| File name: | test 1.jar |
| Full analysis: | https://app.any.run/tasks/d01ee012-48f2-48af-b13f-184535ea4dee |
| Verdict: | Malicious activity |
| Threats: | Adwind RAT, sometimes also called Unrecom, Sockrat, Frutas, jRat, and JSocket, is a Malware As A Service Remote Access Trojan that attackers can use to collect information from infected machines. It was one of the most popular RATs in the market in 2015. |
| Analysis date: | April 29, 2025, 18:39:34 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/zip |
| File info: | Zip archive data, at least v2.0 to extract, compression method=deflate |
| MD5: | 487A91A4D68AF18F5EFACE79E7D554FF |
| SHA1: | 2297373A5F12E16CED4334DABBAFE72827F6A90E |
| SHA256: | 6F29861E9B517C78789C9C059ECC30400770D8C0EB9CD02E5AC4A0AEA496CB24 |
| SSDEEP: | 24576:d2AEW0VXKY8kNqHSIT9YIF6AWglMDfc9+xrbohx/SqQjoE/NHVYTKNidFY:d2AEW0VXKY8kwHSIT9YIF6AWglMDfs+R |
MALICIOUS
ADWIND has been detected
- javaw.exe (PID: 2152)
Changes the autorun value in the registry
- reg.exe (PID: 4988)
ADWIND has been detected (SURICATA)
- javaw.exe (PID: 2152)
Connects to the CnC server
- javaw.exe (PID: 2152)
SUSPICIOUS
Uses ATTRIB.EXE to modify file attributes
- javaw.exe (PID: 2152)
Starts CMD.EXE for commands execution
- javaw.exe (PID: 2152)
Uses REG/REGEDIT.EXE to modify registry
- cmd.exe (PID: 1672)
Contacting a server suspected of hosting an CnC
- javaw.exe (PID: 2152)
Connects to unusual port
- javaw.exe (PID: 2152)
There is functionality for taking screenshot (YARA)
- javaw.exe (PID: 2152)
INFO
Checks supported languages
- javaw.exe (PID: 2152)
Create files in a temporary directory
- javaw.exe (PID: 2152)
Application based on Java
- javaw.exe (PID: 2152)
Creates files in the program directory
- javaw.exe (PID: 2152)
Reads the computer name
- javaw.exe (PID: 2152)
Creates files or folders in the user directory
- javaw.exe (PID: 2152)
Reads the machine GUID from the registry
- javaw.exe (PID: 2152)
Manual execution by a user
- WINWORD.EXE (PID: 3396)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .jar | | | Java Archive (78.3) |
|---|---|---|
| .zip | | | ZIP compressed archive (21.6) |
EXIF
ZIP
| ZipRequiredVersion: | 20 |
|---|---|
| ZipBitFlag: | 0x0808 |
| ZipCompression: | Deflated |
| ZipModifyDate: | 2025:04:29 11:37:22 |
| ZipCRC: | 0x1d0db350 |
| ZipCompressedSize: | 14362 |
| ZipUncompressedSize: | 35507 |
| ZipFileName: | IlIIlLllI/lllIlIlIlll/IIlllllIlIIl/lIlIlIIllI/IIllIllllIIlIIII.class |
Total processes
152
Monitored processes
13
Malicious processes
1
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 896 | C:\WINDOWS\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M | C:\Windows\System32\icacls.exe | — | javaw.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 904 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | attrib.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1672 | cmd.exe /c "REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre1.8.0_271\bin\javaw.exe -jar C:\Users\admin\AppData\Roaming\Microsoft\.tmp\1745951989141.tmp" /f" | C:\Windows\System32\cmd.exe | — | javaw.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2152 | "C:\Program Files\Java\jre1.8.0_271\bin\javaw.exe" -jar "C:\Users\admin\AppData\Local\Temp\test 1.jar" | C:\Program Files\Java\jre1.8.0_271\bin\javaw.exe | explorer.exe | ||||||||||||
User: admin Company: Oracle Corporation Integrity Level: MEDIUM Description: Java(TM) Platform SE binary Version: 8.0.2710.9 Modules
| |||||||||||||||
| 2196 | C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s Dnscache | C:\Windows\System32\svchost.exe | services.exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2236 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 3396 | "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\admin\Desktop\subjectshear.rtf" /o "" | C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Exit code: 0 Version: 16.0.16026.20146 Modules
| |||||||||||||||
| 3888 | C:\WINDOWS\system32\SppExtComObj.exe -Embedding | C:\Windows\System32\SppExtComObj.Exe | — | svchost.exe | |||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: KMS Connection Broker Version: 10.0.19041.3996 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4400 | "C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe" "C8CF4F14-277B-4A06-A055-E6F88050D91F" "1B136FC0-07C5-4E38-B4E8-6EC3DBA27C63" "3396" | C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe | — | WINWORD.EXE | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Artificial Intelligence (AI) Host for the Microsoft® Windows® Operating System and Platform x64. Exit code: 0 Version: 0.12.2.0 Modules
| |||||||||||||||
| 4988 | REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre1.8.0_271\bin\javaw.exe -jar C:\Users\admin\AppData\Roaming\Microsoft\.tmp\1745951989141.tmp" /f | C:\Windows\System32\reg.exe | cmd.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Registry Console Tool Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
21 134
Read events
20 767
Write events
339
Delete events
28
Modification events
| (PID) Process: | (4988) reg.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run |
| Operation: | write | Name: | Home |
Value: C:\Program Files\Java\jre1.8.0_271\bin\javaw.exe -jar C:\Users\admin\AppData\Roaming\Microsoft\.tmp\1745951989141.tmp | |||
| (PID) Process: | (3396) WINWORD.EXE | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common |
| Operation: | write | Name: | SessionId |
Value: B1DAC7467424F045877AB5F87B2C951E | |||
| (PID) Process: | (3396) WINWORD.EXE | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\GracefulExit\WINWORD\2200 |
| Operation: | delete value | Name: | 0 |
Value: ซ鴐㝅娴Ꝇ꿹�䙔�닜樁င$驄摽鶲
ީ湕湫睯쥮Ȇ∢්ł¢ᣂ숁씀褎예됏죃캲ǭ砃㐶ᇅᆘዒ看椀渀眀漀爀搀⸀攀砀攀씀‖ៅ肀줄࠘㈲㈱䐭捥 | |||
| (PID) Process: | (3396) WINWORD.EXE | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\GracefulExit\WINWORD\2200 |
| Operation: | delete key | Name: | (default) |
Value: | |||
| (PID) Process: | (3396) WINWORD.EXE | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\3396 |
| Operation: | write | Name: | 0 |
Value: 0B0E10B4F817BA9C32604BB055720F95DF3F61230046A1978EAAE2A6EEED016A04102400449A7D64B29D01008500A907556E6B6E6F776EC906022222CA0DC2190000C50E8908C91003783634C511C41AD2120B770069006E0077006F00720064002E00650078006500C51620C517808004C91808323231322D44656300 | |||
| (PID) Process: | (3396) WINWORD.EXE | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Resiliency\StartupItems |
| Operation: | write | Name: | +e7 |
Value: 2B653700440D0000040000000000000028AA882536B9DB018C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000 | |||
| (PID) Process: | (3396) WINWORD.EXE | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\ClientTelemetry\Sampling |
| Operation: | write | Name: | 0 |
Value: 017012000000001000B24E9A3E02000000000000000600000000000000 | |||
| (PID) Process: | (3396) WINWORD.EXE | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\3396 |
| Operation: | write | Name: | 0 |
Value: 0B0E10B4F817BA9C32604BB055720F95DF3F61230046A1978EAAE2A6EEED016A04102400449A7D64B29D01008500A907556E6B6E6F776EC906022222CA0DC2190000C91003783634C511C41AD2120B770069006E0077006F00720064002E00650078006500C51620C517808004C91808323231322D44656300 | |||
| (PID) Process: | (3396) WINWORD.EXE | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages |
| Operation: | write | Name: | en-US |
Value: 2 | |||
| (PID) Process: | (3396) WINWORD.EXE | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages |
| Operation: | write | Name: | de-de |
Value: 2 | |||
Executable files
31
Suspicious files
548
Text files
95
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2152 | javaw.exe | C:\Users\admin\AppData\Local\Temp\imageio136737057312046754.tmp | image | |
MD5:5E3346B915AA5DCA99032499F2C502BA | SHA256:9134E48F8B8E90B8A3D77A58CE65F3FCB8472830203FF831D0349242D066DC5F | |||
| 2152 | javaw.exe | C:\Users\admin\AppData\Local\Temp\imageio3803301084208696364.tmp | image | |
MD5:5E3346B915AA5DCA99032499F2C502BA | SHA256:9134E48F8B8E90B8A3D77A58CE65F3FCB8472830203FF831D0349242D066DC5F | |||
| 2152 | javaw.exe | C:\Users\admin\AppData\Local\Temp\imageio3591311630169208651.tmp | image | |
MD5:5E3346B915AA5DCA99032499F2C502BA | SHA256:9134E48F8B8E90B8A3D77A58CE65F3FCB8472830203FF831D0349242D066DC5F | |||
| 2152 | javaw.exe | C:\Users\admin\AppData\Local\Temp\imageio8414017674099802296.tmp | image | |
MD5:5E3346B915AA5DCA99032499F2C502BA | SHA256:9134E48F8B8E90B8A3D77A58CE65F3FCB8472830203FF831D0349242D066DC5F | |||
| 2152 | javaw.exe | C:\Users\admin\AppData\Local\Temp\imageio4862298755119106003.tmp | image | |
MD5:91B80173A1AA545CF3CB8BCF8E66A7E4 | SHA256:995036BA9616404ED6E7658D59D40CD6B93B875338DFE85635DAF685192342C8 | |||
| 2152 | javaw.exe | C:\Users\admin\AppData\Local\Temp\imageio268190279853159880.tmp | image | |
MD5:5E3346B915AA5DCA99032499F2C502BA | SHA256:9134E48F8B8E90B8A3D77A58CE65F3FCB8472830203FF831D0349242D066DC5F | |||
| 2152 | javaw.exe | C:\Users\admin\AppData\Roaming\Microsoft\.tmp\1745951989141.tmp | compressed | |
MD5:487A91A4D68AF18F5EFACE79E7D554FF | SHA256:6F29861E9B517C78789C9C059ECC30400770D8C0EB9CD02E5AC4A0AEA496CB24 | |||
| 2152 | javaw.exe | C:\Users\admin\AppData\Local\Temp\imageio9044989165070396105.tmp | image | |
MD5:91B80173A1AA545CF3CB8BCF8E66A7E4 | SHA256:995036BA9616404ED6E7658D59D40CD6B93B875338DFE85635DAF685192342C8 | |||
| 2152 | javaw.exe | C:\Users\admin\AppData\Local\Temp\imageio5973804562594254443.tmp | image | |
MD5:5E3346B915AA5DCA99032499F2C502BA | SHA256:9134E48F8B8E90B8A3D77A58CE65F3FCB8472830203FF831D0349242D066DC5F | |||
| 2152 | javaw.exe | C:\ProgramData\Oracle\Java\.oracle_jre_usage\17dfc292991c8061.timestamp | text | |
MD5:F82247CF626CA42C7A9E2CD39E7B3921 | SHA256:ED43B8E230BA73E17C07C1402311CD595F0F7C43B336309312140EB8954EFC43 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
15
TCP/UDP connections
72
DNS requests
26
Threats
5
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 2.23.77.188:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
5496 | MoUsoCoreWorker.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
5496 | MoUsoCoreWorker.exe | GET | 200 | 23.216.77.28:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 23.216.77.28:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
4608 | SIHClient.exe | GET | 200 | 2.23.246.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
4608 | SIHClient.exe | GET | 200 | 2.23.246.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
3396 | WINWORD.EXE | GET | 200 | 2.23.77.188:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D | unknown | — | — | whitelisted |
3396 | WINWORD.EXE | GET | 200 | 23.216.77.10:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
3396 | WINWORD.EXE | GET | 200 | 2.23.246.101:80 | http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 23.216.77.28:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
5496 | MoUsoCoreWorker.exe | 23.216.77.28:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
— | — | 184.30.21.171:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
5496 | MoUsoCoreWorker.exe | 184.30.21.171:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
3216 | svchost.exe | 172.211.123.249:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | FR | whitelisted |
2152 | javaw.exe | 147.185.221.27:60448 | material-forces.gl.at.ply.gg | PLAYIT-GG | US | malicious |
6544 | svchost.exe | 40.126.31.2:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
material-forces.gl.at.ply.gg |
| unknown |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
2196 | svchost.exe | A Network Trojan was detected | MALWARE [ANY.RUN] Suspected domain Associated with Malware Distribution (.ply .gg) |
2196 | svchost.exe | Potentially Bad Traffic | ET INFO playit .gg Tunneling Domain in DNS Lookup |
2196 | svchost.exe | Misc activity | ET TA_ABUSED_SERVICES Tunneling Service in DNS Lookup (* .ply .gg) |
2152 | javaw.exe | Malware Command and Control Activity Detected | MALWARE [ANY.RUN] Adwind RAT CnC Communication |
2152 | javaw.exe | Malware Command and Control Activity Detected | MALWARE [ANY.RUN] Adwind RAT CnC Communication 1 |