analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Scan-Po01112019.jar

Full analysis: https://app.any.run/tasks/965ea134-c38e-4ef2-b91f-da5176a1d149
Verdict: Malicious activity
Threats:

Adwind RAT, sometimes also called Unrecom, Sockrat, Frutas, jRat, and JSocket, is a Malware As A Service Remote Access Trojan that attackers can use to collect information from infected machines. It was one of the most popular RATs in the market in 2015.

Malware Trends Tracker     >>>
Analysis date: January 11, 2019, 14:13:42
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
adwind
trojan
Indicators:
MIME: application/java-archive
File info: Java archive data (JAR)
MD5:

664A7C67C1BCAB3A507D567C3F0194FA

SHA1:

FC53EA22BE718965D0D21A3AB4BADE23B3D6D22F

SHA256:

66A6B03ABE953E4A77C3EB71CA206597585F649C40E379251EAD1BD1FAC500DF

SSDEEP:

12288:Wy82+kLlDIalbsgD5wj5HI65VzN20KS8TWZ1HlcycOTOz+QqYrlA:Wb2+QlDnbsggH5VZBAyZ1C6qzgYrlA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • AdWind was detected

      • java.exe (PID: 2180)
      • java.exe (PID: 2748)

    • Application was dropped or rewritten from another process

      • javaw.exe (PID: 2944)
      • java.exe (PID: 2180)
      • java.exe (PID: 2748)
      • javaw.exe (PID: 1240)

    • Loads dropped or rewritten executable

      • java.exe (PID: 2180)
      • explorer.exe (PID: 2028)
      • javaw.exe (PID: 2944)
      • javaw.exe (PID: 1240)
      • java.exe (PID: 2748)

    • Changes the autorun value in the registry

      • reg.exe (PID: 3700)

    • UAC/LUA settings modification

      • regedit.exe (PID: 3192)

    • Turns off system restore

      • regedit.exe (PID: 3192)

    • ADWIND was detected

      • javaw.exe (PID: 1240)

    • Uses TASKKILL.EXE to kill security tools

      • javaw.exe (PID: 1240)

    • Changes Image File Execution Options

      • regedit.exe (PID: 3192)

  • SUSPICIOUS

    • Executes JAVA applets

      • javaw.exe (PID: 2944)
      • explorer.exe (PID: 2028)

    • Starts CMD.EXE for commands execution

      • java.exe (PID: 2180)
      • javaw.exe (PID: 2944)
      • java.exe (PID: 2748)
      • javaw.exe (PID: 1240)

    • Creates files in the user directory

      • javaw.exe (PID: 2944)
      • xcopy.exe (PID: 3464)

    • Executes scripts

      • cmd.exe (PID: 2504)
      • cmd.exe (PID: 2860)
      • cmd.exe (PID: 2444)
      • cmd.exe (PID: 2040)
      • cmd.exe (PID: 3104)
      • cmd.exe (PID: 2584)
      • cmd.exe (PID: 2340)
      • cmd.exe (PID: 3144)

    • Executable content was dropped or overwritten

      • xcopy.exe (PID: 3464)
      • javaw.exe (PID: 1240)

    • Uses REG.EXE to modify Windows registry

      • javaw.exe (PID: 2944)

    • Starts itself from another location

      • javaw.exe (PID: 2944)

    • Uses ATTRIB.EXE to modify file attributes

      • javaw.exe (PID: 2944)

    • Connects to unusual port

      • javaw.exe (PID: 1240)

    • Uses TASKKILL.EXE to kill process

      • javaw.exe (PID: 1240)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: META-INF/MANIFEST.MF
ZipUncompressedSize: 63
ZipCompressedSize: 65
ZipCRC: 0x41f21051
ZipModifyDate: 2019:01:11 10:50:04
ZipCompression: Deflated
ZipBitFlag: 0x0808
ZipRequiredVersion: 20
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
288
Monitored processes
135
Malicious processes
8
Suspicious processes
0

Behavior graph

Click at the process to see the details
start javaw.exe no specs java.exe cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs xcopy.exe cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs explorer.exe no specs reg.exe attrib.exe no specs attrib.exe no specs #ADWIND javaw.exe java.exe cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs taskkill.exe no specs cmd.exe no specs regedit.exe no specs regedit.exe no specs regedit.exe taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs wmic.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2944"C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe" -jar "C:\Users\admin\AppData\Local\Temp\Scan-Po01112019.jar"C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe—explorer.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.920.14
2180"C:\Program Files\Java\jre1.8.0_92\bin\java.exe" -jar C:\Users\admin\AppData\Local\Temp\_0.3957265164144249670183621959121333.classC:\Program Files\Java\jre1.8.0_92\bin\java.exe
javaw.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Version:
8.0.920.14
2860cmd.exe /C cscript.exe C:\Users\admin\AppData\Local\Temp\Retrive4949496496782934262.vbsC:\Windows\system32\cmd.exe—java.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2276cscript.exe C:\Users\admin\AppData\Local\Temp\Retrive4949496496782934262.vbsC:\Windows\system32\cscript.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Console Based Script Host
Exit code:
0
Version:
5.8.7600.16385
2504cmd.exe /C cscript.exe C:\Users\admin\AppData\Local\Temp\Retrive3039184657241482413.vbsC:\Windows\system32\cmd.exe—java.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3836cscript.exe C:\Users\admin\AppData\Local\Temp\Retrive3039184657241482413.vbsC:\Windows\system32\cscript.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Console Based Script Host
Exit code:
0
Version:
5.8.7600.16385
3464xcopy "C:\Program Files\Java\jre1.8.0_92" "C:\Users\admin\AppData\Roaming\Oracle\" /eC:\Windows\system32\xcopy.exe
java.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Extended Copy Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2444cmd.exe /C cscript.exe C:\Users\admin\AppData\Local\Temp\Retrive3208762929116561742.vbsC:\Windows\system32\cmd.exe—javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3100cscript.exe C:\Users\admin\AppData\Local\Temp\Retrive3208762929116561742.vbsC:\Windows\system32\cscript.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Console Based Script Host
Exit code:
0
Version:
5.8.7600.16385
2040cmd.exe /C cscript.exe C:\Users\admin\AppData\Local\Temp\Retrive875811607349819676.vbsC:\Windows\system32\cmd.exe—javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Total events
865
Read events
649
Write events
0
Delete events
0

Modification events

No data
Executable files
110
Suspicious files
10
Text files
73
Unknown types
15

Dropped files

PID
Process
Filename
Type
2944javaw.exeC:\Users\admin\AppData\Local\Temp\Retrive3208762929116561742.vbs —
MD5:—
SHA256:—
2944javaw.exeC:\Users\admin\.oracle_jre_usage\90737d32e3abaa4.timestamptext
MD5:E84F01E10DCF254579E45630BB7EA5D2
SHA256:364E917613CE609D39497ED0B67BA5D2A1E09B687725562CF7F8984A57EED3A0
3464xcopy.exeC:\Users\admin\AppData\Roaming\Oracle\README.txttext
MD5:0F1123976B959AC5E8B89EB8C245C4BD
SHA256:963095CF8DB76FB8071FD19A3110718A42F2AB42B27A3ADFD9EC58981C3E88D2
2180java.exeC:\Users\admin\.oracle_jre_usage\90737d32e3abaa4.timestamptext
MD5:35211D7EF2C114ACFC036649929FACC1
SHA256:407DCD8C432A32C41422E823588E1825FAD4F1B0E116785861402929DFD1E031
3464xcopy.exeC:\Users\admin\AppData\Roaming\Oracle\THIRDPARTYLICENSEREADME.txttext
MD5:745D6DB5FC58C63F74CE6A7D4DB7E695
SHA256:C77BA9F668FEE7E9B810F1493E518ADF87233AC8793E4B37C9B3D1ED7846F1C0
3464xcopy.exeC:\Users\admin\AppData\Roaming\Oracle\bin\deploy.dllexecutable
MD5:720EDC1469525DFCD3AE211E653D0241
SHA256:BFF79FB05667992CC2BDA9BAE6E5A301BAF553042F952203641CCD7E1FC4552D
3464xcopy.exeC:\Users\admin\AppData\Roaming\Oracle\bin\decora_sse.dllexecutable
MD5:94434B8739CB5CD184C63CEC209F06E2
SHA256:ADF4E9CE0866FF16A16F626CFC62355FB81212B1E7C95DD908E3644F88B77E91
2944javaw.exeC:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302019708-1500728564-335382590-1000\83aa4cc77f591dfc2374580bbd95f6ba_90059c37-1320-41a4-b58d-2b75a9850d2fdbf
MD5:C8366AE350E7019AEFC9D1E6E6A498C6
SHA256:11E6ACA8E682C046C83B721EEB5C72C5EF03CB5936C60DF6F4993511DDC61238
3464xcopy.exeC:\Users\admin\AppData\Roaming\Oracle\COPYRIGHTtext
MD5:89F660D2B7D58DA3EFD2FECD9832DA9C
SHA256:F6A08C9CC04D7C6A86576C1EF50DD0A690AE5CB503EFD205EDB2E408BD8D557B
3464xcopy.exeC:\Users\admin\AppData\Roaming\Oracle\releasetext
MD5:1BCCC3A965156E53BE3136B3D583B7B6
SHA256:03A4DB27DEA69374EFBAF121C332D0AF05840D16D0C1FBF127D00E65054B118A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1240
javaw.exe
181.215.247.224:9620
—
IP-Connect LLC
UA
suspicious

DNS requests

No data

Threats

PID
Process
Class
Message
1240
javaw.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 15
1240
javaw.exe
A Network Trojan was detected
ET TROJAN Possible Adwind SSL Cert (assylias.Inc)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Scan-Po01112019.jar