File name:

HUD.js

Full analysis: https://app.any.run/tasks/afe723f5-13ea-4895-b6e6-696585f13c94
Verdict: Malicious activity
Threats:

Adwind RAT, sometimes also called Unrecom, Sockrat, Frutas, jRat, and JSocket, is a Malware As A Service Remote Access Trojan that attackers can use to collect information from infected machines. It was one of the most popular RATs in the market in 2015.

Malware Trends Tracker     >>>
Analysis date: August 13, 2019, 15:24:13
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
adwind
trojan
Indicators:
MIME: text/plain
File info: ASCII text, with very long lines
MD5:

FF45479FE3ABFA21B5984FAD34325324

SHA1:

38E385D6AD076CE77BA2C058E1B0B48ED0D8B721

SHA256:

02823587E64841A35510DD2D92C771461590658A9110645CB645EE45524A316B

SSDEEP:

12288:ZiMwFePrV4/RkQ/J6zKIcHIackg273eESx1S9PS0vq5GqdXf2/UiA64csdliJQBh:ZPEfx63Lkg22wPbHqF0ARfdvTR

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • WScript.exe (PID: 1444)
      • reg.exe (PID: 2804)

    • Writes to a start menu file

      • WScript.exe (PID: 1444)

    • AdWind was detected

      • java.exe (PID: 2396)
      • java.exe (PID: 3056)

    • Loads dropped or rewritten executable

      • javaw.exe (PID: 1644)
      • javaw.exe (PID: 3152)
      • java.exe (PID: 3056)
      • java.exe (PID: 2396)
      • WScript.exe (PID: 1700)

    • Application was dropped or rewritten from another process

      • javaw.exe (PID: 1644)
      • java.exe (PID: 2396)
      • java.exe (PID: 3056)
      • javaw.exe (PID: 3152)

    • UAC/LUA settings modification

      • regedit.exe (PID: 1732)

    • Turns off system restore

      • regedit.exe (PID: 1732)

    • Uses TASKKILL.EXE to kill security tools

      • javaw.exe (PID: 3152)

    • Changes Image File Execution Options

      • regedit.exe (PID: 1732)

  • SUSPICIOUS

    • Application launched itself

      • WScript.exe (PID: 1700)

    • Executes scripts

      • WScript.exe (PID: 1700)
      • cmd.exe (PID: 3728)
      • cmd.exe (PID: 3812)
      • cmd.exe (PID: 2776)
      • cmd.exe (PID: 1048)
      • cmd.exe (PID: 1568)
      • cmd.exe (PID: 2488)
      • cmd.exe (PID: 3888)
      • cmd.exe (PID: 3396)

    • Creates files in the user directory

      • javaw.exe (PID: 1644)
      • WScript.exe (PID: 1700)
      • WScript.exe (PID: 1444)
      • xcopy.exe (PID: 3016)

    • Starts CMD.EXE for commands execution

      • javaw.exe (PID: 1644)
      • java.exe (PID: 2396)
      • java.exe (PID: 3056)
      • javaw.exe (PID: 3152)

    • Executes JAVA applets

      • WScript.exe (PID: 1700)
      • javaw.exe (PID: 1644)

    • Executable content was dropped or overwritten

      • xcopy.exe (PID: 3016)

    • Starts itself from another location

      • javaw.exe (PID: 1644)

    • Uses ATTRIB.EXE to modify file attributes

      • javaw.exe (PID: 1644)

    • Uses REG.EXE to modify Windows registry

      • javaw.exe (PID: 1644)

    • Uses TASKKILL.EXE to kill process

      • javaw.exe (PID: 3152)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
175
Monitored processes
76
Malicious processes
9
Suspicious processes
0

Behavior graph

Click at the process to see the details
start wscript.exe no specs wscript.exe javaw.exe no specs #ADWIND java.exe cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs xcopy.exe cmd.exe no specs cscript.exe no specs attrib.exe no specs reg.exe attrib.exe no specs javaw.exe #ADWIND java.exe cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs taskkill.exe no specs regedit.exe no specs regedit.exe no specs regedit.exe taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
272taskkill /IM V3Proxy.exe /T /FC:\Windows\system32\taskkill.exe—javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
868taskkill /IM NisSrv.exe /T /FC:\Windows\system32\taskkill.exe—javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
916regedit.exe /s C:\Users\admin\AppData\Local\Temp\bqLjtTDjss3857160424203297314.regC:\Windows\regedit.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Editor
Exit code:
3221226540
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\regedit.exe
c:\systemroot\system32\ntdll.dll
1044taskkill /IM MpUXSrv.exe /T /FC:\Windows\system32\taskkill.exe—javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
1048cmd.exe /C cscript.exe C:\Users\admin\AppData\Local\Temp\Retrive8181694140603744842.vbsC:\Windows\system32\cmd.exe—java.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1296taskkill /IM mergecap.exe /T /FC:\Windows\system32\taskkill.exe—javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
1444"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Roaming\EGHMpJvXKO.js" C:\Windows\System32\WScript.exe
WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1568cmd.exe /C cscript.exe C:\Users\admin\AppData\Local\Temp\Retrive5034591013216537684.vbsC:\Windows\system32\cmd.exe—javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1644"C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe" -jar "C:\Users\admin\AppData\Roaming\qdayqalfdf.txt"C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe—WScript.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.920.14
Modules
Images
c:\program files\java\jre1.8.0_92\bin\javaw.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1648cscript.exe C:\Users\admin\AppData\Local\Temp\Retrive1505323408200286325.vbsC:\Windows\system32\cscript.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Console Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\cscript.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
Total events
1 172
Read events
933
Write events
239
Delete events
0

Modification events

(PID) Process:(1700) WScript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(1700) WScript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(1444) WScript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\EGHMpJvXKO
Operation:writeName:
Value:
false - 13/8/2019
(PID) Process:(1444) WScript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:EGHMpJvXKO
Value:
wscript.exe //B "C:\Users\admin\AppData\Roaming\EGHMpJvXKO.js"
(PID) Process:(1444) WScript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:EGHMpJvXKO
Value:
wscript.exe //B "C:\Users\admin\AppData\Roaming\EGHMpJvXKO.js"
(PID) Process:(1444) WScript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WScript_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(1444) WScript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WScript_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(1444) WScript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WScript_RASAPI32
Operation:writeName:FileTracingMask
Value:
4294901760
(PID) Process:(1444) WScript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WScript_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
4294901760
(PID) Process:(1444) WScript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WScript_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
Executable files
110
Suspicious files
10
Text files
79
Unknown types
15

Dropped files

PID
Process
Filename
Type
2396java.exeC:\Users\admin\AppData\Local\Temp\Retrive8181694140603744842.vbs —
MD5:—
SHA256:—
1644javaw.exeC:\Users\admin\.oracle_jre_usage\90737d32e3abaa4.timestamptext
MD5:—
SHA256:—
1700WScript.exeC:\Users\admin\AppData\Roaming\qdayqalfdf.txtjava
MD5:—
SHA256:—
3016xcopy.exeC:\Users\admin\AppData\Roaming\Oracle\Welcome.htmlhtml
MD5:27CF299B6D93FACA73FBCDCF4AECFD93
SHA256:3F1F0EE75588DBBA3B143499D08AA9AB431E4A34E483890CFAC94A8E1061B7CF
1644javaw.exeC:\Users\admin\AppData\Local\Temp\Retrive3566354563386503581.vbstext
MD5:A32C109297ED1CA155598CD295C26611
SHA256:45BFE34AA3EF932F75101246EB53D032F5E7CF6D1F5B4E495334955A255F32E7
3016xcopy.exeC:\Users\admin\AppData\Roaming\Oracle\LICENSEtext
MD5:98F46AB6481D87C4D77E0E91A6DBC15F
SHA256:23F9A5C12FA839650595A32872B7360B9E030C7213580FB27DD9185538A5828C
1644javaw.exeC:\Users\admin\AppData\Local\Temp\Retrive1646263971290416277.vbstext
MD5:3BDFD33017806B85949B6FAA7D4B98E4
SHA256:9DA575DD2D5B7C1E9BAB8B51A16CDE457B3371C6DCDB0537356CF1497FA868F6
3016xcopy.exeC:\Users\admin\AppData\Roaming\Oracle\COPYRIGHTtext
MD5:89F660D2B7D58DA3EFD2FECD9832DA9C
SHA256:F6A08C9CC04D7C6A86576C1EF50DD0A690AE5CB503EFD205EDB2E408BD8D557B
1700WScript.exeC:\Users\admin\AppData\Roaming\EGHMpJvXKO.jstext
MD5:—
SHA256:—
1444WScript.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EGHMpJvXKO.jstext
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
16
DNS requests
1
Threats
1

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3152
javaw.exe
37.48.92.195:1350
—
LeaseWeb Netherlands B.V.
NL
malicious
1444
WScript.exe
67.207.93.17:7755
pluginsrv.duckdns.org
Digital Ocean, Inc.
US
malicious

DNS requests

Domain
IP
Reputation
pluginsrv.duckdns.org
  • 67.207.93.17
malicious

Threats

PID
Process
Class
Message
1064
svchost.exe
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
HUD.js