analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Screenshot.jar

Full analysis: https://app.any.run/tasks/a800049e-34c0-4294-a019-55097511ac2b
Verdict: Malicious activity
Threats:

Adwind RAT, sometimes also called Unrecom, Sockrat, Frutas, jRat, and JSocket, is a Malware As A Service Remote Access Trojan that attackers can use to collect information from infected machines. It was one of the most popular RATs in the market in 2015.

Analysis date: July 17, 2019, 02:48:46
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
adwind
trojan
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

F330386F9853B4C9AE312AF98443BEA6

SHA1:

81C31D1542B4D9D1089443F7FCCF5FD496159BC7

SHA256:

86155FB2F790714A5447B464ED015185D882605DF65F5282933945BF440811B4

SSDEEP:

12288:So77qk5ojxpke1F2N4KQdjDZgHT/7qTJbqvbueDLaJciet:S2X5UEyc4lBgHT/aNqvKcmJcTt

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Writes to a start menu file

      • WScript.exe (PID: 3160)
    • Changes the autorun value in the registry

      • WScript.exe (PID: 3160)
      • reg.exe (PID: 2928)
    • AdWind was detected

      • java.exe (PID: 3364)
      • java.exe (PID: 3052)
    • Loads dropped or rewritten executable

      • java.exe (PID: 3364)
      • explorer.exe (PID: 124)
      • javaw.exe (PID: 3524)
      • javaw.exe (PID: 3308)
      • wscript.exe (PID: 2492)
      • javaw.exe (PID: 3484)
      • java.exe (PID: 3052)
    • Application was dropped or rewritten from another process

      • javaw.exe (PID: 3524)
      • java.exe (PID: 3364)
      • javaw.exe (PID: 3484)
      • javaw.exe (PID: 3308)
      • java.exe (PID: 3052)
  • SUSPICIOUS

    • Executes JAVA applets

      • wscript.exe (PID: 2492)
      • explorer.exe (PID: 124)
      • javaw.exe (PID: 3308)
    • Application launched itself

      • wscript.exe (PID: 2492)
    • Creates files in the user directory

      • javaw.exe (PID: 3308)
      • WScript.exe (PID: 3160)
      • wscript.exe (PID: 2492)
      • xcopy.exe (PID: 3732)
    • Executes scripts

      • javaw.exe (PID: 3524)
      • wscript.exe (PID: 2492)
      • cmd.exe (PID: 3368)
      • cmd.exe (PID: 3568)
      • cmd.exe (PID: 3988)
      • cmd.exe (PID: 1388)
      • cmd.exe (PID: 3496)
      • cmd.exe (PID: 3932)
      • cmd.exe (PID: 3804)
      • cmd.exe (PID: 2520)
    • Starts CMD.EXE for commands execution

      • javaw.exe (PID: 3308)
      • java.exe (PID: 3364)
      • javaw.exe (PID: 3484)
      • java.exe (PID: 3052)
    • Executable content was dropped or overwritten

      • xcopy.exe (PID: 3732)
    • Starts itself from another location

      • javaw.exe (PID: 3308)
    • Uses REG.EXE to modify Windows registry

      • javaw.exe (PID: 3308)
    • Uses ATTRIB.EXE to modify file attributes

      • javaw.exe (PID: 3308)
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: cjrgybqvyc/resources/eryuszytqs
ZipUncompressedSize: 1015266
ZipCompressedSize: 664641
ZipCRC: 0x5e629527
ZipModifyDate: 2019:07:16 13:29:20
ZipCompression: Deflated
ZipBitFlag: -
ZipRequiredVersion: 20
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
76
Monitored processes
29
Malicious processes
9
Suspicious processes
0

Behavior graph

Click at the process to see the details
start javaw.exe no specs wscript.exe no specs wscript.exe javaw.exe no specs #ADWIND java.exe no specs cmd.exe no specs cmd.exe no specs cscript.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs xcopy.exe xcopy.exe no specs explorer.exe no specs reg.exe attrib.exe no specs attrib.exe no specs javaw.exe #ADWIND java.exe cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3524"C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe" -jar "C:\Users\admin\AppData\Local\Temp\Screenshot.jar"C:\Program Files\Java\jre1.8.0_92\bin\javaw.exeexplorer.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.920.14
2492wscript C:\Users\admin\efcpxvbtmf.jsC:\Windows\system32\wscript.exejavaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
3160"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Roaming\fYztKVNgXc.js" C:\Windows\System32\WScript.exe
wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Version:
5.8.7600.16385
3308"C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe" -jar "C:\Users\admin\AppData\Roaming\dndkbflr.txt"C:\Program Files\Java\jre1.8.0_92\bin\javaw.exewscript.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.920.14
3364"C:\Program Files\Java\jre1.8.0_92\bin\java.exe" -jar C:\Users\admin\AppData\Local\Temp\_0.290664130990177853584810467909668342.classC:\Program Files\Java\jre1.8.0_92\bin\java.exe
javaw.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Version:
8.0.920.14
3368cmd.exe /C cscript.exe C:\Users\admin\AppData\Local\Temp\Retrive3761517299882081140.vbsC:\Windows\system32\cmd.exejavaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3988cmd.exe /C cscript.exe C:\Users\admin\AppData\Local\Temp\Retrive4494817041047089818.vbsC:\Windows\system32\cmd.exejava.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
1588cscript.exe C:\Users\admin\AppData\Local\Temp\Retrive3761517299882081140.vbsC:\Windows\system32\cscript.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Console Based Script Host
Exit code:
0
Version:
5.8.7600.16385
3156cscript.exe C:\Users\admin\AppData\Local\Temp\Retrive4494817041047089818.vbsC:\Windows\system32\cscript.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Console Based Script Host
Exit code:
0
Version:
5.8.7600.16385
3568cmd.exe /C cscript.exe C:\Users\admin\AppData\Local\Temp\Retrive5423121815891530270.vbsC:\Windows\system32\cmd.exejavaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Total events
5 924
Read events
5 882
Write events
0
Delete events
0

Modification events

No data
Executable files
110
Suspicious files
10
Text files
80
Unknown types
15

Dropped files

PID
Process
Filename
Type
3524javaw.exeC:\Users\admin\.oracle_jre_usage\90737d32e3abaa4.timestamptext
MD5:63B0F6D774BC3FCE13F501389F4495C3
SHA256:E55F9234B6C67AD609A26A3A2D10D1257ADB4DB21D6D1D3198F65F3419C76CB4
3308javaw.exeC:\Users\admin\.oracle_jre_usage\90737d32e3abaa4.timestamptext
MD5:DD4C3A313DEED8EFE86F104566843E92
SHA256:CF84F685AB2CDCE7A00ECC154CEC1064C54E491207ADA9C3583DF6D79D230F10
3364java.exeC:\Users\admin\.oracle_jre_usage\90737d32e3abaa4.timestamptext
MD5:BF29F20B81F5E6AABD487907B771C7FA
SHA256:F09F0111CD6A69AC981A1CAC16F8D6A5E0B23B7F58D490C4D9722F4AC2862DD8
3160WScript.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fYztKVNgXc.jstext
MD5:6D2359496A51B8814AEC710FF914942A
SHA256:5DA887FE8CD6AAEF5FD213004DDEAAE86DF2A28D98F69A7F139B98EC1FB0AC9C
2492wscript.exeC:\Users\admin\AppData\Roaming\dndkbflr.txtjava
MD5:F32345D31343A22880098B59168D2B4F
SHA256:E09CDFAC1B2B7AEEC8B029E13D5953B426B3848676A49632E1BF3FC8044FE835
3524javaw.exeC:\Users\admin\efcpxvbtmf.jstext
MD5:11361E5219E3E30251113DB95DF990F4
SHA256:FD0FE2A4D1EAF113F3C0F538F7EEB19DC1A1542C1CC3656A857A66CF3EE9C66F
2492wscript.exeC:\Users\admin\AppData\Roaming\fYztKVNgXc.jstext
MD5:6D2359496A51B8814AEC710FF914942A
SHA256:5DA887FE8CD6AAEF5FD213004DDEAAE86DF2A28D98F69A7F139B98EC1FB0AC9C
3732xcopy.exeC:\Users\admin\AppData\Roaming\Oracle\Welcome.htmlhtml
MD5:27CF299B6D93FACA73FBCDCF4AECFD93
SHA256:3F1F0EE75588DBBA3B143499D08AA9AB431E4A34E483890CFAC94A8E1061B7CF
3308javaw.exeC:\Users\admin\AppData\Local\Temp\Retrive3761517299882081140.vbstext
MD5:3BDFD33017806B85949B6FAA7D4B98E4
SHA256:9DA575DD2D5B7C1E9BAB8B51A16CDE457B3371C6DCDB0537356CF1497FA868F6
3364java.exeC:\Users\admin\AppData\Local\Temp\Retrive4494817041047089818.vbstext
MD5:3BDFD33017806B85949B6FAA7D4B98E4
SHA256:9DA575DD2D5B7C1E9BAB8B51A16CDE457B3371C6DCDB0537356CF1497FA868F6
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
10
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3160
WScript.exe
POST
138.68.229.219:7744
http://unknownsoft.duckdns.org:7744/is-ready
US
malicious
3160
WScript.exe
POST
138.68.229.219:7744
http://unknownsoft.duckdns.org:7744/is-ready
US
malicious
3160
WScript.exe
POST
138.68.229.219:7744
http://unknownsoft.duckdns.org:7744/is-ready
US
malicious
3160
WScript.exe
POST
138.68.229.219:7744
http://unknownsoft.duckdns.org:7744/is-ready
US
malicious
3160
WScript.exe
POST
138.68.229.219:7744
http://unknownsoft.duckdns.org:7744/is-ready
US
malicious
3160
WScript.exe
POST
138.68.229.219:7744
http://unknownsoft.duckdns.org:7744/is-ready
US
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3160
WScript.exe
138.68.229.219:7744
unknownsoft.duckdns.org
Digital Ocean, Inc.
US
malicious
3484
javaw.exe
92.38.86.175:1337
vitlop.ddns.net
ALFA TELECOM s.r.o.
CZ
malicious
138.68.229.219:7744
unknownsoft.duckdns.org
Digital Ocean, Inc.
US
malicious

DNS requests

Domain
IP
Reputation
unknownsoft.duckdns.org
  • 138.68.229.219
malicious
vitlop.ddns.net
  • 92.38.86.175
malicious

Threats

PID
Process
Class
Message
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
No debug info