analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

e52a7f4ecb39233d0ed9d2f3762b8eea376c0aee63a2c2785f9428abd86bdacb

Full analysis: https://app.any.run/tasks/b0d6a83d-3458-4ff1-8f01-081f4ea912b6
Verdict: Malicious activity
Threats:

Adwind RAT, sometimes also called Unrecom, Sockrat, Frutas, jRat, and JSocket, is a Malware As A Service Remote Access Trojan that attackers can use to collect information from infected machines. It was one of the most popular RATs in the market in 2015.

Malware Trends Tracker     >>>
Analysis date: January 22, 2019, 18:55:11
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
adwind
trojan
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract
MD5:

697594C989A5246E79E87F26A2B017D6

SHA1:

4E4E03D19DC83D4E6875B1D510476D691FEEC1BE

SHA256:

E52A7F4ECB39233D0ED9D2F3762B8EEA376C0AEE63A2C2785F9428ABD86BDACB

SSDEEP:

12288:q7LKiA7Eq98OlxmQL+oVu1agnsKrTf16rLKnZO2IMB+G3OnPlrfeHOSKDY2:q7LKvl5BVuD1MIZO2IMxOntrf0JKDB

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • wscript.exe (PID: 3844)
      • reg.exe (PID: 3368)

    • AdWind was detected

      • java.exe (PID: 3116)
      • java.exe (PID: 2920)

    • Application was dropped or rewritten from another process

      • java.exe (PID: 3116)
      • javaw.exe (PID: 3048)
      • javaw.exe (PID: 2260)
      • javaw.exe (PID: 3744)
      • java.exe (PID: 2920)

    • Loads dropped or rewritten executable

      • javaw.exe (PID: 3048)
      • java.exe (PID: 3116)
      • javaw.exe (PID: 2260)
      • wscript.exe (PID: 3844)
      • explorer.exe (PID: 116)
      • svchost.exe (PID: 816)
      • java.exe (PID: 2920)
      • javaw.exe (PID: 3744)

  • SUSPICIOUS

    • Executes JAVA applets

      • explorer.exe (PID: 116)
      • wscript.exe (PID: 3844)
      • javaw.exe (PID: 3048)

    • Executes scripts

      • javaw.exe (PID: 2260)
      • cmd.exe (PID: 3908)
      • cmd.exe (PID: 2292)
      • cmd.exe (PID: 2412)
      • cmd.exe (PID: 2276)
      • cmd.exe (PID: 972)
      • cmd.exe (PID: 4048)
      • cmd.exe (PID: 2112)
      • cmd.exe (PID: 2420)

    • Application launched itself

      • WinRAR.exe (PID: 2720)

    • Creates files in the user directory

      • wscript.exe (PID: 3844)
      • javaw.exe (PID: 3048)
      • xcopy.exe (PID: 1020)

    • Starts CMD.EXE for commands execution

      • java.exe (PID: 3116)
      • javaw.exe (PID: 3048)
      • javaw.exe (PID: 3744)
      • java.exe (PID: 2920)

    • Executable content was dropped or overwritten

      • xcopy.exe (PID: 1020)
      • javaw.exe (PID: 3744)

    • Uses REG.EXE to modify Windows registry

      • javaw.exe (PID: 3048)

    • Starts itself from another location

      • javaw.exe (PID: 3048)

    • Uses ATTRIB.EXE to modify file attributes

      • javaw.exe (PID: 3048)

    • Connects to unusual port

      • javaw.exe (PID: 3744)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: 0x0002
ZipCompression: None
ZipModifyDate: 2019:01:21 10:48:19
ZipCRC: 0x3980ba4e
ZipCompressedSize: 640376
ZipUncompressedSize: 640376
ZipFileName: IMG-5896.jar
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
78
Monitored processes
32
Malicious processes
8
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs winrar.exe no specs javaw.exe no specs wscript.exe javaw.exe no specs java.exe cmd.exe no specs cscript.exe no specs cmd.exe no specs cmd.exe no specs cscript.exe no specs cscript.exe no specs xcopy.exe cmd.exe no specs cscript.exe no specs svchost.exe no specs explorer.exe no specs reg.exe attrib.exe no specs attrib.exe no specs javaw.exe java.exe cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs wmic.exe no specs wmic.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2720"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\e52a7f4ecb39233d0ed9d2f3762b8eea376c0aee63a2c2785f9428abd86bdacb.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
2608"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\Rar$DIa2720.34519\IMG-5896.jarC:\Program Files\WinRAR\WinRAR.exe—WinRAR.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
2260"C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe" -jar "C:\Users\admin\Desktop\IMG-5896.jar" C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe—explorer.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.920.14
3844wscript C:\Users\admin\ccfwuebzgr.jsC:\Windows\system32\wscript.exe
javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
3048"C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe" -jar "C:\Users\admin\AppData\Roaming\efqbwyyun.txt"C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe—wscript.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.920.14
3116"C:\Program Files\Java\jre1.8.0_92\bin\java.exe" -jar C:\Users\admin\AppData\Local\Temp\_0.39121555279790776555660213257569117.classC:\Program Files\Java\jre1.8.0_92\bin\java.exe
javaw.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Version:
8.0.920.14
3908cmd.exe /C cscript.exe C:\Users\admin\AppData\Local\Temp\Retrive5577896707906818885.vbsC:\Windows\system32\cmd.exe—javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2352cscript.exe C:\Users\admin\AppData\Local\Temp\Retrive5577896707906818885.vbsC:\Windows\system32\cscript.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Console Based Script Host
Exit code:
0
Version:
5.8.7600.16385
2292cmd.exe /C cscript.exe C:\Users\admin\AppData\Local\Temp\Retrive8679424248253826522.vbsC:\Windows\system32\cmd.exe—javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2412cmd.exe /C cscript.exe C:\Users\admin\AppData\Local\Temp\Retrive7393812441069251454.vbsC:\Windows\system32\cmd.exe—java.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Total events
2 188
Read events
2 122
Write events
0
Delete events
0

Modification events

No data
Executable files
113
Suspicious files
12
Text files
75
Unknown types
15

Dropped files

PID
Process
Filename
Type
3048javaw.exeC:\Users\admin\AppData\Local\Temp\Retrive8679424248253826522.vbs —
MD5:—
SHA256:—
3116java.exeC:\Users\admin\AppData\Local\Temp\Retrive7393812441069251454.vbs —
MD5:—
SHA256:—
3844wscript.exeC:\Users\admin\AppData\Roaming\efqbwyyun.txtjava
MD5:983A14D5FF36B780CD64559517DC7BE0
SHA256:E801A9EC8A76E85FBBEA357ED8DB4F299460FC0B2BEF43B8D1A6A0034F064687
2260javaw.exeC:\Users\admin\.oracle_jre_usage\90737d32e3abaa4.timestamptext
MD5:B7631F1788B61BE680B115874D8834D1
SHA256:5C5656F4DA5D8D8E0ED3A629A0E86C354C024F8790893260F812BCB374E595D2
2720WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa2720.34519\IMG-5896.jarcompressed
MD5:E2F29FD334AD933361725207DE01EEF6
SHA256:E950032D09E33C89EA01C1C45D6F62AF3450B9520051C6F9D5CB1AB83D1F5993
3116java.exeC:\Users\admin\.oracle_jre_usage\90737d32e3abaa4.timestamptext
MD5:5CA66AF266839799827D886A1059E660
SHA256:7483F75FD074B57DB4D3227972B561C09C904B299D570A80F5BEEBF0BEBE07AE
116explorer.exeC:\Users\admin\Desktop\IMG-5896.jarcompressed
MD5:E2F29FD334AD933361725207DE01EEF6
SHA256:E950032D09E33C89EA01C1C45D6F62AF3450B9520051C6F9D5CB1AB83D1F5993
3048javaw.exeC:\Users\admin\.oracle_jre_usage\90737d32e3abaa4.timestamptext
MD5:520A94BE894BDCC1A79F919544868121
SHA256:6F6C5A885F9B05F1E7B9B63E5AB69364A929AEDAF6E371B0F4A98521F6FA42A8
2260javaw.exeC:\Users\admin\ccfwuebzgr.jstext
MD5:4E8EFA5372D288EC31DA939E86821736
SHA256:00B88C0E8E21D870471F2635178714DD1CBFD86B4CD5AFCDE72E4F433639A61C
3048javaw.exeC:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302019708-1500728564-335382590-1000\83aa4cc77f591dfc2374580bbd95f6ba_90059c37-1320-41a4-b58d-2b75a9850d2fdbf
MD5:C8366AE350E7019AEFC9D1E6E6A498C6
SHA256:11E6ACA8E682C046C83B721EEB5C72C5EF03CB5936C60DF6F4993511DDC61238
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
40
DNS requests
4
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3744
javaw.exe
92.38.86.175:1337
vitlop.ddns.net
ALFA TELECOM s.r.o.
CZ
malicious

DNS requests

Domain
IP
Reputation
vitlop.ddns.net
  • 92.38.86.175
malicious

Threats

PID
Process
Class
Message
3744
javaw.exe
A Network Trojan was detected
ET TROJAN [PTsecurity] Fake SSL Certificate Observed (Oracle America)
3744
javaw.exe
A Network Trojan was detected
ET TROJAN [PTsecurity] Fake SSL Certificate Observed (Oracle America)
3744
javaw.exe
A Network Trojan was detected
ET TROJAN [PTsecurity] Fake SSL Certificate Observed (Oracle America)
3744
javaw.exe
A Network Trojan was detected
ET TROJAN [PTsecurity] Fake SSL Certificate Observed (Oracle America)
3744
javaw.exe
A Network Trojan was detected
ET TROJAN [PTsecurity] Fake SSL Certificate Observed (Oracle America)
3744
javaw.exe
A Network Trojan was detected
ET TROJAN [PTsecurity] Fake SSL Certificate Observed (Oracle America)
3744
javaw.exe
A Network Trojan was detected
ET TROJAN [PTsecurity] Fake SSL Certificate Observed (Oracle America)
3744
javaw.exe
A Network Trojan was detected
ET TROJAN [PTsecurity] Fake SSL Certificate Observed (Oracle America)
3744
javaw.exe
A Network Trojan was detected
ET TROJAN [PTsecurity] Fake SSL Certificate Observed (Oracle America)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
e52a7f4ecb39233d0ed9d2f3762b8eea376c0aee63a2c2785f9428abd86bdacb