analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

uvEIGxqVEN_done.vbs

Full analysis: https://app.any.run/tasks/4e0da099-4092-4206-90c0-3e793e7f32d0
Verdict: Malicious activity
Threats:

Adwind RAT, sometimes also called Unrecom, Sockrat, Frutas, jRat, and JSocket, is a Malware As A Service Remote Access Trojan that attackers can use to collect information from infected machines. It was one of the most popular RATs in the market in 2015.

Malware Trends Tracker     >>>
Analysis date: April 15, 2019, 08:06:06
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
adwind
trojan
Indicators:
MIME: text/plain
File info: ASCII text, with very long lines
MD5:

A39B6B5C6D0FC51BA46427A22F46D9C7

SHA1:

D28F28459A0F2A4F582D271FDB9201987DE1CD29

SHA256:

51C8B2BC4705648B0EC3CEBD7FF6839780C0404ED5E0FB34E96A56CDD2DB2F0E

SSDEEP:

24576:o+NE5VKyzuIwW88t/f5CwjcuE13CtGZcn7:ObZ11Hz

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • WScript.exe (PID: 672)
      • WScript.exe (PID: 2216)
      • reg.exe (PID: 2544)

    • Writes to a start menu file

      • WScript.exe (PID: 2216)

    • AdWind was detected

      • java.exe (PID: 3044)
      • java.exe (PID: 2812)

    • Loads dropped or rewritten executable

      • java.exe (PID: 3044)
      • javaw.exe (PID: 2808)
      • javaw.exe (PID: 1500)
      • java.exe (PID: 2812)
      • WScript.exe (PID: 672)
      • cmd.exe (PID: 1512)
      • javaw.exe (PID: 3456)

    • Application was dropped or rewritten from another process

      • javaw.exe (PID: 3456)
      • java.exe (PID: 3044)
      • javaw.exe (PID: 2808)
      • javaw.exe (PID: 1500)
      • java.exe (PID: 2812)

  • SUSPICIOUS

    • Executes scripts

      • WScript.exe (PID: 672)
      • cmd.exe (PID: 796)
      • cmd.exe (PID: 2436)
      • cmd.exe (PID: 3856)
      • cmd.exe (PID: 404)
      • cmd.exe (PID: 3036)
      • cmd.exe (PID: 2260)
      • cmd.exe (PID: 3056)
      • cmd.exe (PID: 3268)

    • Creates files in the user directory

      • WScript.exe (PID: 2216)
      • javaw.exe (PID: 2808)
      • WScript.exe (PID: 672)
      • xcopy.exe (PID: 1532)

    • Executes JAVA applets

      • WScript.exe (PID: 672)
      • cmd.exe (PID: 1512)
      • javaw.exe (PID: 2808)

    • Application launched itself

      • WScript.exe (PID: 672)

    • Starts CMD.EXE for commands execution

      • WScript.exe (PID: 672)
      • java.exe (PID: 3044)
      • javaw.exe (PID: 2808)
      • javaw.exe (PID: 1500)
      • java.exe (PID: 2812)

    • Executable content was dropped or overwritten

      • xcopy.exe (PID: 1532)

    • Uses ATTRIB.EXE to modify file attributes

      • javaw.exe (PID: 2808)

    • Starts itself from another location

      • javaw.exe (PID: 2808)

    • Uses REG.EXE to modify Windows registry

      • javaw.exe (PID: 2808)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
72
Monitored processes
28
Malicious processes
8
Suspicious processes
1

Behavior graph

Click at the process to see the details
start wscript.exe wscript.exe cmd.exe no specs javaw.exe no specs javaw.exe no specs #ADWIND java.exe cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs xcopy.exe cmd.exe no specs cscript.exe no specs reg.exe attrib.exe no specs attrib.exe no specs javaw.exe #ADWIND java.exe cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
672"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\uvEIGxqVEN_done.vbs"C:\Windows\System32\WScript.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
2216"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Roaming\VuAaQOSrAD.vbs" C:\Windows\System32\WScript.exe
WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Version:
5.8.7600.16385
1512"C:\Windows\System32\cmd.exe" /c "C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe" -version 2> C:\Users\admin\AppData\Local\Temp\output.txtC:\Windows\System32\cmd.exe—WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3456"C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe" -version C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe—cmd.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.920.14
2808"C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe" -jar "C:\Users\admin\AppData\Roaming\ntfsmgr.jar"C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe—WScript.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.920.14
3044"C:\Program Files\Java\jre1.8.0_92\bin\java.exe" -jar C:\Users\admin\AppData\Local\Temp\_0.081926792675044327556137908501842559.classC:\Program Files\Java\jre1.8.0_92\bin\java.exe
javaw.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Version:
8.0.920.14
2436cmd.exe /C cscript.exe C:\Users\admin\AppData\Local\Temp\Retrive2081880329282942563.vbsC:\Windows\system32\cmd.exe—javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3804cscript.exe C:\Users\admin\AppData\Local\Temp\Retrive2081880329282942563.vbsC:\Windows\system32\cscript.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Console Based Script Host
Exit code:
0
Version:
5.8.7600.16385
796cmd.exe /C cscript.exe C:\Users\admin\AppData\Local\Temp\Retrive815499278121672364.vbsC:\Windows\system32\cmd.exe—javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2132cscript.exe C:\Users\admin\AppData\Local\Temp\Retrive815499278121672364.vbsC:\Windows\system32\cscript.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Console Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Total events
832
Read events
791
Write events
41
Delete events
0

Modification events

(PID) Process:(672) WScript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(672) WScript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(2216) WScript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\VuAaQOSrAD
Operation:writeName:
Value:
false - 4/15/2019
(PID) Process:(2216) WScript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:VuAaQOSrAD
Value:
wscript.exe //B "C:\Users\admin\AppData\Roaming\VuAaQOSrAD.vbs"
(PID) Process:(2216) WScript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:VuAaQOSrAD
Value:
wscript.exe //B "C:\Users\admin\AppData\Roaming\VuAaQOSrAD.vbs"
(PID) Process:(672) WScript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:ntfsmgr
Value:
"C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe" -jar "C:\Users\admin\AppData\Roaming\ntfsmgr.jar"
(PID) Process:(2216) WScript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WScript_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2216) WScript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WScript_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(2216) WScript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WScript_RASAPI32
Operation:writeName:FileTracingMask
Value:
4294901760
(PID) Process:(2216) WScript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WScript_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
4294901760
Executable files
110
Suspicious files
10
Text files
78
Unknown types
15

Dropped files

PID
Process
Filename
Type
3044java.exeC:\Users\admin\AppData\Local\Temp\Retrive6612119510007379159.vbs —
MD5:—
SHA256:—
672WScript.exeC:\Users\admin\AppData\Roaming\VuAaQOSrAD.vbstext
MD5:2B17FEEA3F4AC61C3F281EBBCCDF77ED
SHA256:3CCA55D48FAE0FF7C00A66364F027E0F97CEA51F05E9A43512075151CFB466F8
2216WScript.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VuAaQOSrAD.vbstext
MD5:2B17FEEA3F4AC61C3F281EBBCCDF77ED
SHA256:3CCA55D48FAE0FF7C00A66364F027E0F97CEA51F05E9A43512075151CFB466F8
3456javaw.exeC:\Users\admin\.oracle_jre_usage\90737d32e3abaa4.timestamptext
MD5:8D5C978E84C3335679010E4ED5256312
SHA256:57AAE5101D1BBF4ADDCADE08DE9E25F3173594046E3693F91C8956F8D7F44FD3
1512cmd.exeC:\Users\admin\AppData\Local\Temp\output.txttext
MD5:FCF81EDEAE4E8C13E8B099A9EE455E27
SHA256:0CCC5DDB797429E5625AEDB2ECEE3F42E97221264CD69D5FF53A094F72FE5D7B
3044java.exeC:\Users\admin\.oracle_jre_usage\90737d32e3abaa4.timestamptext
MD5:579B23A86BF81E7EFFCCE7E947B2C134
SHA256:FE42CDC9C09BEE5C03868B06DC6FCC1238ACB25D1F425F1AB55516F4EE5D51A1
2808javaw.exeC:\Users\admin\.oracle_jre_usage\90737d32e3abaa4.timestamptext
MD5:8D5C978E84C3335679010E4ED5256312
SHA256:57AAE5101D1BBF4ADDCADE08DE9E25F3173594046E3693F91C8956F8D7F44FD3
672WScript.exeC:\Users\admin\AppData\Roaming\ntfsmgr.jarjava
MD5:5C4C889863BA9B6561BF7990D28EEAF6
SHA256:F2EC4EF762724B950F16DB471F7B6B8AF1EFB6E2CDE6442A56ACECF108C9B17E
2808javaw.exeC:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302019708-1500728564-335382590-1000\83aa4cc77f591dfc2374580bbd95f6ba_90059c37-1320-41a4-b58d-2b75a9850d2fdbf
MD5:C8366AE350E7019AEFC9D1E6E6A498C6
SHA256:11E6ACA8E682C046C83B721EEB5C72C5EF03CB5936C60DF6F4993511DDC61238
1532xcopy.exeC:\Users\admin\AppData\Roaming\Oracle\COPYRIGHTtext
MD5:89F660D2B7D58DA3EFD2FECD9832DA9C
SHA256:F6A08C9CC04D7C6A86576C1EF50DD0A690AE5CB503EFD205EDB2E408BD8D557B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
14
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2216
WScript.exe
5.206.225.115:7788
—
Dotsi, Unipessoal Lda.
NL
malicious
1500
javaw.exe
178.239.21.25:5000
pm2bitcoin.com
Telekomunikacije Republike Srpske akcionarsko drustvo Banja Luka
BA
malicious

DNS requests

Domain
IP
Reputation
pm2bitcoin.com
  • 178.239.21.25
malicious

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
uvEIGxqVEN_done.vbs