Analysis
- user interaction
yes - max time kernel
46s - max time network
49s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
20/08/2026, 02:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jjsploit_8.18.9_x64_en-US.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
22 signatures
150 seconds
Behavioral task
behavioral2
Sample
jjsploit_8.18.9_x64_en-US.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
General
- Target jjsploit_8.18.9_x64_en-US.msi
- Size 6.1MB
- Sample260820-dfnxeabb27
- SHA256 85bd7c04a0d0fe935e405b4a912f99c90a4af8057d249a57e3c5f585de7d1897
- MD5 7693db1cb7d7689b617f8e44542ff874
- SHA1 920c5fde620e7b37c1aa709b899cc56fc8efe41b
- SHA512 143221225fa6648466f16047e1aa43f7511b09113025265e5418eb6a7d69874447b3a01a5e2cbb9b49beb9fa978f0e80a4fce93b0390f98c1135cf91cdd892d4
- SSDEEP 196608:U4LsjzUq3/VPb7bi655ZYPUg7Vs7jAEx9vqUQAI:UEsMq3/VH/55ZYcg7G3AETvUAI
- TLSH T1B55633537D40AD32C4968D7A543ECB6ADB78BCA01A91AD173268731ECCF22D06D786D2
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4640 jjsploit.exe - Loads dropped DLL 1 IoCs
pid Process 436 MsiExec.exe - Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA jjsploit.exe - Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 92 raw.githubusercontent.com 93 raw.githubusercontent.com - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe - Drops file in Program Files directory 21 IoCs
description ioc Process File created C:\Program Files\jjsploit\jjsploit.exe msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\general\chattroll.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\animations\levitate.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\jailbreak\walkspeed.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\jailbreak\criminalesp.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\jailbreak\removewalls.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\general\aimbot.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\general\multidimensionalcharacter.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\animations\jumpland.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\animations\energizegui.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\animations\dab.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\animations\walkthrough.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\general\teleportto.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\jailbreak\policeesp.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\general\fly.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\beesim\autodig.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\general\tptool.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\general\infinitejump.lua msiexec.exe File created C:\Program Files\jjsploit\Uninstall jjsploit.lnk msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\general\god.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\general\noclip.lua msiexec.exe - Drops file in Windows directory 10 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI9F19.tmp msiexec.exe File created C:\Windows\Installer\{B0A7DDA5-1A44-46F9-A747-29B5B200830E}\ProductIcon msiexec.exe File opened for modification C:\Windows\Installer\{B0A7DDA5-1A44-46F9-A747-29B5B200830E}\ProductIcon msiexec.exe File created C:\Windows\Installer\e589dc4.msi msiexec.exe File opened for modification C:\Windows\Installer\e589dc2.msi msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{B0A7DDA5-1A44-46F9-A747-29B5B200830E} msiexec.exe File created C:\Windows\Installer\e589dc2.msi msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 3244 msiexec.exe - Modifies trusted root certificate store through registry 1 TTPs 2 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 jjsploit.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 jjsploit.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ee0681d78f5363a20000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000ee0681d70000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900ee0681d7000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1aee0681d7000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dee0681d7000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedgewebview2.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedgewebview2.exe - Modifies data under HKEY_USERS 5 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedgewebview2.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134316682843481029" msedgewebview2.exe - Modifies registry class 26 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5ADD7A0B44A19F647A74925B2B0038E0\Environment = "MainProgram" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ADD7A0B44A19F647A74925B2B0038E0\ProductName = "jjsploit" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ADD7A0B44A19F647A74925B2B0038E0\ProductIcon = "C:\\Windows\\Installer\\{B0A7DDA5-1A44-46F9-A747-29B5B200830E}\\ProductIcon" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\03D213AD8BB2E544BA57872C4637158D\5ADD7A0B44A19F647A74925B2B0038E0 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5ADD7A0B44A19F647A74925B2B0038E0\External msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ADD7A0B44A19F647A74925B2B0038E0 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ADD7A0B44A19F647A74925B2B0038E0\Version = "135397385" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ADD7A0B44A19F647A74925B2B0038E0\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ADD7A0B44A19F647A74925B2B0038E0\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ADD7A0B44A19F647A74925B2B0038E0\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\03D213AD8BB2E544BA57872C4637158D msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ADD7A0B44A19F647A74925B2B0038E0\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ADD7A0B44A19F647A74925B2B0038E0\PackageCode = "A1407C0F842ECFE46AEAB893CE415555" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ADD7A0B44A19F647A74925B2B0038E0\Language = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ADD7A0B44A19F647A74925B2B0038E0\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ADD7A0B44A19F647A74925B2B0038E0\SourceList\PackageName = "jjsploit_8.18.9_x64_en-US.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ADD7A0B44A19F647A74925B2B0038E0\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ADD7A0B44A19F647A74925B2B0038E0\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5ADD7A0B44A19F647A74925B2B0038E0 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5ADD7A0B44A19F647A74925B2B0038E0\MainProgram msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ADD7A0B44A19F647A74925B2B0038E0\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ADD7A0B44A19F647A74925B2B0038E0\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ADD7A0B44A19F647A74925B2B0038E0\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ADD7A0B44A19F647A74925B2B0038E0\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ADD7A0B44A19F647A74925B2B0038E0\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5ADD7A0B44A19F647A74925B2B0038E0\ShortcutsFeature = "MainProgram" msiexec.exe - Modifies system certificate store 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 jjsploit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0 jjsploit.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 0f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df02000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18 jjsploit.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 19000000010000001000000076935b5c5a037216daaf8aac76df42c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf1576142000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18 jjsploit.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1784 msiexec.exe 1784 msiexec.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 3152 msedgewebview2.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3244 msiexec.exe Token: SeIncreaseQuotaPrivilege 3244 msiexec.exe Token: SeSecurityPrivilege 1784 msiexec.exe Token: SeCreateTokenPrivilege 3244 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3244 msiexec.exe Token: SeLockMemoryPrivilege 3244 msiexec.exe Token: SeIncreaseQuotaPrivilege 3244 msiexec.exe Token: SeMachineAccountPrivilege 3244 msiexec.exe Token: SeTcbPrivilege 3244 msiexec.exe Token: SeSecurityPrivilege 3244 msiexec.exe Token: SeTakeOwnershipPrivilege 3244 msiexec.exe Token: SeLoadDriverPrivilege 3244 msiexec.exe Token: SeSystemProfilePrivilege 3244 msiexec.exe Token: SeSystemtimePrivilege 3244 msiexec.exe Token: SeProfSingleProcessPrivilege 3244 msiexec.exe Token: SeIncBasePriorityPrivilege 3244 msiexec.exe Token: SeCreatePagefilePrivilege 3244 msiexec.exe Token: SeCreatePermanentPrivilege 3244 msiexec.exe Token: SeBackupPrivilege 3244 msiexec.exe Token: SeRestorePrivilege 3244 msiexec.exe Token: SeShutdownPrivilege 3244 msiexec.exe Token: SeDebugPrivilege 3244 msiexec.exe Token: SeAuditPrivilege 3244 msiexec.exe Token: SeSystemEnvironmentPrivilege 3244 msiexec.exe Token: SeChangeNotifyPrivilege 3244 msiexec.exe Token: SeRemoteShutdownPrivilege 3244 msiexec.exe Token: SeUndockPrivilege 3244 msiexec.exe Token: SeSyncAgentPrivilege 3244 msiexec.exe Token: SeEnableDelegationPrivilege 3244 msiexec.exe Token: SeManageVolumePrivilege 3244 msiexec.exe Token: SeImpersonatePrivilege 3244 msiexec.exe Token: SeCreateGlobalPrivilege 3244 msiexec.exe Token: SeCreateTokenPrivilege 3244 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3244 msiexec.exe Token: SeLockMemoryPrivilege 3244 msiexec.exe Token: SeIncreaseQuotaPrivilege 3244 msiexec.exe Token: SeMachineAccountPrivilege 3244 msiexec.exe Token: SeTcbPrivilege 3244 msiexec.exe Token: SeSecurityPrivilege 3244 msiexec.exe Token: SeTakeOwnershipPrivilege 3244 msiexec.exe Token: SeLoadDriverPrivilege 3244 msiexec.exe Token: SeSystemProfilePrivilege 3244 msiexec.exe Token: SeSystemtimePrivilege 3244 msiexec.exe Token: SeProfSingleProcessPrivilege 3244 msiexec.exe Token: SeIncBasePriorityPrivilege 3244 msiexec.exe Token: SeCreatePagefilePrivilege 3244 msiexec.exe Token: SeCreatePermanentPrivilege 3244 msiexec.exe Token: SeBackupPrivilege 3244 msiexec.exe Token: SeRestorePrivilege 3244 msiexec.exe Token: SeShutdownPrivilege 3244 msiexec.exe Token: SeDebugPrivilege 3244 msiexec.exe Token: SeAuditPrivilege 3244 msiexec.exe Token: SeSystemEnvironmentPrivilege 3244 msiexec.exe Token: SeChangeNotifyPrivilege 3244 msiexec.exe Token: SeRemoteShutdownPrivilege 3244 msiexec.exe Token: SeUndockPrivilege 3244 msiexec.exe Token: SeSyncAgentPrivilege 3244 msiexec.exe Token: SeEnableDelegationPrivilege 3244 msiexec.exe Token: SeManageVolumePrivilege 3244 msiexec.exe Token: SeImpersonatePrivilege 3244 msiexec.exe Token: SeCreateGlobalPrivilege 3244 msiexec.exe Token: SeCreateTokenPrivilege 3244 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3244 msiexec.exe Token: SeLockMemoryPrivilege 3244 msiexec.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 3244 msiexec.exe 3244 msiexec.exe 3244 msiexec.exe 4640 jjsploit.exe - Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1784 wrote to memory of 436 1784 msiexec.exe 94 PID 1784 wrote to memory of 3344 1784 msiexec.exe 103 PID 3244 wrote to memory of 4640 3244 msiexec.exe 108 PID 4640 wrote to memory of 3152 4640 jjsploit.exe 109 PID 3152 wrote to memory of 716 3152 msedgewebview2.exe 110 PID 3152 wrote to memory of 3844 3152 msedgewebview2.exe 111 PID 3152 wrote to memory of 3844 3152 msedgewebview2.exe 111 PID 3152 wrote to memory of 3844 3152 msedgewebview2.exe 111 PID 3152 wrote to memory of 4672 3152 msedgewebview2.exe 112 PID 3152 wrote to memory of 2512 3152 msedgewebview2.exe 113 PID 3152 wrote to memory of 2512 3152 msedgewebview2.exe 113 PID 3152 wrote to memory of 1416 3152 msedgewebview2.exe 115 PID 3152 wrote to memory of 1416 3152 msedgewebview2.exe 115 PID 3152 wrote to memory of 1416 3152 msedgewebview2.exe 115 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\jjsploit_8.18.9_x64_en-US.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\Program Files\jjsploit\jjsploit.exe"C:\Program Files\jjsploit\jjsploit.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies trusted root certificate store through registry
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=jjsploit.exe --webview-exe-version=8.18.9 --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=4640.1804.543845118616550053⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ff90647b078,0x7ff90647b084,0x7ff90647b0904⤵PID:716
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.18.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1744,i,1910349559470576893,2757562003600118843,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1736 /prefetch:24⤵PID:3844
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.18.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2052,i,1910349559470576893,2757562003600118843,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2068 /prefetch:34⤵PID:4672
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.18.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2384,i,1910349559470576893,2757562003600118843,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:84⤵PID:2512
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.18.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3660,i,1910349559470576893,2757562003600118843,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:14⤵PID:1416
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 9B4ABB864C24684B6E8E6D59A0D8E6BE C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:436
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:3344
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:4028
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
1Subvert Trust Controls
2Install Root Certificate
2System Binary Proxy Execution
1Msiexec
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e589dc3.rbs
- Size 20KB
- SHA256 42776551da219bb991243bbca3daa5107a86df051e4d88653e7eb1b9e3f4356d
- MD5 7dcf378eb1c1df29861aebc8f4bcc0f2
- SHA1 3385eef557f371d379a4eed1638c4142187b1b82
- SHA512 e8d9e903476aa3547e413b155d64643065c509a522bcd7d5ccf9b32af67e5db869ba2b736ad56d16cbbef19797978c82af72e877a72188c9e19392667e674356
- SSDEEP 384:xT/avRzKSJaHWqCQJca87rg/1WpCkt8t8t8t0tstststststststitztztzBsBtB:V/avRzKSJaHWqCQJca87rW1WpCkt8t8I
- TLSH T1C2A265415E10C6A2E2A71674EFA757143732C5CE6398624B868C5329CD833D43FB9FAE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\jjsploit\jjsploit.exe
- Size 17.7MB
- SHA256 0c070f2230646cf5f9f1b691710aabd5dbbd42294d637c41f96474fab58bca35
- MD5 762a2f8d76cc09e1386c3130cbd29bce
- SHA1 ef444f154a2586649955c014b729062e09820688
- SHA512 4975fa427d1e95bfa9024adbd9f1c559d13920752c0e4db84eebd4248472dd1069406862da86453963654d6cf5b1c8aa3e35f47ba60e27229420cdb8f1812214
- SSDEEP 98304:E/IIxyGdVApJB4MzUrJmyHivajp522OG2ElqHF8JUu6X7LGZt+tqpMbqWj+74X/p:EXdVApJBmHivkoElqKUHpW4X/5FjO6
- TLSH T19017E725BE9B596CD05FC474834B8A724A7430CB0B35A9FF488596382F6EBF41F38259
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\jjsploit\jjsploit.lnk
- Size 1KB
- SHA256 afed9ba5017eb666a25e7c5768e49271758825a0cdf0ea260d5939903e138dce
- MD5 fa01079b82f534aa67ca2b20a4f4bbdf
- SHA1 01036f4f719d8345cf86fc79c0c64160666aafab
- SHA512 a7da1e8759b0d643ca533e668bcc5f6f4ed5ddbf7c048c56729a33ef51d5a806ba3b666078098c5d52767dbdb33b436b5a133e66daba70b4d326c78531d31ae9
- TLSH T19A41D05012F62736E3B14E356AF507238A7BFC15EEA4DEE7808442CD1568200E5ACF7B
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\jjsploit\jjsploit.lnk~RFe58a6e9.TMP
- Size 1KB
- SHA256 159ff9b1bfb69b9da4bab06b7021f950f5f8c8c513860e83c4f5175bfe82c449
- MD5 2858ec1ffb0f58ccee56e457f2ff2a76
- SHA1 5c2a3b1c79ae561efdfe897522ea3c28907a9bae
- SHA512 16fad224cb8128ddbebedde24324480b8bcac205536ee8b4f1dfbe69f2e39998d9fbd1eb9b739367d61246e97ed1e03bd231c4b404f5c8c9917ba88d761c64e0
- TLSH T16741CD2012F62B26E3B14A353AF107228A7BFC15EEA09ED3808502CD0568204E56CF7B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI656C.tmp
- Size 132KB
- SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
- MD5 cfbb8568bd3711a97e6124c56fcfa8d9
- SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
- SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
- SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
- TLSH T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 18bdfbbcc37c09c050e0f36694f34a98a980e17c99a3099dd931dbf7b172e24e
- MD5 2727a7abec5a9be974849c12c9befee5
- SHA1 e2ccec52eff6f146c93e274580a4efd56c5e9045
- SHA512 942b90adf4c0e46bfc82b0dd09459aea2c6f7a861572a8e695dcd8d30e41aafa83b038b90194c3d149c148bb08c52bbc79cf854e27b15e954c3498a42b904c64
- TLSH T18DD0112233330238C82038332202A2080800CA0F828A8088A8B88A2F2B2C0A00A2B882
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 38eb5f3213c2fc8c8d61898ff2c71164c01e16fb83631892500026941fa342af
- MD5 bf0412301be92209238075757af27ed9
- SHA1 80bd8d098db1d485b9e03929ad8acdefd4bc6788
- SHA512 98b35f326548241cd111edf0a5801b044c8055bced904894373fb20cc8776f5ed56b25e7e4f9270f29180f2d5e5fbc0843942ba70faca13f724c8b0ef84f0092
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\throttle_store.dat
- Size 20B
- SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
- MD5 9e4e94633b73f4a7680240a0ffd6cd2c
- SHA1 e68e02453ce22736169a56fdb59043d33668368f
- SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\DawnWebGPUCache\data_0
- Size 8KB
- SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
- MD5 cf89d16bb9107c631daabf0c0ee58efb
- SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
- SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
- SSDEEP 3:MsFl:/F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\DawnWebGPUCache\data_1
- Size 264KB
- SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
- MD5 d0d388f3865d0523e451d6ba0be34cc4
- SHA1 8571c6a52aacc2747c048e3419e5657b74612995
- SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
- SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\DawnWebGPUCache\data_2
- Size 8KB
- SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
- MD5 0962291d6d367570bee5454721c17e11
- SHA1 59d10a893ef321a706a9255176761366115bedcb
- SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
- SSDEEP 3:MsHlDll:/H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\DawnWebGPUCache\data_3
- Size 8KB
- SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
- MD5 41876349cb12d6db992f1309f22df3f0
- SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
- SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
- SSDEEP 3:MsGl3ll:/y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Extension Rules\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Sync Data\LevelDB\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
- Size 1KB
- SHA256 278c8f1acab2afe5d606bcdc0a5f9ff12e5785fb7809cd3ad2848586221fa8d5
- MD5 a2aeaf544cb5b65b9f8cc9ff5f2f86fc
- SHA1 ed24e2877f5089360261906fd38a8e726e390278
- SHA512 7b75b595af01fb86f45548f93c99be93089f42940e2a742f82d279e17a397baa52ddacef7fcf51e684c5b43158950e5838e27a38e4c4ef45e75c6a55e3a2b2c0
- TLSH T1FA3145B2EC657F3668826A627512BA435EB0103AC0104F04B5FE871915F71DD562ED36
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
- Size 2KB
- SHA256 609a5196b75107bdcc6a0887b03e3bfb021a3f73a92c1217177b21a1012bc274
- MD5 7285307f9b9ccf9f3ebbce0f209249a7
- SHA1 41730e9707b6c66fe22c73a505b04189020ca728
- SHA512 177fbcf6863d761b8ce5d804c98ea20733a843111423accb75fad1fab87df4c2cd802321966e572237641525e8e831331be7cda222a5d35fab75c66944fb37ac
- TLSH T15E51C773BC25AF3748E36AA0B9467F13AAB5507691512F50A9EE0B1C01EB19C2306C77
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
- Size 3KB
- SHA256 926e0e1f08e9eacb8c83003ecaedee2ee5aa93f89fa568df0738083716266f50
- MD5 9342737fd498d0cebef400e6d72fead8
- SHA1 1686a0e2404e324ad80e0edbf07babe3b3f8b772
- SHA512 4bf8c82c3d9f256719e96c570e47b42648b60f77de8d706c5a4b5381d865f80ca3d51798d15a6c10e5064dd0b74bca152f1d685c6a73ddeca91faa407267be23
- TLSH T1F9717262AC75AA2B4DE3AE51B8863B12B7E15037D0903F94E9FD0F1C01EB2D82352C16
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State~RFe58e114.TMP
- Size 1KB
- SHA256 25d02e1b323b612fa22d9b5f1f98c6ad1856ab11cdceb703b194dda435901825
- MD5 71618392263753a104ab8fa4fdc5068e
- SHA1 578810ca3200479dd6ef4aa93b62363f7e592e69
- SHA512 276cf8a31ba0631b5153ed292a10ff1cf5d770d56bc284cffb1bf3069ac4d826756609fe516526af8b37e47c3d1916d0e168bc7aceb830843377e7fdb40f5da5
- TLSH T194214273D8697B3668816D61B112FA472EE0503A80105F08F5FF822916FB1DC573BC76
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\e589dc2.msi
- Size 6.1MB
- SHA256 85bd7c04a0d0fe935e405b4a912f99c90a4af8057d249a57e3c5f585de7d1897
- MD5 7693db1cb7d7689b617f8e44542ff874
- SHA1 920c5fde620e7b37c1aa709b899cc56fc8efe41b
- SHA512 143221225fa6648466f16047e1aa43f7511b09113025265e5418eb6a7d69874447b3a01a5e2cbb9b49beb9fa978f0e80a4fce93b0390f98c1135cf91cdd892d4
- SSDEEP 196608:U4LsjzUq3/VPb7bi655ZYPUg7Vs7jAEx9vqUQAI:UEsMq3/VH/55ZYcg7G3AETvUAI
- TLSH T1B55633537D40AD32C4968D7A543ECB6ADB78BCA01A91AD173268731ECCF22D06D786D2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 c63282237b20be3475277ed9aea94d9677ea151e31f52513fa1cf1b467ec9b00
- MD5 e0230586ed8987131b6779d95ff94e00
- SHA1 341b7ac1b25ead6018cbd4e00be0f04236ed6ab1
- SHA512 a4876986579f0d518d030a92441b9b91288245d25c37de92f5f17ceb3a4693d518bf67b09d855873c43a8bf994e8af2361d0fa148c0b90a3d62a67da95f91481
- SSDEEP 24576:fu8m+1z5doO/vvTLbWhuEGalg4kzZ1hSdnGdT+AVpUqwu2YMo/F4ZHaRk:N
- TLSH T10447D32437F92200E7F79F3DACF06A23493A7D5B9C159E8D45411B4E0921BB1E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{d78106ee-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{86c05974-f51b-49fd-aac9-5e47de8b0a39}_OnDiskSnapshotProp
- Size 6KB
- SHA256 68f068c769bd351c544fbdf31166dbcc71a4beb288d249027a8dd8ed649c461d
- MD5 1a4a4ad1f6e25be30139cd7cc9702f1d
- SHA1 73ddfe3f8c59e45e646f6ec2b83c7b0e6ffcefeb
- SHA512 ea93253d71daec59867e09980859325c3cea2ff188f95c09fb2bca11062570589f901b3af367b6baf221a5b01589614f33fccb0c480fbc38007abec70a9ec2c2
- SSDEEP 96:FTUQeVhvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:5UQcb++ZVmN
- TLSH T141D19B185AE54711E2F3AB7228F14557A477B811EF33CB8E0298238E2630910F836F6F
- MD5 SHA1 SHA512 SSDEEP TLSH