Analysis
- max time kernel
31s - max time network
40s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/08/2026, 04:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jjsploit_8.16.15_x64_en-US.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
25 signatures
150 seconds
Behavioral task
behavioral2
Sample
jjsploit_8.16.15_x64_en-US.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target jjsploit_8.16.15_x64_en-US.msi
- Size 5.1MB
- Sample260801-emgmcadd38
- SHA256 836e40ceb7f9172d7da29a32ab232e11795cf2cd73a217def60cf81c21dab299
- MD5 8ee74a53af1e3ead8211d9a245f33391
- SHA1 f15638441acc3b5e2b0c21d05ff1579d99d2ddcf
- SHA512 ef3326abc480ee73f94a39ebc79a820841129649e3355600a2ea0b9c0d3364e99522ba8fb1a7fe5e8d7195e1fbf80a80ce37f8232e61346c7ef60bcccc3b988a
- SSDEEP 98304:uT9Y/t/W7KqHjJ3UM5zxCHI2FFgNKr35rWjgH8PZxuTnI3bnQC/+GiQdQm:Ow/CKqDJ3HNxkXgEKjgHIaI3bQy+
- TLSH T1BD36331BBE86D532E8575F7A083ED3918A2F7C20850684433669375DCCF26C26D74EEA
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
pid Process 3336 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 120 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000392849c4232396370000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801392849c40000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101392849c4000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3392849c400000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6392849c400000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 120 msiexec.exe Token: SeIncreaseQuotaPrivilege 120 msiexec.exe Token: SeSecurityPrivilege 676 msiexec.exe Token: SeCreateTokenPrivilege 120 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 120 msiexec.exe Token: SeLockMemoryPrivilege 120 msiexec.exe Token: SeIncreaseQuotaPrivilege 120 msiexec.exe Token: SeMachineAccountPrivilege 120 msiexec.exe Token: SeTcbPrivilege 120 msiexec.exe Token: SeSecurityPrivilege 120 msiexec.exe Token: SeTakeOwnershipPrivilege 120 msiexec.exe Token: SeLoadDriverPrivilege 120 msiexec.exe Token: SeSystemProfilePrivilege 120 msiexec.exe Token: SeSystemtimePrivilege 120 msiexec.exe Token: SeProfSingleProcessPrivilege 120 msiexec.exe Token: SeIncBasePriorityPrivilege 120 msiexec.exe Token: SeCreatePagefilePrivilege 120 msiexec.exe Token: SeCreatePermanentPrivilege 120 msiexec.exe Token: SeBackupPrivilege 120 msiexec.exe Token: SeRestorePrivilege 120 msiexec.exe Token: SeShutdownPrivilege 120 msiexec.exe Token: SeDebugPrivilege 120 msiexec.exe Token: SeAuditPrivilege 120 msiexec.exe Token: SeSystemEnvironmentPrivilege 120 msiexec.exe Token: SeChangeNotifyPrivilege 120 msiexec.exe Token: SeRemoteShutdownPrivilege 120 msiexec.exe Token: SeUndockPrivilege 120 msiexec.exe Token: SeSyncAgentPrivilege 120 msiexec.exe Token: SeEnableDelegationPrivilege 120 msiexec.exe Token: SeManageVolumePrivilege 120 msiexec.exe Token: SeImpersonatePrivilege 120 msiexec.exe Token: SeCreateGlobalPrivilege 120 msiexec.exe Token: SeCreateTokenPrivilege 120 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 120 msiexec.exe Token: SeLockMemoryPrivilege 120 msiexec.exe Token: SeIncreaseQuotaPrivilege 120 msiexec.exe Token: SeMachineAccountPrivilege 120 msiexec.exe Token: SeTcbPrivilege 120 msiexec.exe Token: SeSecurityPrivilege 120 msiexec.exe Token: SeTakeOwnershipPrivilege 120 msiexec.exe Token: SeLoadDriverPrivilege 120 msiexec.exe Token: SeSystemProfilePrivilege 120 msiexec.exe Token: SeSystemtimePrivilege 120 msiexec.exe Token: SeProfSingleProcessPrivilege 120 msiexec.exe Token: SeIncBasePriorityPrivilege 120 msiexec.exe Token: SeCreatePagefilePrivilege 120 msiexec.exe Token: SeCreatePermanentPrivilege 120 msiexec.exe Token: SeBackupPrivilege 120 msiexec.exe Token: SeRestorePrivilege 120 msiexec.exe Token: SeShutdownPrivilege 120 msiexec.exe Token: SeDebugPrivilege 120 msiexec.exe Token: SeAuditPrivilege 120 msiexec.exe Token: SeSystemEnvironmentPrivilege 120 msiexec.exe Token: SeChangeNotifyPrivilege 120 msiexec.exe Token: SeRemoteShutdownPrivilege 120 msiexec.exe Token: SeUndockPrivilege 120 msiexec.exe Token: SeSyncAgentPrivilege 120 msiexec.exe Token: SeEnableDelegationPrivilege 120 msiexec.exe Token: SeManageVolumePrivilege 120 msiexec.exe Token: SeImpersonatePrivilege 120 msiexec.exe Token: SeCreateGlobalPrivilege 120 msiexec.exe Token: SeCreateTokenPrivilege 120 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 120 msiexec.exe Token: SeLockMemoryPrivilege 120 msiexec.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 120 msiexec.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 120 msiexec.exe 676 msiexec.exe 3336 MsiExec.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 676 wrote to memory of 3336 676 msiexec.exe 91 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\jjsploit_8.16.15_x64_en-US.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:120
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:676 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 69A85D70374D1F939F5039EBAEFBB1B8 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3336
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:6544
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:1108
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e5a19a5.rbs
- Size 21KB
- SHA256 8eba60b0cac67f5849d2bb48b66596832ca62f45e380c1dc4f1fa54406d1e93d
- MD5 8cbd49e8b4e3036c39e051153a77d9e7
- SHA1 450f2372ac2a2e3173aa9737b262a22e8fee6373
- SHA512 7f758f593ce9c00419240fa120d5da0ad28e6375fc6b9653731080942f4c6cadd71150e58502fa69b93b0ff23ade359c29e5274939c8b22aa4fa47a0b6ddde07
- SSDEEP 384:2sAl7bh3tsokoTiYy6wxVSXtzT6WzIst8t8t8t0tststststststststitztztbs:2sAl7bh3tsokoTiYy6wxVSXtzT6WzIsv
- TLSH T1E5A2F1865E00C292E25B1774DAEB93083732C99EA3D8921B42CD933A9D937C43FF595D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\jjsploit\jjsploit.exe
- Size 13.4MB
- SHA256 047377af651bd31c4af2cb988e8c95c5f1ecb1a2d138b41bd807ecad579aa349
- MD5 760729893bec312b108142a142cf9677
- SHA1 53304e185ddd904bf6eecca905f6806fb63393e8
- SHA512 336fd1319082443813dff82ef856b0dd6405e94d50313544e19492c838e1eb1370b53dce575dd9f4df31d87eb5bcab3c9a1169dd88a7bfe1c0640c5665261464
- SSDEEP 98304:iy1tisBEm59sHJMhtjp0uMNLHVoznkEfjqkneSdPiuZZIPezRWP8972qfSwkVkph:iQrsHJItj+Or7gkpRGtuJ
- TLSH T14DE6C524BE9B59ACD15EC4B0834B86764D3874CF0B3478FF888596342F6ABF41F28659
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\jjsploit\jjsploit.lnk
- Size 1KB
- SHA256 9870307fe39c105d62f87f908cede1f665b811fe3115b1e3dc5a42eac5c18efe
- MD5 31c255277b0f33fcbc72a746c1fc5083
- SHA1 c569b3e6ec0eaff4ebb4f83d2ca7b0e7ebd4e8fc
- SHA512 0f3dadb19183f40605c23872be26624b73bb30c8d6528bd668dfeea81faeb19819e9c9beee9b2d4c8336a1cf6d265accdfba7e667ace4793ebdf4ab83e1abc9b
- TLSH T17441D02056E50326F3B6467A6EA11752963AFC26E6B49E668085418E0428204E5BDF7E
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\jjsploit\jjsploit.lnk~RFe5a21d1.TMP
- Size 1KB
- SHA256 d9616eb9d89813068aa8b6351b6b6470e3ccd040cf2ab08700c5cd96762ad262
- MD5 30717f21513d745a7034c2f518da56b7
- SHA1 aa930f7b0373f48eaeb8c4f93153aa649c8c6588
- SHA512 bae494a45b3568ec94fd9f6c50a88191c3daac41181a7eeec2eae7c9007aa6870c2fa4f265e91e0eea46724c886bf4bd4fda44bc956d871f6b397e268223bb2c
- TLSH T11B41F12016F10726F3B6867E2F921752D63EFC35E6B49F67808202CE0428604E5B9F7E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIBFBC.tmp
- Size 132KB
- SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
- MD5 cfbb8568bd3711a97e6124c56fcfa8d9
- SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
- SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
- SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
- TLSH T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e5a19a4.msi
- Size 5.1MB
- SHA256 836e40ceb7f9172d7da29a32ab232e11795cf2cd73a217def60cf81c21dab299
- MD5 8ee74a53af1e3ead8211d9a245f33391
- SHA1 f15638441acc3b5e2b0c21d05ff1579d99d2ddcf
- SHA512 ef3326abc480ee73f94a39ebc79a820841129649e3355600a2ea0b9c0d3364e99522ba8fb1a7fe5e8d7195e1fbf80a80ce37f8232e61346c7ef60bcccc3b988a
- SSDEEP 98304:uT9Y/t/W7KqHjJ3UM5zxCHI2FFgNKr35rWjgH8PZxuTnI3bnQC/+GiQdQm:Ow/CKqDJ3HNxkXgEKjgHIaI3bQy+
- TLSH T1BD36331BBE86D532E8575F7A083ED3918A2F7C20850684433669375DCCF26C26D74EEA
- MD5 SHA1 SHA512 SSDEEP TLSH