adwind | 197b50495332e2500a6172e60f954a4a9baf94db133b16238c563257dfb60592

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
779pro.jar
Size 84KB
Sample260730-pg9faa1vhz
SHA256 197b50495332e2500a6172e60f954a4a9baf94db133b16238c563257dfb60592
MD5 2b6de2c2a3fe1c68b74691e76208daa8
SHA1 e349f60257fdfbf7db0cf8b54d8385b60c853575
SHA512 e19f01024b19970307d848751e2fa94daf11de57e48c9ac063a2647d48c644e851a24122ac74dc4212a6afbba9de878e4c015f39e781fb0897ed2c9c00300e63
SSDEEP 1536:sj4OlIZ6rdWTAGmGfg28V99PbmBM+br0mHtNQ465eo/HX9KXI9HTHX4MYh:sMpWWTAy+W3br06tNmeo/HX8Y93e
TLSH
T1128302D56DE9EB26E16B2E77B630077C3D35044E1D2586AE9F720A04AD6026BF333874
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion adwind persistence trojan

Malware Config

Signatures

Family: AdWind
A Java-based RAT family operated as malware-as-a-service.
trojan adwind

JAR file contains resources related to AdWind 1 IoCs

This JAR file potentially contains loader stubs used by the AdWind RAT.

resource	yara_rule
behavioral2/files/0x000d00000001c4f9-18.dat	family_adwind_stub

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1896	attrib.exe
5724	attrib.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\prosky = "\"C:\\Program Files\\Java\\jre-1.8\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\prosky\\prosky.jar\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\prosky = "\"C:\\Program Files\\Java\\jre-1.8\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\prosky\\prosky.jar\""	reg.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\prosky\Desktop.ini	java.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\prosky\Desktop.ini	attrib.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
260	reg.exe
1536	reg.exe
5604	reg.exe
3520	reg.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1832	java.exe
2136	javaw.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1832 wrote to memory of 1536	1832	java.exe	90
PID 1832 wrote to memory of 5604	1832	java.exe	92
PID 1832 wrote to memory of 5724	1832	java.exe	93
PID 1832 wrote to memory of 1896	1832	java.exe	94
PID 1832 wrote to memory of 2136	1832	java.exe	95
PID 2136 wrote to memory of 3520	2136	javaw.exe	99
PID 2136 wrote to memory of 260	2136	javaw.exe	101
PID 2136 wrote to memory of 5796	2136	javaw.exe	103

Views/modifies file attributes 1 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1896	attrib.exe
5724	attrib.exe
5796	attrib.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\779pro.jar
1⤵
- Drops desktop.ini file(s)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1832
- C:\Windows\SYSTEM32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v prosky /t REG_SZ /d "\"C:\Program Files\Java\jre-1.8\bin\javaw.exe\" -jar \"C:\Users\Admin\AppData\Roaming\prosky\prosky.jar\"" /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:1536
- C:\Windows\SYSTEM32\reg.exe
  reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v prosky /f
  2⤵
  - Modifies registry key
  PID:5604
- C:\Windows\SYSTEM32\attrib.exe
  attrib +s +h +r "C:\Users\Admin\AppData\Roaming\prosky\*.*"
  2⤵
  - Sets file to hidden
  - Drops desktop.ini file(s)
  - Views/modifies file attributes
  PID:5724
- C:\Windows\SYSTEM32\attrib.exe
  attrib +s +h +r "C:\Users\Admin\AppData\Roaming\prosky"
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:1896
- C:\Program Files\Java\jre-1.8\bin\javaw.exe
  "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\prosky\prosky.jar"
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2136
- - C:\Windows\SYSTEM32\reg.exe
    reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v prosky /t REG_SZ /d "\"C:\Program Files\Java\jre-1.8\bin\javaw.exe\" -jar \"C:\Users\Admin\AppData\Roaming\prosky\prosky.jar\"" /f
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:3520
- - C:\Windows\SYSTEM32\reg.exe
    reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v prosky /f
    3⤵
    - Modifies registry key
    PID:260
- - C:\Windows\SYSTEM32\attrib.exe
    attrib +H C:\Users\Admin\.Plugins3
    3⤵
    - Views/modifies file attributes
    PID:5796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Desktop.ini

Path C:\Users\Admin\AppData\Roaming\prosky\Desktop.ini
Size 63B
SHA256 2f65fa9c7ed712f493782abf91467f869419a2f8b5adf23b44019c08190fa3f3
MD5 e783bdd20a976eaeaae1ff4624487420
SHA1 c2a44fab9df00b3e11582546b16612333c2f9286
SHA512 8c883678e4625ef44f4885b8c6d7485196774f9cb0b9eee7dd18711749bcae474163df9965effcd13ecd1a33cd7265010c152f8504d6013e4f4d85d68a901a80
TLSH
T19EA0020A11893668F08FD45C29A0F54212ED88668E0965019BB1934941973520BADD5F
MD5 SHA1 SHA512 TLSH

Submit Download

prosky.jar

Path C:\Users\Admin\AppData\Roaming\prosky\prosky.jar
Size 84KB
SHA256 197b50495332e2500a6172e60f954a4a9baf94db133b16238c563257dfb60592
MD5 2b6de2c2a3fe1c68b74691e76208daa8
SHA1 e349f60257fdfbf7db0cf8b54d8385b60c853575
SHA512 e19f01024b19970307d848751e2fa94daf11de57e48c9ac063a2647d48c644e851a24122ac74dc4212a6afbba9de878e4c015f39e781fb0897ed2c9c00300e63
SSDEEP 1536:sj4OlIZ6rdWTAGmGfg28V99PbmBM+br0mHtNQ465eo/HX9KXI9HTHX4MYh:sMpWWTAy+W3br06tNmeo/HX8Y93e
TLSH
T1128302D56DE9EB26E16B2E77B630077C3D35044E1D2586AE9F720A04AD6026BF333874
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1832-2-0x0000018CB4390000-0x0000018CB4600000-memory.dmp

Download

memory/1832-14-0x0000018CB2A10000-0x0000018CB2A11000-memory.dmp

Download

memory/1832-19-0x0000018CB2A10000-0x0000018CB2A11000-memory.dmp

Download

memory/1832-22-0x0000018CB4390000-0x0000018CB4600000-memory.dmp

Download

memory/2136-23-0x000001800D470000-0x000001800D6E0000-memory.dmp

Download

memory/2136-37-0x000001800BA40000-0x000001800BA41000-memory.dmp

Download

memory/2136-40-0x000001800BA40000-0x000001800BA41000-memory.dmp

Download

memory/2136-42-0x000001800D470000-0x000001800D6E0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads