File name: | 03a236d2edf54ccc11d7adec65dd02c3ee4d7dff6226ceb83c5b9be4472939f3.exe |
Full analysis: | https://app.any.run/tasks/d84c934e-1111-41ba-83c6-257bb6725336 |
Verdict: | Malicious activity |
Analysis date: | March 31, 2024, 02:23:37 |
OS: | Windows 10 Professional (build: 19044, 64 bit) |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
MD5: | 5096BEA0BADB422849E9306CF9A8DA9C |
SHA1: | 770AFBD27B0062F0587F70A4C5363A28E6A54063 |
SHA256: | 03A236D2EDF54CCC11D7ADEC65DD02C3EE4D7DFF6226CEB83C5B9BE4472939F3 |
SSDEEP: | 49152:tyg2G6PidgKt60jKHLHuSNbR0VqPWBuEjMYmnG0ZiM9X/hFurlQ4UtULo:Ig2GklKvj4jn5a3BqYp0ZiW5Z45o |
.exe | | | Win32 Executable MS Visual C++ (generic) (42.2) |
---|---|---|
.exe | | | Win64 Executable (generic) (37.3) |
.dll | | | Win32 Dynamic Link Library (generic) (8.8) |
.exe | | | Win32 Executable (generic) (6) |
.exe | | | Generic Win/DOS Executable (2.7) |
Subsystem: | Windows GUI |
---|---|
SubsystemVersion: | 4 |
ImageVersion: | - |
OSVersion: | 4 |
EntryPoint: | 0x1ba88 |
UninitializedDataSize: | - |
InitializedDataSize: | 98304 |
CodeSize: | 176128 |
LinkerVersion: | 8 |
PEType: | PE32 |
ImageFileCharacteristics: | No relocs, Executable, 32-bit |
TimeStamp: | 2014:11:19 16:00:00+00:00 |
MachineType: | Intel 386 or later, and compatibles |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
6480 | "C:\Users\admin\AppData\Local\Temp\03a236d2edf54ccc11d7adec65dd02c3ee4d7dff6226ceb83c5b9be4472939f3.exe" | C:\Users\admin\AppData\Local\Temp\03a236d2edf54ccc11d7adec65dd02c3ee4d7dff6226ceb83c5b9be4472939f3.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
7024 | "C:\Users\admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1711851824-0-app\lzma.exe" "d" "C:\Users\admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1711851824-0-app\JWrapper-JWrapper-00032144438-archive.p2.l2" "C:\Users\admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1711851824-0-app\JWrapper-JWrapper-00032144438-archive.p2" | C:\Users\admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1711851824-0-app\lzma.exe | — | 03a236d2edf54ccc11d7adec65dd02c3ee4d7dff6226ceb83c5b9be4472939f3.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
5116 | "C:\Users\admin\AppData\Roaming\JWrapper-Remote Support\JWrapper-JWrapper-00032144438-complete\lzma.exe" "d" "C:\Users\admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1711851825-0-app\JREArchive.p2.l2" "C:\Users\admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1711851825-0-app\JREArchive.p2" | C:\Users\admin\AppData\Roaming\JWrapper-Remote Support\JWrapper-JWrapper-00032144438-complete\lzma.exe | — | 03a236d2edf54ccc11d7adec65dd02c3ee4d7dff6226ceb83c5b9be4472939f3.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
5904 | "C:\Users\admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1711851825-0-app\bin\unpack200.exe" "C:\Users\admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1711851825-0-app\lib\ext\sunpkcs11.jar.p2" "C:\Users\admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1711851825-0-app\lib\ext\sunpkcs11.jar" | C:\Users\admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1711851825-0-app\bin\unpack200.exe | — | 03a236d2edf54ccc11d7adec65dd02c3ee4d7dff6226ceb83c5b9be4472939f3.exe | |||||||||||
User: admin Company: Sun Microsystems, Inc. Integrity Level: MEDIUM Description: Java(TM) 2 Platform Standard Edition binary Exit code: 0 Version: 5.0.220.3 Modules
| |||||||||||||||
7156 | "C:\Users\admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1711851825-0-app\bin\unpack200.exe" "C:\Users\admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1711851825-0-app\lib\jsse.jar.p2" "C:\Users\admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1711851825-0-app\lib\jsse.jar" | C:\Users\admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1711851825-0-app\bin\unpack200.exe | — | 03a236d2edf54ccc11d7adec65dd02c3ee4d7dff6226ceb83c5b9be4472939f3.exe | |||||||||||
User: admin Company: Sun Microsystems, Inc. Integrity Level: MEDIUM Description: Java(TM) 2 Platform Standard Edition binary Exit code: 0 Version: 5.0.220.3 Modules
| |||||||||||||||
7052 | "C:\Users\admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1711851825-0-app\bin\unpack200.exe" "C:\Users\admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1711851825-0-app\lib\rt.jar.p2" "C:\Users\admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1711851825-0-app\lib\rt.jar" | C:\Users\admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1711851825-0-app\bin\unpack200.exe | — | 03a236d2edf54ccc11d7adec65dd02c3ee4d7dff6226ceb83c5b9be4472939f3.exe | |||||||||||
User: admin Company: Sun Microsystems, Inc. Integrity Level: MEDIUM Description: Java(TM) 2 Platform Standard Edition binary Exit code: 0 Version: 5.0.220.3 Modules
| |||||||||||||||
7048 | "C:\Users\admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1711851825-0-app\bin\javaw.exe" "-Xshare:dump" | C:\Users\admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1711851825-0-app\bin\javaw.exe | — | 03a236d2edf54ccc11d7adec65dd02c3ee4d7dff6226ceb83c5b9be4472939f3.exe | |||||||||||
User: admin Company: Sun Microsystems, Inc. Integrity Level: MEDIUM Description: Java(TM) 2 Platform Standard Edition binary Exit code: 0 Version: 5.0.220.3 Modules
| |||||||||||||||
1080 | cacls "C:\Users\admin\AppData\Roaming\JWrapper-Remote Support\JWAppsSharedConfig\DetectedProxies" /t /e /g "Users":F | C:\Windows\SysWOW64\cacls.exe | — | 03a236d2edf54ccc11d7adec65dd02c3ee4d7dff6226ceb83c5b9be4472939f3.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Control ACLs Program Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
1496 | cacls "C:\Users\admin\AppData\Roaming\JWrapper-Remote Support\JWAppsSharedConfig\ProxyCredentials" /t /e /g "Users":F | C:\Windows\SysWOW64\cacls.exe | — | 03a236d2edf54ccc11d7adec65dd02c3ee4d7dff6226ceb83c5b9be4472939f3.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Control ACLs Program Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
7132 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cacls.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
|
(PID) Process: | (6480) 03a236d2edf54ccc11d7adec65dd02c3ee4d7dff6226ceb83c5b9be4472939f3.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
Operation: | write | Name: | CachePrefix |
Value: | |||
(PID) Process: | (6480) 03a236d2edf54ccc11d7adec65dd02c3ee4d7dff6226ceb83c5b9be4472939f3.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
(PID) Process: | (6480) 03a236d2edf54ccc11d7adec65dd02c3ee4d7dff6226ceb83c5b9be4472939f3.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
(PID) Process: | (6480) 03a236d2edf54ccc11d7adec65dd02c3ee4d7dff6226ceb83c5b9be4472939f3.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
(PID) Process: | (6480) 03a236d2edf54ccc11d7adec65dd02c3ee4d7dff6226ceb83c5b9be4472939f3.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | IntranetName |
Value: 1 | |||
(PID) Process: | (6480) 03a236d2edf54ccc11d7adec65dd02c3ee4d7dff6226ceb83c5b9be4472939f3.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
(PID) Process: | (6480) 03a236d2edf54ccc11d7adec65dd02c3ee4d7dff6226ceb83c5b9be4472939f3.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 0 | |||
(PID) Process: | (6068) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
Operation: | write | Name: | CachePrefix |
Value: | |||
(PID) Process: | (6068) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
(PID) Process: | (6068) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
Operation: | write | Name: | CachePrefix |
Value: Visited: |
PID | Process | Filename | Type | |
---|---|---|---|---|
6480 | 03a236d2edf54ccc11d7adec65dd02c3ee4d7dff6226ceb83c5b9be4472939f3.exe | C:\Users\admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1711851824-0-app\lzma.exe | executable | |
MD5:— | SHA256:— | |||
6480 | 03a236d2edf54ccc11d7adec65dd02c3ee4d7dff6226ceb83c5b9be4472939f3.exe | C:\Users\admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1711851824-0-app\nativesplash.png | image | |
MD5:— | SHA256:— | |||
6480 | 03a236d2edf54ccc11d7adec65dd02c3ee4d7dff6226ceb83c5b9be4472939f3.exe | C:\Users\admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1711851824-0-app\JWrapper-JWrapper-00032144438-archive.p2.l2 | binary | |
MD5:— | SHA256:— | |||
7024 | lzma.exe | C:\Users\admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1711851824-0-app\JWrapper-JWrapper-00032144438-archive.p2 | binary | |
MD5:— | SHA256:— | |||
6480 | 03a236d2edf54ccc11d7adec65dd02c3ee4d7dff6226ceb83c5b9be4472939f3.exe | C:\Users\admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1711851824-0-app\jwrapperlib\jwstandalonelaunch.jar | java | |
MD5:— | SHA256:— | |||
6480 | 03a236d2edf54ccc11d7adec65dd02c3ee4d7dff6226ceb83c5b9be4472939f3.exe | C:\Users\admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1711851824-0-app\jwrapperlib\jwstandalone.jar | java | |
MD5:— | SHA256:— | |||
6480 | 03a236d2edf54ccc11d7adec65dd02c3ee4d7dff6226ceb83c5b9be4472939f3.exe | C:\Users\admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1711851824-0-app\jwrapperlib\sevenzip.jar | java | |
MD5:— | SHA256:— | |||
6480 | 03a236d2edf54ccc11d7adec65dd02c3ee4d7dff6226ceb83c5b9be4472939f3.exe | C:\Users\admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1711851824-0-app\JWrapper-Remote Support-splash.png | image | |
MD5:— | SHA256:— | |||
6480 | 03a236d2edf54ccc11d7adec65dd02c3ee4d7dff6226ceb83c5b9be4472939f3.exe | C:\Users\admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1711851824-0-app\JWrapper-Remote Support-ICNS.icns | binary | |
MD5:— | SHA256:— | |||
6480 | 03a236d2edf54ccc11d7adec65dd02c3ee4d7dff6226ceb83c5b9be4472939f3.exe | C:\Users\admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1711851824-0-app\jwutils_win32.dll | executable | |
MD5:— | SHA256:— |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
6480 | 03a236d2edf54ccc11d7adec65dd02c3ee4d7dff6226ceb83c5b9be4472939f3.exe | GET | — | 54.243.180.93:80 | http://help.supportinthecloud.com/customer/JWrapper-Windows32JRE-00028603591-archive.p2.l2 | unknown | — | — | unknown |
6480 | 03a236d2edf54ccc11d7adec65dd02c3ee4d7dff6226ceb83c5b9be4472939f3.exe | GET | 200 | 54.243.180.93:80 | http://help.supportinthecloud.com/customer/JWrapper-Windows32JRE-00028603591-archive.p2.l2 | unknown | — | — | unknown |
6480 | 03a236d2edf54ccc11d7adec65dd02c3ee4d7dff6226ceb83c5b9be4472939f3.exe | GET | — | 54.243.180.93:80 | http://help.supportinthecloud.com/customer/JWrapper-Windows32JRE-00028603591-archive.p2.l2 | unknown | — | — | unknown |
6480 | 03a236d2edf54ccc11d7adec65dd02c3ee4d7dff6226ceb83c5b9be4472939f3.exe | GET | 200 | 54.243.180.93:80 | http://help.supportinthecloud.com/customer/JWrapper-Windows32JRE-version.txt | unknown | — | — | unknown |
6480 | 03a236d2edf54ccc11d7adec65dd02c3ee4d7dff6226ceb83c5b9be4472939f3.exe | GET | 200 | 54.243.180.93:80 | http://help.supportinthecloud.com/customer/JWrapper-Windows32JRE-version.txt | unknown | — | — | unknown |
6480 | 03a236d2edf54ccc11d7adec65dd02c3ee4d7dff6226ceb83c5b9be4472939f3.exe | GET | 200 | 54.243.180.93:80 | http://help.supportinthecloud.com/customer/JWrapper-Windows32JRE-version.txt | unknown | — | — | unknown |
6480 | 03a236d2edf54ccc11d7adec65dd02c3ee4d7dff6226ceb83c5b9be4472939f3.exe | GET | 200 | 54.243.180.93:80 | http://help.supportinthecloud.com/customer/JWrapper-Remote%20Support-version.txt | unknown | — | — | unknown |
6480 | 03a236d2edf54ccc11d7adec65dd02c3ee4d7dff6226ceb83c5b9be4472939f3.exe | GET | 200 | 54.243.180.93:80 | http://help.supportinthecloud.com/customer/JWrapper-Remote%20Support-version.txt | unknown | — | — | unknown |
5828 | Remote Support.exe | GET | 200 | 54.243.180.93:80 | http://help.supportinthecloud.com/server_side_parameters | unknown | — | — | unknown |
1740 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
4828 | svchost.exe | 239.255.255.250:1900 | — | — | — | unknown |
3808 | svchost.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
1280 | MoUsoCoreWorker.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
3996 | svchost.exe | 20.190.159.23:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
6480 | 03a236d2edf54ccc11d7adec65dd02c3ee4d7dff6226ceb83c5b9be4472939f3.exe | 54.243.180.93:80 | help.supportinthecloud.com | AMAZON-AES | US | unknown |
3996 | svchost.exe | 20.190.159.71:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
3996 | svchost.exe | 192.229.221.95:80 | — | EDGECAST | US | whitelisted |
1740 | SIHClient.exe | 40.127.169.103:443 | slscr.update.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
1740 | SIHClient.exe | 184.30.21.171:80 | www.microsoft.com | AKAMAI-AS | DE | unknown |
1740 | SIHClient.exe | 13.95.31.18:443 | fe3cr.delivery.mp.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
Domain | IP | Reputation |
---|---|---|
help.supportinthecloud.com |
| unknown |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
arc.msn.com |
| whitelisted |
www.bing.com |
| whitelisted |
activation-v2.sls.microsoft.com |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
6480 | 03a236d2edf54ccc11d7adec65dd02c3ee4d7dff6226ceb83c5b9be4472939f3.exe | Potentially Bad Traffic | ET USER_AGENTS Observed Suspicious User-Agent (JWrapperDownloader) |
6480 | 03a236d2edf54ccc11d7adec65dd02c3ee4d7dff6226ceb83c5b9be4472939f3.exe | Potentially Bad Traffic | ET USER_AGENTS Observed Suspicious User-Agent (JWrapperDownloader) |
6480 | 03a236d2edf54ccc11d7adec65dd02c3ee4d7dff6226ceb83c5b9be4472939f3.exe | Misc activity | ET INFO Simplehelp Remote Administration Suite HTTP Server Value in Response |
6480 | 03a236d2edf54ccc11d7adec65dd02c3ee4d7dff6226ceb83c5b9be4472939f3.exe | Potentially Bad Traffic | ET USER_AGENTS Observed Suspicious User-Agent (JWrapperDownloader) |
6480 | 03a236d2edf54ccc11d7adec65dd02c3ee4d7dff6226ceb83c5b9be4472939f3.exe | Potentially Bad Traffic | ET USER_AGENTS Observed Suspicious User-Agent (JWrapperDownloader) |
6480 | 03a236d2edf54ccc11d7adec65dd02c3ee4d7dff6226ceb83c5b9be4472939f3.exe | Potentially Bad Traffic | ET USER_AGENTS Observed Suspicious User-Agent (JWrapperDownloader) |
6480 | 03a236d2edf54ccc11d7adec65dd02c3ee4d7dff6226ceb83c5b9be4472939f3.exe | Potentially Bad Traffic | ET USER_AGENTS Observed Suspicious User-Agent (JWrapperDownloader) |
— | — | Potentially Bad Traffic | ET POLICY Vulnerable Java Version 1.5.x Detected |
— | — | Potentially Bad Traffic | ET POLICY Vulnerable Java Version 1.5.x Detected |