analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Screenshot.jar

Full analysis: https://app.any.run/tasks/5b21f7a9-6c3a-4eb2-a055-33497ba6516b
Verdict: Malicious activity
Threats:

Adwind RAT, sometimes also called Unrecom, Sockrat, Frutas, jRat, and JSocket, is a Malware As A Service Remote Access Trojan that attackers can use to collect information from infected machines. It was one of the most popular RATs in the market in 2015.

Malware Trends Tracker     >>>
Analysis date: July 17, 2019, 02:45:45
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
adwind
trojan
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

F330386F9853B4C9AE312AF98443BEA6

SHA1:

81C31D1542B4D9D1089443F7FCCF5FD496159BC7

SHA256:

86155FB2F790714A5447B464ED015185D882605DF65F5282933945BF440811B4

SSDEEP:

12288:So77qk5ojxpke1F2N4KQdjDZgHT/7qTJbqvbueDLaJciet:S2X5UEyc4lBgHT/aNqvKcmJcTt

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Writes to a start menu file

      • WScript.exe (PID: 2704)

    • Changes the autorun value in the registry

      • WScript.exe (PID: 2704)
      • reg.exe (PID: 2368)

    • AdWind was detected

      • java.exe (PID: 3588)
      • java.exe (PID: 1604)

    • Loads dropped or rewritten executable

      • wscript.exe (PID: 2380)
      • javaw.exe (PID: 3036)
      • javaw.exe (PID: 2888)
      • explorer.exe (PID: 284)
      • java.exe (PID: 3588)
      • java.exe (PID: 1604)
      • javaw.exe (PID: 2748)

    • Application was dropped or rewritten from another process

      • java.exe (PID: 3588)
      • javaw.exe (PID: 3036)
      • javaw.exe (PID: 2888)
      • javaw.exe (PID: 2748)
      • java.exe (PID: 1604)

  • SUSPICIOUS

    • Application launched itself

      • wscript.exe (PID: 2380)

    • Executes scripts

      • wscript.exe (PID: 2380)
      • javaw.exe (PID: 2888)
      • cmd.exe (PID: 2432)
      • cmd.exe (PID: 3732)
      • cmd.exe (PID: 3756)
      • cmd.exe (PID: 3664)
      • cmd.exe (PID: 4084)
      • cmd.exe (PID: 2332)
      • cmd.exe (PID: 3580)
      • cmd.exe (PID: 2732)

    • Executes JAVA applets

      • explorer.exe (PID: 284)
      • wscript.exe (PID: 2380)
      • javaw.exe (PID: 3036)

    • Creates files in the user directory

      • wscript.exe (PID: 2380)
      • javaw.exe (PID: 3036)
      • WScript.exe (PID: 2704)
      • xcopy.exe (PID: 2744)

    • Starts CMD.EXE for commands execution

      • java.exe (PID: 3588)
      • javaw.exe (PID: 3036)
      • javaw.exe (PID: 2748)
      • java.exe (PID: 1604)

    • Executable content was dropped or overwritten

      • xcopy.exe (PID: 2744)

    • Uses ATTRIB.EXE to modify file attributes

      • javaw.exe (PID: 3036)

    • Uses REG.EXE to modify Windows registry

      • javaw.exe (PID: 3036)

    • Starts itself from another location

      • javaw.exe (PID: 3036)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2019:07:16 13:29:20
ZipCRC: 0x5e629527
ZipCompressedSize: 664641
ZipUncompressedSize: 1015266
ZipFileName: cjrgybqvyc/resources/eryuszytqs
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
74
Monitored processes
28
Malicious processes
9
Suspicious processes
0

Behavior graph

Click at the process to see the details
start javaw.exe no specs wscript.exe no specs wscript.exe javaw.exe no specs #ADWIND java.exe cmd.exe no specs cscript.exe no specs cmd.exe no specs cmd.exe no specs cscript.exe no specs cscript.exe no specs cmd.exe no specs xcopy.exe cscript.exe no specs explorer.exe no specs reg.exe attrib.exe no specs attrib.exe no specs javaw.exe #ADWIND java.exe cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2888"C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe" -jar "C:\Users\admin\AppData\Local\Temp\Screenshot.jar"C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe—explorer.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.920.14
2380wscript C:\Users\admin\efcpxvbtmf.jsC:\Windows\system32\wscript.exe—javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
2704"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Roaming\fYztKVNgXc.js" C:\Windows\System32\WScript.exe
wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Version:
5.8.7600.16385
3036"C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe" -jar "C:\Users\admin\AppData\Roaming\xakrimizyc.txt"C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe—wscript.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.920.14
3588"C:\Program Files\Java\jre1.8.0_92\bin\java.exe" -jar C:\Users\admin\AppData\Local\Temp\_0.92101273689728692299408631400995773.classC:\Program Files\Java\jre1.8.0_92\bin\java.exe
javaw.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Version:
8.0.920.14
3756cmd.exe /C cscript.exe C:\Users\admin\AppData\Local\Temp\Retrive3210544730991830634.vbsC:\Windows\system32\cmd.exe—javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2248cscript.exe C:\Users\admin\AppData\Local\Temp\Retrive3210544730991830634.vbsC:\Windows\system32\cscript.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Console Based Script Host
Exit code:
0
Version:
5.8.7600.16385
3664cmd.exe /C cscript.exe C:\Users\admin\AppData\Local\Temp\Retrive6254726695179812015.vbsC:\Windows\system32\cmd.exe—java.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2432cmd.exe /C cscript.exe C:\Users\admin\AppData\Local\Temp\Retrive260720114478018004.vbsC:\Windows\system32\cmd.exe—javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2944cscript.exe C:\Users\admin\AppData\Local\Temp\Retrive6254726695179812015.vbsC:\Windows\system32\cscript.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Console Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Total events
5 062
Read events
5 022
Write events
0
Delete events
0

Modification events

No data
Executable files
110
Suspicious files
10
Text files
80
Unknown types
15

Dropped files

PID
Process
Filename
Type
2380wscript.exeC:\Users\admin\AppData\Roaming\fYztKVNgXc.jstext
MD5:6D2359496A51B8814AEC710FF914942A
SHA256:5DA887FE8CD6AAEF5FD213004DDEAAE86DF2A28D98F69A7F139B98EC1FB0AC9C
3588java.exeC:\Users\admin\.oracle_jre_usage\90737d32e3abaa4.timestamptext
MD5:90B76A9F854191189245FA4DF21CE213
SHA256:AF03B841D09D7FF3B2447782B8DF5CEACC392E6E369BFD59A00CA91112F07492
2888javaw.exeC:\Users\admin\efcpxvbtmf.jstext
MD5:11361E5219E3E30251113DB95DF990F4
SHA256:FD0FE2A4D1EAF113F3C0F538F7EEB19DC1A1542C1CC3656A857A66CF3EE9C66F
3036javaw.exeC:\Users\admin\.oracle_jre_usage\90737d32e3abaa4.timestamptext
MD5:7A755CCB3B9FF6B2E1655F28BD5CB418
SHA256:AACE9957631C103DE0EA1AE3D79BB2AB78E0473325926672EEC1C08EAD68B7F5
2704WScript.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fYztKVNgXc.jstext
MD5:6D2359496A51B8814AEC710FF914942A
SHA256:5DA887FE8CD6AAEF5FD213004DDEAAE86DF2A28D98F69A7F139B98EC1FB0AC9C
2888javaw.exeC:\Users\admin\.oracle_jre_usage\90737d32e3abaa4.timestamptext
MD5:113D8348B7C1DBD64261DEF8B0E514CB
SHA256:5E4ED6378AFBB2B3A3DB5BF1BEEF7ADCE6CD746991C3DB59AFB41A0C69E794F0
2380wscript.exeC:\Users\admin\AppData\Roaming\xakrimizyc.txtjava
MD5:F32345D31343A22880098B59168D2B4F
SHA256:E09CDFAC1B2B7AEEC8B029E13D5953B426B3848676A49632E1BF3FC8044FE835
3036javaw.exeC:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302019708-1500728564-335382590-1000\83aa4cc77f591dfc2374580bbd95f6ba_90059c37-1320-41a4-b58d-2b75a9850d2fdbf
MD5:C8366AE350E7019AEFC9D1E6E6A498C6
SHA256:11E6ACA8E682C046C83B721EEB5C72C5EF03CB5936C60DF6F4993511DDC61238
2744xcopy.exeC:\Users\admin\AppData\Roaming\Oracle\Welcome.htmlhtml
MD5:27CF299B6D93FACA73FBCDCF4AECFD93
SHA256:3F1F0EE75588DBBA3B143499D08AA9AB431E4A34E483890CFAC94A8E1061B7CF
3036javaw.exeC:\Users\admin\AppData\Local\Temp\_0.92101273689728692299408631400995773.classjava
MD5:781FB531354D6F291F1CCAB48DA6D39F
SHA256:97D585B6AFF62FB4E43E7E6A5F816DCD7A14BE11A88B109A9BA9E8CD4C456EB9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
7
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2704
WScript.exe
POST
—
138.68.229.219:7744
http://unknownsoft.duckdns.org:7744/is-ready
US
—
—
malicious
2704
WScript.exe
POST
—
138.68.229.219:7744
http://unknownsoft.duckdns.org:7744/is-ready
US
—
—
malicious
2704
WScript.exe
POST
—
138.68.229.219:7744
http://unknownsoft.duckdns.org:7744/is-ready
US
—
—
malicious
2704
WScript.exe
POST
—
138.68.229.219:7744
http://unknownsoft.duckdns.org:7744/is-ready
US
—
—
malicious
2704
WScript.exe
POST
—
138.68.229.219:7744
http://unknownsoft.duckdns.org:7744/is-ready
US
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2748
javaw.exe
92.38.86.175:1337
vitlop.ddns.net
ALFA TELECOM s.r.o.
CZ
malicious
2704
WScript.exe
138.68.229.219:7744
unknownsoft.duckdns.org
Digital Ocean, Inc.
US
malicious

DNS requests

Domain
IP
Reputation
unknownsoft.duckdns.org
  • 138.68.229.219
malicious
vitlop.ddns.net
  • 92.38.86.175
malicious

Threats

PID
Process
Class
Message
—
—
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Screenshot.jar