analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

http://members.iinet.net.au/~sambo75/FedEx-shipping(ecopy)22-3235-44-Labels.jar

Full analysis: https://app.any.run/tasks/0a044bac-86f0-4061-b5da-e736f64ca2db
Verdict: Malicious activity
Threats:

Adwind RAT, sometimes also called Unrecom, Sockrat, Frutas, jRat, and JSocket, is a Malware As A Service Remote Access Trojan that attackers can use to collect information from infected machines. It was one of the most popular RATs in the market in 2015.

Malware Trends Tracker     >>>
Analysis date: December 14, 2018, 18:58:13
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
opendir
adwind
trojan
Indicators:
MD5:

C56EF284916710CB1B7F0DA78A5CED02

SHA1:

34399ADF088FBF25A71DE948BC483802B87BFB93

SHA256:

B767A69FFC8FA192D2304B85B46F04CB2C46AC1B84B85590706D107CAC9841BC

SSDEEP:

3:N1KTXm0LEQV1jpcmLCN2rXXIWGQI3dg4+:Ch9LVHI36Z

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • AdWind was detected

      • java.exe (PID: 3148)
      • java.exe (PID: 2728)

    • Loads dropped or rewritten executable

      • iexplore.exe (PID: 3228)
      • javaw.exe (PID: 2764)
      • java.exe (PID: 3148)
      • iexplore.exe (PID: 2944)
      • javaw.exe (PID: 2332)
      • java.exe (PID: 2728)

    • Application was dropped or rewritten from another process

      • java.exe (PID: 3148)
      • javaw.exe (PID: 2764)
      • javaw.exe (PID: 2332)
      • java.exe (PID: 2728)

    • Changes the autorun value in the registry

      • reg.exe (PID: 2452)

    • ADWIND was detected

      • javaw.exe (PID: 2332)

  • SUSPICIOUS

    • Creates files in the user directory

      • javaw.exe (PID: 2764)
      • xcopy.exe (PID: 3968)

    • Executes JAVA applets

      • iexplore.exe (PID: 2944)
      • javaw.exe (PID: 2764)

    • Starts CMD.EXE for commands execution

      • java.exe (PID: 3148)
      • javaw.exe (PID: 2764)
      • java.exe (PID: 2728)
      • javaw.exe (PID: 2332)

    • Executes scripts

      • cmd.exe (PID: 2176)
      • cmd.exe (PID: 4040)
      • cmd.exe (PID: 3676)
      • cmd.exe (PID: 2824)
      • cmd.exe (PID: 2800)
      • cmd.exe (PID: 2620)
      • cmd.exe (PID: 2660)
      • cmd.exe (PID: 2612)

    • Executable content was dropped or overwritten

      • xcopy.exe (PID: 3968)
      • javaw.exe (PID: 2332)

    • Uses REG.EXE to modify Windows registry

      • javaw.exe (PID: 2764)

    • Starts itself from another location

      • javaw.exe (PID: 2764)

    • Uses ATTRIB.EXE to modify file attributes

      • javaw.exe (PID: 2764)

    • Connects to unusual port

      • javaw.exe (PID: 2332)

  • INFO

    • Changes internet zones settings

      • iexplore.exe (PID: 2944)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2944)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 2944)
      • iexplore.exe (PID: 3228)

    • Creates files in the user directory

      • iexplore.exe (PID: 2944)
      • iexplore.exe (PID: 3228)

    • Application launched itself

      • iexplore.exe (PID: 2944)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
72
Monitored processes
27
Malicious processes
6
Suspicious processes
1

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe javaw.exe no specs java.exe cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs xcopy.exe cscript.exe no specs cmd.exe no specs cscript.exe no specs reg.exe attrib.exe no specs attrib.exe no specs #ADWIND javaw.exe java.exe cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs wmic.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2944"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3228"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2944 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
2764"C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe" -jar "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\FedEx-shipping(ecopy)22-3235-44-Labels[1].jar" C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe—iexplore.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.920.14
3148"C:\Program Files\Java\jre1.8.0_92\bin\java.exe" -jar C:\Users\admin\AppData\Local\Temp\_0.133753112349978786894419876484780556.classC:\Program Files\Java\jre1.8.0_92\bin\java.exe
javaw.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Version:
8.0.920.14
2176cmd.exe /C cscript.exe C:\Users\admin\AppData\Local\Temp\Retrive5102215968150116583.vbsC:\Windows\system32\cmd.exe—javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2708cscript.exe C:\Users\admin\AppData\Local\Temp\Retrive5102215968150116583.vbsC:\Windows\system32\cscript.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Console Based Script Host
Exit code:
0
Version:
5.8.7600.16385
4040cmd.exe /C cscript.exe C:\Users\admin\AppData\Local\Temp\Retrive8817750696798682258.vbsC:\Windows\system32\cmd.exe—javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2640cscript.exe C:\Users\admin\AppData\Local\Temp\Retrive8817750696798682258.vbsC:\Windows\system32\cscript.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Console Based Script Host
Exit code:
0
Version:
5.8.7600.16385
3676cmd.exe /C cscript.exe C:\Users\admin\AppData\Local\Temp\Retrive6991080113461864125.vbsC:\Windows\system32\cmd.exe—java.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3968xcopy "C:\Program Files\Java\jre1.8.0_92" "C:\Users\admin\AppData\Roaming\Oracle\" /eC:\Windows\system32\xcopy.exe
javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Extended Copy Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
932
Read events
868
Write events
0
Delete events
0

Modification events

No data
Executable files
109
Suspicious files
13
Text files
78
Unknown types
19

Dropped files

PID
Process
Filename
Type
2944iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFEDDD03F487A8285E.TMP —
MD5:—
SHA256:—
2944iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\favicon[1].ico —
MD5:—
SHA256:—
2944iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
2944iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF28D876B3D9F1F0A3.TMP —
MD5:—
SHA256:—
2944iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{4461DA61-FFD2-11E8-BAD8-5254004A04AF}.dat —
MD5:—
SHA256:—
2764javaw.exeC:\Users\admin\AppData\Local\Temp\Retrive8817750696798682258.vbs —
MD5:—
SHA256:—
2944iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\IETldCache\index.datdat
MD5:D7A950FEFD60DBAA01DF2D85FEFB3862
SHA256:75D0B1743F61B76A35B1FEDD32378837805DE58D79FA950CB6E8164BFA72073A
3228iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\MSHist012018121420181215\index.datdat
MD5:DE098641E1270C8A7A40BC29FD0E80A5
SHA256:3328A3650EA7E89A792ED24062D83C129A1F32958B4B48BFA31956FBA4AE9884
3228iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\JavaDeployReg.logtext
MD5:E485176E5E5FB9AA56144F2AD22F6EE7
SHA256:45C510DF72F12D126E19711C3A443D5C53480F1B9292E56711E12862E3C7886C
3228iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\FedEx-shipping(ecopy)22-3235-44-Labels[1].jarcompressed
MD5:89776DE10022C2CB4E9DC80E261364CB
SHA256:C08A27BBB1BAB436B5C654032A61A6A048DFC0A1407D8FDCED17E8E44E85F01A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
3
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3228
iexplore.exe
GET
200
203.0.178.90:80
http://members.iinet.net.au/~sambo75/FedEx-shipping(ecopy)22-3235-44-Labels.jar
AU
compressed
507 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2944
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
2332
javaw.exe
212.73.150.132:1010
—
BelCloud Hosting Corporation
BG
malicious
3228
iexplore.exe
203.0.178.90:80
members.iinet.net.au
Internode Pty Ltd
AU
malicious

DNS requests

Domain
IP
Reputation
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
members.iinet.net.au
  • 203.0.178.90
malicious

Threats

PID
Process
Class
Message
2332
javaw.exe
A Network Trojan was detected
ET TROJAN Possible Adwind SSL Cert (assylias.Inc)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
http://members.iinet.net.au/~sambo75/FedEx-shipping(ecopy)22-3235-44-Labels.jar