analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
download:

download

Full analysis: https://app.any.run/tasks/41558e0f-36f0-4b02-b022-e5a97f975a44
Verdict: Malicious activity
Threats:

Adwind RAT, sometimes also called Unrecom, Sockrat, Frutas, jRat, and JSocket, is a Malware As A Service Remote Access Trojan that attackers can use to collect information from infected machines. It was one of the most popular RATs in the market in 2015.

Analysis date: April 15, 2019, 08:32:20
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
adwind
trojan
Indicators:
MIME: application/java-archive
File info: Java archive data (JAR)
MD5:

125AFD7F5AC82756105FCE32679DA0AE

SHA1:

62122CA89100E505269314C356394CCD076824F0

SHA256:

E428AE81B543D24C323AAD94F768BBE13501A966095A57897D2E29DFB3085F7D

SSDEEP:

12288:JF1qEfzDbDmSdmLfqicIKUblmqmeDLne04nVWj:JFDSVBcrUbojSe04Ij

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • AdWind was detected

      • java.exe (PID: 3360)
      • java.exe (PID: 3636)
    • Loads dropped or rewritten executable

      • explorer.exe (PID: 2036)
      • svchost.exe (PID: 812)
      • java.exe (PID: 3360)
      • javaw.exe (PID: 2656)
      • javaw.exe (PID: 2192)
      • java.exe (PID: 3636)
    • Application was dropped or rewritten from another process

      • javaw.exe (PID: 2656)
      • java.exe (PID: 3360)
      • javaw.exe (PID: 2192)
      • java.exe (PID: 3636)
    • Changes the autorun value in the registry

      • reg.exe (PID: 1336)
    • Turns off system restore

      • regedit.exe (PID: 2516)
    • UAC/LUA settings modification

      • regedit.exe (PID: 2516)
    • ADWIND was detected

      • javaw.exe (PID: 2192)
    • Uses TASKKILL.EXE to kill security tools

      • javaw.exe (PID: 2192)
    • Changes Image File Execution Options

      • regedit.exe (PID: 2516)
  • SUSPICIOUS

    • Executes JAVA applets

      • javaw.exe (PID: 2656)
      • explorer.exe (PID: 2036)
    • Executes scripts

      • cmd.exe (PID: 2280)
      • cmd.exe (PID: 3296)
      • cmd.exe (PID: 2212)
      • cmd.exe (PID: 3688)
      • cmd.exe (PID: 3520)
      • cmd.exe (PID: 3392)
      • cmd.exe (PID: 3200)
      • cmd.exe (PID: 3244)
    • Starts CMD.EXE for commands execution

      • java.exe (PID: 3360)
      • javaw.exe (PID: 2656)
      • java.exe (PID: 3636)
      • javaw.exe (PID: 2192)
    • Creates files in the user directory

      • javaw.exe (PID: 2656)
      • xcopy.exe (PID: 2920)
    • Executable content was dropped or overwritten

      • xcopy.exe (PID: 2920)
      • javaw.exe (PID: 2192)
    • Uses REG.EXE to modify Windows registry

      • javaw.exe (PID: 2656)
    • Uses ATTRIB.EXE to modify file attributes

      • javaw.exe (PID: 2656)
    • Starts itself from another location

      • javaw.exe (PID: 2656)
    • Uses TASKKILL.EXE to kill process

      • javaw.exe (PID: 2192)
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: META-INF/MANIFEST.MF
ZipUncompressedSize: 64
ZipCompressedSize: 66
ZipCRC: 0xa8b207ba
ZipModifyDate: 2019:01:28 10:01:15
ZipCompression: Deflated
ZipBitFlag: 0x0808
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
91
Monitored processes
36
Malicious processes
8
Suspicious processes
0

Behavior graph

Click at the process to see the details
start javaw.exe no specs #ADWIND java.exe cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs xcopy.exe svchost.exe no specs explorer.exe no specs winrar.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs reg.exe attrib.exe no specs attrib.exe no specs #ADWIND javaw.exe #ADWIND java.exe cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs taskkill.exe no specs cmd.exe no specs regedit.exe no specs regedit.exe no specs taskkill.exe no specs regedit.exe taskkill.exe no specs wmic.exe no specs taskkill.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2656"C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe" -jar "C:\Users\admin\Desktop\download.zip"C:\Program Files\Java\jre1.8.0_92\bin\javaw.exeexplorer.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.920.14
3360"C:\Program Files\Java\jre1.8.0_92\bin\java.exe" -jar C:\Users\admin\AppData\Local\Temp\_0.123599389895671328742298485433720252.classC:\Program Files\Java\jre1.8.0_92\bin\java.exe
javaw.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Version:
8.0.920.14
2280cmd.exe /C cscript.exe C:\Users\admin\AppData\Local\Temp\Retrive2717000166232448575.vbsC:\Windows\system32\cmd.exejava.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
1080cscript.exe C:\Users\admin\AppData\Local\Temp\Retrive2717000166232448575.vbsC:\Windows\system32\cscript.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Console Based Script Host
Exit code:
0
Version:
5.8.7600.16385
3296cmd.exe /C cscript.exe C:\Users\admin\AppData\Local\Temp\Retrive1018691691147541556.vbsC:\Windows\system32\cmd.exejava.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
476cscript.exe C:\Users\admin\AppData\Local\Temp\Retrive1018691691147541556.vbsC:\Windows\system32\cscript.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Console Based Script Host
Exit code:
0
Version:
5.8.7600.16385
2920xcopy "C:\Program Files\Java\jre1.8.0_92" "C:\Users\admin\AppData\Roaming\Oracle\" /eC:\Windows\system32\xcopy.exe
java.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Extended Copy Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
812C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestrictedC:\Windows\System32\svchost.exeservices.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2036C:\Windows\Explorer.EXEC:\Windows\explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3308"C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -- "C:\Users\admin\Desktop\download.zip" C:\Users\admin\Desktop\C:\Program Files\WinRAR\WinRAR.exeexplorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
3
Version:
5.60.0
Total events
2 698
Read events
2 299
Write events
399
Delete events
0

Modification events

(PID) Process:(2036) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
Operation:writeName:{B41DB860-8EE4-11D2-9906-E49FADC173CA} {00000122-0000-0000-C000-000000000046} 0xFFFF
Value:
0100000000000000C656E8CF65F3D401
(PID) Process:(2036) explorer.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2036) explorer.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E
Operation:writeName:@C:\Windows\system32\ntshrui.dll,-103
Value:
S&hare with
(PID) Process:(2036) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.zip\OpenWithProgids
Operation:writeName:WinRAR.ZIP
Value:
(PID) Process:(2036) explorer.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E
Operation:writeName:@sendmail.dll,-21
Value:
Desktop (create shortcut)
(PID) Process:(2036) explorer.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E
Operation:writeName:@zipfldr.dll,-10148
Value:
Compressed (zipped) folder
(PID) Process:(2036) explorer.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E
Operation:writeName:@sendmail.dll,-4
Value:
Mail recipient
(PID) Process:(2036) explorer.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E
Operation:writeName:@C:\Windows\system32\FXSRESM.dll,-120
Value:
Fax recipient
(PID) Process:(2036) explorer.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:LangID
Value:
0904
(PID) Process:(2036) explorer.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\Windows\system32\WFS.exe
Value:
Microsoft Windows Fax and Scan
Executable files
110
Suspicious files
10
Text files
74
Unknown types
30

Dropped files

PID
Process
Filename
Type
3360java.exeC:\Users\admin\AppData\Local\Temp\Retrive1018691691147541556.vbs
MD5:
SHA256:
2656javaw.exeC:\Users\admin\.oracle_jre_usage\90737d32e3abaa4.timestamptext
MD5:9D7D7E1C3823DD60F00092B434766944
SHA256:72E5AAE7F0BA57A9EFE4A87DA3F2D6DDEE8237CF06B9F2998C4555D0BBAA689D
3360java.exeC:\Users\admin\.oracle_jre_usage\90737d32e3abaa4.timestamptext
MD5:B8DCE5FB651C532ECC6342139F26EBAC
SHA256:D2070DB89AD2A990092A309B32AD86EBC83D6A03C515C238D4C93FDEE28AAD98
2920xcopy.exeC:\Users\admin\AppData\Roaming\Oracle\bin\dt_socket.dllexecutable
MD5:138F156057245747692A68EBE50D52C2
SHA256:F0FD0268D6E410C05E7EE71AD9C96744CD5E4A97329F608041D7078FAEE24ED0
2920xcopy.exeC:\Users\admin\AppData\Roaming\Oracle\bin\dcpr.dllexecutable
MD5:682CFD9431E5675900B04FEBE6CD4EB9
SHA256:80111E1D706741F5EF7F661835C3AA46664666425AA1B5F93103410F2BEE1213
3360java.exeC:\Users\admin\AppData\Local\Temp\Retrive2717000166232448575.vbstext
MD5:3BDFD33017806B85949B6FAA7D4B98E4
SHA256:9DA575DD2D5B7C1E9BAB8B51A16CDE457B3371C6DCDB0537356CF1497FA868F6
2920xcopy.exeC:\Users\admin\AppData\Roaming\Oracle\bin\deploy.dllexecutable
MD5:720EDC1469525DFCD3AE211E653D0241
SHA256:BFF79FB05667992CC2BDA9BAE6E5A301BAF553042F952203641CCD7E1FC4552D
2920xcopy.exeC:\Users\admin\AppData\Roaming\Oracle\Welcome.htmlhtml
MD5:27CF299B6D93FACA73FBCDCF4AECFD93
SHA256:3F1F0EE75588DBBA3B143499D08AA9AB431E4A34E483890CFAC94A8E1061B7CF
2920xcopy.exeC:\Users\admin\AppData\Roaming\Oracle\THIRDPARTYLICENSEREADME-JAVAFX.txttext
MD5:AB9DB8D553033C0326BD2D38D77F84C1
SHA256:38995534DF44E0526F8C8C8D479C778A4B34627CFD69F19213CFBE019A7261BA
2920xcopy.exeC:\Users\admin\AppData\Roaming\Oracle\releasetext
MD5:1BCCC3A965156E53BE3136B3D583B7B6
SHA256:03A4DB27DEA69374EFBAF121C332D0AF05840D16D0C1FBF127D00E65054B118A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2192
javaw.exe
185.165.153.199:18
lexdeerex.duckdns.org
NL
malicious

DNS requests

Domain
IP
Reputation
lexdeerex.duckdns.org
  • 185.165.153.199
malicious

Threats

PID
Process
Class
Message
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
2192
javaw.exe
A Network Trojan was detected
ET TROJAN Possible Adwind SSL Cert (assylias.Inc)
2192
javaw.exe
A Network Trojan was detected
MALWARE [PTsecurity] Backdoor.Java.Adwind.cu
No debug info