analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

da2f714d3f37b420c5a2657c03274a1c15c77e22d4e1d82ed3297fd1db81f3fa.jar

Full analysis: https://app.any.run/tasks/36538ac9-1c41-4a1f-ac3e-bf60f8fd4872
Verdict: Malicious activity
Threats:

Adwind RAT, sometimes also called Unrecom, Sockrat, Frutas, jRat, and JSocket, is a Malware As A Service Remote Access Trojan that attackers can use to collect information from infected machines. It was one of the most popular RATs in the market in 2015.

Malware Trends Tracker     >>>
Analysis date: October 20, 2020, 12:43:13
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
adwind
trojan
rat
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

6B1D7CD3999C94E5579F9982677B0E3C

SHA1:

6F10D0F858C0FCDAF625E293D6908CAD65FBC3DE

SHA256:

DA2F714D3F37B420C5A2657C03274A1C15C77E22D4E1D82ED3297FD1DB81F3FA

SSDEEP:

12288:kqxpl66TjjnOXzMe+YMjlyn7uLCNNrjFgDfAAWvh5BeV:kMl6Wjjnhemjlyn79iDolp6V

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • AdWind was detected

      • java.exe (PID: 316)
      • java.exe (PID: 2596)

    • Loads dropped or rewritten executable

      • java.exe (PID: 316)
      • javaw.exe (PID: 3764)
      • wscript.exe (PID: 2004)
      • explorer.exe (PID: 392)
      • javaw.exe (PID: 2548)
      • svchost.exe (PID: 808)
      • javaw.exe (PID: 3452)
      • java.exe (PID: 2596)

    • Application was dropped or rewritten from another process

      • java.exe (PID: 316)
      • javaw.exe (PID: 2548)
      • javaw.exe (PID: 3764)
      • javaw.exe (PID: 3452)
      • java.exe (PID: 2596)

    • Changes the autorun value in the registry

      • reg.exe (PID: 444)

    • UAC/LUA settings modification

      • regedit.exe (PID: 2192)

    • Turns off system restore

      • regedit.exe (PID: 2192)

    • Uses TASKKILL.EXE to kill security tools

      • javaw.exe (PID: 3452)

    • ADWIND was detected

      • javaw.exe (PID: 3452)

    • Changes Image File Execution Options

      • regedit.exe (PID: 2192)

  • SUSPICIOUS

    • Executes scripts

      • javaw.exe (PID: 2548)
      • cmd.exe (PID: 1752)
      • cmd.exe (PID: 2448)
      • cmd.exe (PID: 1712)
      • cmd.exe (PID: 4040)
      • cmd.exe (PID: 2268)
      • cmd.exe (PID: 3148)
      • cmd.exe (PID: 1652)
      • cmd.exe (PID: 3704)

    • Executes JAVA applets

      • explorer.exe (PID: 392)
      • wscript.exe (PID: 2004)
      • javaw.exe (PID: 3764)

    • Creates files in the user directory

      • wscript.exe (PID: 2004)
      • javaw.exe (PID: 3764)
      • xcopy.exe (PID: 492)

    • Starts CMD.EXE for commands execution

      • javaw.exe (PID: 3764)
      • java.exe (PID: 316)
      • javaw.exe (PID: 3452)
      • java.exe (PID: 2596)

    • Executable content was dropped or overwritten

      • xcopy.exe (PID: 492)
      • javaw.exe (PID: 3452)

    • Uses REG.EXE to modify Windows registry

      • javaw.exe (PID: 3764)

    • Uses ATTRIB.EXE to modify file attributes

      • javaw.exe (PID: 3764)

    • Starts itself from another location

      • javaw.exe (PID: 3764)

    • Uses WMIC.EXE to obtain a system information

      • javaw.exe (PID: 3452)

    • Uses TASKKILL.EXE to kill process

      • javaw.exe (PID: 3452)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: etqfaxpchs/resources/ryfoxvccct
ZipUncompressedSize: 933626
ZipCompressedSize: 631720
ZipCRC: 0x43ac53fa
ZipModifyDate: 2020:10:18 11:15:20
ZipCompression: Deflated
ZipBitFlag: -
ZipRequiredVersion: 20
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
474
Monitored processes
227
Malicious processes
10
Suspicious processes
0

Behavior graph

Click at the process to see the details
start javaw.exe no specs wscript.exe no specs javaw.exe no specs #ADWIND java.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs cmd.exe no specs cscript.exe no specs cscript.exe no specs cmd.exe no specs xcopy.exe cscript.exe no specs xcopy.exe no specs svchost.exe no specs explorer.exe no specs reg.exe attrib.exe no specs attrib.exe no specs #ADWIND javaw.exe #ADWIND java.exe cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs taskkill.exe no specs cmd.exe no specs regedit.exe no specs regedit.exe no specs regedit.exe taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs wmic.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2548"C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe" -jar "C:\Users\admin\AppData\Local\Temp\da2f714d3f37b420c5a2657c03274a1c15c77e22d4e1d82ed3297fd1db81f3fa.jar"C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe—explorer.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.920.14
2004wscript C:\Users\admin\guujrevkgr.jsC:\Windows\system32\wscript.exe—javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
3764"C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe" -jar "C:\Users\admin\AppData\Roaming\ttmzcvxul.txt"C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe—wscript.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.920.14
316"C:\Program Files\Java\jre1.8.0_92\bin\java.exe" -jar C:\Users\admin\AppData\Local\Temp\_0.73716423518500026919102071804308464.classC:\Program Files\Java\jre1.8.0_92\bin\java.exe
javaw.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Version:
8.0.920.14
2448cmd.exe /C cscript.exe C:\Users\admin\AppData\Local\Temp\Retrive9111042326596572392.vbsC:\Windows\system32\cmd.exe—javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
892cscript.exe C:\Users\admin\AppData\Local\Temp\Retrive9111042326596572392.vbsC:\Windows\system32\cscript.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Console Based Script Host
Exit code:
0
Version:
5.8.7600.16385
1752cmd.exe /C cscript.exe C:\Users\admin\AppData\Local\Temp\Retrive6097337168934293924.vbsC:\Windows\system32\cmd.exe—java.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
4040cmd.exe /C cscript.exe C:\Users\admin\AppData\Local\Temp\Retrive1801332209358429996.vbsC:\Windows\system32\cmd.exe—javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3440cscript.exe C:\Users\admin\AppData\Local\Temp\Retrive6097337168934293924.vbsC:\Windows\system32\cscript.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Console Based Script Host
Exit code:
0
Version:
5.8.7600.16385
780cscript.exe C:\Users\admin\AppData\Local\Temp\Retrive1801332209358429996.vbsC:\Windows\system32\cscript.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Console Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Total events
1 239
Read events
1 010
Write events
0
Delete events
0

Modification events

No data
Executable files
111
Suspicious files
10
Text files
75
Unknown types
15

Dropped files

PID
Process
Filename
Type
316java.exeC:\Users\admin\AppData\Local\Temp\Retrive6097337168934293924.vbs —
MD5:—
SHA256:—
3764javaw.exeC:\Users\admin\AppData\Local\Temp\Retrive1801332209358429996.vbs —
MD5:—
SHA256:—
2548javaw.exeC:\Users\admin\.oracle_jre_usage\90737d32e3abaa4.timestamptext
MD5:5C3E979F222E4744DD24312706885EBD
SHA256:EEA116F38823CED6FF785A0BE8EC4D5A7D67974837614C031B016F7F3E395D88
2004wscript.exeC:\Users\admin\AppData\Roaming\ttmzcvxul.txtjava
MD5:A85C41AFA192B716563E9FDC9685CE8A
SHA256:F4EEB00E3A49637C077B7B44A161B3E7995E97F1E315BEB77C3C097C6C37CA29
3764javaw.exeC:\Users\admin\.oracle_jre_usage\90737d32e3abaa4.timestamptext
MD5:2CCB50594E0904943AA19FDCBE9ED108
SHA256:1B78A382BA46A05155FB3A2297B20E2574AB2A0F4526F7E289E7CEC1A293012E
316java.exeC:\Users\admin\.oracle_jre_usage\90737d32e3abaa4.timestamptext
MD5:9868E7042991AC801CCB37D613DE385C
SHA256:32D7958A576CCFE0CAB0B16752A045E10FC76C63474FA4E4F578B520E732FE6A
2548javaw.exeC:\Users\admin\guujrevkgr.jstext
MD5:E8299670EE26C446B6655B9FE83B3339
SHA256:D69B9173A1F8ADB361FD12C78F769679F21921C47E2A79372C0603C457E9664D
3764javaw.exeC:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302019708-1500728564-335382590-1000\83aa4cc77f591dfc2374580bbd95f6ba_90059c37-1320-41a4-b58d-2b75a9850d2fdbf
MD5:C8366AE350E7019AEFC9D1E6E6A498C6
SHA256:11E6ACA8E682C046C83B721EEB5C72C5EF03CB5936C60DF6F4993511DDC61238
492xcopy.exeC:\Users\admin\AppData\Roaming\Oracle\releasetext
MD5:1BCCC3A965156E53BE3136B3D583B7B6
SHA256:03A4DB27DEA69374EFBAF121C332D0AF05840D16D0C1FBF127D00E65054B118A
492xcopy.exeC:\Users\admin\AppData\Roaming\Oracle\THIRDPARTYLICENSEREADME.txttext
MD5:745D6DB5FC58C63F74CE6A7D4DB7E695
SHA256:C77BA9F668FEE7E9B810F1493E518ADF87233AC8793E4B37C9B3D1ED7846F1C0
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3452
javaw.exe
185.165.153.6:2786
—
—
NL
malicious

DNS requests

No data

Threats

PID
Process
Class
Message
3452
javaw.exe
A Network Trojan was detected
ET TROJAN Possible Adwind/jSocket SSL Cert (assylias.Inc)
3452
javaw.exe
A Network Trojan was detected
REMOTE [PTsecurity] Backdoor.Java.Adwind.cu
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
da2f714d3f37b420c5a2657c03274a1c15c77e22d4e1d82ed3297fd1db81f3fa.jar