Malware Analysis Report

2025-03-15 08:24

Sample ID 241020-zrh17azcmc
Target https://cdn.discordapp.com/attachments/824221029240274995/1296988829957357669/JJSploit_8.10.7_x64-setup.exe?ex=6714f339&is=6713a1b9&hm=72f841359f4ee2c0dea65d59ca550ad724169a9e1fb75ee81982119970e22369&
Tags
defense_evasion discovery evasion persistence ransomware
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

Threat Level: Likely malicious

The file https://cdn.discordapp.com/attachments/824221029240274995/1296988829957357669/JJSploit_8.10.7_x64-setup.exe?ex=6714f339&is=6713a1b9&hm=72f841359f4ee2c0dea65d59ca550ad724169a9e1fb75ee81982119970e22369& was found to be: Likely malicious.

Malicious Activity Summary

defense_evasion discovery evasion persistence ransomware

Downloads MZ/PE file

Disables Task Manager via registry modification

Executes dropped EXE

Enumerates connected drives

Legitimate hosting services abused for malware hosting/C2

Modifies WinLogon

Sets desktop wallpaper using registry

Drops file in Windows directory

Subvert Trust Controls: Mark-of-the-Web Bypass

Enumerates physical storage devices

Browser Information Discovery

Enumerates kernel/hardware configuration

Reads runtime system information

System Location Discovery: System Language Discovery

Enumerates system info in registry

Kills process with taskkill

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

NTFS ADS

Suspicious use of AdjustPrivilegeToken

Suspicious use of SendNotifyMessage

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Modifies data under HKEY_USERS

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-20 20:56

Signatures

N/A

Analysis: behavioral5

Detonation Overview

Submitted

2024-10-20 20:56

Reported

2024-10-20 20:57

Platform

debian9-mipsel-20240226-en

Command Line

N/A

Signatures

N/A

Processes

N/A

Network

N/A

Files

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-20 20:56

Reported

2024-10-20 20:58

Platform

win11-20241007-en

Max time kernel

72s

Max time network

83s

Command Line

"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/824221029240274995/1296988829957357669/JJSploit_8.10.7_x64-setup.exe?ex=6714f339&is=6713a1b9&hm=72f841359f4ee2c0dea65d59ca550ad724169a9e1fb75ee81982119970e22369&

Signatures

Disables Task Manager via registry modification

evasion

Downloads MZ/PE file

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\Downloads\000.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\B: C:\Users\Admin\Downloads\000.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\Downloads\000.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\Downloads\000.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\Downloads\000.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\Downloads\000.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\Downloads\000.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\Downloads\000.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\Downloads\000.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\Downloads\000.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\Downloads\000.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\Downloads\000.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\Downloads\000.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\Downloads\000.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\Downloads\000.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\Downloads\000.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\Downloads\000.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\Downloads\000.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\Downloads\000.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\Downloads\000.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\Downloads\000.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\Downloads\000.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\Downloads\000.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\Downloads\000.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0" C:\Users\Admin\Downloads\000.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Control Panel\Desktop\Wallpaper C:\Users\Admin\Downloads\000.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\SystemTemp C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Subvert Trust Controls: Mark-of-the-Web Bypass

defense_evasion
Description Indicator Process Target
File opened for modification C:\Users\Admin\Downloads\000.exe:Zone.Identifier C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Downloads\000.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133739314623405324" C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon C:\Users\Admin\Downloads\000.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile C:\Users\Admin\Downloads\000.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\icon.ico" C:\Users\Admin\Downloads\000.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4018527317-446799424-2810249686-1000\{B23F5604-21C2-4DC3-8B1F-69C30F14B483} C:\Users\Admin\Downloads\000.exe N/A

NTFS ADS

Description Indicator Process Target
File opened for modification C:\Users\Admin\Downloads\000.exe:Zone.Identifier C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\Downloads\000.exe N/A
N/A N/A C:\Users\Admin\Downloads\000.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3392 wrote to memory of 3400 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3392 wrote to memory of 3400 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3392 wrote to memory of 1736 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3392 wrote to memory of 1736 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3392 wrote to memory of 1736 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3392 wrote to memory of 1736 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3392 wrote to memory of 1736 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3392 wrote to memory of 1736 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3392 wrote to memory of 1736 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3392 wrote to memory of 1736 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3392 wrote to memory of 1736 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3392 wrote to memory of 1736 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3392 wrote to memory of 1736 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3392 wrote to memory of 1736 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3392 wrote to memory of 1736 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3392 wrote to memory of 1736 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3392 wrote to memory of 1736 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3392 wrote to memory of 1736 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3392 wrote to memory of 1736 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3392 wrote to memory of 1736 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3392 wrote to memory of 1736 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3392 wrote to memory of 1736 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3392 wrote to memory of 1736 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3392 wrote to memory of 1736 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3392 wrote to memory of 1736 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3392 wrote to memory of 1736 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3392 wrote to memory of 1736 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3392 wrote to memory of 1736 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3392 wrote to memory of 1736 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3392 wrote to memory of 1736 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3392 wrote to memory of 1736 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3392 wrote to memory of 1736 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3392 wrote to memory of 2384 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3392 wrote to memory of 2384 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3392 wrote to memory of 4560 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3392 wrote to memory of 4560 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3392 wrote to memory of 4560 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3392 wrote to memory of 4560 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3392 wrote to memory of 4560 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3392 wrote to memory of 4560 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3392 wrote to memory of 4560 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3392 wrote to memory of 4560 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3392 wrote to memory of 4560 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3392 wrote to memory of 4560 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3392 wrote to memory of 4560 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3392 wrote to memory of 4560 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3392 wrote to memory of 4560 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3392 wrote to memory of 4560 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3392 wrote to memory of 4560 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3392 wrote to memory of 4560 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3392 wrote to memory of 4560 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3392 wrote to memory of 4560 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3392 wrote to memory of 4560 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3392 wrote to memory of 4560 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3392 wrote to memory of 4560 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3392 wrote to memory of 4560 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3392 wrote to memory of 4560 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3392 wrote to memory of 4560 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3392 wrote to memory of 4560 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3392 wrote to memory of 4560 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3392 wrote to memory of 4560 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3392 wrote to memory of 4560 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3392 wrote to memory of 4560 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3392 wrote to memory of 4560 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

Processes

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/824221029240274995/1296988829957357669/JJSploit_8.10.7_x64-setup.exe?ex=6714f339&is=6713a1b9&hm=72f841359f4ee2c0dea65d59ca550ad724169a9e1fb75ee81982119970e22369&

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcb976cc40,0x7ffcb976cc4c,0x7ffcb976cc58

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1748,i,18424439682036735694,514286506125429395,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1700 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2040,i,18424439682036735694,514286506125429395,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2104 /prefetch:3

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2172,i,18424439682036735694,514286506125429395,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2204 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3076,i,18424439682036735694,514286506125429395,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3120 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3092,i,18424439682036735694,514286506125429395,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3148 /prefetch:1

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4496,i,18424439682036735694,514286506125429395,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4512 /prefetch:8

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4764,i,18424439682036735694,514286506125429395,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4836 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4956,i,18424439682036735694,514286506125429395,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4792 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4896,i,18424439682036735694,514286506125429395,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4976 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5172,i,18424439682036735694,514286506125429395,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5180 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=3488,i,18424439682036735694,514286506125429395,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5052 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=3440,i,18424439682036735694,514286506125429395,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3456 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=4768,i,18424439682036735694,514286506125429395,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5264 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=3256,i,18424439682036735694,514286506125429395,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5404 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5576,i,18424439682036735694,514286506125429395,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5588 /prefetch:8

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Users\Admin\Downloads\000.exe

"C:\Users\Admin\Downloads\000.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\windl.bat""

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im explorer.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic useraccount where name='Admin' set FullName='UR NEXT'

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic useraccount where name='Admin' rename 'UR NEXT'

C:\Windows\SysWOW64\shutdown.exe

shutdown /f /r /t 0

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x4 /state0:0xa3a0f855 /state1:0x41c64e6d

Network

Country Destination Domain Proto
US 8.8.8.8:53 cdn.discordapp.com udp
US 162.159.133.233:443 cdn.discordapp.com tcp
US 162.159.133.233:443 cdn.discordapp.com udp
US 35.190.80.1:443 a.nel.cloudflare.com tcp
US 35.190.80.1:443 a.nel.cloudflare.com udp
N/A 224.0.0.251:5353 udp
GB 142.250.200.36:443 www.google.com udp
GB 142.250.200.36:443 www.google.com tcp
GB 142.250.179.238:443 apis.google.com udp
GB 216.58.201.110:443 consent.google.com udp
GB 216.58.201.110:443 consent.google.com tcp
US 216.239.34.157:443 tunnel.googlezip.net tcp
US 216.239.34.157:443 tunnel.googlezip.net tcp
US 8.8.8.8:53 157.34.239.216.in-addr.arpa udp
GB 216.58.201.110:443 consent.google.com tcp
US 185.199.109.154:443 github.githubassets.com tcp
US 185.199.110.133:443 raw.githubusercontent.com tcp
US 185.199.109.154:443 github.githubassets.com tcp
US 185.199.109.154:443 github.githubassets.com tcp
US 185.199.109.154:443 github.githubassets.com tcp
US 185.199.109.154:443 github.githubassets.com tcp
US 185.199.109.154:443 github.githubassets.com tcp
GB 20.26.156.215:443 github.com tcp
GB 20.26.156.215:443 github.com tcp
GB 20.26.156.215:443 github.com tcp
GB 142.250.187.234:443 content-autofill.googleapis.com tcp
US 185.199.109.154:443 github.githubassets.com tcp
US 140.82.112.21:443 collector.github.com tcp
US 140.82.112.21:443 collector.github.com tcp
GB 20.26.156.210:443 api.github.com tcp
GB 142.250.187.234:443 content-autofill.googleapis.com udp
US 8.8.8.8:53 21.112.82.140.in-addr.arpa udp
US 185.199.111.133:443 raw.githubusercontent.com tcp
US 185.199.111.133:443 raw.githubusercontent.com tcp

Files

\??\pipe\crashpad_3392_FUTVWIKCANLVJKUB

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

MD5 3c964608e48cae1c387147f22bf47db3
SHA1 873734335d26815b39636feaac9677ae456f6a18
SHA256 a057e0881e9617128eb8c9758ccc87c6a3ed55fcb6db9d2332f9907e184221ea
SHA512 d70701fedf6e1494981eb66bcc6db723ccbb383cb19099fd17e5fbdd0a84ea75bd67aba2710587592aeebb32725382e7428819e38b7372d9a83f23433d744b43

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 8cd7a6d3290aaee510d5c514ba4a99be
SHA1 46a8b61c96a48eebde6eb474e89c2588f7074b01
SHA256 30c6aea41fe84455dcd68a4d87cf316603c729fec7cd7b0b01ed20ecee0db106
SHA512 d719d38ccaff2cb45fdc56c9e25c7eb69345e9fbcb137b695abb1919ce8b5b3957c97ea626a075f0889a71b640e706cc27b2174c19f91cc125e2f8eb499eaad7

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 bfa4ba86008db7d0ea2e76d3d2e1de99
SHA1 7d721cb32a5b4db0c876050602d93c4aadef875a
SHA256 be4f4341278107bc874fb3d447fc29d9f369ff285ec653d223efcc69da1074c5
SHA512 4cc8644df088b04b3091bed7d9a81b16c8f2a9266cd090f9d503e14e3bb12bc84c2b1c9d60c625d148681819083bcca66e38ccee17e52e811c4376edee2f5abc

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 1518e5ecc46bc3b0af322603c6fc5dea
SHA1 b893a6a3d6248535bbc4e524233342bf4a37985b
SHA256 581d325bf6ee68edef2f62314dd48baef2ec440cbc63afed28f21152a8d61be1
SHA512 69411e82e24be618540db78f617eadcb0144a76af12e114f9fb967e25e51a8926ad4ef7b04fdffdad2bbcdad9da7a98ab0957780352f4008c7143ee1d3c701bf

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 a2f2eceae7ddac987a242b747e7745e8
SHA1 df21fb252059e61da0f734d1127a31ec5c113d56
SHA256 737d6f8cf2729e95432ba5bf48f3aebce1bc66f387a34cb157018cab065608f1
SHA512 fbfc697eae674d36bbc0b89b9fd3f570a24d48e1cf0b79fd0e766b2292615feb5011494c244d42d4dd5e317e025d2cad38a0da5e365e164ffa78c58cf4e5da44

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 27db444c14480761b64664871aa5780e
SHA1 2481986e6eaba5b73175b363347d9e54825aac8e
SHA256 ae030e1deaea6ce36ed159bd99cd8291d831b3cfbf835a431c14b5abc7d8ab63
SHA512 7f6d3dbc76f05efb2a4042629b04fdb3b8f1e4414f0d444135f7d7e050c084ca272bbc4f29e7a99f2d264bafca971f6cb70156691e461be42d01289149f912ca

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 f17034db83fe29101ba9c9d02b106995
SHA1 0542eb90823f15a585b12447049df7cd65e49794
SHA256 c2b6b89559d0a3628a0393d03aaf37a634b0ef21482bb0b0c732a1c6b4a506a7
SHA512 704b6f7568c3753241834adaa4b2dbb5f3d9a024c32c56da117c4f3f324a81a460f57bb9dc4a3347df9a41c00f26693469efd5600b842c5f6ed669316c78749b

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 1d7b20de10ea1f9418c5c338fd200b2c
SHA1 38ff42a7df1374968cc3948657ac29fa4c1ca0c6
SHA256 743b0cf8a761d7a036461a12d2034c4db57b3e4c3f40a4cbe5613b4d6ec287b2
SHA512 be4571691cb333e6b3afa84272a60fadc0bc9458c0076b75ed168017dc5fab0bca2c725ff5099504c4a0c2bc3afcb0e3207adaa4b32d619bfd1020f18e0dfa56

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 b0f898df06b7dd7781c187bb3e25276e
SHA1 71f73e65ff7dc88397d651127a958e001bf7c0fb
SHA256 0a96925722e9acbc89806bd42201676143c70c25522063e24bd630402d65e1b6
SHA512 8791cf74ec1c53037cc5184604a1ff8cb1fa80f8d87075db96a4c38d28fca8ccf8f9095dcc96cd0e2916c56523980c8c372b50b6fc69d61765d9dcddd22f280c

C:\Users\Admin\Downloads\000.exe:Zone.Identifier

MD5 fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1 d59fc84cdd5217c6cf74785703655f78da6b582b
SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
SHA512 aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 6748fae89cf76d2aa3df8b3610e0bc71
SHA1 54ba94c7de86dea2da9b1ec4a9cc1101a0541505
SHA256 de681e5efe94a1afc2126e7f303fb2031c7d012de0eece65288e0b14a46ba968
SHA512 dbe9fa18e91eb11f817b87b2fba896f5d92d5acd28461d4592f14a991954e0e346b2326c68888fc5109ffd36be017dceda5f124af012e41cbd6fac0b6a1cc2e6

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 069cae70e9358bd48456cfff18d05d39
SHA1 7042fac958d9a6148a6f39e5eec008ae6693c01b
SHA256 01e84a7df63c330e130eb547239ff383b1074997195ca37f50430f2b2d814c70
SHA512 7981fe2269aa0c0b6585595775e1279828403d9d22fb11eabf69ecff22997936031668b7d498adc08d0e94cf442bd5e2b05c495c72b45bef83725189e992e3e6

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 9502c3ec526db8746de584a88880c70d
SHA1 9aa5a70257f819ebc90f05eaba81596d234c6479
SHA256 37ab22bb7c54c81b1cac69c1b79159a864c561e045414095e13fea55d1831c8f
SHA512 86dad6ed5d678324cfab84ac03856fe013371f93b3d145b4334516664e2e9018d7db1fc659143a261a9e3ffd2c7e515f6365abeeb19043447835faa1392f0a47

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 1266ad5f55c6ea76db502ae322b66899
SHA1 f003a97f81fb7c4ed8c78257d8c0a1a2b8f9f4e9
SHA256 5503ec361f31b765d505db1ddab6c681fcf8e1164d2286eb8c772bd9be77edaa
SHA512 74077c82981b2ca5d838ae51e2049c37b82b6ff82c10dda6bdd443838bab252e7836b72a8ad4c3a77f8263f761d4f8fcf2cb8937afd744eda4b29e9da990614d

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 87e23c695908965e968e152ee784d836
SHA1 733424b4301160d14fc0b2e7bcc121d1580027c0
SHA256 30d3c0fd47eb7fb5a7418ce818d1c6c17ebb1a89dff1d1f73a870f3b553111a3
SHA512 b933b2469533482d8a615c07f9f68c561a9e10c50d0a85c2402482b6391f4e85769685331b9f9e4e030f0c42495d18229941d73e94e1a42939bedcbcd17ccca7

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1

MD5 36c632c3fad8f53ec8367a30c2c9b4dc
SHA1 f3d8cf596323c28fd3a97ff023e1edabe1085442
SHA256 0eb6237fdb050b4f08ffaf624aee8f12f51f74e2b018f18556e043cda3a63df6
SHA512 f519bd55930d80d42545fd8eabed2e2c8bb39b7c59f0bef7900caefdecabde5cf48cd90d9a7098ee3a736259a70bef3f8f47090634cc5936a946f3d09a93880b

C:\Users\Admin\Downloads\000.exe

MD5 d5671758956b39e048680b6a8275e96a
SHA1 33c341130bf9c93311001a6284692c86fec200ef
SHA256 4a900b344ef765a66f98cf39ac06273d565ca0f5d19f7ea4ca183786155d4a47
SHA512 972e89ed8b7b4d75df0a05c53e71fb5c29edaa173d7289656676b9d2a1ed439be1687beddc6fb1fbf068868c3da9c3d2deb03b55e5ab5e7968858b5efc49fbe7

memory/2288-416-0x000000007472E000-0x000000007472F000-memory.dmp

memory/2288-417-0x00000000009D0000-0x000000000107E000-memory.dmp

memory/2288-418-0x0000000074720000-0x0000000074ED1000-memory.dmp

memory/2288-419-0x00000000061B0000-0x0000000006756000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\windl.bat

MD5 a9401e260d9856d1134692759d636e92
SHA1 4141d3c60173741e14f36dfe41588bb2716d2867
SHA256 b551fba71dfd526d4916ae277d8686d83fff36d22fcf6f18457924a070b30ef7
SHA512 5cbe38cdab0283b87d9a9875f7ba6fa4e8a7673d933ca05deddddbcf6cf793bd1bf34ac0add798b4ed59ab483e49f433ce4012f571a658bc0add28dd987a57b6

memory/2288-427-0x0000000074720000-0x0000000074ED1000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

memory/2288-438-0x000000000B960000-0x000000000B998000-memory.dmp

memory/2288-439-0x000000000B930000-0x000000000B93E000-memory.dmp

memory/2288-445-0x000000000B9D0000-0x000000000B9E0000-memory.dmp

memory/2288-444-0x000000000B9D0000-0x000000000B9E0000-memory.dmp

memory/2288-443-0x000000000B9D0000-0x000000000B9E0000-memory.dmp

memory/2288-442-0x000000000B9D0000-0x000000000B9E0000-memory.dmp

memory/2288-449-0x000000000B9D0000-0x000000000B9E0000-memory.dmp

memory/2288-450-0x000000000BD70000-0x000000000BD80000-memory.dmp

memory/2288-448-0x000000000B9D0000-0x000000000B9E0000-memory.dmp

memory/2288-447-0x000000000BD70000-0x000000000BD80000-memory.dmp

memory/2288-446-0x000000000BD70000-0x000000000BD80000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

MD5 49378ebca9eee3209637225717702414
SHA1 0fb8c4568992c1ed04a912c406cd8301016a6b7c
SHA256 275ad09b940cf730e7a28519d8dfbb3642eee40b62f26de14eb9916b7f57d1c0
SHA512 60f5e270d56856e164b04f53bcad8e227401b034c09268f1ea07affb45f2f71e0f23018efeeb61fdfd8ad97a5d2e78449162ddceae9821ef1b56006e377d784a

C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

MD5 6c4085fb131d1d9d5cdd4b16ceef397a
SHA1 e6eea0341b56a19b470c69c9a61ba0f285dda230
SHA256 ef483036d6769d95b033d2fbdbe29ed7547477ce3d52f0a3007ad5b2383d4bad
SHA512 706f380d2c19de726deb4873ee8dc5acb1b0492bc08adc40a2665bbcc72b49e5673abe5b1f48d421dc27810c4aeef2b4e244112897820abb52c53ea9ecb29a64

C:\Users\Admin\AppData\Local\Temp\rniw.exe

MD5 9232120b6ff11d48a90069b25aa30abc
SHA1 97bb45f4076083fca037eee15d001fd284e53e47
SHA256 70faa0e1498461731f873d3594f20cbf2beaa6f123a06b66f9df59a9cdf862be
SHA512 b06688a9fc0b853d2895f11e812c48d5871f2793183fda5e9638ded22fc5dc1e813f174baedc980a1f0b6a7b0a65cd61f29bb16acc6dd45da62988eb012d6877

C:\Users\Admin\Desktop\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N1XT.txt

MD5 9037ebf0a18a1c17537832bc73739109
SHA1 1d951dedfa4c172a1aa1aae096cfb576c1fb1d60
SHA256 38c889b5d7bdcb79bbcb55554c520a9ce74b5bfc29c19d1e4cb1419176c99f48
SHA512 4fb5c06089524c6dcd48b6d165cedb488e9efe2d27613289ef8834dbb6c010632d2bd5e3ac75f83b1d8024477ebdf05b9e0809602bbe1780528947c36e4de32f

C:\Users\Admin\AppData\Local\Temp\one.rtf

MD5 6fbd6ce25307749d6e0a66ebbc0264e7
SHA1 faee71e2eac4c03b96aabecde91336a6510fff60
SHA256 e152b106733d9263d3cf175f0b6197880d70acb753f8bde8035a3e4865b31690
SHA512 35a0d6d91178ec10619cf4d2fd44d3e57aa0266e1779e15b1eef6e9c359c77c384e0ffe4edb2cde980a6847e53f47733e6eacb72d46762066b3541dee3d29064

memory/2288-1272-0x000000007472E000-0x000000007472F000-memory.dmp

memory/2288-1273-0x0000000074720000-0x0000000074ED1000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-20 20:56

Reported

2024-10-20 21:02

Platform

ubuntu1804-amd64-20240729-en

Max time kernel

0s

Max time network

281s

Command Line

[xdg-open https://cdn.discordapp.com/attachments/824221029240274995/1296988829957357669/JJSploit_8.10.7_x64-setup.exe?ex=6714f339&is=6713a1b9&hm=72f841359f4ee2c0dea65d59ca550ad724169a9e1fb75ee81982119970e22369&]

Signatures

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A

Enumerates kernel/hardware configuration

discovery
Description Indicator Process Target
File opened for reading /sys/bus/pci/devices/0000:00:03.0/resource /usr/lib/firefox/firefox N/A
File opened for reading /sys/bus/pci/devices/0000:00:03.0/vendor /usr/lib/firefox/firefox N/A
File opened for reading /sys/bus/pci/devices/0000:00:06.0/vendor /usr/lib/firefox/firefox N/A
File opened for reading /sys/bus/pci/devices/0000:00:05.0/device /usr/lib/firefox/firefox N/A
File opened for reading /sys/bus/pci/devices/0000:00:01.1/resource /usr/lib/firefox/firefox N/A
File opened for reading /sys/bus/pci/devices/0000:00:04.0/irq /usr/lib/firefox/firefox N/A
File opened for reading /sys/bus/pci/devices/0000:00:00.0/class /usr/lib/firefox/firefox N/A
File opened for reading /sys/bus/pci/devices/0000:00:06.0/device /usr/lib/firefox/firefox N/A
File opened for reading /sys/bus/pci/devices/0000:00:01.0/device /usr/lib/firefox/firefox N/A
File opened for reading /sys/bus/pci/devices/0000:00:00.0/resource /usr/lib/firefox/firefox N/A
File opened for reading /sys/bus/pci/devices/0000:00:06.0/resource /usr/lib/firefox/firefox N/A
File opened for reading /sys/bus/pci/devices/0000:00:01.0/vendor /usr/lib/firefox/firefox N/A
File opened for reading /sys/bus/pci/devices/0000:00:01.3/class /usr/lib/firefox/firefox N/A
File opened for reading /sys/bus/pci/devices/0000:00:06.0/class /usr/lib/firefox/firefox N/A
File opened for reading /sys/bus/pci/devices/0000:00:02.0/class /usr/lib/firefox/firefox N/A
File opened for reading /sys/bus/pci/devices/0000:00:04.0/class /usr/lib/firefox/firefox N/A
File opened for reading /sys/bus/pci/devices/0000:00:02.0/class /usr/lib/firefox/firefox N/A
File opened for reading /sys/bus/pci/devices/0000:00:01.0/irq /usr/lib/firefox/firefox N/A
File opened for reading /sys/bus/pci/devices/0000:00:04.0/resource /usr/lib/firefox/firefox N/A
File opened for reading /sys/bus/pci/devices/0000:00:00.0/vendor /usr/lib/firefox/firefox N/A
File opened for reading /sys/bus/pci/devices/0000:00:00.0/device /usr/lib/firefox/firefox N/A
File opened for reading /sys/bus/pci/devices/0000:00:03.0/class /usr/lib/firefox/firefox N/A
File opened for reading /sys/bus/pci/devices/0000:00:02.0/vendor /usr/lib/firefox/firefox N/A
File opened for reading /sys/bus/pci/devices/0000:00:00.0/resource /usr/lib/firefox/firefox N/A
File opened for reading /sys/bus/pci/devices/0000:00:03.0/vendor /usr/lib/firefox/firefox N/A
File opened for reading /sys/bus/pci/devices/0000:00:02.0/device /usr/lib/firefox/firefox N/A
File opened for reading /sys/bus/pci/devices/0000:00:00.0/irq /usr/lib/firefox/firefox N/A
File opened for reading /sys/bus/pci/devices/0000:00:03.0/vendor /usr/lib/firefox/firefox N/A
File opened for reading /sys/bus/pci/devices/0000:00:06.0/device /usr/lib/firefox/firefox N/A
File opened for reading /sys/bus/pci/devices/0000:00:02.0/resource /usr/lib/firefox/firefox N/A
File opened for reading /sys/bus/pci/devices/0000:00:03.0/resource /usr/lib/firefox/firefox N/A
File opened for reading /sys/bus/pci/devices/0000:00:01.0/device /usr/lib/firefox/firefox N/A
File opened for reading /sys/bus/pci/devices/0000:00:00.0/class /usr/lib/firefox/firefox N/A
File opened for reading /sys/bus/pci/devices/0000:00:01.3/resource /usr/lib/firefox/firefox N/A
File opened for reading /sys/bus/pci/devices/0000:00:01.3/irq /usr/lib/firefox/firefox N/A
File opened for reading /sys/bus/pci/devices/0000:00:01.1/irq /usr/lib/firefox/firefox N/A
File opened for reading /sys/bus/pci/devices/0000:00:01.1/vendor /usr/lib/firefox/firefox N/A
File opened for reading /sys/bus/pci/devices/0000:00:01.3/vendor /usr/lib/firefox/firefox N/A
File opened for reading /sys/bus/pci/devices/0000:00:01.1/device /usr/lib/firefox/firefox N/A
File opened for reading /sys/bus/pci/devices/0000:00:00.0/class /usr/lib/firefox/firefox N/A
File opened for reading /sys/bus/pci/devices/0000:00:04.0/irq /usr/lib/firefox/firefox N/A
File opened for reading /sys/bus/pci/devices/0000:00:00.0/vendor /usr/lib/firefox/firefox N/A
File opened for reading /sys/bus/pci/devices/0000:00:05.0/irq /usr/lib/firefox/firefox N/A
File opened for reading /sys/bus/pci/devices/0000:00:01.1/resource /usr/lib/firefox/firefox N/A
File opened for reading /sys/bus/pci/devices/0000:00:05.0/vendor /usr/lib/firefox/firefox N/A
File opened for reading /sys/bus/pci/devices/0000:00:06.0/vendor /usr/lib/firefox/firefox N/A
File opened for reading /sys/bus/pci/devices/0000:00:05.0/class /usr/lib/firefox/firefox N/A
File opened for reading /sys/bus/pci/devices/0000:00:01.1/vendor /usr/lib/firefox/firefox N/A
File opened for reading /sys/bus/pci/devices/0000:00:03.0/resource /usr/lib/firefox/firefox N/A
File opened for reading /sys/bus/pci/devices/0000:00:02.0/resource /usr/lib/firefox/firefox N/A
File opened for reading /sys/bus/pci/devices/0000:00:01.0/resource /usr/lib/firefox/firefox N/A
File opened for reading /sys/bus/pci/devices/0000:00:01.0/vendor /usr/lib/firefox/firefox N/A
File opened for reading /sys/bus/pci/devices/0000:00:01.0/class /usr/lib/firefox/firefox N/A
File opened for reading /sys/bus/pci/devices/0000:00:04.0/class /usr/lib/firefox/firefox N/A
File opened for reading /sys/bus/pci/devices/0000:00:01.0/vendor /usr/lib/firefox/firefox N/A
File opened for reading /sys/bus/pci/devices/0000:00:06.0/vendor /usr/lib/firefox/firefox N/A
File opened for reading /sys/bus/pci/devices/0000:00:04.0/irq /usr/lib/firefox/firefox N/A
File opened for reading /sys/bus/pci/devices/0000:00:05.0/vendor /usr/lib/firefox/firefox N/A
File opened for reading /sys/bus/pci/devices/0000:00:05.0/resource /usr/lib/firefox/firefox N/A
File opened for reading /sys/bus/pci/devices/0000:00:01.3/device /usr/lib/firefox/firefox N/A
File opened for reading /sys/bus/pci/devices/0000:00:06.0/irq /usr/lib/firefox/firefox N/A
File opened for reading /sys/bus/pci/devices/0000:00:01.1/vendor /usr/lib/firefox/firefox N/A
File opened for reading /sys/bus/pci/devices/0000:00:00.0/device /usr/lib/firefox/firefox N/A
File opened for reading /sys/bus/pci/devices/0000:00:06.0/resource /usr/lib/firefox/firefox N/A

Reads runtime system information

discovery
Description Indicator Process Target
File opened for reading /proc/filesystems /usr/lib/firefox/firefox N/A
File opened for reading /proc/filesystems /bin/sed N/A
File opened for reading /proc/self/fd /usr/bin/dbus-send N/A
File opened for reading /proc/filesystems /bin/sed N/A
File opened for reading /proc/filesystems /bin/sed N/A
File opened for reading /proc/filesystems /usr/lib/firefox/firefox N/A
File opened for reading /proc/self/stat /usr/lib/firefox/firefox N/A
File opened for reading /proc/filesystems /bin/sed N/A
File opened for reading /proc/filesystems /bin/sed N/A
File opened for reading /proc/self/task/1655/stat /usr/lib/firefox/firefox N/A
File opened for reading /proc/self/stat /usr/lib/firefox/firefox N/A
File opened for reading /proc/filesystems /usr/lib/firefox/firefox N/A
File opened for reading /proc/self/stat /usr/lib/firefox/firefox N/A
File opened for reading /proc/self/fd /usr/bin/dbus-send N/A
File opened for reading /proc/self/task/1668/stat /usr/lib/firefox/firefox N/A
File opened for reading /proc/self/task/1681/stat /usr/lib/firefox/firefox N/A

Processes

/usr/bin/xdg-open

[xdg-open https://cdn.discordapp.com/attachments/824221029240274995/1296988829957357669/JJSploit_8.10.7_x64-setup.exe?ex=6714f339&is=6713a1b9&hm=72f841359f4ee2c0dea65d59ca550ad724169a9e1fb75ee81982119970e22369&]

/usr/bin/dbus-send

[dbus-send --print-reply --dest=org.freedesktop.DBus /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager]

/usr/bin/dbus-launch

[dbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr]

/bin/grep

[grep = \"xfce4\"$]

/usr/bin/xprop

[xprop -root _DT_SAVE_MODE]

/bin/grep

[grep -i ^xfce_desktop_window]

/usr/bin/xprop

[xprop -root]

/bin/grep

[grep -q ^Enlightenment]

/bin/uname

[uname]

/bin/grep

[grep -q ^file://]

/bin/egrep

[egrep -q ^[[:alpha:]+\.\-]+:]

/usr/local/sbin/grep

[grep -E -q ^[[:alpha:]+\.\-]+:]

/usr/local/bin/grep

[grep -E -q ^[[:alpha:]+\.\-]+:]

/usr/sbin/grep

[grep -E -q ^[[:alpha:]+\.\-]+:]

/usr/bin/grep

[grep -E -q ^[[:alpha:]+\.\-]+:]

/sbin/grep

[grep -E -q ^[[:alpha:]+\.\-]+:]

/bin/grep

[grep -E -q ^[[:alpha:]+\.\-]+:]

/bin/sed

[sed -n s/\(^[[:alnum:]+\.-]*\):.*$/\1/p]

/usr/bin/xdg-mime

[xdg-mime query default x-scheme-handler/https]

/usr/bin/dbus-send

[dbus-send --print-reply --dest=org.freedesktop.DBus /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager]

/usr/bin/dbus-launch

[dbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr]

/bin/grep

[grep = \"xfce4\"$]

/usr/bin/xprop

[xprop -root _DT_SAVE_MODE]

/usr/bin/xprop

[xprop -root]

/bin/grep

[grep -i ^xfce_desktop_window]

/bin/grep

[grep -q ^Enlightenment]

/bin/uname

[uname]

/bin/sed

[sed s/:/ /g]

/usr/bin/cut

[cut -d ; -f 1]

/usr/bin/cut

[cut -d = -f 2]

/usr/bin/head

[head -n 1]

/bin/grep

[grep x-scheme-handler/https= /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache]

/usr/bin/cut

[cut -d ; -f 1]

/usr/bin/cut

[cut -d = -f 2]

/usr/bin/head

[head -n 1]

/bin/grep

[grep x-scheme-handler/https= /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache]

/usr/bin/cut

[cut -d ; -f 1]

/usr/bin/cut

[cut -d = -f 2]

/usr/bin/head

[head -n 1]

/bin/grep

[grep x-scheme-handler/https= /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache]

/usr/bin/cut

[cut -d ; -f 1]

/usr/bin/cut

[cut -d = -f 2]

/usr/bin/head

[head -n 1]

/bin/grep

[grep x-scheme-handler/https= /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache]

/usr/bin/cut

[cut -d ; -f 1]

/usr/bin/cut

[cut -d = -f 2]

/usr/bin/head

[head -n 1]

/bin/grep

[grep x-scheme-handler/https= /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache]

/bin/sed

[sed s/:/ /g]

/bin/sed

[sed -e s|-|/|]

/bin/sed

[sed -e s|-|/|]

/usr/bin/cut

[cut -d= -f 2-]

/usr/bin/which

[which firefox]

/usr/bin/cut

[cut -d= -f 2-]

/usr/bin/cut

[cut -d= -f 2-]

/usr/bin/cut

[cut -d= -f 2-]

/usr/bin/firefox

[/usr/bin/firefox https://cdn.discordapp.com/attachments/824221029240274995/1296988829957357669/JJSploit_8.10.7_x64-setup.exe?ex=6714f339&is=6713a1b9&hm=72f841359f4ee2c0dea65d59ca550ad724169a9e1fb75ee81982119970e22369&]

/usr/bin/which

[which /usr/bin/firefox]

/usr/lib/firefox/firefox

[/usr/lib/firefox/firefox https://cdn.discordapp.com/attachments/824221029240274995/1296988829957357669/JJSploit_8.10.7_x64-setup.exe?ex=6714f339&is=6713a1b9&hm=72f841359f4ee2c0dea65d59ca550ad724169a9e1fb75ee81982119970e22369&]

/bin/grep

[grep -q %s]

/usr/bin/x-www-browser

[x-www-browser https://cdn.discordapp.com/attachments/824221029240274995/1296988829957357669/JJSploit_8.10.7_x64-setup.exe?ex=6714f339&is=6713a1b9&hm=72f841359f4ee2c0dea65d59ca550ad724169a9e1fb75ee81982119970e22369&]

/usr/bin/which

[which /usr/bin/x-www-browser]

/usr/lib/firefox/firefox

[/usr/lib/firefox/firefox https://cdn.discordapp.com/attachments/824221029240274995/1296988829957357669/JJSploit_8.10.7_x64-setup.exe?ex=6714f339&is=6713a1b9&hm=72f841359f4ee2c0dea65d59ca550ad724169a9e1fb75ee81982119970e22369&]

/bin/grep

[grep -q %s]

/usr/bin/firefox

[firefox https://cdn.discordapp.com/attachments/824221029240274995/1296988829957357669/JJSploit_8.10.7_x64-setup.exe?ex=6714f339&is=6713a1b9&hm=72f841359f4ee2c0dea65d59ca550ad724169a9e1fb75ee81982119970e22369&]

/usr/bin/which

[which /usr/bin/firefox]

/usr/lib/firefox/firefox

[/usr/lib/firefox/firefox https://cdn.discordapp.com/attachments/824221029240274995/1296988829957357669/JJSploit_8.10.7_x64-setup.exe?ex=6714f339&is=6713a1b9&hm=72f841359f4ee2c0dea65d59ca550ad724169a9e1fb75ee81982119970e22369&]

/bin/grep

[grep -q %s]

/bin/grep

[grep -q %s]

/bin/grep

[grep -q %s]

/bin/grep

[grep -q %s]

/bin/grep

[grep -q %s]

/bin/grep

[grep -q %s]

/bin/grep

[grep -q %s]

/bin/grep

[grep -q %s]

/bin/grep

[grep -q %s]

/bin/grep

[grep -q %s]

/bin/grep

[grep -q %s]

/bin/grep

[grep -q %s]

/bin/grep

[grep -q %s]

/bin/grep

[grep -q %s]

Network

Country Destination Domain Proto
GB 185.125.188.62:443 tcp
GB 185.125.188.62:443 tcp
US 151.101.193.91:443 tcp
US 151.101.193.91:443 tcp
N/A 224.0.0.251:5353 udp
GB 84.17.50.8:443 tcp
US 1.1.1.1:53 1527653184.rsc.cdn77.org udp
US 1.1.1.1:53 1527653184.rsc.cdn77.org udp
GB 84.17.50.8:443 1527653184.rsc.cdn77.org tcp
US 1.1.1.1:53 spocs.getpocket.com udp
US 1.1.1.1:53 spocs.getpocket.com udp
US 1.1.1.1:53 getpocket.cdn.mozilla.net udp
US 1.1.1.1:53 getpocket.cdn.mozilla.net udp
US 1.1.1.1:53 prod.ads.prod.webservices.mozgcp.net udp
US 34.120.5.221:443 getpocket.cdn.mozilla.net tcp
US 1.1.1.1:53 prod.remote-settings.prod.webservices.mozgcp.net udp
US 1.1.1.1:53 shavar.prod.mozaws.net udp
US 1.1.1.1:53 prod.remote-settings.prod.webservices.mozgcp.net udp
US 1.1.1.1:53 tracking-protection.cdn.mozilla.net udp
US 1.1.1.1:53 tracking-protection.cdn.mozilla.net udp
US 1.1.1.1:53 tracking-protection.prod.mozaws.net udp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 1.1.1.1:53 www.google.com udp
US 1.1.1.1:53 www.google.com udp
GB 142.250.178.4:443 www.google.com tcp
GB 142.250.178.4:443 www.google.com udp
US 1.1.1.1:53 csp.withgoogle.com udp
US 1.1.1.1:53 csp.withgoogle.com udp
GB 216.58.201.113:443 csp.withgoogle.com tcp
GB 216.58.201.113:443 csp.withgoogle.com udp
US 1.1.1.1:53 play.google.com udp
US 1.1.1.1:53 play.google.com udp
GB 142.250.180.14:443 play.google.com tcp
GB 142.250.180.14:443 play.google.com udp
US 1.1.1.1:53 ogads-pa.googleapis.com udp
US 1.1.1.1:53 ogads-pa.googleapis.com udp
GB 142.250.179.234:443 ogads-pa.googleapis.com tcp
GB 142.250.179.234:443 ogads-pa.googleapis.com tcp
GB 142.250.179.234:443 ogads-pa.googleapis.com udp
US 1.1.1.1:53 consent.google.com udp
US 1.1.1.1:53 consent.google.com udp
GB 172.217.169.46:443 consent.google.com tcp
GB 172.217.169.46:443 consent.google.com udp
US 1.1.1.1:53 id.google.com udp
US 1.1.1.1:53 id.google.com udp
MX 192.178.56.195:443 id.google.com tcp
GB 216.58.201.113:443 csp.withgoogle.com udp
MX 192.178.56.195:443 id.google.com udp
GB 142.250.179.234:443 ogads-pa.googleapis.com udp
US 1.1.1.1:53 github.com udp
US 1.1.1.1:53 github.com udp
GB 20.26.156.215:443 github.com tcp
US 1.1.1.1:53 github.githubassets.com udp
US 1.1.1.1:53 github.githubassets.com udp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 1.1.1.1:53 collector.github.com udp
US 1.1.1.1:53 collector.github.com udp
US 1.1.1.1:53 glb-db52c2cf8be544.github.com udp
US 140.82.114.22:443 collector.github.com tcp
US 1.1.1.1:53 api.github.com udp
US 1.1.1.1:53 api.github.com udp
GB 20.26.156.210:443 api.github.com tcp
US 1.1.1.1:53 location.services.mozilla.com udp
US 1.1.1.1:53 location.services.mozilla.com udp
US 1.1.1.1:53 prod.balrog.prod.cloudops.mozgcp.net udp
US 1.1.1.1:53 prod.classify-client.prod.webservices.mozgcp.net udp
US 35.190.72.216:443 location.services.mozilla.com tcp
US 35.190.72.216:443 location.services.mozilla.com tcp
US 35.190.72.216:443 location.services.mozilla.com udp
US 1.1.1.1:53 archive.mozilla.org udp
US 1.1.1.1:53 archive.mozilla.org udp
US 34.117.35.28:443 archive.mozilla.org tcp
US 1.1.1.1:53 ciscobinary.openh264.org udp
US 1.1.1.1:53 ciscobinary.openh264.org udp
GB 88.221.134.209:80 ciscobinary.openh264.org tcp
US 34.117.35.28:443 archive.mozilla.org udp
GB 142.250.178.4:443 www.google.com udp
MX 192.178.56.195:443 id.google.com udp
GB 216.58.201.113:443 csp.withgoogle.com udp
GB 142.250.180.14:443 play.google.com udp
US 1.1.1.1:53 m.majorgeeks.com udp
US 1.1.1.1:53 m.majorgeeks.com udp
US 51.81.2.247:443 m.majorgeeks.com tcp
US 1.1.1.1:53 www.majorgeeks.com udp
US 1.1.1.1:53 www.majorgeeks.com udp
US 51.81.2.245:443 www.majorgeeks.com tcp
GB 142.250.179.234:443 ogads-pa.googleapis.com udp
US 51.81.2.245:443 www.majorgeeks.com tcp
US 51.81.2.245:443 www.majorgeeks.com tcp
US 1.1.1.1:53 ra.majorgeeks.com udp
US 1.1.1.1:53 ra.majorgeeks.com udp
US 51.81.2.245:443 www.majorgeeks.com tcp
US 1.1.1.1:53 platform-api.sharethis.com udp
US 1.1.1.1:53 platform-api.sharethis.com udp
GB 142.250.178.4:443 www.google.com tcp
US 1.1.1.1:53 apis.google.com udp
US 1.1.1.1:53 apis.google.com udp
US 1.1.1.1:53 cdn-images.mailchimp.com udp
US 1.1.1.1:53 cdn-images.mailchimp.com udp
US 51.81.2.245:443 www.majorgeeks.com tcp
US 1.1.1.1:53 img.buymeacoffee.com udp
US 1.1.1.1:53 img.buymeacoffee.com udp
US 1.1.1.1:53 dbhkt46el5ri0.cloudfront.net udp
GB 18.172.153.106:443 platform-api.sharethis.com tcp
GB 172.217.16.238:443 apis.google.com tcp
US 1.1.1.1:53 api.majorgeeks.com udp
US 1.1.1.1:53 api.majorgeeks.com udp
GB 18.245.187.33:443 cdn-images.mailchimp.com tcp
US 51.81.2.248:443 ra.majorgeeks.com tcp
US 51.81.2.248:443 ra.majorgeeks.com tcp
US 51.81.2.252:443 api.majorgeeks.com tcp
GB 142.250.178.4:443 www.google.com udp
GB 172.217.16.238:443 apis.google.com udp
GB 18.245.187.33:443 cdn-images.mailchimp.com udp
US 1.1.1.1:53 region1.analytics.google.com udp
US 1.1.1.1:53 region1.analytics.google.com udp
US 1.1.1.1:53 stats.g.doubleclick.net udp
US 1.1.1.1:53 stats.g.doubleclick.net udp
US 1.1.1.1:53 www.google.co.uk udp
US 1.1.1.1:53 www.google.co.uk udp
US 216.239.34.36:443 region1.analytics.google.com tcp
BE 108.177.15.155:443 stats.g.doubleclick.net tcp
GB 172.217.169.3:443 www.google.co.uk tcp
US 216.239.34.36:443 region1.analytics.google.com tcp
BE 108.177.15.155:443 stats.g.doubleclick.net tcp
GB 172.217.169.3:443 www.google.co.uk tcp
GB 172.217.169.3:443 www.google.co.uk udp
BE 108.177.15.155:443 stats.g.doubleclick.net udp
US 216.239.34.36:443 region1.analytics.google.com udp
US 1.1.1.1:53 connect.facebook.net udp
US 1.1.1.1:53 connect.facebook.net udp
US 104.26.3.199:443 img.buymeacoffee.com tcp
US 51.81.2.245:443 www.majorgeeks.com tcp
US 104.26.3.199:443 img.buymeacoffee.com udp
US 1.1.1.1:53 cse.google.com udp
US 1.1.1.1:53 cse.google.com udp
GB 142.250.200.46:443 cse.google.com tcp
GB 142.250.200.46:443 cse.google.com udp
US 1.1.1.1:53 buttons-config.sharethis.com udp
US 1.1.1.1:53 buttons-config.sharethis.com udp
US 1.1.1.1:53 l.sharethis.com udp
US 1.1.1.1:53 l.sharethis.com udp
US 1.1.1.1:53 majorgeekscom.disqus.com udp
US 1.1.1.1:53 majorgeekscom.disqus.com udp
GB 18.245.143.111:443 buttons-config.sharethis.com tcp
US 1.1.1.1:53 httplogserver-lb.global.unified-prod.sharethis.net udp
US 1.1.1.1:53 prod.disqus.map.fastlylb.net udp
IE 34.241.118.49:443 l.sharethis.com tcp
US 199.232.196.134:443 majorgeekscom.disqus.com tcp
US 1.1.1.1:53 clients1.google.com udp
US 1.1.1.1:53 clients1.google.com udp
GB 216.58.213.14:443 clients1.google.com tcp
US 1.1.1.1:53 fundingchoicesmessages.google.com udp
US 1.1.1.1:53 fundingchoicesmessages.google.com udp
GB 142.250.180.14:443 fundingchoicesmessages.google.com tcp
GB 216.58.213.14:443 clients1.google.com udp
GB 142.250.180.14:443 fundingchoicesmessages.google.com udp
US 1.1.1.1:53 platform-cdn.sharethis.com udp
US 1.1.1.1:53 platform-cdn.sharethis.com udp
US 1.1.1.1:53 count-server.sharethis.com udp
US 1.1.1.1:53 count-server.sharethis.com udp
GB 18.165.201.52:443 platform-cdn.sharethis.com tcp
GB 18.165.201.52:443 platform-cdn.sharethis.com tcp
GB 18.165.201.52:443 platform-cdn.sharethis.com tcp
GB 18.165.201.52:443 platform-cdn.sharethis.com tcp
GB 18.165.201.52:443 platform-cdn.sharethis.com tcp
GB 18.165.201.52:443 platform-cdn.sharethis.com tcp
GB 18.154.84.47:443 count-server.sharethis.com tcp
US 1.1.1.1:53 disqus.com udp
US 1.1.1.1:53 disqus.com udp
US 151.101.128.134:443 disqus.com tcp
US 51.81.2.248:443 ra.majorgeeks.com tcp
US 51.81.2.248:443 ra.majorgeeks.com tcp
US 51.81.2.248:443 ra.majorgeeks.com tcp
US 51.81.2.248:443 ra.majorgeeks.com tcp
US 1.1.1.1:53 lh3.googleusercontent.com udp
US 1.1.1.1:53 lh3.googleusercontent.com udp
GB 142.250.187.225:443 lh3.googleusercontent.com tcp
GB 142.250.187.225:443 lh3.googleusercontent.com udp
US 1.1.1.1:53 c.disquscdn.com udp
US 1.1.1.1:53 c.disquscdn.com udp
GB 216.137.44.100:443 c.disquscdn.com tcp
GB 216.137.44.100:443 c.disquscdn.com tcp
GB 157.240.214.11:443 connect.facebook.net tcp
GB 157.240.214.11:443 connect.facebook.net udp
US 1.1.1.1:53 www.facebook.com udp
US 1.1.1.1:53 www.facebook.com udp
GB 163.70.147.35:443 www.facebook.com tcp
GB 163.70.147.35:443 www.facebook.com udp
US 1.1.1.1:53 referrer.disqus.com udp
US 1.1.1.1:53 referrer.disqus.com udp
US 151.101.128.134:443 disqus.com tcp
US 199.232.192.134:443 referrer.disqus.com tcp
US 1.1.1.1:53 googleads.g.doubleclick.net udp
US 1.1.1.1:53 googleads.g.doubleclick.net udp
GB 142.250.179.226:443 googleads.g.doubleclick.net tcp
GB 142.250.179.226:443 googleads.g.doubleclick.net tcp
US 1.1.1.1:53 ep1.adtrafficquality.google udp
US 1.1.1.1:53 ep1.adtrafficquality.google udp
GB 142.250.180.2:443 ep1.adtrafficquality.google tcp
GB 142.250.179.226:443 googleads.g.doubleclick.net udp
GB 142.250.180.2:443 ep1.adtrafficquality.google udp
US 1.1.1.1:53 ep2.adtrafficquality.google udp
US 1.1.1.1:53 ep2.adtrafficquality.google udp
US 1.1.1.1:53 tpc.googlesyndication.com udp
US 1.1.1.1:53 tpc.googlesyndication.com udp
GB 216.58.201.97:443 tpc.googlesyndication.com tcp
GB 216.58.201.97:443 tpc.googlesyndication.com tcp
GB 216.58.201.97:443 tpc.googlesyndication.com udp
GB 216.58.201.97:443 tpc.googlesyndication.com tcp
GB 216.58.201.97:443 tpc.googlesyndication.com udp
US 1.1.1.1:53 connectivity-check.ubuntu.com udp
US 1.1.1.1:53 connectivity-check.ubuntu.com udp
GB 185.125.190.48:80 connectivity-check.ubuntu.com tcp
US 51.81.2.245:443 www.majorgeeks.com tcp
US 51.81.2.248:443 ra.majorgeeks.com tcp
US 51.81.2.248:443 ra.majorgeeks.com tcp
US 51.81.2.245:443 www.majorgeeks.com tcp
US 1.1.1.1:53 ajax.googleapis.com udp
US 1.1.1.1:53 ajax.googleapis.com udp
US 51.81.2.245:443 www.majorgeeks.com tcp
US 51.81.2.245:443 www.majorgeeks.com tcp
US 51.81.2.245:443 www.majorgeeks.com tcp
US 51.81.2.245:443 www.majorgeeks.com tcp
US 51.81.2.245:443 www.majorgeeks.com tcp
GB 216.58.204.74:443 ajax.googleapis.com tcp
GB 216.58.204.74:443 ajax.googleapis.com udp
US 51.81.2.248:443 ra.majorgeeks.com tcp
US 1.1.1.1:53 platform-api.sharethis.com udp
US 1.1.1.1:53 d2znr2yi078d75.cloudfront.net udp
US 1.1.1.1:53 files1.majorgeeks.com udp
US 1.1.1.1:53 files1.majorgeeks.com udp
US 51.81.2.249:443 files1.majorgeeks.com tcp
US 1.1.1.1:53 fundingchoicesmessages.google.com udp
US 1.1.1.1:53 fundingchoicesmessages.google.com udp
US 51.81.2.245:443 www.majorgeeks.com tcp
GB 172.217.169.3:443 www.google.co.uk udp
US 1.1.1.1:53 csi.gstatic.com udp
US 1.1.1.1:53 csi.gstatic.com udp
US 172.217.203.120:443 csi.gstatic.com tcp
US 51.81.2.248:443 ra.majorgeeks.com tcp
US 1.1.1.1:53 platform-api.sharethis.com udp
GB 172.217.16.238:443 apis.google.com udp
GB 142.250.178.4:443 www.google.com udp
US 51.81.2.248:443 ra.majorgeeks.com tcp
US 1.1.1.1:53 scontent.xx.fbcdn.net udp
US 1.1.1.1:53 scontent.xx.fbcdn.net udp
US 51.81.2.248:443 ra.majorgeeks.com tcp
US 172.217.203.120:443 csi.gstatic.com udp
GB 142.250.200.46:443 cse.google.com udp
US 51.81.2.245:443 www.majorgeeks.com tcp
US 1.1.1.1:53 d2znr2yi078d75.cloudfront.net udp
US 1.1.1.1:53 httplogserver-lb.global.unified-prod.sharethis.net udp
US 1.1.1.1:53 prod.disqus.map.fastlylb.net udp
US 1.1.1.1:53 prod.disqus.map.fastlylb.net udp
GB 142.250.180.14:443 fundingchoicesmessages.google.com udp
GB 163.70.151.21:443 scontent.xx.fbcdn.net udp
US 51.81.2.245:443 www.majorgeeks.com tcp
US 1.1.1.1:53 googleads.g.doubleclick.net udp
GB 142.250.179.226:443 googleads.g.doubleclick.net udp
US 1.1.1.1:53 star-mini.c10r.facebook.com udp
US 1.1.1.1:53 star-mini.c10r.facebook.com udp
GB 163.70.151.35:443 star-mini.c10r.facebook.com udp
US 1.1.1.1:53 d3oiwf0xhhk8m1.cloudfront.net udp
US 1.1.1.1:53 d3oiwf0xhhk8m1.cloudfront.net udp
US 1.1.1.1:53 count-server.sharethis.com udp
US 51.81.2.248:443 ra.majorgeeks.com tcp
US 51.81.2.245:443 www.majorgeeks.com tcp
US 51.81.2.248:443 ra.majorgeeks.com tcp
US 51.81.2.245:443 www.majorgeeks.com tcp
US 51.81.2.248:443 ra.majorgeeks.com tcp
US 1.1.1.1:53 c.disquscdn.com udp
US 1.1.1.1:53 c.disquscdn.com udp
US 51.81.2.245:443 www.majorgeeks.com tcp
GB 216.58.201.97:443 tpc.googlesyndication.com udp
US 199.232.192.134:443 prod.disqus.map.fastlylb.net tcp
US 199.232.192.134:443 prod.disqus.map.fastlylb.net tcp
US 199.232.192.134:443 prod.disqus.map.fastlylb.net tcp
GB 142.250.178.4:443 www.google.com udp
US 1.1.1.1:53 id.google.com udp
US 1.1.1.1:53 id.google.com udp
GB 142.250.200.35:443 id.google.com udp
US 1.1.1.1:53 csp.withgoogle.com udp
GB 216.58.201.113:443 csp.withgoogle.com udp
US 1.1.1.1:53 play.google.com udp
GB 142.250.180.14:443 fundingchoicesmessages.google.com udp
US 1.1.1.1:53 github.com udp
GB 20.26.156.215:443 github.com tcp
US 1.1.1.1:53 glb-db52c2cf8be544.github.com udp
US 1.1.1.1:53 avatars.githubusercontent.com udp
US 1.1.1.1:53 avatars.githubusercontent.com udp
US 185.199.108.133:443 avatars.githubusercontent.com tcp
US 185.199.108.133:443 avatars.githubusercontent.com tcp
US 1.1.1.1:53 api.github.com udp
GB 20.26.156.210:443 api.github.com tcp
US 1.1.1.1:53 raw.githubusercontent.com udp
US 1.1.1.1:53 raw.githubusercontent.com udp
US 185.199.109.133:443 raw.githubusercontent.com tcp
US 185.199.109.133:443 raw.githubusercontent.com tcp
US 185.199.110.133:443 raw.githubusercontent.com tcp

Files

N/A

Analysis: behavioral3

Detonation Overview

Submitted

2024-10-20 20:56

Reported

2024-10-20 20:57

Platform

debian9-armhf-20240611-en

Command Line

N/A

Signatures

N/A

Processes

N/A

Network

N/A

Files

N/A

Analysis: behavioral4

Detonation Overview

Submitted

2024-10-20 20:56

Reported

2024-10-20 20:57

Platform

debian9-mipsbe-20240418-en

Command Line

N/A

Signatures

N/A

Processes

N/A

Network

N/A

Files

N/A