Analysis
-
max time kernel
90s -
max time network
93s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system -
submitted
08-03-2024 18:54
Static task
static1
Behavioral task
behavioral1
Sample
Adwind.jar
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Adwind.jar
Resource
win10-20240221-en
Behavioral task
behavioral3
Sample
Adwind.jar
Resource
win10v2004-20240226-en
Behavioral task
behavioral4
Sample
Adwind.jar
Resource
win11-20240221-en
General
-
Target
Adwind.jar
-
Size
5KB
-
MD5
fe537a3346590c04d81d357e3c4be6e8
-
SHA1
b1285f1d8618292e17e490857d1bdf0a79104837
-
SHA256
bbc572cced7c94d63a7208f4aba4ed20d1350bef153b099035a86c95c8d96d4a
-
SHA512
50a5c1ad99ee9f3a540cb30e87ebfdf7561f0a0ee35b3d06c394fa2bad06ca6088a04848ddcb25f449b3c98b89a91d1ba5859f1ed6737119b606968be250c8ce
-
SSDEEP
96:w9fXh7CBF8l1cHRDOjY4YbiPkW7UW1g+dWi9sBSy3HQNm6wx2xC7vz5:GXh78hHRDOU4YWPk2J14i9E3ymBxW+
Malware Config
Signatures
-
Modifies file permissions 1 TTPs 1 IoCs
-
Drops file in Program Files directory 12 IoCs
Processes:
java.exedescription ioc process File opened for modification C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ntdll.pdb java.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
java.exedescription pid process target process PID 5100 wrote to memory of 2380 5100 java.exe icacls.exe PID 5100 wrote to memory of 2380 5100 java.exe icacls.exe
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\Adwind.jar1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestampFilesize
46B
MD547e9037412f71066efb3f06aba75ee28
SHA11027b426f73c04481fb3337b766a8084668cc224
SHA25654321caa8f3732a129779b5fff3267f376bec9d1cd676da7ee5873ce15657d7e
SHA5122b822efcd00ac78a999b03ab705e67819a69b1cb99662cdd7b73b62ee74afab70a5859e4373582252ca3fb5e6a0b6ed4e25d44e7c25963c922f8b86a40409d2d
-
memory/5100-44-0x000002013A910000-0x000002013B910000-memory.dmpFilesize
16.0MB
-
memory/5100-56-0x000002013ACC0000-0x000002013ACD0000-memory.dmpFilesize
64KB
-
memory/5100-17-0x000002013A910000-0x000002013B910000-memory.dmpFilesize
16.0MB
-
memory/5100-26-0x000002013A910000-0x000002013B910000-memory.dmpFilesize
16.0MB
-
memory/5100-38-0x000002013A910000-0x000002013B910000-memory.dmpFilesize
16.0MB
-
memory/5100-40-0x000002013AB90000-0x000002013ABA0000-memory.dmpFilesize
64KB
-
memory/5100-41-0x000002013AC10000-0x000002013AC20000-memory.dmpFilesize
64KB
-
memory/5100-43-0x000002013ABD0000-0x000002013ABE0000-memory.dmpFilesize
64KB
-
memory/5100-42-0x000002013ACB0000-0x000002013ACC0000-memory.dmpFilesize
64KB
-
memory/5100-45-0x000002013ABE0000-0x000002013ABF0000-memory.dmpFilesize
64KB
-
memory/5100-58-0x000002013A910000-0x000002013B910000-memory.dmpFilesize
16.0MB
-
memory/5100-12-0x000002013A8F0000-0x000002013A8F1000-memory.dmpFilesize
4KB
-
memory/5100-52-0x000002013AC70000-0x000002013AC80000-memory.dmpFilesize
64KB
-
memory/5100-49-0x000002013A910000-0x000002013B910000-memory.dmpFilesize
16.0MB
-
memory/5100-47-0x000002013AC20000-0x000002013AC30000-memory.dmpFilesize
64KB
-
memory/5100-50-0x000002013AC40000-0x000002013AC50000-memory.dmpFilesize
64KB
-
memory/5100-48-0x000002013AC30000-0x000002013AC40000-memory.dmpFilesize
64KB
-
memory/5100-51-0x000002013AC60000-0x000002013AC70000-memory.dmpFilesize
64KB
-
memory/5100-53-0x000002013A910000-0x000002013B910000-memory.dmpFilesize
16.0MB
-
memory/5100-54-0x000002013AC80000-0x000002013AC90000-memory.dmpFilesize
64KB
-
memory/5100-55-0x000002013AC90000-0x000002013ACA0000-memory.dmpFilesize
64KB
-
memory/5100-7-0x000002013A910000-0x000002013B910000-memory.dmpFilesize
16.0MB
-
memory/5100-57-0x000002013A910000-0x000002013B910000-memory.dmpFilesize
16.0MB
-
memory/5100-46-0x000002013ABF0000-0x000002013AC00000-memory.dmpFilesize
64KB