce13bb5853a96d0cd424d60d3c9f82a36258d20d9a7a0450e6c00d657

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/04/2026, 05:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
svchost11.jar
Size 62KB
Sample260427-gljfnae18j
SHA256 72fa918ce13bb5853a96d0cd424d60d3c9f82a36258d20d9a7a0450e6c00d657
MD5 ab94f67492c5e4a2b45bf46cd198f773
SHA1 9ca894b36826ae863462565f04a4ea010889ea5a
SHA512 f4094a0f565ca38d52438d3fa7da0859e9bbdeab4c3141bb48092117be65f7ae16f5817d9e41a82db2a514dce75de5f5161b1935ebe1a99da2e2b923a563a1c3
SSDEEP 1536:4cRc8ZUHaz2ku/IHdDU7i9QSY5s8BPDqVyIydahi:LW8KU27I5RW5BWHrhi
TLSH
T19853026CB89CD7B3DAA351BBC9211CCE6D72D14E66A4C30B81135592B812A1FC7978FC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion adwind persistence trojan

Malware Config

Signatures

Family: AdWind
A Java-based RAT family operated as malware-as-a-service.
trojan adwind

JAR file contains resources related to AdWind 1 IoCs

This JAR file potentially contains loader stubs used by the AdWind RAT.

resource	yara_rule
behavioral2/files/0x001900000002b40b-17.dat	family_adwind_stub

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3404	attrib.exe
3228	attrib.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "\"C:\\Program Files\\Java\\jre-1.8\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate\\WindowsHelper.jar\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "\"C:\\Program Files\\Java\\jre-1.8\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate\\WindowsHelper.jar\""	reg.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\WindowsUpdate\Desktop.ini	java.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\WindowsUpdate\Desktop.ini	attrib.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
2676	reg.exe
3792	reg.exe
3564	reg.exe
636	reg.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4176	java.exe
5056	javaw.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4176 wrote to memory of 3792	4176	java.exe	81
PID 4176 wrote to memory of 3564	4176	java.exe	83
PID 4176 wrote to memory of 3404	4176	java.exe	85
PID 4176 wrote to memory of 3228	4176	java.exe	86
PID 4176 wrote to memory of 5056	4176	java.exe	89
PID 5056 wrote to memory of 636	5056	javaw.exe	90
PID 5056 wrote to memory of 2676	5056	javaw.exe	92
PID 5056 wrote to memory of 1924	5056	javaw.exe	94

Views/modifies file attributes 1 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3404	attrib.exe
3228	attrib.exe
1924	attrib.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\svchost11.jar
1⤵
- Drops desktop.ini file(s)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4176
- C:\Windows\SYSTEM32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdate /t REG_SZ /d "\"C:\Program Files\Java\jre-1.8\bin\javaw.exe\" -jar \"C:\Users\Admin\AppData\Roaming\WindowsUpdate\WindowsHelper.jar\"" /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:3792
- C:\Windows\SYSTEM32\reg.exe
  reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdate /f
  2⤵
  - Modifies registry key
  PID:3564
- C:\Windows\SYSTEM32\attrib.exe
  attrib +s +h +r "C:\Users\Admin\AppData\Roaming\WindowsUpdate\*.*"
  2⤵
  - Sets file to hidden
  - Drops desktop.ini file(s)
  - Views/modifies file attributes
  PID:3404
- C:\Windows\SYSTEM32\attrib.exe
  attrib +s +h +r "C:\Users\Admin\AppData\Roaming\WindowsUpdate"
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:3228
- C:\Program Files\Java\jre-1.8\bin\javaw.exe
  "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\WindowsUpdate\WindowsHelper.jar"
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5056
- - C:\Windows\SYSTEM32\reg.exe
    reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdate /t REG_SZ /d "\"C:\Program Files\Java\jre-1.8\bin\javaw.exe\" -jar \"C:\Users\Admin\AppData\Roaming\WindowsUpdate\WindowsHelper.jar\"" /f
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:636
- - C:\Windows\SYSTEM32\reg.exe
    reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdate /f
    3⤵
    - Modifies registry key
    PID:2676
- - C:\Windows\SYSTEM32\attrib.exe
    attrib +H C:\Users\Admin\.Plugins3
    3⤵
    - Views/modifies file attributes
    PID:1924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 a9bd347afa5c5e2d996d1353618703e69fc65ddf675888e0c8c9ad410d03dc07
MD5 7dbd3d78a389ff97c5c8f36fef634696
SHA1 716da56a315e2ed821ef7e3b8fcc52b0c0cae3d6
SHA512 b5dc82ec16e1e5fb0ec67db54ec36a73ed9373ba62c05e679904a71bacadf9c9ef22fb31a3f22c37de9420f6128c2075ab0d8d55cf9aafb412a2c3753acd28c6
MD5 SHA1 SHA512

Submit Download

Desktop.ini

Path C:\Users\Admin\AppData\Roaming\WindowsUpdate\Desktop.ini
Size 63B
SHA256 2f65fa9c7ed712f493782abf91467f869419a2f8b5adf23b44019c08190fa3f3
MD5 e783bdd20a976eaeaae1ff4624487420
SHA1 c2a44fab9df00b3e11582546b16612333c2f9286
SHA512 8c883678e4625ef44f4885b8c6d7485196774f9cb0b9eee7dd18711749bcae474163df9965effcd13ecd1a33cd7265010c152f8504d6013e4f4d85d68a901a80
TLSH
T19EA0020A11893668F08FD45C29A0F54212ED88668E0965019BB1934941973520BADD5F
MD5 SHA1 SHA512 TLSH

Submit Download

WindowsHelper.jar

Path C:\Users\Admin\AppData\Roaming\WindowsUpdate\WindowsHelper.jar
Size 62KB
SHA256 72fa918ce13bb5853a96d0cd424d60d3c9f82a36258d20d9a7a0450e6c00d657
MD5 ab94f67492c5e4a2b45bf46cd198f773
SHA1 9ca894b36826ae863462565f04a4ea010889ea5a
SHA512 f4094a0f565ca38d52438d3fa7da0859e9bbdeab4c3141bb48092117be65f7ae16f5817d9e41a82db2a514dce75de5f5161b1935ebe1a99da2e2b923a563a1c3
SSDEEP 1536:4cRc8ZUHaz2ku/IHdDU7i9QSY5s8BPDqVyIydahi:LW8KU27I5RW5BWHrhi
TLSH
T19853026CB89CD7B3DAA351BBC9211CCE6D72D14E66A4C30B81135592B812A1FC7978FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4176-2-0x00000170D0CF0000-0x00000170D0F60000-memory.dmp

Download

memory/4176-24-0x00000170CF420000-0x00000170CF421000-memory.dmp

Download

memory/4176-26-0x00000170D0CF0000-0x00000170D0F60000-memory.dmp

Download

memory/5056-20-0x000001E424BD0000-0x000001E424E40000-memory.dmp

Download

memory/5056-38-0x000001E424BB0000-0x000001E424BB1000-memory.dmp

Download

memory/5056-39-0x000001E424BB0000-0x000001E424BB1000-memory.dmp

Download

memory/5056-40-0x000001E424BD0000-0x000001E424E40000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads