File name:

SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214

Full analysis: https://app.any.run/tasks/f246734d-6c9f-4e4b-b9a5-c3000426a79d
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: August 01, 2024, 10:26:29
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
adware
antivm
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

F3B38057487D64140183EE0F1C20A80F

SHA1:

DB432B20058AD282903EDCE073C0B98A2F4B7F83

SHA256:

A830292E36D87BBCF23D918178988D0768ED82F7CEE0B5ACDB4C3B37539E5DCA

SSDEEP:

196608:BZVawWWnpCXA9/oLTEop2jjDYqwyGIrSs4EOqlAqnvZlhTRhvyfJr7:B/R2S0h0zYDyZr3WqlAgH9RAfd7

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exe (PID: 6444)
      • javaw.exe (PID: 4236)
      • Manage Remote Access Service.exe (PID: 6544)

    • Deletes the SafeBoot registry key

      • SimpleService.exe (PID: 6680)

  • SUSPICIOUS

    • The process drops C-runtime libraries

      • SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exe (PID: 6444)

    • Executable content was dropped or overwritten

      • SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exe (PID: 6444)
      • javaw.exe (PID: 4236)
      • Manage Remote Access Service.exe (PID: 6544)

    • Access to an unwanted program domain was detected

      • SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exe (PID: 6444)

    • Uses ICACLS.EXE to modify access control lists

      • SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exe (PID: 6444)
      • javaw.exe (PID: 4236)
      • Manage Remote Access Service.exe (PID: 6544)
      • Manage Remote Access Service.exe (PID: 1076)
      • Stop Remote Access Service.exe (PID: 4296)
      • Manage Remote Access Service.exe (PID: 4084)

    • Creates a software uninstall entry

      • SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exe (PID: 6444)

    • Reads security settings of Internet Explorer

      • elev_win.exe (PID: 6908)
      • elev_win.exe (PID: 4772)
      • elev_win.exe (PID: 6492)
      • SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exe (PID: 6444)

    • Reads the date of Windows installation

      • elev_win.exe (PID: 6908)
      • elev_win.exe (PID: 4772)
      • elev_win.exe (PID: 6492)

    • Executes as Windows Service

      • SimpleService.exe (PID: 4016)
      • SimpleService.exe (PID: 6436)

    • Process drops legitimate windows executable

      • SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exe (PID: 6444)

    • There is functionality for VM detection (VMWare)

      • javaw.exe (PID: 4236)

    • There is functionality for VM detection (antiVM strings)

      • javaw.exe (PID: 4236)

  • INFO

    • Checks supported languages

      • SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exe (PID: 6444)
      • javaw.exe (PID: 4064)
      • windowslauncher.exe (PID: 6820)
      • javaw.exe (PID: 4236)
      • elev_win.exe (PID: 6908)
      • Manage Remote Access Service.exe (PID: 6544)
      • SimpleService.exe (PID: 7132)
      • SimpleService.exe (PID: 6916)
      • SimpleService.exe (PID: 4016)
      • elev_win.exe (PID: 4772)
      • Remote Access Service.exe (PID: 6264)
      • SimpleService.exe (PID: 6680)
      • StopSimpleGatewayService.exe (PID: 7048)
      • Manage Remote Access Service.exe (PID: 1076)
      • Stop Remote Access Service.exe (PID: 4296)
      • elev_win.exe (PID: 6492)
      • Manage Remote Access Service.exe (PID: 4084)
      • SimpleService.exe (PID: 2628)
      • SimpleService.exe (PID: 400)
      • SimpleService.exe (PID: 6436)
      • Remote Access Service.exe (PID: 7104)

    • Create files in a temporary directory

      • SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exe (PID: 6444)
      • javaw.exe (PID: 4064)
      • javaw.exe (PID: 4236)
      • Manage Remote Access Service.exe (PID: 6544)
      • Manage Remote Access Service.exe (PID: 1076)
      • Stop Remote Access Service.exe (PID: 4296)
      • Manage Remote Access Service.exe (PID: 4084)

    • Reads CPU info

      • SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exe (PID: 6444)
      • javaw.exe (PID: 4064)
      • javaw.exe (PID: 4236)
      • Manage Remote Access Service.exe (PID: 6544)
      • Manage Remote Access Service.exe (PID: 1076)
      • Stop Remote Access Service.exe (PID: 4296)
      • Manage Remote Access Service.exe (PID: 4084)

    • Creates files in the program directory

      • SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exe (PID: 6444)
      • javaw.exe (PID: 4064)
      • javaw.exe (PID: 4236)
      • Remote Access Service.exe (PID: 6264)
      • Manage Remote Access Service.exe (PID: 6544)
      • Manage Remote Access Service.exe (PID: 1076)
      • Stop Remote Access Service.exe (PID: 4296)
      • StopSimpleGatewayService.exe (PID: 7048)
      • Manage Remote Access Service.exe (PID: 4084)
      • Remote Access Service.exe (PID: 7104)

    • Reads the machine GUID from the registry

      • SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exe (PID: 6444)
      • javaw.exe (PID: 4236)
      • Manage Remote Access Service.exe (PID: 6544)
      • Manage Remote Access Service.exe (PID: 1076)
      • Stop Remote Access Service.exe (PID: 4296)
      • Manage Remote Access Service.exe (PID: 4084)

    • Process checks computer location settings

      • javaw.exe (PID: 4236)
      • javaw.exe (PID: 4064)
      • SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exe (PID: 6444)
      • elev_win.exe (PID: 6908)
      • Manage Remote Access Service.exe (PID: 6544)
      • elev_win.exe (PID: 4772)
      • Manage Remote Access Service.exe (PID: 1076)
      • Stop Remote Access Service.exe (PID: 4296)
      • Manage Remote Access Service.exe (PID: 4084)
      • elev_win.exe (PID: 6492)

    • Reads the computer name

      • javaw.exe (PID: 4236)
      • elev_win.exe (PID: 6908)
      • Manage Remote Access Service.exe (PID: 6544)
      • SimpleService.exe (PID: 7132)
      • SimpleService.exe (PID: 6916)
      • SimpleService.exe (PID: 4016)
      • elev_win.exe (PID: 4772)
      • Manage Remote Access Service.exe (PID: 1076)
      • SimpleService.exe (PID: 6680)
      • Stop Remote Access Service.exe (PID: 4296)
      • elev_win.exe (PID: 6492)
      • Manage Remote Access Service.exe (PID: 4084)
      • SimpleService.exe (PID: 2628)
      • SimpleService.exe (PID: 400)
      • SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exe (PID: 6444)
      • SimpleService.exe (PID: 6436)

    • Checks proxy server information

      • SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exe (PID: 6444)

    • Creates files or folders in the user directory

      • SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exe (PID: 6444)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (46.3)
.exe | Win64 Executable (generic) (41)
.exe | Win32 Executable (generic) (6.6)
.exe | Generic Win/DOS Executable (2.9)
.exe | DOS Executable Generic (2.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:11:08 11:22:09+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 225280
InitializedDataSize: 114688
UninitializedDataSize: -
EntryPoint: 0x1e911
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 5.5.2.0
ProductVersionNumber: 10.10.10.10
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileVersion: 5.5.2.0
ProductVersion: 5.5.2.0
OriginalFileName: Remote Access-windows32-offline.exe_ico
InternalName:
FileDescription: SimpleHelp Remote Access Client
CompanyName: SimpleHelp Ltd
LegalCopyright: Copyright (c) 2024
ProductName: Remote Access
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
202
Monitored processes
70
Malicious processes
2
Suspicious processes
2

Behavior graph

Click at the process to see the details
start securiteinfo.com.not-a-virus.heur.remoteadmin.win32.remsim.gen.17224.19214.exe windowslauncher.exe no specs icacls.exe no specs conhost.exe no specs icacls.exe no specs conhost.exe no specs javaw.exe no specs icacls.exe no specs conhost.exe no specs icacls.exe no specs conhost.exe no specs THREAT javaw.exe icacls.exe no specs conhost.exe no specs icacls.exe no specs conhost.exe no specs icacls.exe no specs conhost.exe no specs icacls.exe no specs conhost.exe no specs icacls.exe no specs conhost.exe no specs icacls.exe no specs conhost.exe no specs icacls.exe no specs conhost.exe no specs icacls.exe no specs conhost.exe no specs elev_win.exe no specs manage remote access service.exe icacls.exe no specs conhost.exe no specs simpleservice.exe no specs simpleservice.exe no specs simpleservice.exe no specs remote access service.exe no specs icacls.exe no specs conhost.exe no specs icacls.exe no specs conhost.exe no specs elev_win.exe no specs manage remote access service.exe no specs icacls.exe no specs conhost.exe no specs simpleservice.exe no specs stopsimplegatewayservice.exe no specs stop remote access service.exe no specs icacls.exe no specs conhost.exe no specs icacls.exe no specs conhost.exe no specs icacls.exe no specs conhost.exe no specs icacls.exe no specs conhost.exe no specs icacls.exe no specs conhost.exe no specs icacls.exe no specs conhost.exe no specs icacls.exe no specs conhost.exe no specs elev_win.exe no specs manage remote access service.exe no specs icacls.exe no specs conhost.exe no specs simpleservice.exe no specs simpleservice.exe no specs simpleservice.exe no specs remote access service.exe no specs securiteinfo.com.not-a-virus.heur.remoteadmin.win32.remsim.gen.17224.19214.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
32\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—icacls.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
400"C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\restricted\SimpleService.exe" -install "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\simplegateway.service"C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\restricted\SimpleService.exe—Manage Remote Access Service.exe
User:
admin
Company:
SimpleHelp Ltd
Integrity Level:
HIGH
Description:
Application to manage service installation on Windows
Exit code:
32771696
Version:
5.5-SNAPSH
Modules
Images
c:\programdata\jwrapper-remote access\jwappssharedconfig\restricted\simpleservice.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
420icacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\StopSimpleGatewayService.exe" /t /c /grant *S-1-5-32-545:RXC:\Windows\SysWOW64\icacls.exe—javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\icacls.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
460\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—icacls.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
788\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—icacls.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1044\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—icacls.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1076"C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00108263518\JWrapper-Windows32JRE-00108249500-complete\bin\Manage Remote Access Service.exe" -cp "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00108263518\JWrapper-Remote Access-00108263518-complete\remoteaccess-jar-with-dependencies.jar" -Xmx256m -Xms5m -XX:MinHeapFreeRatio=15 -XX:MaxHeapFreeRatio=30 -Djava.util.Arrays.useLegacyMergeSort=true -Djava.net.preferIPv4Stack=true -Dsun.java2d.dpiaware=true -Dsun.java2d.uiScale.enabled=false -Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2,TLSv1.3 -Djdk.attach.allowAttachSelf=true -Dapple.awt.UIElement=true -Xrs jwrapper.JWrapper "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00108263518\JWrapper-Remote Access-00108263518-complete\unrestricted\JWLaunchProperties-1722508031241-1"C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00108263518\JWrapper-Windows32JRE-00108249500-complete\bin\Manage Remote Access Service.exe—elev_win.exe
User:
admin
Company:
SimpleHelp Ltd
Integrity Level:
HIGH
Description:
SimpleHelp Remote Access Client
Exit code:
0
Version:
5.5.2.0
Modules
Images
c:\programdata\jwrapper-remote access\jwrapper-remote access bundle-00108263518\jwrapper-windows32jre-00108249500-complete\bin\manage remote access service.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\winmm.dll
2064icacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\Remote Access Service.exe" /t /c /grant *S-1-5-32-545:RXC:\Windows\SysWOW64\icacls.exe—javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\icacls.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2248\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—icacls.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2248\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—icacls.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
10 096
Read events
10 034
Write events
60
Delete events
2

Modification events

(PID) Process:(6444) SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6444) SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6444) SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6444) SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(6444) SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(6444) SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(6444) SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(6444) SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Remote Access
Operation:writeName:UninstallString
Value:
"C:\ProgramData\JWrapper-Remote Access\Remote AccessWinLauncher.exe" JWVAPP JWRAPPER_UNINSTALLER
(PID) Process:(6444) SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Remote Access
Operation:writeName:DisplayName
Value:
Remote Access
(PID) Process:(6444) SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Remote Access
Operation:writeName:DisplayIcon
Value:
"C:\ProgramData\JWrapper-Remote Access\JWApps\Remote_Access_ConfigureICO.ico"
Executable files
105
Suspicious files
53
Text files
132
Unknown types
19

Dropped files

PID
Process
Filename
Type
6444SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exeC:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00108263518\JWrapperTemp-1722508012-0-app\jwBuildVersiontext
MD5:11287D8E86A1EBCB2E539093823EE843
SHA256:939E5C652907652A3F73E1BA5A2F90B443B3BA9B5AE1362720AE2F102F347121
6444SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exeC:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00108263518\JWrapperTemp-1722508012-0-app\nativesplash.pngimage
MD5:A695003E634F94B6181F79D774B8DF56
SHA256:6B1460B3785B9C53F520B4125117CB014DCB93BD038B075DC0801EA0D7C440BD
6444SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exeC:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00108263518\JWrapperTemp-1722508012-0-app\jwagent.jarcompressed
MD5:33D035AB5B44CCE3E747737CA3A77BE2
SHA256:0E44F569779E866D66E5FE347200BD8D22388BED4998E7FE3DA41814392D5ADE
6444SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exeC:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00108263518\JWrapperTemp-1722508012-0-app\jwrapperlib\jwstandalone.jarjava
MD5:318178B8AB6A4575DBF23DFB0197E4A4
SHA256:83F910DF8E75C692F05C1443F272CF0FE9BEB59272E568DA440DAB633EAC151C
6444SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exeC:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00108263518\JWrapperTemp-1722508012-0-app\elev_win.exeexecutable
MD5:A35D6764B9165DB9E616316D839679EE
SHA256:018FD5480B8623D747F225500130149C89B37708A7336B2A6670E1D0C6B21C18
6444SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exeC:\ProgramData\JWrapper-Remote Access\logs\Wrapper-2024-08-01-10-26-52-829.logtext
MD5:4E76E3396592811EA8A1560800637ED4
SHA256:831688AD61B144308EC7D8FF3957F37F29840E784D5CF7E7A2DE8DAF09D62F7D
6444SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exeC:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00108263518\JWrapperTemp-1722508012-0-app\session_win.exeexecutable
MD5:0AC97A2B6BD5AA9E13267DDC900222CB
SHA256:E620C9B46A33CB1957519C8989EB767CA66B8025690CAF1A87D94D48DB2D8722
6444SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exeC:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00108263518\JWrapperTemp-1722508012-0-app\JWrapper-Remote Access-ICNS.icnsimage
MD5:1566015B1BB21F6A6CEF4D6C9FE16020
SHA256:AD9C24A9F15050418B049AC7B1394578D37723237CB3C119AF0ABAEDCB220A83
6444SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exeC:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00108263518\JWrapperTemp-1722508012-0-app\libjwutils_linux64.soo
MD5:290F13A502FEFE2F8D134428FC0DD942
SHA256:090EBA06A09957EED9966D2014DED4519AAC3FFF80C3EAE13923C791631AD412
6444SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exeC:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00108263518\JWrapperTemp-1722508012-0-app\libjwutils_linux64arm.soo
MD5:2213A431BA77834AE3E5B9A0019AD176
SHA256:0621BB09D90A6EAB8B0C6CAE061616395E721C3CFC986BF2FE89A68CE87F1856
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
50
DNS requests
18
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6444
SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exe
GET
200
62.2.106.38:8080
http://help.bamsup.com:8080/access/JWrapper-Windows32JRE-version.txt?time=226127477&platform=windows-intel-64&osid=w10-0-19045
unknown
—
—
unknown
6444
SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exe
GET
200
62.2.106.38:8080
http://help.bamsup.com:8080/access/JWrapper-Windows32JRE-version.txt?time=226127477&platform=windows-intel-64&osid=w10-0-19045
unknown
—
—
unknown
6444
SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exe
GET
200
62.2.106.38:8080
http://help.bamsup.com:8080/access/JWrapper-Windows32JRE-version.txt?time=226127477&platform=windows-intel-64&osid=w10-0-19045
unknown
—
—
unknown
6444
SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exe
GET
200
62.2.106.38:8080
http://help.bamsup.com:8080/access/JWrapper-Remote%20Access-version.txt?platform=windows-intel-64&osid=w10-0-19045&guv=00108263447
unknown
—
—
unknown
6444
SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exe
GET
200
62.2.106.38:8080
http://help.bamsup.com:8080/access/JWrapper-JWrapper-version.txt?platform=windows-intel-64&osid=w10-0-19045&guv=00108263447
unknown
—
—
unknown
6444
SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exe
GET
200
62.2.106.38:8080
http://help.bamsup.com:8080/access/JWrapper-Remote%20Access-version.txt?platform=windows-intel-64&osid=w10-0-19045&guv=00108263447
unknown
—
—
unknown
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
4236
javaw.exe
GET
200
62.2.106.38:8080
http://help.bamsup.com:8080/translations_user/de.txt
unknown
—
—
unknown
2212
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7012
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5588
RUXIMICS.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2120
MoUsoCoreWorker.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5512
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6444
SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exe
62.2.106.38:8080
help.bamsup.com
Liberty Global B.V.
CH
unknown
5336
SearchApp.exe
104.126.37.153:443
www.bing.com
Akamai International B.V.
DE
unknown
5336
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.142
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
help.bamsup.com
  • 62.2.106.38
unknown
www.bing.com
  • 104.126.37.153
  • 104.126.37.131
  • 104.126.37.155
  • 104.126.37.139
  • 104.126.37.145
  • 104.126.37.130
  • 104.126.37.123
  • 104.126.37.144
  • 104.126.37.128
  • 104.126.37.178
  • 104.126.37.179
  • 104.126.37.184
  • 104.126.37.186
  • 104.126.37.171
  • 104.126.37.177
  • 104.126.37.170
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
login.live.com
  • 40.126.31.69
  • 40.126.31.71
  • 20.190.159.71
  • 40.126.31.67
  • 20.190.159.0
  • 20.190.159.73
  • 20.190.159.75
  • 40.126.31.73
whitelisted
th.bing.com
  • 104.126.37.128
  • 104.126.37.153
  • 104.126.37.131
  • 104.126.37.155
  • 104.126.37.139
  • 104.126.37.145
  • 104.126.37.130
  • 104.126.37.123
  • 104.126.37.144
whitelisted
fd.api.iris.microsoft.com
  • 20.31.169.57
whitelisted
arc.msn.com
  • 20.31.169.57
whitelisted

Threats

PID
Process
Class
Message
6444
SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exe
Potentially Bad Traffic
ET USER_AGENTS Observed Suspicious User-Agent (JWrapperDownloader)
6444
SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exe
Potentially Bad Traffic
ET USER_AGENTS Observed Suspicious User-Agent (JWrapperDownloader)
6444
SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP SimpleHelp Remote Access Software Activity
6444
SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP SimpleHelp Remote Access Software Activity
6444
SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exe
Misc activity
ET INFO Simplehelp Remote Administration Suite HTTP Server Value in Response
6444
SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exe
Potentially Bad Traffic
ET USER_AGENTS Observed Suspicious User-Agent (JWrapperDownloader)
6444
SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP SimpleHelp Remote Access Software Activity
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214