analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

DHL e-AWB Air Waybill No. 9656564923.jar

Full analysis: https://app.any.run/tasks/d6216be3-66b1-4b88-be15-d04bfb8a49c7
Verdict: Malicious activity
Threats:

Adwind RAT, sometimes also called Unrecom, Sockrat, Frutas, jRat, and JSocket, is a Malware As A Service Remote Access Trojan that attackers can use to collect information from infected machines. It was one of the most popular RATs in the market in 2015.

Malware Trends Tracker     >>>
Analysis date: January 22, 2019, 16:30:11
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
dunihi
adwind
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

CF57D16645E62B13E151BF1ABD4BA324

SHA1:

B6121FA9383E97C8285EB723EED338756532804F

SHA256:

D1B5F634F514A51377411E6B2B6E183905A670B590F46C99AE7AEACE2B84B942

SSDEEP:

12288:UUpP6jaQpUtKl8N6MpeqbJxonzkmQZejTYSf6sn9TKqYZWKhJK9:FpC5GtKqo/Cej04TXDKhg9

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • wscript.exe (PID: 2304)
      • WScript.exe (PID: 3916)
      • reg.exe (PID: 3000)

    • Writes to a start menu file

      • WScript.exe (PID: 3916)

    • Connects to CnC server

      • WScript.exe (PID: 3916)

    • DUNIHI was detected

      • WScript.exe (PID: 3916)

    • AdWind was detected

      • java.exe (PID: 3924)
      • java.exe (PID: 3564)

    • Loads dropped or rewritten executable

      • java.exe (PID: 3924)
      • cmd.exe (PID: 2676)
      • explorer.exe (PID: 2028)
      • wscript.exe (PID: 2304)
      • javaw.exe (PID: 3420)
      • javaw.exe (PID: 2980)
      • javaw.exe (PID: 3504)
      • java.exe (PID: 3564)
      • javaw.exe (PID: 3384)

    • Application was dropped or rewritten from another process

      • javaw.exe (PID: 3420)
      • javaw.exe (PID: 2980)
      • java.exe (PID: 3924)
      • javaw.exe (PID: 3504)
      • java.exe (PID: 3564)
      • javaw.exe (PID: 3384)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • wscript.exe (PID: 2304)
      • java.exe (PID: 3924)
      • javaw.exe (PID: 3504)
      • java.exe (PID: 3564)
      • javaw.exe (PID: 3384)

    • Executes scripts

      • javaw.exe (PID: 2980)
      • wscript.exe (PID: 2304)
      • cmd.exe (PID: 3388)
      • cmd.exe (PID: 2684)
      • cmd.exe (PID: 2692)
      • cmd.exe (PID: 2544)
      • cmd.exe (PID: 2116)
      • cmd.exe (PID: 3596)
      • cmd.exe (PID: 2408)
      • cmd.exe (PID: 2868)

    • Creates files in the user directory

      • wscript.exe (PID: 2304)
      • WScript.exe (PID: 3916)
      • javaw.exe (PID: 3504)
      • xcopy.exe (PID: 480)

    • Executes JAVA applets

      • explorer.exe (PID: 2028)
      • wscript.exe (PID: 2304)
      • cmd.exe (PID: 2676)
      • javaw.exe (PID: 3504)

    • Application launched itself

      • wscript.exe (PID: 2304)

    • Connects to unusual port

      • WScript.exe (PID: 3916)
      • javaw.exe (PID: 3384)

    • Uses REG.EXE to modify Windows registry

      • javaw.exe (PID: 3504)

    • Executable content was dropped or overwritten

      • xcopy.exe (PID: 480)

    • Uses ATTRIB.EXE to modify file attributes

      • javaw.exe (PID: 3504)

    • Starts itself from another location

      • javaw.exe (PID: 3504)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2019:01:22 09:43:16
ZipCRC: 0x288eca21
ZipCompressedSize: 641171
ZipUncompressedSize: 940403
ZipFileName: inlydyives/resources/tiertpjppz
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
76
Monitored processes
31
Malicious processes
10
Suspicious processes
1

Behavior graph

Click at the process to see the details
start javaw.exe no specs wscript.exe #DUNIHI wscript.exe cmd.exe no specs javaw.exe no specs javaw.exe no specs java.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs cmd.exe no specs cscript.exe no specs cscript.exe no specs cmd.exe no specs xcopy.exe cscript.exe no specs xcopy.exe no specs explorer.exe no specs reg.exe attrib.exe no specs attrib.exe no specs javaw.exe java.exe cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2980"C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe" -jar "C:\Users\admin\AppData\Local\Temp\DHL e-AWB Air Waybill No. 9656564923.jar"C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe—explorer.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.920.14
2304wscript C:\Users\admin\ofiemshpzk.vbsC:\Windows\system32\wscript.exe
javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
3916"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Roaming\DWWXtdeamg.vbs" C:\Windows\System32\WScript.exe
wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Version:
5.8.7600.16385
2676"C:\Windows\System32\cmd.exe" /c "C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe" -version 2> C:\Users\admin\AppData\Local\Temp\output.txtC:\Windows\System32\cmd.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3420"C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe" -version C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe—cmd.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.920.14
3504"C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe" -jar "C:\Users\admin\AppData\Roaming\ntfsmgr.jar"C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe—wscript.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.920.14
3924"C:\Program Files\Java\jre1.8.0_92\bin\java.exe" -jar C:\Users\admin\AppData\Local\Temp\_0.89631988775927863640605878625960008.classC:\Program Files\Java\jre1.8.0_92\bin\java.exe—javaw.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Version:
8.0.920.14
2684cmd.exe /C cscript.exe C:\Users\admin\AppData\Local\Temp\Retrive5856979153842981310.vbsC:\Windows\system32\cmd.exe—javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3228cscript.exe C:\Users\admin\AppData\Local\Temp\Retrive5856979153842981310.vbsC:\Windows\system32\cscript.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Console Based Script Host
Exit code:
0
Version:
5.8.7600.16385
2544cmd.exe /C cscript.exe C:\Users\admin\AppData\Local\Temp\Retrive9197828011475133552.vbsC:\Windows\system32\cmd.exe—java.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Total events
4 284
Read events
4 245
Write events
39
Delete events
0

Modification events

(PID) Process:(2304) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2304) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(3916) WScript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\DWWXtdeamg
Operation:writeName:
Value:
false - 1/22/2019
(PID) Process:(3916) WScript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:DWWXtdeamg
Value:
wscript.exe //B "C:\Users\admin\AppData\Roaming\DWWXtdeamg.vbs"
(PID) Process:(3916) WScript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:DWWXtdeamg
Value:
wscript.exe //B "C:\Users\admin\AppData\Roaming\DWWXtdeamg.vbs"
(PID) Process:(2304) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:ntfsmgr
Value:
"C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe" -jar "C:\Users\admin\AppData\Roaming\ntfsmgr.jar"
(PID) Process:(3916) WScript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WScript_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3916) WScript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WScript_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3916) WScript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WScript_RASAPI32
Operation:writeName:FileTracingMask
Value:
4294901760
(PID) Process:(3916) WScript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WScript_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
4294901760
Executable files
110
Suspicious files
10
Text files
82
Unknown types
15

Dropped files

PID
Process
Filename
Type
3924java.exeC:\Users\admin\AppData\Local\Temp\Retrive9197828011475133552.vbs —
MD5:—
SHA256:—
2304wscript.exeC:\Users\admin\AppData\Roaming\DWWXtdeamg.vbstext
MD5:157A1401AF6D62810BF12E593BA4647D
SHA256:34957897CBA025D8A5F8F9C6093B31215D6DEA40BCFA8A4DD5566264DB5C1A57
2980javaw.exeC:\Users\admin\.oracle_jre_usage\90737d32e3abaa4.timestamptext
MD5:295113FD53D436AC4CBC6F3E67F1BCCE
SHA256:8F3FF20E2EE5DA91CB6987E9E9E84D2CD2B6330C1BC5FBC08989DA9CCF99269B
3916WScript.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DWWXtdeamg.vbstext
MD5:157A1401AF6D62810BF12E593BA4647D
SHA256:34957897CBA025D8A5F8F9C6093B31215D6DEA40BCFA8A4DD5566264DB5C1A57
2676cmd.exeC:\Users\admin\AppData\Local\Temp\output.txttext
MD5:FCF81EDEAE4E8C13E8B099A9EE455E27
SHA256:0CCC5DDB797429E5625AEDB2ECEE3F42E97221264CD69D5FF53A094F72FE5D7B
2980javaw.exeC:\Users\admin\ofiemshpzk.vbstext
MD5:5C04828CD933CAE1707F1968E132CCB8
SHA256:F481155CF4F3014D36789858E84CFDF89A699F1E4946F58A239D34431A46B45A
3504javaw.exeC:\Users\admin\.oracle_jre_usage\90737d32e3abaa4.timestamptext
MD5:FC3A3BFDCF3D8C34C73B494F78804D9B
SHA256:7D5E720838717BFE553C1BF5EAA33FECE2AFD160B0E7213382622B3D86FC936B
3924java.exeC:\Users\admin\.oracle_jre_usage\90737d32e3abaa4.timestamptext
MD5:E4865A9FE2696762B89AB840E81A48AC
SHA256:94892CBF2B0FA98D5BAF40040349B5541A52BEBBE526BFA230D16E940CDD75A1
480xcopy.exeC:\Users\admin\AppData\Roaming\Oracle\README.txttext
MD5:0F1123976B959AC5E8B89EB8C245C4BD
SHA256:963095CF8DB76FB8071FD19A3110718A42F2AB42B27A3ADFD9EC58981C3E88D2
480xcopy.exeC:\Users\admin\AppData\Roaming\Oracle\COPYRIGHTtext
MD5:89F660D2B7D58DA3EFD2FECD9832DA9C
SHA256:F6A08C9CC04D7C6A86576C1EF50DD0A690AE5CB503EFD205EDB2E408BD8D557B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
6
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3916
WScript.exe
POST
—
185.183.97.184:1122
http://goz.kingdaddy.pw:1122/is-ready
RO
—
—
suspicious
3916
WScript.exe
POST
—
185.183.97.184:1122
http://goz.kingdaddy.pw:1122/is-ready
RO
—
—
suspicious
3916
WScript.exe
POST
200
185.183.97.184:1122
http://goz.kingdaddy.pw:1122/is-ready
RO
text
12 b
suspicious
3916
WScript.exe
POST
200
185.183.97.184:1122
http://goz.kingdaddy.pw:1122/is-ready
RO
text
12 b
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3916
WScript.exe
185.183.97.184:1122
goz.kingdaddy.pw
Host Sailor Ltd.
RO
suspicious
3384
javaw.exe
31.171.152.105:2888
—
Keminet Ltd.
AL
malicious

DNS requests

Domain
IP
Reputation
goz.kingdaddy.pw
  • 185.183.97.184
  • 198.54.115.94
malicious

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET DNS Query to a *.pw domain - Likely Hostile
3916
WScript.exe
A Network Trojan was detected
ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm Checkin 1
3916
WScript.exe
A Network Trojan was detected
ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm Checkin UA
3916
WScript.exe
A Network Trojan was detected
MALWARE [PTsecurity] Dunihi VBS.Downloader.Trojan
3916
WScript.exe
Potentially Bad Traffic
ET INFO HTTP Request to a *.pw domain
3916
WScript.exe
A Network Trojan was detected
ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm Checkin 1
3916
WScript.exe
A Network Trojan was detected
ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm Checkin UA
3916
WScript.exe
A Network Trojan was detected
MALWARE [PTsecurity] Dunihi VBS.Downloader.Trojan
3916
WScript.exe
Potentially Bad Traffic
ET INFO HTTP Request to a *.pw domain
3916
WScript.exe
A Network Trojan was detected
ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm Checkin 1
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
DHL e-AWB Air Waybill No. 9656564923.jar