Overview

overview

8

Static

static

3

J.exe

windows11-21h2-x64

7

J.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    143s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    16/08/2026, 21:53

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    J.exe
  • Size 6.0MB
  • Sample260816-1r1rnsysb1
  • SHA256 6fad1fa7397970c71464183ad8aab7d158d799eba54c0fdd8573a21b6da37c1e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryinstallerransomwarespywaretrojan

Malware Config

Signatures

  • Downloads MZ/PE file 1 IoCs
  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 12 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

    defense_evasion
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
    defense_evasionspywaretrojan
  • NTFS ADS 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\J.exe
    "C:\Users\Admin\AppData\Local\Temp\J.exe"
    1⤵
    • Modifies trusted root certificate store through registry
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:2672
    • C:\Users\Admin\AppData\Local\Temp\NodeDistro-WinGet-1091474544\portable\winget.exe
      C:\Users\Admin\AppData\Local\Temp\NodeDistro-WinGet-1091474544\portable\winget.exe --version
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:3440
    • C:\Users\Admin\AppData\Local\Temp\NodeDistro-WinGet-1091474544\portable\winget.exe
      C:\Users\Admin\AppData\Local\Temp\NodeDistro-WinGet-1091474544\portable\winget.exe install --id Proton.ProtonVPN --exact --source winget --silent --accept-package-agreements --accept-source-agreements --disable-interactivity
      2⤵
      • Downloads MZ/PE file
      • Executes dropped EXE
      • Loads dropped DLL
      • Subvert Trust Controls: Mark-of-the-Web Bypass
      • Modifies registry class
      • NTFS ADS
      • Suspicious use of WriteProcessMemory
      PID:3428
      • C:\Users\Admin\AppData\Local\Temp\WinGet\defaultState\Proton.ProtonVPN.5.1.7\ProtonVPN_v5.1.7_x64.exe
        "C:\Users\Admin\AppData\Local\Temp\WinGet\defaultState\Proton.ProtonVPN.5.1.7\ProtonVPN_v5.1.7_x64.exe" /SP- /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /LOG="C:\Users\Admin\AppData\Local\Temp\WinGet\defaultState\Proton.ProtonVPN.5.1.7-26-08-16-22-55-20.log"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1932
        • C:\Users\Admin\AppData\Local\Temp\is-EKDCKW6EI3.tmp\ProtonVPN_v5.1.7_x64.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-EKDCKW6EI3.tmp\ProtonVPN_v5.1.7_x64.tmp" /SL5="$B0094,128731564,1139200,C:\Users\Admin\AppData\Local\Temp\WinGet\defaultState\Proton.ProtonVPN.5.1.7\ProtonVPN_v5.1.7_x64.exe" /SP- /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /LOG="C:\Users\Admin\AppData\Local\Temp\WinGet\defaultState\Proton.ProtonVPN.5.1.7-26-08-16-22-55-20.log"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:4088
          • C:\Users\Admin\AppData\Local\Temp\is-MYOHGGTNO0.tmp\VC_redist.x64.exe
            "C:\Users\Admin\AppData\Local\Temp\is-MYOHGGTNO0.tmp\VC_redist.x64.exe" /install /quiet /norestart
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:5300
            • C:\Windows\Temp\{5275D9F1-F1C8-4F98-B7B1-53E64AA04F4C}\.cr\VC_redist.x64.exe
              "C:\Windows\Temp\{5275D9F1-F1C8-4F98-B7B1-53E64AA04F4C}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-MYOHGGTNO0.tmp\VC_redist.x64.exe" -burn.filehandle.attached=748 -burn.filehandle.self=752 /install /quiet /norestart
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4080
              • C:\Windows\Temp\{9BCACD76-D3BF-469E-B7CE-9BB2D1477D1B}\.be\VC_redist.x64.exe
                "C:\Windows\Temp\{9BCACD76-D3BF-469E-B7CE-9BB2D1477D1B}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{2956720F-93B7-45BB-A37D-1BB09DBFCD47} {9DE3B237-F321-41ED-BDBC-71D7314952F8} 4080
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:1444
  • C:\Program Files\Proton\VPN\v5.1.7\ProtonVPNService.exe
    "C:\Program Files\Proton\VPN\v5.1.7\ProtonVPNService.exe"
    1⤵
    • Executes dropped EXE
    PID:4560
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:4864
  • C:\Windows\system32\srtasks.exe
    C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3832

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        ProtonVPN.Launcher.exe
        • Path C:\Program Files\Proton\VPN\ProtonVPN.Launcher.exe
        • Size 17.9MB
        • SHA256 bf83f90b2994d8f086459f80bba0c78281bd44130c3af4ea6ddc812268fb3d4f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ProtonVPNService.deps.json
        • Path C:\Program Files\Proton\VPN\v5.1.7\ProtonVPNService.deps.json
        • Size 368KB
        • SHA256 59e4139e760853d26ac3cd777fe88f76d3df141fa187c77c62493835e888b5a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ProtonVPNService.exe
        • Path C:\Program Files\Proton\VPN\v5.1.7\ProtonVPNService.exe
        • Size 466KB
        • SHA256 2fb398f9d7b75bfad4c751d3d8b813871345c3982bd41eaad012f79e89c1a217
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ProtonVPNService.runtimeconfig.json
        • Path C:\Program Files\Proton\VPN\v5.1.7\ProtonVPNService.runtimeconfig.json
        • Size 629B
        • SHA256 3533261fd47a7c17c49346a1e536e497a9a69c986d9181fc625b14856edb7a05
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        is-BHCUD48SRS.tmp
        • Path C:\Program Files\Proton\VPN\v5.1.7\is-BHCUD48SRS.tmp
        • Size 237KB
        • SHA256 1d99a14ae2322bf36f9fe6553df0c20911c9d11e9d4d849778f311e031b8427d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        source.msix.dnld.msix
        • Path C:\Users\Admin\AppData\Local\Microsoft\WinGet\State\defaultState\Microsoft.PreIndexed.Package\Microsoft.Winget.Source_8wekyb3d8bbwe\source.msix.dnld.msix
        • Size 3.3MB
        • SHA256 9845b104fb2471a6e74e9114a5104bd6dd84adfe4bb105783d925024331bed46
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        APPX.euty78v1jun0_7mlj96s3wqid.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\APPX.euty78v1jun0_7mlj96s3wqid.tmp
        • Size 2KB
        • SHA256 7f72f44b02cf3ea124cf47be89741e61a2897187014c0e516e3b13b23ba381b4
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        APPX.npcydk88u5_dmgmnrzo4j9s1f.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\APPX.npcydk88u5_dmgmnrzo4j9s1f.tmp
        • Size 11KB
        • SHA256 22490e2af358703eb3475ccb07b5cb8330746836dc4efe371cb86f55d4013203
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        APPX.rj3h9aohwfbbwuefkw7rxflmg.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\APPX.rj3h9aohwfbbwuefkw7rxflmg.tmp
        • Size 11KB
        • SHA256 972ef9c526edbe0d3b3355663d788d813efd6642af9abfd42a92405118c7533a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppPackageAppList.targetsize-48_contrast-black.png
        • Path C:\Users\Admin\AppData\Local\Temp\NodeDistro-WinGet-1091474544\portable\Assets\contrast-black\AppPackageAppList.targetsize-48_contrast-black.png
        • Size 368B
        • SHA256 fb211ca16725f640fc2e7454304f2c4da34edb3483d3065ea8c08758828ba9e7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        MSVCP140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\NodeDistro-WinGet-1091474544\portable\MSVCP140.dll
        • Size 551KB
        • SHA256 fd96b594b1f418852893de4cb960f74b43d6905d9966c5532263ca619c9dafc7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\NodeDistro-WinGet-1091474544\portable\VCRUNTIME140.dll
        • Size 107KB
        • SHA256 c4ae88c9eb48d63b23560f2e5babbdbf129e3787127688d5383415bbc7347b59
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\NodeDistro-WinGet-1091474544\portable\VCRUNTIME140_1.dll
        • Size 38KB
        • SHA256 63b9a905cfb0c822d403e2a511ffa4132b1433285530b3cc062f41e8e0a274ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WindowsPackageManager.dll
        • Path C:\Users\Admin\AppData\Local\Temp\NodeDistro-WinGet-1091474544\portable\WindowsPackageManager.dll
        • Size 7.2MB
        • SHA256 2a1bfc8de845848aa02095f286e0ff21cb68b5a3c26e0c239fe8acb7777a1aca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        concrt140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\NodeDistro-WinGet-1091474544\portable\concrt140.dll
        • Size 305KB
        • SHA256 e02aefc7967e98c6372d68ad70405e9a78ebb899f385985ae9e263e10745f9fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        resources.pri
        • Path C:\Users\Admin\AppData\Local\Temp\NodeDistro-WinGet-1091474544\portable\resources.pri
        • Size 200KB
        • SHA256 31275da2cf1dece0706aca9ecfec0e17adb872f278f287734c5d9caf74a7aaaf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        winget.exe
        • Path C:\Users\Admin\AppData\Local\Temp\NodeDistro-WinGet-1091474544\portable\winget.exe
        • Size 22KB
        • SHA256 f6e83654df097dae90c1e725ecb25c4781b540d3f91d1c64992a3fd96e1b6cbe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WinGet-2026-08-16-22-54-54.047.log
        • Path C:\Users\Admin\AppData\Local\Temp\WinGet\defaultState\WinGet-2026-08-16-22-54-54.047.log
        • Size 771B
        • SHA256 8a3c4161eee9d55ea62daff8ffd57b14780c92304c86d9d20aec65ad8ace5c47
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ProtonVPN_v5.1.7_x64.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\is-EKDCKW6EI3.tmp\ProtonVPN_v5.1.7_x64.tmp
        • Size 3.8MB
        • SHA256 66952413b8db14e063825c461b1cb8036e2ef123e094ced762e6b89c9626bf7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ProtonVPN.InstallActions.x86.dll
        • Path C:\Users\Admin\AppData\Local\Temp\is-MYOHGGTNO0.tmp\ProtonVPN.InstallActions.x86.dll
        • Size 460KB
        • SHA256 bd51e20ef2ca443d772e1b9bad20615a90ef2d89be95c8f78d072f903872870c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VC_redist.x64.exe
        • Path C:\Users\Admin\AppData\Local\Temp\is-MYOHGGTNO0.tmp\VC_redist.x64.exe
        • Size 17.9MB
        • SHA256 843068991daaa1f73ad9f6239bce4d0f6a07a51f18c37ea2a867e9beca71295c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VC_redist.x64.exe
        • Path C:\Windows\Temp\{5275D9F1-F1C8-4F98-B7B1-53E64AA04F4C}\.cr\VC_redist.x64.exe
        • Size 615KB
        • SHA256 dbcc159853d8b83c1df0a0a698127ab98e926af1b6dee86e96f541dc94b34948
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        logo.png
        • Path C:\Windows\Temp\{9BCACD76-D3BF-469E-B7CE-9BB2D1477D1B}\.ba\logo.png
        • Size 1KB
        • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        wixstdba.dll
        • Path C:\Windows\Temp\{9BCACD76-D3BF-469E-B7CE-9BB2D1477D1B}\.ba\wixstdba.dll
        • Size 215KB
        • SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1932-2012-0x0000000000220000-0x0000000000345000-memory.dmp
        Download

        memory/1932-943-0x0000000000220000-0x0000000000345000-memory.dmp
        Download

        memory/1932-3438-0x0000000000220000-0x0000000000345000-memory.dmp
        Download

        memory/4088-955-0x0000000003D70000-0x0000000003EB0000-memory.dmp
        Download

        memory/4088-2015-0x0000000000820000-0x0000000000C01000-memory.dmp
        Download

        memory/4088-3421-0x0000000000820000-0x0000000000C01000-memory.dmp
        Download

        memory/4088-3437-0x0000000000820000-0x0000000000C01000-memory.dmp
        Download