d60041d15a1294a6fb436d20bff8e2cfaffd6b61aeddd504aadd1a35dc7f5ddd

Analysis

user interaction
yes
max time kernel
58s
max time network
61s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/04/2026, 12:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jjsploit_8.17.9_x64_en-US (1).msi
Size 6.0MB
Sample260427-psy4paby3s
SHA256 d60041d15a1294a6fb436d20bff8e2cfaffd6b61aeddd504aadd1a35dc7f5ddd
MD5 11554209ebea8dd6a79759b131da131f
SHA1 5a9a794e5b18389c31b00ce714111d0107061055
SHA512 eaed0b53938e0107fc9be0a6255d1b7cb35b90334a3174c878bdbaf035228833461bd25f329a0256fb372bba6a81ace028586b7c29150e144c747061dbe6d43e
SSDEEP 196608:01/HwnpyyCBiw0xvbWRiogDNHEt31ol8tDlc+:U/HwIxBinv1NGtVhT
TLSH
T19156338FFE829D37D89A0C32853F87658328BC505B4A645723D975A9C8F67C04D36EE2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4996	jjsploit.exe

Loads dropped DLL 1 IoCs

pid	Process
3376	MsiExec.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	jjsploit.exe

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
59	raw.githubusercontent.com
61	raw.githubusercontent.com
35	raw.githubusercontent.com
41	raw.githubusercontent.com
55	raw.githubusercontent.com
57	raw.githubusercontent.com

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 21 IoCs

description	ioc	Process
File created	C:\Program Files\jjsploit\resources\luascripts\general\teleportto.lua	msiexec.exe
File created	C:\Program Files\jjsploit\jjsploit.exe	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\god.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\beesim\autodig.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\tptool.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\jailbreak\policeesp.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\fly.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\infinitejump.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\jailbreak\walkspeed.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\animations\walkthrough.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\aimbot.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\jailbreak\removewalls.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\multidimensionalcharacter.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\jailbreak\criminalesp.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\animations\levitate.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\animations\energizegui.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\animations\jumpland.lua	msiexec.exe
File created	C:\Program Files\jjsploit\Uninstall jjsploit.lnk	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\noclip.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\animations\dab.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\chattroll.lua	msiexec.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e589de1.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{CAEE2EA4-A7F5-4155-9048-D4EBB6FAF462}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF6F291DCABADF8F18.TMP	msiexec.exe
File created	C:\Windows\Installer\e589de1.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e589de3.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFC4D45284C4334E6A.TMP	msiexec.exe
File created	C:\Windows\Installer\{CAEE2EA4-A7F5-4155-9048-D4EBB6FAF462}\ProductIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\{CAEE2EA4-A7F5-4155-9048-D4EBB6FAF462}\ProductIcon	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA52A7E7D6007FA3D.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFEC906557219C8BB7.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9F58.tmp	msiexec.exe
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe

Modifies trusted root certificate store through registry 1 TTPs 5 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\10CBD8BEC613C79DA1E92AC6242F12CB9EB2C140\Blob = 1400000001000000140000004ab84219f1c42c990de2279efd9c563da794910b03000000010000001400000010cbd8bec613c79da1e92ac6242f12cb9eb2c1400f0000000100000020000000bf3c9c033a3b572bdc7d97548088c358bc63d170ecf29a92fc157d336205043f2000000001000000f9020000308202f5308201dda00302010202104cb41d7cc01f502923fa4c1e0efab0e1300d06092a864886f70d01010b050030133111300f06035504031308436c6f75644e6574301e170d3236303430383230303030305a170d3331303430383230303030305a30133111300f06035504031308436c6f75644e657430820122300d06092a864886f70d01010105000382010f003082010a0282010100d29e9ccd135fd58a4605b2f58da8df578de64dc37af8014d4632e6f84d1315e09c45fb26158288e512b46f09699c949e1631f06aaa16c73496c139ef397491ed46ab735dcb7cc2292342fa6a4d84a36b03eaaa387b7aacdaedf0eccb5e8a5cbb2b160fc254b887df97a542120d5cc8803f098184bb1579b1ca56bffe4361824f17db0c8f91f39c9bdb8fa141db422a0d8754eeefdb4614e6a33d4cd8ba2589566b19c10de5e35cf522920666006cf374547c5fcc2e7e2dfe7fa7c192c029809282c915ed6c19632730b65419bcfbbf40fbbabb21dbd8a34da9c3715bf41bba93989b1f380e7c5aee0d1a212f4a5e991e1b5c58aafb971016a157b16658ea9d610203010001a3453043300e0603551d0f0101ff04040302010630120603551d130101ff040830060101ff020101301d0603551d0e041604144ab84219f1c42c990de2279efd9c563da794910b300d06092a864886f70d01010b05000382010100ae2231f69141577567fb94dd3a53849b9b930fb181669a804412c78a63f792b34789e5e80d8b88448295c0aa46f3f8d64b3152e12ea987059e5f371a52801cb3d0fdd603240aedfc454d7917005418065df6443932da2479eabaac65dee2b22cf07c0c1aa6a6e3b420cfb9715dbe29787cdaf8ae38bbeabe4167f64acb234bd5698f207fa61f0226c928b6ff0bc4be104319b8e76c21613264428457d01f85040ca409704030af37fb4323f78721ab2c98f562c2e435dcfd5b58c351adf2658792a2c097bbb7a56750fa6dad35a3817785102582920957b7776d5b883b21ae92094120f73de33ec8bffc2b3af262c4f3281634d71c0b224a494a4e2f6f356c24	jjsploit.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	jjsploit.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	jjsploit.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\10CBD8BEC613C79DA1E92AC6242F12CB9EB2C140\Blob = 190000000100000010000000a1e46e98ff8b0cd3f46cd21cfa8c709a0f0000000100000020000000bf3c9c033a3b572bdc7d97548088c358bc63d170ecf29a92fc157d336205043f03000000010000001400000010cbd8bec613c79da1e92ac6242f12cb9eb2c1401400000001000000140000004ab84219f1c42c990de2279efd9c563da794910b2000000001000000f9020000308202f5308201dda00302010202104cb41d7cc01f502923fa4c1e0efab0e1300d06092a864886f70d01010b050030133111300f06035504031308436c6f75644e6574301e170d3236303430383230303030305a170d3331303430383230303030305a30133111300f06035504031308436c6f75644e657430820122300d06092a864886f70d01010105000382010f003082010a0282010100d29e9ccd135fd58a4605b2f58da8df578de64dc37af8014d4632e6f84d1315e09c45fb26158288e512b46f09699c949e1631f06aaa16c73496c139ef397491ed46ab735dcb7cc2292342fa6a4d84a36b03eaaa387b7aacdaedf0eccb5e8a5cbb2b160fc254b887df97a542120d5cc8803f098184bb1579b1ca56bffe4361824f17db0c8f91f39c9bdb8fa141db422a0d8754eeefdb4614e6a33d4cd8ba2589566b19c10de5e35cf522920666006cf374547c5fcc2e7e2dfe7fa7c192c029809282c915ed6c19632730b65419bcfbbf40fbbabb21dbd8a34da9c3715bf41bba93989b1f380e7c5aee0d1a212f4a5e991e1b5c58aafb971016a157b16658ea9d610203010001a3453043300e0603551d0f0101ff04040302010630120603551d130101ff040830060101ff020101301d0603551d0e041604144ab84219f1c42c990de2279efd9c563da794910b300d06092a864886f70d01010b05000382010100ae2231f69141577567fb94dd3a53849b9b930fb181669a804412c78a63f792b34789e5e80d8b88448295c0aa46f3f8d64b3152e12ea987059e5f371a52801cb3d0fdd603240aedfc454d7917005418065df6443932da2479eabaac65dee2b22cf07c0c1aa6a6e3b420cfb9715dbe29787cdaf8ae38bbeabe4167f64acb234bd5698f207fa61f0226c928b6ff0bc4be104319b8e76c21613264428457d01f85040ca409704030af37fb4323f78721ab2c98f562c2e435dcfd5b58c351adf2658792a2c097bbb7a56750fa6dad35a3817785102582920957b7776d5b883b21ae92094120f73de33ec8bffc2b3af262c4f3281634d71c0b224a494a4e2f6f356c24	jjsploit.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\10CBD8BEC613C79DA1E92AC6242F12CB9EB2C140\Blob = 0f0000000100000020000000bf3c9c033a3b572bdc7d97548088c358bc63d170ecf29a92fc157d336205043f03000000010000001400000010cbd8bec613c79da1e92ac6242f12cb9eb2c1402000000001000000f9020000308202f5308201dda00302010202104cb41d7cc01f502923fa4c1e0efab0e1300d06092a864886f70d01010b050030133111300f06035504031308436c6f75644e6574301e170d3236303430383230303030305a170d3331303430383230303030305a30133111300f06035504031308436c6f75644e657430820122300d06092a864886f70d01010105000382010f003082010a0282010100d29e9ccd135fd58a4605b2f58da8df578de64dc37af8014d4632e6f84d1315e09c45fb26158288e512b46f09699c949e1631f06aaa16c73496c139ef397491ed46ab735dcb7cc2292342fa6a4d84a36b03eaaa387b7aacdaedf0eccb5e8a5cbb2b160fc254b887df97a542120d5cc8803f098184bb1579b1ca56bffe4361824f17db0c8f91f39c9bdb8fa141db422a0d8754eeefdb4614e6a33d4cd8ba2589566b19c10de5e35cf522920666006cf374547c5fcc2e7e2dfe7fa7c192c029809282c915ed6c19632730b65419bcfbbf40fbbabb21dbd8a34da9c3715bf41bba93989b1f380e7c5aee0d1a212f4a5e991e1b5c58aafb971016a157b16658ea9d610203010001a3453043300e0603551d0f0101ff04040302010630120603551d130101ff040830060101ff020101301d0603551d0e041604144ab84219f1c42c990de2279efd9c563da794910b300d06092a864886f70d01010b05000382010100ae2231f69141577567fb94dd3a53849b9b930fb181669a804412c78a63f792b34789e5e80d8b88448295c0aa46f3f8d64b3152e12ea987059e5f371a52801cb3d0fdd603240aedfc454d7917005418065df6443932da2479eabaac65dee2b22cf07c0c1aa6a6e3b420cfb9715dbe29787cdaf8ae38bbeabe4167f64acb234bd5698f207fa61f0226c928b6ff0bc4be104319b8e76c21613264428457d01f85040ca409704030af37fb4323f78721ab2c98f562c2e435dcfd5b58c351adf2658792a2c097bbb7a56750fa6dad35a3817785102582920957b7776d5b883b21ae92094120f73de33ec8bffc2b3af262c4f3281634d71c0b224a494a4e2f6f356c24	jjsploit.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000adcdd9a6d08c0ad30000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000adcdd9a60000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900adcdd9a6000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1aadcdd9a6000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dadcdd9a6000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134217670742151734"	msedgewebview2.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe

Modifies registry class 26 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4AE2EEAC5F7A551409844DBE6BAF4F26\ShortcutsFeature = "MainProgram"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\Version = "135331849"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\ProductIcon = "C:\\Windows\\Installer\\{CAEE2EA4-A7F5-4155-9048-D4EBB6FAF462}\\ProductIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4AE2EEAC5F7A551409844DBE6BAF4F26\Environment = "MainProgram"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\PackageCode = "9FC2B6F90A0842C469E6F4CAD3052A7D"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4AE2EEAC5F7A551409844DBE6BAF4F26\MainProgram	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4AE2EEAC5F7A551409844DBE6BAF4F26\External	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\ProductName = "jjsploit"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\SourceList\Net	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\Language = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4B2484A816E553E46810E7349D0703EF	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4B2484A816E553E46810E7349D0703EF\4AE2EEAC5F7A551409844DBE6BAF4F26	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\SourceList\PackageName = "jjsploit_8.17.9_x64_en-US (1).msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4AE2EEAC5F7A551409844DBE6BAF4F26	msiexec.exe

Modifies system certificate store 2 TTPs 7 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	jjsploit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0	jjsploit.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 0f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df02000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	jjsploit.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 19000000010000001000000076935b5c5a037216daaf8aac76df42c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf1576142000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	jjsploit.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 040000000100000010000000fa68bcd9b57fadfdc91d068328cc24c10f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df019000000010000001000000076935b5c5a037216daaf8aac76df42c12000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	jjsploit.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 5c00000001000000040000008001000019000000010000001000000076935b5c5a037216daaf8aac76df42c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614040000000100000010000000fa68bcd9b57fadfdc91d068328cc24c12000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	jjsploit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\10CBD8BEC613C79DA1E92AC6242F12CB9EB2C140	jjsploit.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3680	msiexec.exe
3680	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
948	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1492	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1492	msiexec.exe
Token: SeSecurityPrivilege	3680	msiexec.exe
Token: SeCreateTokenPrivilege	1492	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1492	msiexec.exe
Token: SeLockMemoryPrivilege	1492	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1492	msiexec.exe
Token: SeMachineAccountPrivilege	1492	msiexec.exe
Token: SeTcbPrivilege	1492	msiexec.exe
Token: SeSecurityPrivilege	1492	msiexec.exe
Token: SeTakeOwnershipPrivilege	1492	msiexec.exe
Token: SeLoadDriverPrivilege	1492	msiexec.exe
Token: SeSystemProfilePrivilege	1492	msiexec.exe
Token: SeSystemtimePrivilege	1492	msiexec.exe
Token: SeProfSingleProcessPrivilege	1492	msiexec.exe
Token: SeIncBasePriorityPrivilege	1492	msiexec.exe
Token: SeCreatePagefilePrivilege	1492	msiexec.exe
Token: SeCreatePermanentPrivilege	1492	msiexec.exe
Token: SeBackupPrivilege	1492	msiexec.exe
Token: SeRestorePrivilege	1492	msiexec.exe
Token: SeShutdownPrivilege	1492	msiexec.exe
Token: SeDebugPrivilege	1492	msiexec.exe
Token: SeAuditPrivilege	1492	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1492	msiexec.exe
Token: SeChangeNotifyPrivilege	1492	msiexec.exe
Token: SeRemoteShutdownPrivilege	1492	msiexec.exe
Token: SeUndockPrivilege	1492	msiexec.exe
Token: SeSyncAgentPrivilege	1492	msiexec.exe
Token: SeEnableDelegationPrivilege	1492	msiexec.exe
Token: SeManageVolumePrivilege	1492	msiexec.exe
Token: SeImpersonatePrivilege	1492	msiexec.exe
Token: SeCreateGlobalPrivilege	1492	msiexec.exe
Token: SeCreateTokenPrivilege	1492	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1492	msiexec.exe
Token: SeLockMemoryPrivilege	1492	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1492	msiexec.exe
Token: SeMachineAccountPrivilege	1492	msiexec.exe
Token: SeTcbPrivilege	1492	msiexec.exe
Token: SeSecurityPrivilege	1492	msiexec.exe
Token: SeTakeOwnershipPrivilege	1492	msiexec.exe
Token: SeLoadDriverPrivilege	1492	msiexec.exe
Token: SeSystemProfilePrivilege	1492	msiexec.exe
Token: SeSystemtimePrivilege	1492	msiexec.exe
Token: SeProfSingleProcessPrivilege	1492	msiexec.exe
Token: SeIncBasePriorityPrivilege	1492	msiexec.exe
Token: SeCreatePagefilePrivilege	1492	msiexec.exe
Token: SeCreatePermanentPrivilege	1492	msiexec.exe
Token: SeBackupPrivilege	1492	msiexec.exe
Token: SeRestorePrivilege	1492	msiexec.exe
Token: SeShutdownPrivilege	1492	msiexec.exe
Token: SeDebugPrivilege	1492	msiexec.exe
Token: SeAuditPrivilege	1492	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1492	msiexec.exe
Token: SeChangeNotifyPrivilege	1492	msiexec.exe
Token: SeRemoteShutdownPrivilege	1492	msiexec.exe
Token: SeUndockPrivilege	1492	msiexec.exe
Token: SeSyncAgentPrivilege	1492	msiexec.exe
Token: SeEnableDelegationPrivilege	1492	msiexec.exe
Token: SeManageVolumePrivilege	1492	msiexec.exe
Token: SeImpersonatePrivilege	1492	msiexec.exe
Token: SeCreateGlobalPrivilege	1492	msiexec.exe
Token: SeCreateTokenPrivilege	1492	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1492	msiexec.exe
Token: SeLockMemoryPrivilege	1492	msiexec.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1492	msiexec.exe
1492	msiexec.exe
4996	jjsploit.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3680 wrote to memory of 3376	3680	msiexec.exe	81
PID 3680 wrote to memory of 2256	3680	msiexec.exe	85
PID 1492 wrote to memory of 4996	1492	msiexec.exe	88
PID 4996 wrote to memory of 948	4996	jjsploit.exe	89
PID 948 wrote to memory of 2596	948	msedgewebview2.exe	90
PID 948 wrote to memory of 3768	948	msedgewebview2.exe	91
PID 948 wrote to memory of 3768	948	msedgewebview2.exe	91
PID 948 wrote to memory of 3768	948	msedgewebview2.exe	91
PID 948 wrote to memory of 572	948	msedgewebview2.exe	92
PID 948 wrote to memory of 3136	948	msedgewebview2.exe	93
PID 948 wrote to memory of 3136	948	msedgewebview2.exe	93
PID 948 wrote to memory of 1508	948	msedgewebview2.exe	94
PID 948 wrote to memory of 1508	948	msedgewebview2.exe	94
PID 948 wrote to memory of 1508	948	msedgewebview2.exe	94

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\jjsploit_8.17.9_x64_en-US (1).msi"
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Program Files\jjsploit\jjsploit.exe
  "C:\Program Files\jjsploit\jjsploit.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies trusted root certificate store through registry
  - Modifies system certificate store
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4996
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.9 --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=4996.956.13625222359969215415
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:948
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x170,0x7ff863a6b078,0x7ff863a6b084,0x7ff863a6b090
      4⤵
      PID:2596
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1684,i,9437204911736684496,5365511757056108374,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1612 /prefetch:2
      4⤵
      PID:3768
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2004,i,9437204911736684496,5365511757056108374,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1880 /prefetch:11
      4⤵
      PID:572
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2276,i,9437204911736684496,5365511757056108374,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:13
      4⤵
      PID:3136
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3540,i,9437204911736684496,5365511757056108374,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
      4⤵
      PID:1508

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3680
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A7B4D0F75805E4ED830273F4D98D6EEA C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3376
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:2256

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:2440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e589de2.rbs

Path C:\Config.Msi\e589de2.rbs
Size 21KB
SHA256 6d87d4cd3df6856b932731fa0d8c50b2c4e440528c29e5e34224e60ed3e583ab
MD5 a09770579425015bb54d87a179cb79a6
SHA1 abba0b9fd2a6157306b9a46cebe24877e3b9217c
SHA512 2592575ddd94634e5f8f797774f14d693b863b9caadaf47ee414e42c0bde281eac811fe36aff566be4fea9607b0f30658678649eaa09c91033ba5df7a4032b09
SSDEEP 384:JEZAB7OTEXTIrY8nTZoWjdLRWixst8t8t8t0tstststststststitztztGIGk/kW:JEZAB7OTEXTIrY8nTZoWjdLRWixst8ti
TLSH
T1ACA202835A50C2E6E66B0774DB975B043B72C58E9358420B46CCC27A9D877C83FF9A8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjsploit.exe

Path C:\Program Files\jjsploit\jjsploit.exe
Size 17.6MB
SHA256 75c45301f7a6632b67934cd30bb08d4c322c55b9e68d2a6edbc5873982cbcbe8
MD5 f5b2fd9a39c097322b6cb663cca5b4e8
SHA1 08c113bccec7d3cdf4f6a2b313d1b1421ad62f85
SHA512 490b5c18b55ca136782d2f25e8f8b86a3cc5ae0ad25fda274bfe1a3adc759cbbb8f11592f6e7ad3451b758199e90db482767f4ebae7d93db61d8b90b3f61aae8
SSDEEP 196608:h9Uzqh1cmdDOf+IHFLU/6NW+tiFZJXij:MzqoyS+IHFI/extiFZJXi
TLSH
T139070725BE8B996CD05FC474834B8A720A7570CB0B35B9FF448596392F6ABF41F38219
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjsploit.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\jjsploit\jjsploit.lnk
Size 1KB
SHA256 52f110237f5e1e70d70447a8602bf628b917a29b65c099046dbbb396d8a49852
MD5 f7184062d524a3769eb8d142d81c0017
SHA1 ec2feab89e7953ee88259eeebdfcb8816a04d9d5
SHA512 b452a88234a5741ff664b8371c757db53b00478d0615ff281a82dc5f97f20ff84252c7e81fa36ef3d52d9c2e089e7f3104421e205ed11e9db09843479005ed8e
TLSH
T14D41F30052E1472BE3B58A382F620721C7BFFC2199A49F1B8188015E4924100E9ACFBB
MD5 SHA1 SHA512 TLSH

Submit Download

jjsploit.lnk~RFe58a0fe.TMP

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\jjsploit\jjsploit.lnk~RFe58a0fe.TMP
Size 1KB
SHA256 e2a16956e7be2f1bb520e58dcf1de7605df60278716e9694415073953e597e01
MD5 f42f02421c927cbc01924588e70f9b54
SHA1 63d090d1763ac5be936afa321842188b27e8f940
SHA512 cb80bbd87ea24d934beb038f56f334a817bc6487c26fd70be40a2a1da170d7caead801ddc86d83018de3d387cd5e773fd8a33fc3875fc8b4859061479ad3d045
TLSH
T15241D21052F1472BE3B586782F524761C7BFFC219AA46F578189015E4964100EDACFBB
MD5 SHA1 SHA512 TLSH

Submit Download

MSI6CCE.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI6CCE.tmp
Size 132KB
SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
MD5 cfbb8568bd3711a97e6124c56fcfa8d9
SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
TLSH
T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 8e2a4aac4aada56d08ec9602733c135006aba24191ff1f71330a68d38b759f68
MD5 4cee2a60b759d314be6a341b65bc2bc0
SHA1 448bdf0d47d5557e0232733929390a0a773651dc
SHA512 d6788ef37ed5c1b3cfc02989ea90ca3fda2c8a8b12f07b9c94f7501924321cf370c45abdae87a5a96f80e8ea438e2ea3c49ae85a76ffb2f5152fffe062fce452
TLSH
T176D0123272024534C01464330063A10D4801D10F81475300542E9E1D2A444900D02451
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 ac099f5c62d0bfc7d0b9b91e7e1a3947ac2a4acfc153cfab33fe0b0273485a98
MD5 955b2853a86f62ee552f8201a2bba9f4
SHA1 44cbc917c017dc16f2e39ed9cc2c8b617e40904f
SHA512 926bcc1750b69d6932cc186820b3bede30a15aed63fe19087ad5f2182aec665a5e860cf9864a740bf686af47223ca80943d6773b09cf55578a33bda82578f7b2
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\DawnGraphiteCache\index
Size 256KB
SHA256 c52d6fba41ff31317427e47d947c6fc8233ca798bef7089edfa9499b6ff1515d
MD5 f16c6e6c6beb3c1cf50e70f151864de4
SHA1 0d9ea1e0bf42b46bdf49aca0b334a11ac43158e0
SHA512 b64af78c49df428c5c9701a22e54900ec3818cd6f30d1a039680fc9709bd9e19aca671330bfc68d91e5b5b0aa544630dd920f7ebf58410134ee11aa4dd05510a
SSDEEP 3:LstlNllkll/lQK/:LsX3lEtf/
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
Size 1KB
SHA256 df2721c7f7544d53a7cd124a4f0e8702b97326cdd9721c3489762ea9ca9b9f03
MD5 68662f29aeb4205fd5ad96647a4b8e6d
SHA1 822a0d119a7225892099a0d3881f79a0875207e9
SHA512 c1425af7baf04379ea5810c9661d03edf65b4d12c71ae2936e9c65e49292cfb4ca72306325f325ec07b3585e80695711c939b6411caf16d3296e23e405e27db7
TLSH
T169318777B1E4BB335DD2668176563F573D60842AC2914E8CB9DE0B1C01EB68C5135C33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
Size 2KB
SHA256 dabf1525f40136f0fe0a8be56a09092a58cf84f6f4a6b66ae2928ed9fb6ee6b5
MD5 65fb3ba9a46153c8642c68b1c5dcb5dd
SHA1 b9d9e4748842accb4018d277f447899820315b0b
SHA512 137e6322a25e3f10af24cfbe57d4ec94045c7260f55c4d98667d6aae76b23c6a770aa13ff7495c901252d3c0dbdce3f3f4318f85f1f1e361250c18111248679f
TLSH
T1455196737998EA374DE36A447D463F1366758015D7922FA4ADED0B0C01DB65C2311C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
Size 3KB
SHA256 b905e7f5f2e3303388c3c6cba5026392b7c14af389898bb12f9d3d0ae2608fb4
MD5 77d3938f00617e3a90558ed41d86d24e
SHA1 f6521bda5e9aea8d244e96b653e4f4f983c54377
SHA512 7509b7d2aea7c0f07fc5b10f3a07c12121284d741c7a2cbb933045cf0a921c394a64c1a23ffc8c9d3d985c4af3455a53510a36bac162acdefcd9650f2f40019d
TLSH
T19C71743B65A8E9374EE3AA44B9862B1676A54127D6D13FA8D9ED0F0C01DB7881311C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
Size 16KB
SHA256 f3c63b03309058ae52dcc30afc6f1aafd6d33d958b79720c96832e99144fcd5e
MD5 54ac0351d4675b5d2222aaa41fe8622f
SHA1 312173b33856c9861aadcdd6a05eb16789daf8ff
SHA512 2fc466121a834c3b4893939b23560edc104810351e7a72ef3de2f03dead138a215933b99a449d967d6274addb66e8fb0c9ca3ffa25a3823206d025aaa4c1a96d
SSDEEP 384:zwfRE5BdEZfr0kuh9Rt/nP9yxNb+PH3Vf+MuSibS1J:oRkurqhNsyPXN+dA
TLSH
T16D72AE234AB0D93B5CE685053D0A2B0779F8C94A95D26A98BCDD1F1D07CBBC90322D33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe58bafe.TMP

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State~RFe58bafe.TMP
Size 1KB
SHA256 a95ccac7330d44880e0d0a06622c02acbe14e7784da3e12577a0c47b731d85cb
MD5 10468a87f5f17d3b87f80449fab14783
SHA1 474e66d162afc58a53c313d41577116ec0386368
SHA512 21aca6955e86ea22f63f1676711c4f733fbc75c9720fbaeef4a3153a9ea8aee2f8e319719dd16321e3ed6391e989386bec4644e857dfd3aa8d1c114c4b53d78f
TLSH
T13E21657BE0E8BA375EE26980B6537F473D90842AD3914E5CF9DD071C01AB5885236C33
MD5 SHA1 SHA512 TLSH

Submit Download

e589de1.msi

Path C:\Windows\Installer\e589de1.msi
Size 6.0MB
SHA256 d60041d15a1294a6fb436d20bff8e2cfaffd6b61aeddd504aadd1a35dc7f5ddd
MD5 11554209ebea8dd6a79759b131da131f
SHA1 5a9a794e5b18389c31b00ce714111d0107061055
SHA512 eaed0b53938e0107fc9be0a6255d1b7cb35b90334a3174c878bdbaf035228833461bd25f329a0256fb372bba6a81ace028586b7c29150e144c747061dbe6d43e
SSDEEP 196608:01/HwnpyyCBiw0xvbWRiogDNHEt31ol8tDlc+:U/HwIxBinv1NGtVhT
TLSH
T19156338FFE829D37D89A0C32853F87658328BC505B4A645723D975A9C8F67C04D36EE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.6MB
SHA256 326887c92366af76de58ad5b077608b69df66fdca0023e493d78a3cd36606c9c
MD5 1e226269248f5dd552c81e51332f6574
SHA1 c76bbb7dd2bb6cc27c53047903fc63c4a5e0a1fb
SHA512 a7fb8b66f03970e3a931e8742680c57321c43c006408f5ed7e9c622dd24949809d36527cb6e86d686fec5dc9a800f38f569c3041d7a5c04e2492616f86d57192
SSDEEP 24576:+2gmSp1odoO/vvTLtmmeBkH6fapdwoi82GVtHZUGvNqYUqCDY93B7r8Rh:H
TLSH
T19347C12836F92250E7F79E3C68F06A234E3A7D5B9C159A8D05451B4E0D21FB0E872F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{40e26408-6e0e-4c4a-9f0e-78456df2f865}_OnDiskSnapshotProp

Path \??\Volume{a6d9cdad-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{40e26408-6e0e-4c4a-9f0e-78456df2f865}_OnDiskSnapshotProp
Size 6KB
SHA256 56ac82f8cd0e2cc7c0d0864940ebe49e9b939dedca357a2b098cbb2a7a038b1f
MD5 1aa159c945806a9cae1699149073d75b
SHA1 f83a4b1acb93b73151ba953729bdc687b0422b47
SHA512 07cc596ccabd2957bf42b4425097f7532f45d6a2a5e778abbfdee7b937c05481ae2c6ea50ab91afb5308761170bd28c980b0ee5f68557cf3dac1d81f1f6d404f
SSDEEP 96:F/QehwVsvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:RQ3V2b++ZVmN
TLSH
T118D189085AF54711E2B3AB3229F14557A877B911EF33CB8E0198238E6670A10F936F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/948-301-0x000002078DA00000-0x000002078E1AE000-memory.dmp

Download

memory/1492-67-0x000001C59EE80000-0x000001C59EF56000-memory.dmp

Download

memory/1492-4-0x000001C59EE80000-0x000001C59EF56000-memory.dmp

Download

memory/1508-212-0x00007FF883E30000-0x00007FF883E31000-memory.dmp

Download

memory/2256-274-0x00000224F8D70000-0x00000224F8E46000-memory.dmp

Download

memory/2256-297-0x00000224F8D70000-0x00000224F8E46000-memory.dmp

Download

memory/2440-9-0x000001EBB20E0000-0x000001EBB21B6000-memory.dmp

Download

memory/2440-261-0x000001EBB20E0000-0x000001EBB21B6000-memory.dmp

Download

memory/3680-5-0x00000268CDD30000-0x00000268CDE06000-memory.dmp

Download

memory/3768-93-0x00007FF883E30000-0x00007FF883E31000-memory.dmp

Download

memory/4996-300-0x00000277E8580000-0x00000277E858C000-memory.dmp

Download

memory/4996-299-0x00000277E6790000-0x00000277E6866000-memory.dmp

Download