File name:

JJspolit.rar

Full analysis: https://app.any.run/tasks/710a0bf0-89f7-486a-8af5-46bbe85d75af
Verdict: Malicious activity
Analysis date: January 29, 2025, 15:00:59
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
evasion
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

A6012BB08A7C25AD032FD31F815C7987

SHA1:

45CE05049E8740A21A28C89CF4918FAEFE1A1E6C

SHA256:

6C50296F9DFD602721D55416F71A74BDC5F774E617DF5040829C18809E1031F7

SSDEEP:

1536:8Hl4m1LD6YPfTtE/dNf8czZ4VWyPNtlqF6O1JCvSuMpTSTZd:8DSkfTtELf1z4WyXls1kPMsZd

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Checks for external IP

      • JJspolit.exe (PID: 3988)
      • svchost.exe (PID: 2192)
      • JJspolit.exe (PID: 6764)
      • JJspolit.exe (PID: 7120)

    • Executes application which crashes

      • JJspolit.exe (PID: 3988)
      • JJspolit.exe (PID: 7120)
      • JJspolit.exe (PID: 6764)

  • INFO

    • Disables trace logs

      • JJspolit.exe (PID: 3988)
      • JJspolit.exe (PID: 6764)
      • JJspolit.exe (PID: 7120)

    • Reads the computer name

      • JJspolit.exe (PID: 3988)
      • JJspolit.exe (PID: 6768)
      • JJspolit.exe (PID: 6764)
      • JJspolit.exe (PID: 7120)
      • JJspolit.exe (PID: 7052)
      • JJspolit.exe (PID: 6960)
      • JJspolit.exe (PID: 5036)
      • JJspolit.exe (PID: 644)
      • JJspolit.exe (PID: 2996)

    • Manual execution by a user

      • JJspolit.exe (PID: 3988)
      • JJspolit.exe (PID: 6764)
      • JJspolit.exe (PID: 5036)
      • JJspolit.exe (PID: 6768)
      • JJspolit.exe (PID: 6968)
      • JJspolit.exe (PID: 7052)
      • JJspolit.exe (PID: 6960)
      • JJspolit.exe (PID: 7120)
      • JJspolit.exe (PID: 6928)
      • JJspolit.exe (PID: 2996)
      • JJspolit.exe (PID: 644)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6316)

    • Reads the machine GUID from the registry

      • JJspolit.exe (PID: 3988)
      • JJspolit.exe (PID: 6764)
      • JJspolit.exe (PID: 6768)
      • JJspolit.exe (PID: 6968)
      • JJspolit.exe (PID: 6960)
      • JJspolit.exe (PID: 7120)
      • JJspolit.exe (PID: 6928)
      • JJspolit.exe (PID: 644)

    • Checks supported languages

      • JJspolit.exe (PID: 3988)
      • JJspolit.exe (PID: 6764)
      • JJspolit.exe (PID: 6768)
      • JJspolit.exe (PID: 5036)
      • JJspolit.exe (PID: 6968)
      • JJspolit.exe (PID: 7120)
      • JJspolit.exe (PID: 6960)
      • JJspolit.exe (PID: 6928)
      • JJspolit.exe (PID: 7052)
      • JJspolit.exe (PID: 644)
      • JJspolit.exe (PID: 2996)

    • Reads Environment values

      • JJspolit.exe (PID: 3988)
      • JJspolit.exe (PID: 6764)
      • JJspolit.exe (PID: 7120)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 5256)
      • WerFault.exe (PID: 7164)

    • Checks proxy server information

      • WerFault.exe (PID: 5256)
      • JJspolit.exe (PID: 7120)
      • JJspolit.exe (PID: 6764)

    • Reads the software policy settings

      • WerFault.exe (PID: 5256)
      • WerFault.exe (PID: 7164)
      • WerFault.exe (PID: 836)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)

EXIF

ZIP

FileVersion: RAR v5
CompressedSize: 77856
UncompressedSize: 113152
OperatingSystem: Win32
ArchivedFileName: JJspolit.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
149
Monitored processes
16
Malicious processes
0
Suspicious processes
3

Behavior graph

Click at the process to see the details
start winrar.exe jjspolit.exe werfault.exe svchost.exe jjspolit.exe jjspolit.exe no specs jjspolit.exe no specs jjspolit.exe no specs jjspolit.exe no specs jjspolit.exe no specs jjspolit.exe jjspolit.exe no specs werfault.exe jjspolit.exe no specs jjspolit.exe no specs werfault.exe

Process information

PID
CMD
Path
Indicators
Parent process
644"C:\Users\admin\Desktop\JJspolit.exe" C:\Users\admin\Desktop\JJspolit.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
6.4.12.0
Modules
Images
c:\users\admin\desktop\jjspolit.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
836C:\WINDOWS\system32\WerFault.exe -u -p 7120 -s 1796C:\Windows\System32\WerFault.exe
JJspolit.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
2192C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2996"C:\Users\admin\Desktop\JJspolit.exe" C:\Users\admin\Desktop\JJspolit.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
6.4.12.0
Modules
Images
c:\users\admin\desktop\jjspolit.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
3988"C:\Users\admin\Desktop\JJspolit.exe" C:\Users\admin\Desktop\JJspolit.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
2148734499
Version:
6.4.12.0
Modules
Images
c:\users\admin\desktop\jjspolit.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
5036"C:\Users\admin\Desktop\JJspolit.exe" C:\Users\admin\Desktop\JJspolit.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
6.4.12.0
Modules
Images
c:\users\admin\desktop\jjspolit.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
5256C:\WINDOWS\system32\WerFault.exe -u -p 3988 -s 1776C:\Windows\System32\WerFault.exe
JJspolit.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\oleaut32.dll
6316"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\JJspolit.rarC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
6764"C:\Users\admin\Desktop\JJspolit.exe" C:\Users\admin\Desktop\JJspolit.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
2148734499
Version:
6.4.12.0
Modules
Images
c:\users\admin\desktop\jjspolit.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
6768"C:\Users\admin\Desktop\JJspolit.exe" C:\Users\admin\Desktop\JJspolit.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
6.4.12.0
Modules
Images
c:\users\admin\desktop\jjspolit.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
Total events
14 448
Read events
14 414
Write events
34
Delete events
0

Modification events

(PID) Process:(6316) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(6316) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(6316) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(6316) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\JJspolit.rar
(PID) Process:(6316) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6316) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6316) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6316) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6316) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(6316) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3D0000002D000000FD03000016020000
Executable files
1
Suspicious files
10
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
5256WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_JJspolit.exe_46d523d52922dfda817f7fa85c4b156db1f9c11_ea45177a_503e5e12-b7bd-41bf-bace-d7ca0163602b\Report.wer —
MD5:—
SHA256:—
5256WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\JJspolit.exe.3988.dmp —
MD5:—
SHA256:—
7164WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_JJspolit.exe_46d523d52922dfda817f7fa85c4b156db1f9c11_ea45177a_21b02021-60fb-4006-8340-6c05d645eb7d\Report.wer —
MD5:—
SHA256:—
7164WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\JJspolit.exe.6764.dmp —
MD5:—
SHA256:—
836WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_JJspolit.exe_46d523d52922dfda817f7fa85c4b156db1f9c11_ea45177a_b6b2f06c-aaf7-42bb-b4f7-fb67138beb74\Report.wer —
MD5:—
SHA256:—
836WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\JJspolit.exe.7120.dmp —
MD5:—
SHA256:—
5256WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERC112.tmp.WERInternalMetadata.xmlbinary
MD5:5224CFEE18E409CA34BBB6B50ACB2ABE
SHA256:9491EBB0688E7E8BD9F5448CB5BCA9C0F5E1F3387F0BFA6BCCF387266148924F
5256WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\37C951188967C8EB88D99893D9D191FEbinary
MD5:FA84E4BCC92AA5DB735AB50711040CDE
SHA256:6D7205E794FDE4219A62D9692ECDDF612663A5CF20399E79BE87B851FCA4CA33
5256WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\21253908F3CB05D51B1C2DA8B681A785binary
MD5:B77C28E49A390FB636B519129E638DDE
SHA256:5AA137F75812CFDAC83E700E0E215D75F130AA92159468E4D38CA5B816C92256
5256WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\37C951188967C8EB88D99893D9D191FEbinary
MD5:C8D21F30FDD576AFCB374F0C01249790
SHA256:0584DE91592F687A7A2B520275CE4009FC6179A7A8C274F03A988DFB2B505185
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
40
DNS requests
23
Threats
8

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7120
JJspolit.exe
GET
200
208.95.112.1:80
http://ip-api.com/line/?fields=hosting
unknown
—
—
shared
—
—
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6092
svchost.exe
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6092
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
3988
JJspolit.exe
GET
200
208.95.112.1:80
http://ip-api.com/line/?fields=hosting
unknown
—
—
shared
3984
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6652
backgroundTaskHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
5256
WerFault.exe
GET
200
95.101.78.32:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5256
WerFault.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
6092
svchost.exe
2.16.241.19:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
6092
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4712
MoUsoCoreWorker.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5064
SearchApp.exe
2.23.227.221:443
—
Ooredoo Q.S.C.
QA
unknown
1612
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1176
svchost.exe
20.190.159.64:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
ocsp.digicert.com
  • 2.23.77.188
  • 2.17.190.73
whitelisted
google.com
  • 142.250.186.78
whitelisted
crl.microsoft.com
  • 2.16.241.19
  • 2.16.241.12
  • 95.101.78.32
  • 95.101.78.42
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 23.35.229.160
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
  • 40.127.240.158
whitelisted
login.live.com
  • 20.190.159.64
  • 40.126.31.69
  • 20.190.159.4
  • 40.126.31.71
  • 20.190.159.0
  • 20.190.159.23
  • 20.190.159.73
  • 20.190.159.75
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted
ip-api.com
  • 208.95.112.1
shared
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted

Threats

PID
Process
Class
Message
3988
JJspolit.exe
Device Retrieving External IP Address Detected
POLICY [ANY.RUN] External Hosting Lookup by ip-api
2192
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
3988
JJspolit.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
2192
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
6764
JJspolit.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
6764
JJspolit.exe
Device Retrieving External IP Address Detected
POLICY [ANY.RUN] External Hosting Lookup by ip-api
7120
JJspolit.exe
Device Retrieving External IP Address Detected
POLICY [ANY.RUN] External Hosting Lookup by ip-api
7120
JJspolit.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
Process
Message
JJspolit.exe
CLR: Managed code called FailFast without specifying a reason.
JJspolit.exe
CLR: Managed code called FailFast without specifying a reason.
JJspolit.exe
CLR: Managed code called FailFast without specifying a reason.
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
JJspolit.rar