| File name: | PJL.exe |
| Full analysis: | https://app.any.run/tasks/bc579c2d-8547-44f2-ae6e-3a5056f0f4b5 |
| Verdict: | Malicious activity |
| Threats: | A backdoor is a type of cybersecurity threat that allows attackers to secretly compromise a system and conduct malicious activities, such as stealing data and modifying files. Backdoors can be difficult to detect, as they often use legitimate system applications to evade defense mechanisms. Threat actors often utilize special malware, such as PlugX, to establish backdoors on target devices. |
| Analysis date: | June 21, 2025, 10:02:37 |
| OS: | Windows 11 Professional (build: 22000, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows, 7 sections |
| MD5: | FA0A1F2ECFD5E6896EEE02F6034D75AF |
| SHA1: | FB4558993A59CD32FF91663C1719C2928584EDFC |
| SHA256: | 1045F5137B6F1DAE238194BCF8BA9AFCB3B196C25824B89E963F98D68CBB2D91 |
| SSDEEP: | 12288:MeD+84KqJ2FhqhghXJG3yYEquAYoSs8vi06WIHZDztO4HAE4tFU+fo9qJKRiznd1:Me74KqJ2P/G3yY1uAYoSs8vi06WIHZDs |
| .exe | | | Win64 Executable (generic) (87.3) |
|---|---|---|
| .exe | | | Generic Win/DOS Executable (6.3) |
| .exe | | | DOS Executable Generic (6.3) |
| MachineType: | AMD AMD64 |
|---|---|
| TimeStamp: | 2025:06:20 13:56:19+00:00 |
| ImageFileCharacteristics: | Executable, Large address aware |
| PEType: | PE32+ |
| LinkerVersion: | 14.32 |
| CodeSize: | 176128 |
| InitializedDataSize: | 156160 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x2b3c9 |
| OSVersion: | 6 |
| ImageVersion: | - |
| SubsystemVersion: | 6 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.1.0.0 |
| ProductVersionNumber: | 1.1.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | English (U.S.) |
| CharacterSet: | Unicode |
| CompanyName: | Raytheon Technologies |
| FileDescription: | CONFIDENTIAL: INTERNAL USE ONLY. |
| FileVersion: | 1.1.0.0 |
| ProductName: | PhantomJIT |
| ProductVersion: | 1.1.0.0 |
| OriginalFileName: | PJL.exe |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 88 | "C:\Windows\system32\DllHost.exe" /Processid:{9F156763-7844-4DC4-B2B1-901F640F5155} | C:\Windows\System32\dllhost.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: COM Surrogate Exit code: 0 Version: 10.0.22000.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2868 | "C:\Windows\system32\DllHost.exe" /Processid:{9F156763-7844-4DC4-B2B1-901F640F5155} | C:\Windows\System32\dllhost.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: COM Surrogate Exit code: 0 Version: 10.0.22000.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 3124 | "C:\Windows\system32\DllHost.exe" /Processid:{9F156763-7844-4DC4-B2B1-901F640F5155} | C:\Windows\System32\dllhost.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: COM Surrogate Exit code: 0 Version: 10.0.22000.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6312 | "C:\Windows\system32\DllHost.exe" /Processid:{9F156763-7844-4DC4-B2B1-901F640F5155} | C:\Windows\System32\dllhost.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: COM Surrogate Exit code: 0 Version: 10.0.22000.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6440 | "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca | C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Version: 421.22500.3595.0 Modules
| |||||||||||||||
| 6996 | "C:\Users\admin\Desktop\PJL.exe" | C:\Users\admin\Desktop\PJL.exe | explorer.exe | ||||||||||||
User: admin Company: Raytheon Technologies Integrity Level: MEDIUM Description: CONFIDENTIAL: INTERNAL USE ONLY. Version: 1.1.0.0 Modules
| |||||||||||||||
| (PID) Process: | (6996) PJL.exe | Key: | HKEY_CLASSES_ROOT\TypeLib\{00020802-0000-0000-C000-000000000046}\1.3 |
| Operation: | delete key | Name: | (default) |
Value: | |||
| (PID) Process: | (6996) PJL.exe | Key: | HKEY_CLASSES_ROOT\TypeLib\{00020813-0000-0000-C000-000000000046}\1.2 |
| Operation: | delete key | Name: | (default) |
Value: | |||
| (PID) Process: | (6996) PJL.exe | Key: | HKEY_CLASSES_ROOT\TypeLib\{00020813-0000-0000-C000-000000000046}\1.6 |
| Operation: | delete key | Name: | (default) |
Value: | |||
| (PID) Process: | (6996) PJL.exe | Key: | HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\9 |
| Operation: | delete key | Name: | (default) |
Value: | |||
| (PID) Process: | (6996) PJL.exe | Key: | HKEY_CLASSES_ROOT\TypeLib\{00062FFF-0000-0000-C000-000000000046}\9.6 |
| Operation: | delete key | Name: | (default) |
Value: | |||
| (PID) Process: | (6996) PJL.exe | Key: | HKEY_CLASSES_ROOT\TypeLib\{0006F062-0000-0000-C000-000000000046}\1.2 |
| Operation: | delete key | Name: | (default) |
Value: | |||
| (PID) Process: | (6996) PJL.exe | Key: | HKEY_CLASSES_ROOT\TypeLib\{000C1092-0000-0000-C000-000000000046}\1.0 |
| Operation: | delete key | Name: | (default) |
Value: | |||
| (PID) Process: | (6996) PJL.exe | Key: | HKEY_CLASSES_ROOT\TypeLib\{00f25ae8-3625-4e34-92d4-f0918cf010ee}\1.0 |
| Operation: | delete key | Name: | (default) |
Value: | |||
| (PID) Process: | (6996) PJL.exe | Key: | HKEY_CLASSES_ROOT\TypeLib\{B0EDF154-910A-11D2-B632-00C04F79498E}\1.0 |
| Operation: | delete key | Name: | (default) |
Value: | |||
| (PID) Process: | (6996) PJL.exe | Key: | HKEY_CLASSES_ROOT\TypeLib\{0D452EE1-E08F-101A-852E-02608C4D0BB4}\2.0 |
| Operation: | delete key | Name: | (default) |
Value: | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6440 | MiniSearchHost.exe | C:\Users\admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SettingsCache.txt~RF164480.TMP | — | |
MD5:— | SHA256:— | |||
| 6440 | MiniSearchHost.exe | C:\Users\admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SettingsCache.txt.~tmp | text | |
MD5:0920EC84A13CD92053328B518FB1E443 | SHA256:C1C0C1512391FFB7E63BD60A0DB09FB24AEA95ACF6066B9E25EFF9376E9EF677 | |||
| 6996 | PJL.exe | C:\Users\admin\AppData\Local\Temp\e8jv1shudbi2.dat | binary | |
MD5:AE99E9A4A7CA95321275E2C784EFF274 | SHA256:6E04C96C767D2EF90FDCBBFC504FFAB88D2F410EA118343236E7AF93CA6EB523 | |||
| 6996 | PJL.exe | C:\Users\admin\AppData\Local\Temp\srjmbs86v6r2.scr | executable | |
MD5:FA0A1F2ECFD5E6896EEE02F6034D75AF | SHA256:1045F5137B6F1DAE238194BCF8BA9AFCB3B196C25824B89E963F98D68CBB2D91 | |||
| 6996 | PJL.exe | C:\Users\admin\AppData\Local\Temp\vbktlvpujena.sct | xml | |
MD5:806F252DC7082EF2F7D40DECB6152A13 | SHA256:7DA77138BF5DFFE6BB7BD4470789E3AD2B7383266EEFCAFB1AED40789FCF34A9 | |||
| 6440 | MiniSearchHost.exe | C:\Users\admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SettingsCache.txt | text | |
MD5:0920EC84A13CD92053328B518FB1E443 | SHA256:C1C0C1512391FFB7E63BD60A0DB09FB24AEA95ACF6066B9E25EFF9376E9EF677 | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2840 | svchost.exe | GET | 200 | 199.232.214.172:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?45659ff28ebcce25 | unknown | — | — | whitelisted |
6996 | PJL.exe | GET | 200 | 147.45.45.156:51000 | http://147.45.45.156:51000/challenge | unknown | — | — | unknown |
2860 | svchost.exe | GET | 304 | 199.232.214.172:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?7f3766ba4aa80e38 | unknown | — | — | whitelisted |
1524 | svchost.exe | GET | 200 | 23.55.104.138:80 | http://www.msftconnecttest.com/connecttest.txt | unknown | — | — | whitelisted |
— | — | GET | 200 | 13.107.6.156:443 | https://mrodevicemgr.officeapps.live.com/mrodevicemgrsvc/api/v1/C2RTargetAudienceData?omid=97560490bafb0d49bca6f8f0df91025d&susid=c408ee57-2103-4c34-9e6f-30bdf6c87e50&audienceFFN=492350f6-3a01-4f97-b9c0-c7c6ddf67d60&tid=&osver=Client%7C10.0.22000&offver=16.0.16626.20134&ring=Production&aud=Production&ch=CC&osarch=x64&manstate=6 | unknown | — | — | — |
— | — | POST | 200 | 20.190.160.2:443 | https://login.live.com/RST2.srf | unknown | xml | 10.3 Kb | whitelisted |
— | — | POST | — | 20.189.173.14:443 | https://self.events.data.microsoft.com/OneCollector/1.0/ | unknown | — | — | whitelisted |
— | — | POST | 200 | 147.45.45.156:443 | https://147.45.45.156/ | unknown | binary | 12 b | — |
2840 | svchost.exe | GET | 304 | 199.232.214.172:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?6e89692cca504d0f | unknown | — | — | whitelisted |
2840 | svchost.exe | GET | 200 | 199.232.210.172:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?242c32f45d9b2ec7 | unknown | — | — | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 52.109.32.97:443 | officeclient.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | GB | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4444 | OfficeC2RClient.exe | 52.109.32.97:443 | officeclient.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | GB | whitelisted |
3400 | firefox.exe | 34.120.208.123:443 | incoming.telemetry.mozilla.org | GOOGLE-CLOUD-PLATFORM | US | whitelisted |
1036 | pingsender.exe | 34.120.208.123:443 | incoming.telemetry.mozilla.org | GOOGLE-CLOUD-PLATFORM | US | whitelisted |
1524 | svchost.exe | 23.55.104.146:80 | — | Akamai International B.V. | US | unknown |
1580 | rundll32.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 51.116.246.106:443 | v10.events.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | DE | whitelisted |
6996 | PJL.exe | 147.45.45.156:51000 | — | OOO FREEnet Group | RU | unknown |
2860 | svchost.exe | 20.42.73.26:443 | v10.events.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
Domain | IP | Reputation |
|---|---|---|
officeclient.microsoft.com |
| whitelisted |
incoming.telemetry.mozilla.org |
| whitelisted |
telemetry-incoming.r53-2.services.mozilla.com |
| whitelisted |
v10.events.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
ctldl.windowsupdate.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
ecs.office.com |
| whitelisted |
mrodevicemgr.officeapps.live.com |
| whitelisted |
dns.msftncsi.com |
| whitelisted |
PID | Process | Class | Message |
|---|---|---|---|
1524 | svchost.exe | Misc activity | ET INFO Microsoft Connection Test |
— | — | Malware Command and Control Activity Detected | ET MALWARE Havoc Demon CnC Request |