analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Bestellung.jar

Full analysis: https://app.any.run/tasks/f847eb5b-902b-4d20-bb19-9de9a3e0f141
Verdict: Malicious activity
Threats:

Adwind RAT, sometimes also called Unrecom, Sockrat, Frutas, jRat, and JSocket, is a Malware As A Service Remote Access Trojan that attackers can use to collect information from infected machines. It was one of the most popular RATs in the market in 2015.

Malware Trends Tracker     >>>
Analysis date: May 15, 2019, 07:01:34
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
adwind
trojan
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

D455417AE393A11A868021E7CC79A0F8

SHA1:

DB35CA4BC6C2A5218F928D383BCD77A193EA6491

SHA256:

5A26AD69FEA584831A0A8AE32F710216AB6F8F688068A928B06E269DC63D8D52

SSDEEP:

12288:GJH+dYeizteqLM7JZRVRThRzqL7AwuzdgQiRvRLjMRWVnNDyujLDBbS:GHBpeeAJ7zzrf+jjLjcW1NDyuzBbS

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • WScript.exe (PID: 404)
      • reg.exe (PID: 948)

    • Writes to a start menu file

      • WScript.exe (PID: 404)

    • AdWind was detected

      • java.exe (PID: 764)
      • java.exe (PID: 2300)

    • Loads dropped or rewritten executable

      • javaw.exe (PID: 1708)
      • java.exe (PID: 764)
      • wscript.exe (PID: 2664)
      • java.exe (PID: 2300)
      • explorer.exe (PID: 2036)
      • svchost.exe (PID: 812)
      • javaw.exe (PID: 2896)
      • javaw.exe (PID: 2064)

    • Application was dropped or rewritten from another process

      • java.exe (PID: 2300)
      • java.exe (PID: 764)
      • javaw.exe (PID: 2896)
      • javaw.exe (PID: 1708)
      • javaw.exe (PID: 2064)

    • ADWIND was detected

      • javaw.exe (PID: 2064)

    • UAC/LUA settings modification

      • regedit.exe (PID: 592)

    • Uses TASKKILL.EXE to kill security tools

      • javaw.exe (PID: 2064)

    • Changes Image File Execution Options

      • regedit.exe (PID: 592)

    • Turns off system restore

      • regedit.exe (PID: 592)

  • SUSPICIOUS

    • Executes scripts

      • wscript.exe (PID: 2664)
      • javaw.exe (PID: 2896)
      • cmd.exe (PID: 3276)
      • cmd.exe (PID: 2320)
      • cmd.exe (PID: 2000)
      • cmd.exe (PID: 2552)
      • cmd.exe (PID: 2884)
      • cmd.exe (PID: 1464)
      • cmd.exe (PID: 2824)
      • cmd.exe (PID: 2644)

    • Executes JAVA applets

      • explorer.exe (PID: 2036)
      • javaw.exe (PID: 1708)
      • wscript.exe (PID: 2664)

    • Application launched itself

      • wscript.exe (PID: 2664)

    • Creates files in the user directory

      • wscript.exe (PID: 2664)
      • WScript.exe (PID: 404)
      • javaw.exe (PID: 1708)
      • xcopy.exe (PID: 296)

    • Starts CMD.EXE for commands execution

      • javaw.exe (PID: 1708)
      • java.exe (PID: 764)
      • javaw.exe (PID: 2064)
      • java.exe (PID: 2300)

    • Uses ATTRIB.EXE to modify file attributes

      • javaw.exe (PID: 1708)

    • Uses REG.EXE to modify Windows registry

      • javaw.exe (PID: 1708)

    • Starts itself from another location

      • javaw.exe (PID: 1708)

    • Executable content was dropped or overwritten

      • xcopy.exe (PID: 296)
      • javaw.exe (PID: 2064)

    • Uses TASKKILL.EXE to kill process

      • javaw.exe (PID: 2064)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: mdrjpeznzq/resources/ecbislmdgc
ZipUncompressedSize: 1014379
ZipCompressedSize: 665362
ZipCRC: 0xbbd258a1
ZipModifyDate: 2019:05:15 10:09:12
ZipCompression: Deflated
ZipBitFlag: -
ZipRequiredVersion: 20
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
183
Monitored processes
84
Malicious processes
11
Suspicious processes
1

Behavior graph

Click at the process to see the details
start javaw.exe no specs wscript.exe no specs wscript.exe javaw.exe no specs #ADWIND java.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs xcopy.exe xcopy.exe no specs reg.exe attrib.exe no specs attrib.exe no specs #ADWIND javaw.exe #ADWIND java.exe svchost.exe no specs explorer.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs taskkill.exe no specs cmd.exe no specs regedit.exe no specs regedit.exe no specs taskkill.exe no specs regedit.exe taskkill.exe no specs taskkill.exe no specs wmic.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2896"C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe" -jar "C:\Users\admin\AppData\Local\Temp\Bestellung.jar"C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe—explorer.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.920.14
2664wscript C:\Users\admin\tsphdgplal.jsC:\Windows\system32\wscript.exe—javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
404"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Roaming\dWHpdvgiip.js" C:\Windows\System32\WScript.exe
wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Version:
5.8.7600.16385
1708"C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe" -jar "C:\Users\admin\AppData\Roaming\bgogbagrg.txt"C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe—wscript.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.920.14
764"C:\Program Files\Java\jre1.8.0_92\bin\java.exe" -jar C:\Users\admin\AppData\Local\Temp\_0.91972698576644244165783236015098287.classC:\Program Files\Java\jre1.8.0_92\bin\java.exe
javaw.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Version:
8.0.920.14
3276cmd.exe /C cscript.exe C:\Users\admin\AppData\Local\Temp\Retrive2639706806798522286.vbsC:\Windows\system32\cmd.exe—javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3908cscript.exe C:\Users\admin\AppData\Local\Temp\Retrive2639706806798522286.vbsC:\Windows\system32\cscript.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Console Based Script Host
Exit code:
0
Version:
5.8.7600.16385
2320cmd.exe /C cscript.exe C:\Users\admin\AppData\Local\Temp\Retrive6843019202397677237.vbsC:\Windows\system32\cmd.exe—java.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
1356cscript.exe C:\Users\admin\AppData\Local\Temp\Retrive6843019202397677237.vbsC:\Windows\system32\cscript.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Console Based Script Host
Exit code:
0
Version:
5.8.7600.16385
2000cmd.exe /C cscript.exe C:\Users\admin\AppData\Local\Temp\Retrive5911545512578396387.vbsC:\Windows\system32\cmd.exe—javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Total events
8 764
Read events
8 507
Write events
257
Delete events
0

Modification events

(PID) Process:(2664) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2664) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(404) WScript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\dWHpdvgiip
Operation:writeName:
Value:
false - 15/5/2019
(PID) Process:(404) WScript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:dWHpdvgiip
Value:
wscript.exe //B "C:\Users\admin\AppData\Roaming\dWHpdvgiip.js"
(PID) Process:(404) WScript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:dWHpdvgiip
Value:
wscript.exe //B "C:\Users\admin\AppData\Roaming\dWHpdvgiip.js"
(PID) Process:(404) WScript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WScript_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(404) WScript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WScript_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(404) WScript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WScript_RASAPI32
Operation:writeName:FileTracingMask
Value:
4294901760
(PID) Process:(404) WScript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WScript_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
4294901760
(PID) Process:(404) WScript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WScript_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
Executable files
111
Suspicious files
10
Text files
79
Unknown types
15

Dropped files

PID
Process
Filename
Type
1708javaw.exeC:\Users\admin\AppData\Local\Temp\Retrive5911545512578396387.vbs —
MD5:—
SHA256:—
404WScript.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dWHpdvgiip.jstext
MD5:BBC5D0B32C7A010CCA38F66198516357
SHA256:51E2072777014A883B43C66874100342BCBA29D58D1291AECC1AE8479EB16A00
2896javaw.exeC:\Users\admin\.oracle_jre_usage\90737d32e3abaa4.timestamptext
MD5:A90FB5A9F5F7BC207812866C13239AAA
SHA256:4EFFC37D619975A0C1DAD44F537F430AF6C22E12E59B2A037B27B08CE54F3215
764java.exeC:\Users\admin\.oracle_jre_usage\90737d32e3abaa4.timestamptext
MD5:93D1F0A0E80C0F421163D77D442FCB33
SHA256:8C3C4E0B3D3B90B87246E3EE4F57406A57BA8F08551C656152D142A4BCA3FAEC
2664wscript.exeC:\Users\admin\AppData\Roaming\dWHpdvgiip.jstext
MD5:BBC5D0B32C7A010CCA38F66198516357
SHA256:51E2072777014A883B43C66874100342BCBA29D58D1291AECC1AE8479EB16A00
2896javaw.exeC:\Users\admin\tsphdgplal.jstext
MD5:E7A8C58AF07A81D8F7A2961E756949B4
SHA256:9BC6358E7D3E5418558316DB100CBDCBBF0BACA3C4DB9059022B3CE9BA343D1B
2664wscript.exeC:\Users\admin\AppData\Roaming\bgogbagrg.txtjava
MD5:61236228C451168FD1334385FE85C12F
SHA256:BEB5A707085EDCFDC6638E5D50E0625996E5A953DAFDFCB4D1B6EA1C18BA1508
1708javaw.exeC:\Users\admin\.oracle_jre_usage\90737d32e3abaa4.timestamptext
MD5:AE5AC151A05946758219B9AADD8EBA4D
SHA256:1B36C47D542EF738ACBF741889BD7FBB9299ECF3F6DCBC49C02E69F3E5DA592A
296xcopy.exeC:\Users\admin\AppData\Roaming\Oracle\releasetext
MD5:1BCCC3A965156E53BE3136B3D583B7B6
SHA256:03A4DB27DEA69374EFBAF121C332D0AF05840D16D0C1FBF127D00E65054B118A
1708javaw.exeC:\Users\admin\AppData\Local\Temp\Retrive2639706806798522286.vbstext
MD5:3BDFD33017806B85949B6FAA7D4B98E4
SHA256:9DA575DD2D5B7C1E9BAB8B51A16CDE457B3371C6DCDB0537356CF1497FA868F6
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
10
DNS requests
2
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2064
javaw.exe
185.244.31.160:7075
olavroy.duckdns.org
—
—
malicious
404
WScript.exe
184.75.209.163:7800
unknownsoft.duckdns.org
Amanah Tech Inc.
CA
malicious

DNS requests

Domain
IP
Reputation
unknownsoft.duckdns.org
  • 184.75.209.163
malicious
olavroy.duckdns.org
  • 185.244.31.160
malicious

Threats

PID
Process
Class
Message
—
—
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
—
—
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
2064
javaw.exe
A Network Trojan was detected
ET TROJAN Possible Adwind SSL Cert (assylias.Inc)
2064
javaw.exe
A Network Trojan was detected
MALWARE [PTsecurity] Backdoor.Java.Adwind.cu
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Bestellung.jar