File name:

SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214

Full analysis: https://app.any.run/tasks/f246734d-6c9f-4e4b-b9a5-c3000426a79d
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: August 01, 2024, 10:26:29
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
adware
antivm
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

F3B38057487D64140183EE0F1C20A80F

SHA1:

DB432B20058AD282903EDCE073C0B98A2F4B7F83

SHA256:

A830292E36D87BBCF23D918178988D0768ED82F7CEE0B5ACDB4C3B37539E5DCA

SSDEEP:

196608:BZVawWWnpCXA9/oLTEop2jjDYqwyGIrSs4EOqlAqnvZlhTRhvyfJr7:B/R2S0h0zYDyZr3WqlAgH9RAfd7

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exe (PID: 6444)
      • javaw.exe (PID: 4236)
      • Manage Remote Access Service.exe (PID: 6544)

    • Deletes the SafeBoot registry key

      • SimpleService.exe (PID: 6680)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exe (PID: 6444)

    • Executable content was dropped or overwritten

      • SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exe (PID: 6444)
      • javaw.exe (PID: 4236)
      • Manage Remote Access Service.exe (PID: 6544)

    • Reads security settings of Internet Explorer

      • SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exe (PID: 6444)
      • elev_win.exe (PID: 6908)
      • elev_win.exe (PID: 4772)
      • elev_win.exe (PID: 6492)

    • Access to an unwanted program domain was detected

      • SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exe (PID: 6444)

    • Uses ICACLS.EXE to modify access control lists

      • SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exe (PID: 6444)
      • Manage Remote Access Service.exe (PID: 6544)
      • Manage Remote Access Service.exe (PID: 1076)
      • Stop Remote Access Service.exe (PID: 4296)
      • javaw.exe (PID: 4236)
      • Manage Remote Access Service.exe (PID: 4084)

    • Reads the date of Windows installation

      • elev_win.exe (PID: 6908)
      • elev_win.exe (PID: 4772)
      • elev_win.exe (PID: 6492)

    • Executes as Windows Service

      • SimpleService.exe (PID: 4016)
      • SimpleService.exe (PID: 6436)

    • The process drops C-runtime libraries

      • SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exe (PID: 6444)

    • Creates a software uninstall entry

      • SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exe (PID: 6444)

    • There is functionality for VM detection (antiVM strings)

      • javaw.exe (PID: 4236)

    • There is functionality for VM detection (VMWare)

      • javaw.exe (PID: 4236)

  • INFO

    • Checks supported languages

      • SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exe (PID: 6444)
      • windowslauncher.exe (PID: 6820)
      • javaw.exe (PID: 4064)
      • javaw.exe (PID: 4236)
      • elev_win.exe (PID: 6908)
      • Manage Remote Access Service.exe (PID: 6544)
      • SimpleService.exe (PID: 7132)
      • SimpleService.exe (PID: 6916)
      • Remote Access Service.exe (PID: 6264)
      • SimpleService.exe (PID: 4016)
      • elev_win.exe (PID: 4772)
      • Manage Remote Access Service.exe (PID: 1076)
      • SimpleService.exe (PID: 6680)
      • StopSimpleGatewayService.exe (PID: 7048)
      • Stop Remote Access Service.exe (PID: 4296)
      • Manage Remote Access Service.exe (PID: 4084)
      • elev_win.exe (PID: 6492)
      • SimpleService.exe (PID: 2628)
      • SimpleService.exe (PID: 400)
      • Remote Access Service.exe (PID: 7104)
      • SimpleService.exe (PID: 6436)

    • Checks proxy server information

      • SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exe (PID: 6444)

    • Reads CPU info

      • SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exe (PID: 6444)
      • javaw.exe (PID: 4064)
      • javaw.exe (PID: 4236)
      • Manage Remote Access Service.exe (PID: 6544)
      • Manage Remote Access Service.exe (PID: 1076)
      • Stop Remote Access Service.exe (PID: 4296)
      • Manage Remote Access Service.exe (PID: 4084)

    • Process checks computer location settings

      • SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exe (PID: 6444)
      • javaw.exe (PID: 4236)
      • javaw.exe (PID: 4064)
      • elev_win.exe (PID: 6908)
      • Manage Remote Access Service.exe (PID: 6544)
      • elev_win.exe (PID: 4772)
      • Manage Remote Access Service.exe (PID: 1076)
      • Stop Remote Access Service.exe (PID: 4296)
      • elev_win.exe (PID: 6492)
      • Manage Remote Access Service.exe (PID: 4084)

    • Creates files or folders in the user directory

      • SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exe (PID: 6444)

    • Create files in a temporary directory

      • javaw.exe (PID: 4064)
      • SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exe (PID: 6444)
      • javaw.exe (PID: 4236)
      • Manage Remote Access Service.exe (PID: 6544)
      • Manage Remote Access Service.exe (PID: 1076)
      • Stop Remote Access Service.exe (PID: 4296)
      • Manage Remote Access Service.exe (PID: 4084)

    • Reads the machine GUID from the registry

      • SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exe (PID: 6444)
      • javaw.exe (PID: 4236)
      • Manage Remote Access Service.exe (PID: 6544)
      • Manage Remote Access Service.exe (PID: 1076)
      • Stop Remote Access Service.exe (PID: 4296)
      • Manage Remote Access Service.exe (PID: 4084)

    • Creates files in the program directory

      • javaw.exe (PID: 4236)
      • javaw.exe (PID: 4064)
      • Manage Remote Access Service.exe (PID: 6544)
      • Remote Access Service.exe (PID: 6264)
      • SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exe (PID: 6444)
      • Manage Remote Access Service.exe (PID: 1076)
      • StopSimpleGatewayService.exe (PID: 7048)
      • Stop Remote Access Service.exe (PID: 4296)
      • Remote Access Service.exe (PID: 7104)
      • Manage Remote Access Service.exe (PID: 4084)

    • Reads the computer name

      • javaw.exe (PID: 4236)
      • elev_win.exe (PID: 6908)
      • Manage Remote Access Service.exe (PID: 6544)
      • SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exe (PID: 6444)
      • SimpleService.exe (PID: 6916)
      • SimpleService.exe (PID: 4016)
      • elev_win.exe (PID: 4772)
      • Manage Remote Access Service.exe (PID: 1076)
      • SimpleService.exe (PID: 6680)
      • Stop Remote Access Service.exe (PID: 4296)
      • Manage Remote Access Service.exe (PID: 4084)
      • elev_win.exe (PID: 6492)
      • SimpleService.exe (PID: 2628)
      • SimpleService.exe (PID: 400)
      • SimpleService.exe (PID: 7132)
      • SimpleService.exe (PID: 6436)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (46.3)
.exe | Win64 Executable (generic) (41)
.exe | Win32 Executable (generic) (6.6)
.exe | Generic Win/DOS Executable (2.9)
.exe | DOS Executable Generic (2.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:11:08 11:22:09+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 225280
InitializedDataSize: 114688
UninitializedDataSize: -
EntryPoint: 0x1e911
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 5.5.2.0
ProductVersionNumber: 10.10.10.10
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileVersion: 5.5.2.0
ProductVersion: 5.5.2.0
OriginalFileName: Remote Access-windows32-offline.exe_ico
InternalName:
FileDescription: SimpleHelp Remote Access Client
CompanyName: SimpleHelp Ltd
LegalCopyright: Copyright (c) 2024
ProductName: Remote Access
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
202
Monitored processes
70
Malicious processes
2
Suspicious processes
2

Behavior graph

Click at the process to see the details
start securiteinfo.com.not-a-virus.heur.remoteadmin.win32.remsim.gen.17224.19214.exe windowslauncher.exe no specs icacls.exe no specs conhost.exe no specs icacls.exe no specs conhost.exe no specs javaw.exe no specs icacls.exe no specs conhost.exe no specs icacls.exe no specs conhost.exe no specs THREAT javaw.exe icacls.exe no specs conhost.exe no specs icacls.exe no specs conhost.exe no specs icacls.exe no specs conhost.exe no specs icacls.exe no specs conhost.exe no specs icacls.exe no specs conhost.exe no specs icacls.exe no specs conhost.exe no specs icacls.exe no specs conhost.exe no specs icacls.exe no specs conhost.exe no specs elev_win.exe no specs manage remote access service.exe icacls.exe no specs conhost.exe no specs simpleservice.exe no specs simpleservice.exe no specs simpleservice.exe no specs remote access service.exe no specs icacls.exe no specs conhost.exe no specs icacls.exe no specs conhost.exe no specs elev_win.exe no specs manage remote access service.exe no specs icacls.exe no specs conhost.exe no specs simpleservice.exe no specs stopsimplegatewayservice.exe no specs stop remote access service.exe no specs icacls.exe no specs conhost.exe no specs icacls.exe no specs conhost.exe no specs icacls.exe no specs conhost.exe no specs icacls.exe no specs conhost.exe no specs icacls.exe no specs conhost.exe no specs icacls.exe no specs conhost.exe no specs icacls.exe no specs conhost.exe no specs elev_win.exe no specs manage remote access service.exe no specs icacls.exe no specs conhost.exe no specs simpleservice.exe no specs simpleservice.exe no specs simpleservice.exe no specs remote access service.exe no specs securiteinfo.com.not-a-virus.heur.remoteadmin.win32.remsim.gen.17224.19214.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
32\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—icacls.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
400"C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\restricted\SimpleService.exe" -install "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\simplegateway.service"C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\restricted\SimpleService.exe—Manage Remote Access Service.exe
User:
admin
Company:
SimpleHelp Ltd
Integrity Level:
HIGH
Description:
Application to manage service installation on Windows
Exit code:
32771696
Version:
5.5-SNAPSH
Modules
Images
c:\programdata\jwrapper-remote access\jwappssharedconfig\restricted\simpleservice.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
420icacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\StopSimpleGatewayService.exe" /t /c /grant *S-1-5-32-545:RXC:\Windows\SysWOW64\icacls.exe—javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\icacls.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
460\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—icacls.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
788\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—icacls.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1044\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—icacls.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1076"C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00108263518\JWrapper-Windows32JRE-00108249500-complete\bin\Manage Remote Access Service.exe" -cp "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00108263518\JWrapper-Remote Access-00108263518-complete\remoteaccess-jar-with-dependencies.jar" -Xmx256m -Xms5m -XX:MinHeapFreeRatio=15 -XX:MaxHeapFreeRatio=30 -Djava.util.Arrays.useLegacyMergeSort=true -Djava.net.preferIPv4Stack=true -Dsun.java2d.dpiaware=true -Dsun.java2d.uiScale.enabled=false -Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2,TLSv1.3 -Djdk.attach.allowAttachSelf=true -Dapple.awt.UIElement=true -Xrs jwrapper.JWrapper "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00108263518\JWrapper-Remote Access-00108263518-complete\unrestricted\JWLaunchProperties-1722508031241-1"C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00108263518\JWrapper-Windows32JRE-00108249500-complete\bin\Manage Remote Access Service.exe—elev_win.exe
User:
admin
Company:
SimpleHelp Ltd
Integrity Level:
HIGH
Description:
SimpleHelp Remote Access Client
Exit code:
0
Version:
5.5.2.0
Modules
Images
c:\programdata\jwrapper-remote access\jwrapper-remote access bundle-00108263518\jwrapper-windows32jre-00108249500-complete\bin\manage remote access service.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\winmm.dll
2064icacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\Remote Access Service.exe" /t /c /grant *S-1-5-32-545:RXC:\Windows\SysWOW64\icacls.exe—javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\icacls.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2248\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—icacls.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2248\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—icacls.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
10 096
Read events
10 034
Write events
60
Delete events
2

Modification events

(PID) Process:(6444) SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6444) SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6444) SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6444) SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(6444) SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(6444) SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(6444) SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(6444) SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Remote Access
Operation:writeName:UninstallString
Value:
"C:\ProgramData\JWrapper-Remote Access\Remote AccessWinLauncher.exe" JWVAPP JWRAPPER_UNINSTALLER
(PID) Process:(6444) SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Remote Access
Operation:writeName:DisplayName
Value:
Remote Access
(PID) Process:(6444) SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Remote Access
Operation:writeName:DisplayIcon
Value:
"C:\ProgramData\JWrapper-Remote Access\JWApps\Remote_Access_ConfigureICO.ico"
Executable files
105
Suspicious files
53
Text files
132
Unknown types
19

Dropped files

PID
Process
Filename
Type
6444SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exeC:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00108263518\JWrapperTemp-1722508012-0-app\jwBuildVersiontext
MD5:11287D8E86A1EBCB2E539093823EE843
SHA256:939E5C652907652A3F73E1BA5A2F90B443B3BA9B5AE1362720AE2F102F347121
6444SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exeC:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00108263518\JWrapperTemp-1722508012-0-app\nativesplash.pngimage
MD5:A695003E634F94B6181F79D774B8DF56
SHA256:6B1460B3785B9C53F520B4125117CB014DCB93BD038B075DC0801EA0D7C440BD
6444SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exeC:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00108263518\JWrapperTemp-1722508012-0-app\JWrapper-Remote Access-splash.pngimage
MD5:A695003E634F94B6181F79D774B8DF56
SHA256:6B1460B3785B9C53F520B4125117CB014DCB93BD038B075DC0801EA0D7C440BD
6444SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exeC:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00108263518\JWrapperTemp-1722508012-0-app\libjwutils_linux32arm.soo
MD5:5DD2344B3866E74D4642199166E0F670
SHA256:EF5E83087166DBC4BB41C35DEAFF7594D21D606307AD81D8080DEB8CDF9177BB
6444SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exeC:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00108263518\JWrapperTemp-1722508012-0-app\JWrapper-Remote Access-ICNS.icnsimage
MD5:1566015B1BB21F6A6CEF4D6C9FE16020
SHA256:AD9C24A9F15050418B049AC7B1394578D37723237CB3C119AF0ABAEDCB220A83
6444SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exeC:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00108263518\JWrapperTemp-1722508012-0-app\jwagent.jarcompressed
MD5:33D035AB5B44CCE3E747737CA3A77BE2
SHA256:0E44F569779E866D66E5FE347200BD8D22388BED4998E7FE3DA41814392D5ADE
6444SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exeC:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00108263518\JWrapperTemp-1722508012-0-app\libjwutils_macos.jnilibclass
MD5:94A206303DAC9B16B63FD8CC9F794A7E
SHA256:5C6287A0C857F7AB80FF4963B0076B1F66D1AA8DCEF202F4991D3227FD2E4BE4
6444SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exeC:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00108263518\JWrapperTemp-1722508012-0-app\jwutils_win64.dllexecutable
MD5:F7D634257C5FE0137DB959F2F09EF3FE
SHA256:7C35C375FF5A5756CB4907D8FD43A040CCE19981E83269BEFCCB254BE06F7CB7
6444SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exeC:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00108263518\JWrapperTemp-1722508012-0-app\jwAuthorPublicKeytext
MD5:1128DCB368DF4E55C20A4657D6B9B6A5
SHA256:B72D40A45A55DF2C60142D734630E5BE9464B52A09CF71A2951BD4553F785A12
6444SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exeC:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00108263518\JWrapperTemp-1722508012-0-app\SimpleService.exeexecutable
MD5:E5DDAC9E6A1C3B63312DDA9CE9B4577D
SHA256:B4601B0D874A600FA6ACF4AD4CFDC4C01549C497BC9E821264E94523618869EF
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
50
DNS requests
18
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6444
SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exe
GET
200
62.2.106.38:8080
http://help.bamsup.com:8080/access/JWrapper-Windows32JRE-version.txt?time=226127477&platform=windows-intel-64&osid=w10-0-19045
unknown
—
—
unknown
7012
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
2212
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6444
SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exe
GET
200
62.2.106.38:8080
http://help.bamsup.com:8080/access/JWrapper-Remote%20Access-version.txt?platform=windows-intel-64&osid=w10-0-19045&guv=00108263447
unknown
—
—
unknown
4236
javaw.exe
GET
200
62.2.106.38:8080
http://help.bamsup.com:8080/translations_user/de.txt
unknown
—
—
unknown
6444
SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exe
GET
200
62.2.106.38:8080
http://help.bamsup.com:8080/access/JWrapper-Remote%20Access-version.txt?platform=windows-intel-64&osid=w10-0-19045&guv=00108263447
unknown
—
—
unknown
6444
SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exe
GET
200
62.2.106.38:8080
http://help.bamsup.com:8080/access/JWrapper-Windows32JRE-version.txt?time=226127477&platform=windows-intel-64&osid=w10-0-19045
unknown
—
—
unknown
6444
SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exe
GET
200
62.2.106.38:8080
http://help.bamsup.com:8080/access/JWrapper-Windows32JRE-version.txt?time=226127477&platform=windows-intel-64&osid=w10-0-19045
unknown
—
—
unknown
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6988
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5588
RUXIMICS.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2120
MoUsoCoreWorker.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5512
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6444
SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exe
62.2.106.38:8080
help.bamsup.com
Liberty Global B.V.
CH
unknown
5336
SearchApp.exe
104.126.37.153:443
www.bing.com
Akamai International B.V.
DE
unknown
5336
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.142
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
help.bamsup.com
  • 62.2.106.38
unknown
www.bing.com
  • 104.126.37.153
  • 104.126.37.131
  • 104.126.37.155
  • 104.126.37.139
  • 104.126.37.145
  • 104.126.37.130
  • 104.126.37.123
  • 104.126.37.144
  • 104.126.37.128
  • 104.126.37.178
  • 104.126.37.179
  • 104.126.37.184
  • 104.126.37.186
  • 104.126.37.171
  • 104.126.37.177
  • 104.126.37.170
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
login.live.com
  • 40.126.31.69
  • 40.126.31.71
  • 20.190.159.71
  • 40.126.31.67
  • 20.190.159.0
  • 20.190.159.73
  • 20.190.159.75
  • 40.126.31.73
whitelisted
th.bing.com
  • 104.126.37.128
  • 104.126.37.153
  • 104.126.37.131
  • 104.126.37.155
  • 104.126.37.139
  • 104.126.37.145
  • 104.126.37.130
  • 104.126.37.123
  • 104.126.37.144
whitelisted
fd.api.iris.microsoft.com
  • 20.31.169.57
whitelisted
arc.msn.com
  • 20.31.169.57
whitelisted

Threats

PID
Process
Class
Message
6444
SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exe
Potentially Bad Traffic
ET USER_AGENTS Observed Suspicious User-Agent (JWrapperDownloader)
6444
SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exe
Potentially Bad Traffic
ET USER_AGENTS Observed Suspicious User-Agent (JWrapperDownloader)
6444
SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP SimpleHelp Remote Access Software Activity
6444
SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP SimpleHelp Remote Access Software Activity
6444
SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exe
Misc activity
ET INFO Simplehelp Remote Administration Suite HTTP Server Value in Response
6444
SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exe
Potentially Bad Traffic
ET USER_AGENTS Observed Suspicious User-Agent (JWrapperDownloader)
6444
SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP SimpleHelp Remote Access Software Activity
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Remsim.gen.17224.19214