analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://cykhardware.com/remittance.jar

Full analysis: https://app.any.run/tasks/0be3a5c5-53aa-4e97-9335-8320473036e8
Verdict: Malicious activity
Threats:

Adwind RAT, sometimes also called Unrecom, Sockrat, Frutas, jRat, and JSocket, is a Malware As A Service Remote Access Trojan that attackers can use to collect information from infected machines. It was one of the most popular RATs in the market in 2015.

Malware Trends Tracker     >>>
Analysis date: November 18, 2019, 12:24:39
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
adwind
trojan
Indicators:
MD5:

C9C897740062CB709464EF4D7E658E9C

SHA1:

4E59C92A9720C14D489DBC42B564D3825972C6B3

SHA256:

B52C67C7AEED9B8D1C278C75AF72C83B21D6132866BB5431466F9536D0FEDA78

SSDEEP:

3:N8BOW0DGKn+3ELXAXn:24W043ETy

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • javaw.exe (PID: 4024)
      • java.exe (PID: 1252)
      • iexplore.exe (PID: 3532)
      • iexplore.exe (PID: 2412)

    • AdWind was detected

      • java.exe (PID: 1252)

    • Application was dropped or rewritten from another process

      • java.exe (PID: 1252)
      • javaw.exe (PID: 4024)

  • SUSPICIOUS

    • Executes scripts

      • cmd.exe (PID: 3904)
      • cmd.exe (PID: 2796)
      • cmd.exe (PID: 1044)
      • cmd.exe (PID: 2120)

    • Starts CMD.EXE for commands execution

      • javaw.exe (PID: 4024)
      • java.exe (PID: 1252)

    • Executes JAVA applets

      • javaw.exe (PID: 4024)
      • iexplore.exe (PID: 2412)

    • Creates files in the user directory

      • javaw.exe (PID: 4024)
      • xcopy.exe (PID: 2600)

    • Executable content was dropped or overwritten

      • xcopy.exe (PID: 2600)

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 2412)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2412)

    • Changes internet zones settings

      • iexplore.exe (PID: 2412)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 2412)
      • iexplore.exe (PID: 3532)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
54
Monitored processes
14
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe javaw.exe no specs #ADWIND java.exe cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs xcopy.exe xcopy.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2412"C:\Program Files\Internet Explorer\iexplore.exe" "https://cykhardware.com/remittance.jar"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3532"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2412 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
4024"C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe" -jar "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\VZQG1M4S\remittance[1].jar" C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe—iexplore.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Version:
8.0.920.14
1252"C:\Program Files\Java\jre1.8.0_92\bin\java.exe" -jar C:\Users\admin\AppData\Local\Temp\_0.37164561125175392002205146321065169.classC:\Program Files\Java\jre1.8.0_92\bin\java.exe
javaw.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Version:
8.0.920.14
3904cmd.exe /C cscript.exe C:\Users\admin\AppData\Local\Temp\Retrive677771099768698678.vbsC:\Windows\system32\cmd.exe—java.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2212cscript.exe C:\Users\admin\AppData\Local\Temp\Retrive677771099768698678.vbsC:\Windows\system32\cscript.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Console Based Script Host
Exit code:
0
Version:
5.8.7600.16385
2120cmd.exe /C cscript.exe C:\Users\admin\AppData\Local\Temp\Retrive6973596317010699697.vbsC:\Windows\system32\cmd.exe—javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
4072cscript.exe C:\Users\admin\AppData\Local\Temp\Retrive6973596317010699697.vbsC:\Windows\system32\cscript.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Console Based Script Host
Exit code:
0
Version:
5.8.7600.16385
2796cmd.exe /C cscript.exe C:\Users\admin\AppData\Local\Temp\Retrive750038555726705310.vbsC:\Windows\system32\cmd.exe—java.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3696cscript.exe C:\Users\admin\AppData\Local\Temp\Retrive750038555726705310.vbsC:\Windows\system32\cscript.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Console Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Total events
785
Read events
714
Write events
68
Delete events
3

Modification events

(PID) Process:(2412) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2412) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2412) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(2412) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
Operation:writeName:SecuritySafe
Value:
1
(PID) Process:(2412) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2412) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000092000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(2412) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Recovery\Active
Operation:writeName:{6D4DBEBD-09FE-11EA-AB41-5254004A04AF}
Value:
0
(PID) Process:(2412) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Type
Value:
4
(PID) Process:(2412) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Count
Value:
2
(PID) Process:(2412) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Time
Value:
E3070B00010012000C00180038002800
Executable files
108
Suspicious files
11
Text files
74
Unknown types
19

Dropped files

PID
Process
Filename
Type
2412iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFDFDBF778499C172A.TMP —
MD5:—
SHA256:—
2412iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\favicon[1].ico —
MD5:—
SHA256:—
2412iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
2412iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFABC1D371BCB6F661.TMP —
MD5:—
SHA256:—
2412iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{6D4DBEBD-09FE-11EA-AB41-5254004A04AF}.dat —
MD5:—
SHA256:—
1252java.exeC:\Users\admin\AppData\Local\Temp\Retrive677771099768698678.vbs —
MD5:—
SHA256:—
4024javaw.exeC:\Users\admin\AppData\Local\Temp\Retrive6973596317010699697.vbs —
MD5:—
SHA256:—
3532iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\MSHist012019111820191119\index.datdat
MD5:ED1E4C455CCAB40986E3890140301D25
SHA256:C90AA9F731029FCC6CC973D2BAADDB0F2C8AB07B5E6629F207DDD116557E2845
3532iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.datdat
MD5:56DC43497BC53F301006D24E996614F9
SHA256:A7333242FACA4116DB3232DF2EBD0A1FBB1B374BB4E40ADEB5304484C8AB1114
3532iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\JavaDeployReg.logtext
MD5:1686692C46EA6A7285D7A842AD73DCC5
SHA256:201732C11C123850B0001072F38711E59291E71EFDD678F22B82C34D4D47272F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
2
DNS requests
2
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2412
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3532
iexplore.exe
103.6.245.172:443
cykhardware.com
iCore Technology Sdn Bhd
MY
unknown

DNS requests

Domain
IP
Reputation
cykhardware.com
  • 103.6.245.172
unknown
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://cykhardware.com/remittance.jar