salatstealer | eb87a8aab833d5c2d60eaf7e86227e047b6e9c3910ed30426cf1a1aafdc7ea2a

Resubmissions

27/06/2026, 04:40

260627-falk7shv2m10

27/06/2026, 04:40

260627-fahvbahv2k

27/06/2026, 04:28

260627-e32bpagx5x10

Analysis

max time kernel
60s
max time network
63s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-uk
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-uklocale:uk-uaos:windows11-ltsc_2024-x64systemwindows
submitted
27/06/2026, 04:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jjsploit.exe
Size 9.5MB
Sample260627-e32bpagx5x
SHA256 eb87a8aab833d5c2d60eaf7e86227e047b6e9c3910ed30426cf1a1aafdc7ea2a
MD5 17f5422b04932ab3740a4a2d30bc20e4
SHA1 b122d6ba6b0624db9f303e2cc5ec4a31f099c62d
SHA512 9e2c6875f517337ed2715eacc352b5fa7dd929f6e3d21ada615604d5a6577233353b3d4d5b33ac3caff65238017310407724076c0dd62bcf72379faa0e8b7685
SSDEEP 196608:0H0s7mytQg7otWq1/HwnpyyCBiw0xvbWRiogDNHEt31ol8tDlc+:G0OtdaJ/HwIxBinv1NGtVhT
TLSH
T1FEA6338BFE81EC33D4690C32863B47569314BC208B4A995727D976A9C9F27C41E36EF1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access defense_evasion discovery salatstealer persistence ransomware spyware stealer trojan upx

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 9 IoCs

resource	yara_rule
behavioral2/memory/6904-20-0x00000000003A0000-0x0000000000FF7000-memory.dmp	family_salatstealer
behavioral2/memory/6904-21-0x00000000003A0000-0x0000000000FF7000-memory.dmp	family_salatstealer
behavioral2/memory/6904-26-0x00000000003A0000-0x0000000000FF7000-memory.dmp	family_salatstealer
behavioral2/memory/6904-35-0x00000000003A0000-0x0000000000FF7000-memory.dmp	family_salatstealer
behavioral2/memory/1932-38-0x0000000000C00000-0x0000000001857000-memory.dmp	family_salatstealer
behavioral2/memory/4824-48-0x0000000000A50000-0x00000000016A7000-memory.dmp	family_salatstealer
behavioral2/memory/4824-176-0x0000000000A50000-0x00000000016A7000-memory.dmp	family_salatstealer
behavioral2/memory/7112-290-0x0000000000370000-0x0000000000FC7000-memory.dmp	family_salatstealer
behavioral2/memory/4824-329-0x0000000000A50000-0x00000000016A7000-memory.dmp	family_salatstealer

Executes dropped EXE 7 IoCs

pid	Process
6904	jjsploit.exe
1932	WUDFHost.exe
4824	csrss.exe
5244	jjsploit.exe
7112	csrss.exe
6488	csrss.exe
1356	csrss.exe

Loads dropped DLL 1 IoCs

pid	Process
1236	MsiExec.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000\Software\Microsoft\Windows\CurrentVersion\Run\WUDFHost = "C:\\Program Files (x86)\\Microsoft.NET\\WUDFHost.exe"	jjsploit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "C:\\Program Files (x86)\\Adobe\\csrss.exe"	jjsploit.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	jjsploit.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

UPX packed file 15 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000f00000001c89f-8.dat	upx
behavioral2/memory/6904-20-0x00000000003A0000-0x0000000000FF7000-memory.dmp	upx
behavioral2/memory/6904-21-0x00000000003A0000-0x0000000000FF7000-memory.dmp	upx
behavioral2/memory/6904-26-0x00000000003A0000-0x0000000000FF7000-memory.dmp	upx
behavioral2/memory/6904-35-0x00000000003A0000-0x0000000000FF7000-memory.dmp	upx
behavioral2/memory/1932-36-0x0000000000C00000-0x0000000001857000-memory.dmp	upx
behavioral2/memory/1932-38-0x0000000000C00000-0x0000000001857000-memory.dmp	upx
behavioral2/memory/4824-41-0x0000000000A50000-0x00000000016A7000-memory.dmp	upx
behavioral2/memory/4824-48-0x0000000000A50000-0x00000000016A7000-memory.dmp	upx
behavioral2/memory/4824-176-0x0000000000A50000-0x00000000016A7000-memory.dmp	upx
behavioral2/memory/7112-276-0x0000000000370000-0x0000000000FC7000-memory.dmp	upx
behavioral2/memory/7112-290-0x0000000000370000-0x0000000000FC7000-memory.dmp	upx
behavioral2/memory/4824-329-0x0000000000A50000-0x00000000016A7000-memory.dmp	upx
behavioral2/memory/6488-330-0x0000000000A50000-0x00000000016A7000-memory.dmp	upx
behavioral2/memory/1356-338-0x0000000000A50000-0x00000000016A7000-memory.dmp	upx

Drops file in Program Files directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\5c3d5e08-a43a-23de-935d-bb021fa708a4	jjsploit.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\multidimensionalcharacter.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\animations\dab.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\animations\levitate.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\fly.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\infinitejump.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\beesim\autodig.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\animations\walkthrough.lua	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\csrss.exe	jjsploit.exe
File created	C:\Program Files\jjsploit\resources\luascripts\jailbreak\removewalls.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\animations\energizegui.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\animations\jumpland.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\teleportto.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\chattroll.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\tptool.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\jailbreak\policeesp.lua	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\5c3d5e08-a43a-23de-935d-bb021fa708a4	jjsploit.exe
File created	C:\Program Files\jjsploit\jjsploit.exe	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\jailbreak\walkspeed.lua	msiexec.exe
File created	C:\Program Files\jjsploit\Uninstall jjsploit.lnk	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\csrss.exe	csrss.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\WUDFHost.exe	jjsploit.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\god.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\noclip.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\jailbreak\criminalesp.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\aimbot.lua	msiexec.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\{CAEE2EA4-A7F5-4155-9048-D4EBB6FAF462}\ProductIcon	msiexec.exe
File created	C:\Windows\Installer\e59304f.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD7ED51726B1EB120.TMP	msiexec.exe
File created	C:\Windows\Installer\e59304d.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF7FE985C5C040FAB5.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF82D3ED1A5D5F2247.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFEF273322C4D0AA79.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e59304d.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe
File created	C:\Windows\Installer\SourceHash{CAEE2EA4-A7F5-4155-9048-D4EBB6FAF462}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI34A3.tmp	msiexec.exe
File created	C:\Windows\Installer\{CAEE2EA4-A7F5-4155-9048-D4EBB6FAF462}\ProductIcon	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jjsploit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WUDFHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000fd4eb96d5ffc258e0000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801fd4eb96d0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101fd4eb96d000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3fd4eb96d00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6fd4eb96d00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 27 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4B2484A816E553E46810E7349D0703EF\4AE2EEAC5F7A551409844DBE6BAF4F26	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\bnd_0a4439d3\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\Language = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\SourceList\Media	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\Local Settings	jjsploit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4AE2EEAC5F7A551409844DBE6BAF4F26	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4AE2EEAC5F7A551409844DBE6BAF4F26\External	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\Version = "135331849"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\ProductIcon = "C:\\Windows\\Installer\\{CAEE2EA4-A7F5-4155-9048-D4EBB6FAF462}\\ProductIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4B2484A816E553E46810E7349D0703EF	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\SourceList\PackageName = "jjsploit_8.17.9_x64_en-US.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4AE2EEAC5F7A551409844DBE6BAF4F26\Environment = "MainProgram"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\ProductName = "jjsploit"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\PackageCode = "9FC2B6F90A0842C469E6F4CAD3052A7D"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bnd_0a4439d3\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4AE2EEAC5F7A551409844DBE6BAF4F26\ShortcutsFeature = "MainProgram"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4AE2EEAC5F7A551409844DBE6BAF4F26\MainProgram	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26	msiexec.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
6904	jjsploit.exe
6904	jjsploit.exe
6904	jjsploit.exe
6904	jjsploit.exe
460	msiexec.exe
460	msiexec.exe
4824	csrss.exe
4824	csrss.exe
4824	csrss.exe
4824	csrss.exe
2728	powershell.exe
2728	powershell.exe
2728	powershell.exe
4824	csrss.exe
4824	csrss.exe
4824	csrss.exe
4824	csrss.exe
4824	csrss.exe
4824	csrss.exe
4824	csrss.exe
4824	csrss.exe
4824	csrss.exe
4824	csrss.exe
4824	csrss.exe
4824	csrss.exe
4824	csrss.exe
4824	csrss.exe
4824	csrss.exe
4824	csrss.exe
4824	csrss.exe
4824	csrss.exe
4824	csrss.exe
4824	csrss.exe
4824	csrss.exe
4824	csrss.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
2672	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2892	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2892	msiexec.exe
Token: SeSecurityPrivilege	460	msiexec.exe
Token: SeCreateTokenPrivilege	2892	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2892	msiexec.exe
Token: SeLockMemoryPrivilege	2892	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2892	msiexec.exe
Token: SeMachineAccountPrivilege	2892	msiexec.exe
Token: SeTcbPrivilege	2892	msiexec.exe
Token: SeSecurityPrivilege	2892	msiexec.exe
Token: SeTakeOwnershipPrivilege	2892	msiexec.exe
Token: SeLoadDriverPrivilege	2892	msiexec.exe
Token: SeSystemProfilePrivilege	2892	msiexec.exe
Token: SeSystemtimePrivilege	2892	msiexec.exe
Token: SeProfSingleProcessPrivilege	2892	msiexec.exe
Token: SeIncBasePriorityPrivilege	2892	msiexec.exe
Token: SeCreatePagefilePrivilege	2892	msiexec.exe
Token: SeCreatePermanentPrivilege	2892	msiexec.exe
Token: SeBackupPrivilege	2892	msiexec.exe
Token: SeRestorePrivilege	2892	msiexec.exe
Token: SeShutdownPrivilege	2892	msiexec.exe
Token: SeDebugPrivilege	2892	msiexec.exe
Token: SeAuditPrivilege	2892	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2892	msiexec.exe
Token: SeChangeNotifyPrivilege	2892	msiexec.exe
Token: SeRemoteShutdownPrivilege	2892	msiexec.exe
Token: SeUndockPrivilege	2892	msiexec.exe
Token: SeSyncAgentPrivilege	2892	msiexec.exe
Token: SeEnableDelegationPrivilege	2892	msiexec.exe
Token: SeManageVolumePrivilege	2892	msiexec.exe
Token: SeImpersonatePrivilege	2892	msiexec.exe
Token: SeCreateGlobalPrivilege	2892	msiexec.exe
Token: SeCreateTokenPrivilege	2892	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2892	msiexec.exe
Token: SeLockMemoryPrivilege	2892	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2892	msiexec.exe
Token: SeMachineAccountPrivilege	2892	msiexec.exe
Token: SeTcbPrivilege	2892	msiexec.exe
Token: SeSecurityPrivilege	2892	msiexec.exe
Token: SeTakeOwnershipPrivilege	2892	msiexec.exe
Token: SeLoadDriverPrivilege	2892	msiexec.exe
Token: SeSystemProfilePrivilege	2892	msiexec.exe
Token: SeSystemtimePrivilege	2892	msiexec.exe
Token: SeProfSingleProcessPrivilege	2892	msiexec.exe
Token: SeIncBasePriorityPrivilege	2892	msiexec.exe
Token: SeCreatePagefilePrivilege	2892	msiexec.exe
Token: SeCreatePermanentPrivilege	2892	msiexec.exe
Token: SeBackupPrivilege	2892	msiexec.exe
Token: SeRestorePrivilege	2892	msiexec.exe
Token: SeShutdownPrivilege	2892	msiexec.exe
Token: SeDebugPrivilege	2892	msiexec.exe
Token: SeAuditPrivilege	2892	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2892	msiexec.exe
Token: SeChangeNotifyPrivilege	2892	msiexec.exe
Token: SeRemoteShutdownPrivilege	2892	msiexec.exe
Token: SeUndockPrivilege	2892	msiexec.exe
Token: SeSyncAgentPrivilege	2892	msiexec.exe
Token: SeEnableDelegationPrivilege	2892	msiexec.exe
Token: SeManageVolumePrivilege	2892	msiexec.exe
Token: SeImpersonatePrivilege	2892	msiexec.exe
Token: SeCreateGlobalPrivilege	2892	msiexec.exe
Token: SeCreateTokenPrivilege	2892	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2892	msiexec.exe
Token: SeLockMemoryPrivilege	2892	msiexec.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2892	msiexec.exe
2892	msiexec.exe
5244	jjsploit.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2892	msiexec.exe
460	msiexec.exe
1236	MsiExec.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 5192 wrote to memory of 6904	5192	jjsploit.exe	90
PID 5192 wrote to memory of 2892	5192	jjsploit.exe	91
PID 460 wrote to memory of 1236	460	msiexec.exe	93
PID 6904 wrote to memory of 1932	6904	jjsploit.exe	97
PID 460 wrote to memory of 7084	460	msiexec.exe	103
PID 2892 wrote to memory of 5244	2892	msiexec.exe	106
PID 5244 wrote to memory of 2672	5244	jjsploit.exe	107
PID 2672 wrote to memory of 856	2672	msedgewebview2.exe	108
PID 2672 wrote to memory of 6436	2672	msedgewebview2.exe	109
PID 2672 wrote to memory of 6436	2672	msedgewebview2.exe	109
PID 2672 wrote to memory of 6436	2672	msedgewebview2.exe	109
PID 2672 wrote to memory of 6436	2672	msedgewebview2.exe	109
PID 2672 wrote to memory of 1056	2672	msedgewebview2.exe	110
PID 2672 wrote to memory of 2400	2672	msedgewebview2.exe	111
PID 2672 wrote to memory of 2400	2672	msedgewebview2.exe	111
PID 2672 wrote to memory of 2400	2672	msedgewebview2.exe	111
PID 2672 wrote to memory of 7148	2672	msedgewebview2.exe	112
PID 2672 wrote to memory of 7148	2672	msedgewebview2.exe	112
PID 2672 wrote to memory of 7148	2672	msedgewebview2.exe	112
PID 2672 wrote to memory of 7148	2672	msedgewebview2.exe	112
PID 2672 wrote to memory of 7148	2672	msedgewebview2.exe	112
PID 4824 wrote to memory of 2728	4824	csrss.exe	113
PID 4824 wrote to memory of 7112	4824	csrss.exe	115
PID 4824 wrote to memory of 6488	4824	csrss.exe	118
PID 4824 wrote to memory of 1356	4824	csrss.exe	119

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\jjsploit.exe
"C:\Users\Admin\AppData\Local\Temp\jjsploit.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5192
- C:\Users\Admin\AppData\Local\Temp\bnd_0a4439d3\jjsploit.exe
  "C:\Users\Admin\AppData\Local\Temp\bnd_0a4439d3\jjsploit.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:6904
- - C:\Program Files (x86)\Microsoft.NET\WUDFHost.exe
    "C:\Program Files (x86)\Microsoft.NET\WUDFHost.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1932
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\bnd_0a4439d3\jjsploit_8.17.9_x64_en-US.msi"
  2⤵
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2892
- - C:\Program Files\jjsploit\jjsploit.exe
    "C:\Program Files\jjsploit\jjsploit.exe"
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5244
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.9 --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=uk-UA --accept-lang=uk-UA --mojo-named-platform-channel-pipe=5244.2648.5624074953089195550 /pfhostedapp:29c3566ed9441bce44d52060c3c564a95f18725f
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      PID:2672
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView /prefetch:4 /pfhostedapp:29c3566ed9441bce44d52060c3c564a95f18725f --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffff9505fd8,0x7ffff9505fe4,0x7ffff9505ff0
        5⤵
        
        PID:856
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1748 --field-trial-handle=1756,i,13378689880041325890,16088400360876391134,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:29c3566ed9441bce44d52060c3c564a95f18725f
        5⤵
        
        PID:6436
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=uk --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2160 --field-trial-handle=1756,i,13378689880041325890,16088400360876391134,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:29c3566ed9441bce44d52060c3c564a95f18725f
        5⤵
        
        PID:1056
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=uk --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2448 --field-trial-handle=1756,i,13378689880041325890,16088400360876391134,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:29c3566ed9441bce44d52060c3c564a95f18725f
        5⤵
        
        PID:2400
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=uk_UA" --mojo-platform-channel-handle=3300 --field-trial-handle=1756,i,13378689880041325890,16088400360876391134,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:29c3566ed9441bce44d52060c3c564a95f18725f /prefetch:1
        5⤵
        
        PID:7148

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:460
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 06A7E093087FAF1B93346EA1BAB176D8 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1236
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:7084

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:1156

C:\Program Files (x86)\Adobe\csrss.exe
"C:\Program Files (x86)\Adobe\csrss.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\csrss.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\csrss.exe" -
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:7112
- C:\Program Files (x86)\Adobe\csrss.exe
  "C:\Program Files (x86)\Adobe\csrss.exe" -
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6488
- C:\Program Files (x86)\Adobe\csrss.exe
  "C:\Program Files (x86)\Adobe\csrss.exe" -
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1356

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59304e.rbs

Path C:\Config.Msi\e59304e.rbs
Size 21KB
SHA256 ccc5bb526017aa0c949852177d003495c4b7302a356dac05ee4d64390057b0d5
MD5 33af64af720ad8a2b4d75c414f116b12
SHA1 478c79873ddeb5f48fb59395810987f2674c628a
SHA512 2d55e4914ae841e44988b2dc999a8d70794c1abb34c64b227b5b15837f96aa404bfddda102db7b87574d3c57641ae5321d87cae6c5f77a6e166f82daffec2412
SSDEEP 384:yCZAB7OTEXTIrY8nTZoWjdLRWixst8t8t8t0tstststststststitztztqvGk/k6:yCZAB7OTEXTIrY8nTZoWjdLRWixst8tv
TLSH
T100A201835A40C2E6E66B0774DF975B043B72C58E9358424B46CC827A9D877C83FF9A8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjsploit.exe

Path C:\Program Files\jjsploit\jjsploit.exe
Size 17.6MB
SHA256 75c45301f7a6632b67934cd30bb08d4c322c55b9e68d2a6edbc5873982cbcbe8
MD5 f5b2fd9a39c097322b6cb663cca5b4e8
SHA1 08c113bccec7d3cdf4f6a2b313d1b1421ad62f85
SHA512 490b5c18b55ca136782d2f25e8f8b86a3cc5ae0ad25fda274bfe1a3adc759cbbb8f11592f6e7ad3451b758199e90db482767f4ebae7d93db61d8b90b3f61aae8
SSDEEP 196608:h9Uzqh1cmdDOf+IHFLU/6NW+tiFZJXij:MzqoyS+IHFI/extiFZJXi
TLSH
T139070725BE8B996CD05FC474834B8A720A7570CB0B35B9FF448596392F6ABF41F38219
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjsploit.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\jjsploit\jjsploit.lnk
Size 1KB
SHA256 ca1b7b0d72cce3dc7b4587be15f8ea9ef799d2e1865f5e486e52420ca68bbd6f
MD5 79a21389eb0b58fda491731516e85b87
SHA1 81848b6938f62d4118e125658d54791282f79b1c
SHA512 f37eca71e922f589086111a9a106d03b5020afc0b323ffdbbccba2340fa58aa8807cc2efe9c8908758b21587fb2793828fa137e542992c836fe44676d357acfe
TLSH
T15341D30056F5072AE7A586346F6243629B7EFC25A9A09FA7C189418D5D34000EDBDF7E
MD5 SHA1 SHA512 TLSH

Submit Download

jjsploit.lnk~RFe5937b0.TMP

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\jjsploit\jjsploit.lnk~RFe5937b0.TMP
Size 1KB
SHA256 9c2023137505fcc107e57c58ee9aaa577bf1ec4aa8423b933ccdc8effe872266
MD5 163aff4856c28b9af551b8b769bb29c3
SHA1 258deb76bfa452f01fa0a3250caa944a69c8e59b
SHA512 373b9abfc916a5183389ef593db24ffc2c2b041cedab5b8c6b7bf8c074393e0c09bc36b93940e1fe4b5a81dab87df3361460706a8bc57079a6fe820b36b215b7
TLSH
T17741DF0056F5072BE7A586382FA243629B7EFC25A9A05FA7C1C9018D5934500EEBDF7E
MD5 SHA1 SHA512 TLSH

Submit Download

MSIE124.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSIE124.tmp
Size 132KB
SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
MD5 cfbb8568bd3711a97e6124c56fcfa8d9
SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
TLSH
T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_yijy2bef.qjq.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yijy2bef.qjq.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

jjsploit.exe

Path C:\Users\Admin\AppData\Local\Temp\bnd_0a4439d3\jjsploit.exe
Size 3.4MB
SHA256 af227894e7648154bba3f519f16c3ac395a0f9e241ce6f0c0d28bd88fdb6175b
MD5 5ffdb8236394214d6163b955c4119422
SHA1 ded3671954c9225c36ef32aef9885318e9d5fdc7
SHA512 10390df168c8118930c8ed5f8d207fdc2509b0e4d910cc3ef2aece454be3637e0e59576bc44d405314d96aaa4404c2b22eb7cae4118fc9fb4b0f33c2bb0e2cce
SSDEEP 49152:96+Cwgua4sCMuijTMkFr8h+5+AS2aVWdhxT+m60kAp0OcS/gQogSUxSKG09Hio:9kH0s7mE5tSzV4hp9kaLjogS0b
TLSH
T128F533C60794F472E139BD3A8B73660AB044B03CD897DD751BCA4AA98323DCE775296C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjsploit_8.17.9_x64_en-US.msi

Path C:\Users\Admin\AppData\Local\Temp\bnd_0a4439d3\jjsploit_8.17.9_x64_en-US.msi
Size 6.0MB
SHA256 d60041d15a1294a6fb436d20bff8e2cfaffd6b61aeddd504aadd1a35dc7f5ddd
MD5 11554209ebea8dd6a79759b131da131f
SHA1 5a9a794e5b18389c31b00ce714111d0107061055
SHA512 eaed0b53938e0107fc9be0a6255d1b7cb35b90334a3174c878bdbaf035228833461bd25f329a0256fb372bba6a81ace028586b7c29150e144c747061dbe6d43e
SSDEEP 196608:01/HwnpyyCBiw0xvbWRiogDNHEt31ol8tDlc+:U/HwIxBinv1NGtVhT
TLSH
T19156338FFE829D37D89A0C32853F87658328BC505B4A645723D975A9C8F67C04D36EE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 7164ecd140efdc01a54d85b8bf80c290825241bc3f82470ac276506f0a4b9452
MD5 b3b6b93e4eaa5577285ac01f26aafd75
SHA1 80877d14518c3b371f43a0ada09cf54e2fa8e74c
SHA512 a379320a3b587b7713a13655bb43b97086198e2f37523f5a104fc8fdc9e979ca01d239d62a53c8f40c590ba43882800945e9eea21a11a0d8b9e06d2fd2631a55
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 e82f7e96d8ae6446a7f95eeb326d5b2db2ecce41b570f0dc1b6c12ea389588c8
MD5 b334cf83b78aa101588e2d90c44bad2a
SHA1 91caae13e6a6a308929fe29f7d6639aa8d777e98
SHA512 1f386a0e617740fe6d7aff1ab9123c28e74f9d41076cc45145d6266ee136a44dc67641c70970509a4c4282796340ac2c2ce73b199b697f48335688f7fba10f46
TLSH
T110D024133301077CC0343133000377CD1501C70F400740D4DC3DC55D1F044541D17451
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
Size 15KB
SHA256 487a479acf95c131f4997898f5cfea438dd67b7e15a796fc0512790bb55d31e5
MD5 3609bbe73f5b2ff3dc46900e19a07e11
SHA1 8d1eb358059650d249f4433a370c036e5345e49f
SHA512 4124f28205f555b7d47d129fc6aa6d8c904cafa32f03f18054f1b1c466a1aa8951973099b0e7aa6e9820340faa3a066f56781993fd34913b580a5166cb4d456f
SSDEEP 384:Xsrv+89zHqlDNP9oidZNBSEJMasfl3aEN/:crv+4UNbdryaYl3aEN/
TLSH
T180729E33E578A6378DB39405B44B2E077FB8A0AA62C25B60D9D91B4E42CF4DD2307D43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
Size 2KB
SHA256 5ea773418a4312876528170356a7e9432ea37c2caf5a22c8f5cedf1a34179cf9
MD5 eb1027f7408925dfd53b059e45e10cd1
SHA1 1964403aea95bc034785bb9c573243f9a610969a
SHA512 44a49612f847f035baab73ae00d740ae01aa8095b81fae2be9de4dc3632b4c8c41609a3e806bb2589a7cb08c900a85008884bddd844ac02a8df3dd1ed1e50700
TLSH
T17A5192336C506A7789A39604784B3F63DEB6A079AB522F20A9CD070D01CB81C6347C36
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
Size 3KB
SHA256 6198ee94dd47127745e29832ea273eee302a1145ba0a5d072a6822deb20db9b8
MD5 ccc170e7335c8b186957619c2a2edc47
SHA1 098978664bb6d362dc51d17b4472b5a84978a4ee
SHA512 90b9beec7e7f4d9f06b7a8b46a70d22ada2e95ee994cf0ed1be31ed5f67c6aa3385f3d748dc78ab7bd226d3258b968f21f38f40cb5fa60d20b2391bee1eed78d
TLSH
T14B71A4376960A9778DA39A0478872F17BBE2903BEA867F64D9EC0F0D01CB65C1353C16
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe59577d.TMP

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State~RFe59577d.TMP
Size 1KB
SHA256 62eeb997234efde9466cdfd44983026261126e7819af580fc5f9cb615559d339
MD5 d49b5d5d7949ba72795b74f91a377ea1
SHA1 d763591db18a327b713232e42725f18a5c938e3c
SHA512 96f703ce2d625018b82e22b7a067786f2dd80c938802af1a88872eb2c3331392e1965025d07e1dc7f0c515b7efc6d372a2da0e053211589f8dfc2c86efc05e0f
TLSH
T18031327399A027728C52A10635576EA7AFB2903EA7428F1065CE470E12DB44CDA6FC31
MD5 SHA1 SHA512 TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 9545d070d8dd6ba62c66b176ed1e4d44b7569fdad7d19433bd15c230dfe88274
MD5 a80da206b0911832747c282ef2221a34
SHA1 984491d021c0045021b3d653d0ffbb63d25aa05e
SHA512 6c1dba693599a1ff7947329feba6e6557d6b94616b64a52148be406d152006fc3109cc3cc55003ac10d5c19e10936d1d3fb45acea02ba183411133cf456d6aa0
SSDEEP 24576:0Fo3DMPZdoO/vvTL/ygggC1wfL+KrbnTEd2idduoW1O6ZHxQcYx2Qp6hU+K:MH4
TLSH
T1A057C5243AF92110F7F79E3CA8F16A23493A7D5BAC15DE8D45411B4E0821F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{1896f738-4d66-4a4a-962f-2ffa3099dc1f}_OnDiskSnapshotProp

Path \??\Volume{6db94efd-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{1896f738-4d66-4a4a-962f-2ffa3099dc1f}_OnDiskSnapshotProp
Size 6KB
SHA256 982f17298783da43542794f314e962560ece2b0291c624b9bbede7f836249408
MD5 7ede1143f9d6c51516467322b8f8ff52
SHA1 1a17fb9ec3616abfbd695baad536a77f17e19da2
SHA512 b0d91c8c06fba4255ad2e9c9f3b0c313218ffa27735898a45dd7920dd18eeb96ba3b33b6ee5eb8a045d554340453c1562a738e5e5a48873dea9e192322e72980
SSDEEP 96:FHhe22Jvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:FhEb++uVmN
TLSH
T16AD167185AF54711E2B3AB3229F14557A877B911EF33CB8E0198238E6630A10F975F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1356-338-0x0000000000A50000-0x00000000016A7000-memory.dmp

Download

memory/1932-38-0x0000000000C00000-0x0000000001857000-memory.dmp

Download

memory/1932-36-0x0000000000C00000-0x0000000001857000-memory.dmp

Download

memory/2728-288-0x0000000006160000-0x00000000061AC000-memory.dmp

Download

memory/2728-305-0x00000000075D0000-0x0000000007673000-memory.dmp

Download

memory/2728-314-0x0000000008970000-0x0000000008F2A000-memory.dmp

Download

memory/2728-313-0x0000000007BF0000-0x0000000007C12000-memory.dmp

Download

memory/2728-312-0x0000000007800000-0x0000000007896000-memory.dmp

Download

memory/2728-311-0x0000000007750000-0x000000000775A000-memory.dmp

Download

memory/2728-309-0x00000000076F0000-0x000000000770A000-memory.dmp

Download

memory/2728-308-0x0000000007D30000-0x00000000083AC000-memory.dmp

Download

memory/2728-304-0x00000000075B0000-0x00000000075D0000-memory.dmp

Download

memory/2728-297-0x0000000070360000-0x00000000706BB000-memory.dmp

Download

memory/2728-296-0x00000000700D0000-0x000000007011C000-memory.dmp

Download

memory/2728-295-0x0000000007570000-0x00000000075A6000-memory.dmp

Download

memory/2728-274-0x00000000028A0000-0x00000000028D6000-memory.dmp

Download

memory/2728-291-0x00000000065A0000-0x00000000065E8000-memory.dmp

Download

memory/2728-275-0x00000000053A0000-0x00000000059EA000-memory.dmp

Download

memory/2728-277-0x0000000005210000-0x0000000005232000-memory.dmp

Download

memory/2728-278-0x0000000005A60000-0x0000000005AC6000-memory.dmp

Download

memory/2728-279-0x0000000005AD0000-0x0000000005B36000-memory.dmp

Download

memory/2728-287-0x0000000006140000-0x000000000615E000-memory.dmp

Download

memory/2728-285-0x0000000005C00000-0x0000000005F5B000-memory.dmp

Download

memory/4824-176-0x0000000000A50000-0x00000000016A7000-memory.dmp

Download

memory/4824-329-0x0000000000A50000-0x00000000016A7000-memory.dmp

Download

memory/4824-48-0x0000000000A50000-0x00000000016A7000-memory.dmp

Download

memory/4824-41-0x0000000000A50000-0x00000000016A7000-memory.dmp

Download

memory/5192-12-0x00007FFFF9C40000-0x00007FFFFA5E4000-memory.dmp

Download

memory/5192-1-0x0000000000C70000-0x00000000015F2000-memory.dmp

Download

memory/5192-9-0x00007FFFF9C40000-0x00007FFFFA5E4000-memory.dmp

Download

memory/5192-0-0x00007FFFF9DCF000-0x00007FFFF9DD0000-memory.dmp

Download

memory/5192-2-0x00007FFFF9C40000-0x00007FFFFA5E4000-memory.dmp

Download

memory/5192-19-0x00007FFFF9C40000-0x00007FFFFA5E4000-memory.dmp

Download

memory/6436-121-0x00007FF81C160000-0x00007FF81C161000-memory.dmp

Download

memory/6488-330-0x0000000000A50000-0x00000000016A7000-memory.dmp

Download

memory/6904-35-0x00000000003A0000-0x0000000000FF7000-memory.dmp

Download

memory/6904-26-0x00000000003A0000-0x0000000000FF7000-memory.dmp

Download

memory/6904-21-0x00000000003A0000-0x0000000000FF7000-memory.dmp

Download

memory/6904-20-0x00000000003A0000-0x0000000000FF7000-memory.dmp

Download

memory/7112-290-0x0000000000370000-0x0000000000FC7000-memory.dmp

Download

memory/7112-276-0x0000000000370000-0x0000000000FC7000-memory.dmp

Download

memory/7148-136-0x00007FF81C160000-0x00007FF81C161000-memory.dmp

Download