analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

New Order #06500-2018.jar

Full analysis: https://app.any.run/tasks/26a7f4fb-5316-42f7-8a7a-131a859873e1
Verdict: Malicious activity
Threats:

Adwind RAT, sometimes also called Unrecom, Sockrat, Frutas, jRat, and JSocket, is a Malware As A Service Remote Access Trojan that attackers can use to collect information from infected machines. It was one of the most popular RATs in the market in 2015.

Malware Trends Tracker     >>>
Analysis date: July 17, 2019, 06:02:21
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
adwind
trojan
Indicators:
MIME: application/java-archive
File info: Java archive data (JAR)
MD5:

1C22B591395318999FA89A18095E439A

SHA1:

3F8A36D0E8477E4AFFED16120EFBB39A2123243A

SHA256:

82D919ED765771DAB3D626919CC288B122362D1873A0C8E34BAFF61BF4D3F4E0

SSDEEP:

12288:/IF4Yi7xIbQzvx4WLV4218ANrz5EHFqY+vjP1dRYtfZBryNGPve6:/W4F+QzZ4WLVNWAllYFYPLRyf3GNGd

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • AdWind was detected

      • java.exe (PID: 2124)
      • java.exe (PID: 2968)

    • Loads dropped or rewritten executable

      • javaw.exe (PID: 3880)
      • java.exe (PID: 2124)
      • explorer.exe (PID: 124)
      • java.exe (PID: 2968)
      • javaw.exe (PID: 2916)

    • Application was dropped or rewritten from another process

      • java.exe (PID: 2124)
      • javaw.exe (PID: 3880)
      • javaw.exe (PID: 2916)
      • java.exe (PID: 2968)

    • Changes the autorun value in the registry

      • reg.exe (PID: 1920)

  • SUSPICIOUS

    • Creates files in the user directory

      • javaw.exe (PID: 3880)
      • xcopy.exe (PID: 1468)

    • Executes JAVA applets

      • javaw.exe (PID: 3880)
      • explorer.exe (PID: 124)

    • Starts CMD.EXE for commands execution

      • javaw.exe (PID: 3880)
      • java.exe (PID: 2124)
      • javaw.exe (PID: 2916)
      • java.exe (PID: 2968)

    • Executes scripts

      • cmd.exe (PID: 2156)
      • cmd.exe (PID: 2096)
      • cmd.exe (PID: 3576)
      • cmd.exe (PID: 3192)
      • cmd.exe (PID: 2868)
      • cmd.exe (PID: 1804)
      • cmd.exe (PID: 2984)
      • cmd.exe (PID: 864)

    • Executable content was dropped or overwritten

      • xcopy.exe (PID: 1468)

    • Uses REG.EXE to modify Windows registry

      • javaw.exe (PID: 3880)

    • Uses ATTRIB.EXE to modify file attributes

      • javaw.exe (PID: 3880)

    • Starts itself from another location

      • javaw.exe (PID: 3880)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0808
ZipCompression: Deflated
ZipModifyDate: 2018:05:29 06:52:15
ZipCRC: 0x55b53518
ZipCompressedSize: 77
ZipUncompressedSize: 75
ZipFileName: META-INF/MANIFEST.MF
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
69
Monitored processes
25
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start javaw.exe no specs #ADWIND java.exe cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs xcopy.exe cscript.exe no specs cmd.exe no specs cscript.exe no specs explorer.exe no specs reg.exe attrib.exe no specs attrib.exe no specs javaw.exe no specs #ADWIND java.exe cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3880"C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe" -jar "C:\Users\admin\AppData\Local\Temp\New Order #06500-2018.jar"C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe—explorer.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.920.14
2124"C:\Program Files\Java\jre1.8.0_92\bin\java.exe" -jar C:\Users\admin\AppData\Local\Temp\_0.54867237829374883940743495701608753.classC:\Program Files\Java\jre1.8.0_92\bin\java.exe
javaw.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Version:
8.0.920.14
2156cmd.exe /C cscript.exe C:\Users\admin\AppData\Local\Temp\Retrive6186206127450422246.vbsC:\Windows\system32\cmd.exe—javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2324cscript.exe C:\Users\admin\AppData\Local\Temp\Retrive6186206127450422246.vbsC:\Windows\system32\cscript.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Console Based Script Host
Exit code:
0
Version:
5.8.7600.16385
2096cmd.exe /C cscript.exe C:\Users\admin\AppData\Local\Temp\Retrive8066837619698926680.vbsC:\Windows\system32\cmd.exe—javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
1464cscript.exe C:\Users\admin\AppData\Local\Temp\Retrive8066837619698926680.vbsC:\Windows\system32\cscript.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Console Based Script Host
Exit code:
0
Version:
5.8.7600.16385
3576cmd.exe /C cscript.exe C:\Users\admin\AppData\Local\Temp\Retrive4454280629410344062.vbsC:\Windows\system32\cmd.exe—java.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
1468xcopy "C:\Program Files\Java\jre1.8.0_92" "C:\Users\admin\AppData\Roaming\Oracle\" /eC:\Windows\system32\xcopy.exe
javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Extended Copy Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1856cscript.exe C:\Users\admin\AppData\Local\Temp\Retrive4454280629410344062.vbsC:\Windows\system32\cscript.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Console Based Script Host
Exit code:
0
Version:
5.8.7600.16385
3192cmd.exe /C cscript.exe C:\Users\admin\AppData\Local\Temp\Retrive2076520194261960694.vbsC:\Windows\system32\cmd.exe—java.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Total events
265
Read events
264
Write events
1
Delete events
0

Modification events

(PID) Process:(1920) reg.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:YjKEhQmbawQy
Value:
"C:\Users\admin\AppData\Roaming\Oracle\bin\javaw.exe" -jar "C:\Users\admin\JCnDqDesRbhTl\kAemIciKNl.ervIRKUoXWQIaWLljC"
Executable files
109
Suspicious files
10
Text files
73
Unknown types
15

Dropped files

PID
Process
Filename
Type
3880javaw.exeC:\Users\admin\AppData\Local\Temp\Retrive8066837619698926680.vbs —
MD5:—
SHA256:—
3880javaw.exeC:\Users\admin\.oracle_jre_usage\90737d32e3abaa4.timestamptext
MD5:1A91922269007A2706F3FF7BA8BADFC2
SHA256:4AA983BE33AC0140F183EAC9F5A744B4E119A8DDDF8D5396C782F737C9578C9C
2124java.exeC:\Users\admin\.oracle_jre_usage\90737d32e3abaa4.timestamptext
MD5:389AD7746FCC0FA7A10EB518A17C9625
SHA256:EF8E51018C2F519ABA30C134EAD4713C462C720BE4B989CBF03DBD3ECA4DAF55
3880javaw.exeC:\Users\admin\AppData\Local\Temp\Retrive6186206127450422246.vbstext
MD5:3BDFD33017806B85949B6FAA7D4B98E4
SHA256:9DA575DD2D5B7C1E9BAB8B51A16CDE457B3371C6DCDB0537356CF1497FA868F6
1468xcopy.exeC:\Users\admin\AppData\Roaming\Oracle\THIRDPARTYLICENSEREADME.txttext
MD5:745D6DB5FC58C63F74CE6A7D4DB7E695
SHA256:C77BA9F668FEE7E9B810F1493E518ADF87233AC8793E4B37C9B3D1ED7846F1C0
1468xcopy.exeC:\Users\admin\AppData\Roaming\Oracle\bin\dt_shmem.dllexecutable
MD5:0744E6A5145AA945D89A16EAC835FAB2
SHA256:C417390F681276EC0D55D81A91B87EAE75CA245045F5C23E9B43550B708FB1A6
1468xcopy.exeC:\Users\admin\AppData\Roaming\Oracle\bin\dt_socket.dllexecutable
MD5:138F156057245747692A68EBE50D52C2
SHA256:F0FD0268D6E410C05E7EE71AD9C96744CD5E4A97329F608041D7078FAEE24ED0
1468xcopy.exeC:\Users\admin\AppData\Roaming\Oracle\README.txttext
MD5:0F1123976B959AC5E8B89EB8C245C4BD
SHA256:963095CF8DB76FB8071FD19A3110718A42F2AB42B27A3ADFD9EC58981C3E88D2
3880javaw.exeC:\Users\admin\AppData\Local\Temp\_0.54867237829374883940743495701608753.classjava
MD5:781FB531354D6F291F1CCAB48DA6D39F
SHA256:97D585B6AFF62FB4E43E7E6A5F816DCD7A14BE11A88B109A9BA9E8CD4C456EB9
1468xcopy.exeC:\Users\admin\AppData\Roaming\Oracle\THIRDPARTYLICENSEREADME-JAVAFX.txttext
MD5:AB9DB8D553033C0326BD2D38D77F84C1
SHA256:38995534DF44E0526F8C8C8D479C778A4B34627CFD69F19213CFBE019A7261BA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

Domain
IP
Reputation
www.jackpotkizi.cf
  • —
malicious

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET INFO DNS Query for Suspicious .cf Domain
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
New Order #06500-2018.jar