File name:

jjsploit_8.14.1_x64_en-US.msi

Full analysis: https://app.any.run/tasks/258990fd-743d-4b12-9aa2-cc31a15d4fd9
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: April 19, 2025, 17:24:08
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
generated-doc
loader
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: jjsploit, Author: wearedevs, Keywords: Installer, Comments: This installer database contains the logic and data required to install jjsploit., Template: x64;0, Revision Number: {2069C114-2427-448A-A9E1-243AD24E7A19}, Create Time/Date: Tue Mar 25 22:34:08 2025, Last Saved Time/Date: Tue Mar 25 22:34:08 2025, Number of Pages: 450, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.14.1.8722), Security: 2
MD5:

900A51240149C0317A1A71738F6CECBD

SHA1:

A207E7CAC1D2062A5951CEE7A4589BA52785E75B

SHA256:

C70F0597C3F2FC5BE12B58F9E8C297B09DE1F477158B9DE398F2068269F9056E

SSDEEP:

98304:+RS4kZ1SxT+KjUJQt/8NdYRVC2O2qvm6i/I6o3Onrzg62hzr9zXl5fwS0UFv43ZN:pWrRLiB5u

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 1324)

    • Changes the autorun value in the registry

      • MicrosoftEdgeUpdate.exe (PID: 7756)

  • SUSPICIOUS

    • Executes as Windows Service

      • VSSVC.exe (PID: 7944)

    • Starts POWERSHELL.EXE for commands execution

      • msiexec.exe (PID: 7508)

    • The process bypasses the loading of PowerShell profile settings

      • msiexec.exe (PID: 7508)

    • Downloads file from URI via Powershell

      • powershell.exe (PID: 1324)

    • Gets or sets the security protocol (POWERSHELL)

      • powershell.exe (PID: 1324)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 7508)

    • Manipulates environment variables

      • powershell.exe (PID: 1324)

    • Starts process via Powershell

      • powershell.exe (PID: 1324)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 1324)
      • MicrosoftEdgeUpdate.exe (PID: 7756)
      • MicrosoftEdgeWebview2Setup.exe (PID: 7600)
      • MicrosoftEdge_X64_135.0.3179.85.exe (PID: 5728)

    • Starts a Microsoft application from unusual location

      • MicrosoftEdgeWebview2Setup.exe (PID: 7600)
      • MicrosoftEdgeUpdate.exe (PID: 7756)

    • Process drops legitimate windows executable

      • powershell.exe (PID: 1324)
      • MicrosoftEdgeWebview2Setup.exe (PID: 7600)
      • MicrosoftEdgeUpdate.exe (PID: 7756)
      • MicrosoftEdge_X64_135.0.3179.85.exe (PID: 5728)

    • Creates/Modifies COM task schedule object

      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 7772)
      • MicrosoftEdgeUpdate.exe (PID: 7676)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 7628)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6148)

    • Reads security settings of Internet Explorer

      • MicrosoftEdgeUpdate.exe (PID: 7756)
      • MicrosoftEdgeUpdate.exe (PID: 7892)

    • Starts itself from another location

      • MicrosoftEdgeUpdate.exe (PID: 7756)

    • Application launched itself

      • setup.exe (PID: 660)

  • INFO

    • Reads the computer name

      • msiexec.exe (PID: 7508)
      • msiexec.exe (PID: 7812)
      • MicrosoftEdgeUpdate.exe (PID: 7756)
      • MicrosoftEdgeUpdate.exe (PID: 7676)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 7772)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 7628)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6148)
      • MicrosoftEdgeUpdate.exe (PID: 7844)
      • MicrosoftEdgeUpdate.exe (PID: 7892)
      • MicrosoftEdge_X64_135.0.3179.85.exe (PID: 5728)
      • setup.exe (PID: 660)
      • MicrosoftEdgeUpdate.exe (PID: 7856)

    • An automatically generated document

      • msiexec.exe (PID: 7416)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 7416)
      • msiexec.exe (PID: 7508)

    • Checks supported languages

      • msiexec.exe (PID: 7508)
      • msiexec.exe (PID: 7812)
      • MicrosoftEdgeWebview2Setup.exe (PID: 7600)
      • MicrosoftEdgeUpdate.exe (PID: 7756)
      • MicrosoftEdgeUpdate.exe (PID: 7676)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 7628)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 7772)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6148)
      • MicrosoftEdgeUpdate.exe (PID: 7844)
      • MicrosoftEdgeUpdate.exe (PID: 7856)
      • MicrosoftEdgeUpdate.exe (PID: 7892)
      • MicrosoftEdge_X64_135.0.3179.85.exe (PID: 5728)
      • setup.exe (PID: 660)
      • setup.exe (PID: 4812)

    • Manages system restore points

      • SrTasks.exe (PID: 6048)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 7508)

    • Disables trace logs

      • powershell.exe (PID: 1324)

    • Checks proxy server information

      • powershell.exe (PID: 1324)
      • MicrosoftEdgeUpdate.exe (PID: 7844)
      • MicrosoftEdgeUpdate.exe (PID: 7892)

    • The sample compiled with english language support

      • powershell.exe (PID: 1324)
      • MicrosoftEdgeWebview2Setup.exe (PID: 7600)
      • MicrosoftEdgeUpdate.exe (PID: 7756)
      • MicrosoftEdge_X64_135.0.3179.85.exe (PID: 5728)

    • The executable file from the user directory is run by the Powershell process

      • MicrosoftEdgeWebview2Setup.exe (PID: 7600)

    • Create files in a temporary directory

      • MicrosoftEdgeWebview2Setup.exe (PID: 7600)
      • MicrosoftEdgeUpdate.exe (PID: 7756)

    • Creates files or folders in the user directory

      • MicrosoftEdgeUpdate.exe (PID: 7756)
      • MicrosoftEdgeUpdate.exe (PID: 7892)
      • MicrosoftEdge_X64_135.0.3179.85.exe (PID: 5728)
      • setup.exe (PID: 660)
      • setup.exe (PID: 4812)

    • Reads Environment values

      • MicrosoftEdgeUpdate.exe (PID: 7844)

    • Process checks computer location settings

      • MicrosoftEdgeUpdate.exe (PID: 7756)

    • Reads the software policy settings

      • MicrosoftEdgeUpdate.exe (PID: 7844)
      • MicrosoftEdgeUpdate.exe (PID: 7892)

    • Reads the machine GUID from the registry

      • MicrosoftEdgeUpdate.exe (PID: 7892)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (98.5)
.msi | Microsoft Installer (100)

EXIF

FlashPix

CodePage: Windows Latin 1 (Western European)
Title: Installation Database
Subject: jjsploit
Author: wearedevs
Keywords: Installer
Comments: This installer database contains the logic and data required to install jjsploit.
Template: x64;0
RevisionNumber: {2069C114-2427-448A-A9E1-243AD24E7A19}
CreateDate: 2025:03:25 22:34:08
ModifyDate: 2025:03:25 22:34:08
Pages: 450
Words: 2
Software: Windows Installer XML Toolset (3.14.1.8722)
Security: Read-only recommended
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
157
Monitored processes
21
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start msiexec.exe msiexec.exe msiexec.exe no specs vssvc.exe no specs srtasks.exe no specs conhost.exe no specs powershell.exe conhost.exe no specs microsoftedgewebview2setup.exe microsoftedgeupdate.exe microsoftedgeupdate.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdate.exe microsoftedgeupdate.exe no specs microsoftedgeupdate.exe slui.exe no specs microsoftedge_x64_135.0.3179.85.exe setup.exe no specs setup.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
660"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\Install\{AECFF422-F851-41C7-BBB1-FA3E67E0C351}\EDGEMITMP_41582.tmp\setup.exe" --install-archive="C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\Install\{AECFF422-F851-41C7-BBB1-FA3E67E0C351}\MicrosoftEdge_X64_135.0.3179.85.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --user-levelC:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\Install\{AECFF422-F851-41C7-BBB1-FA3E67E0C351}\EDGEMITMP_41582.tmp\setup.exe—MicrosoftEdge_X64_135.0.3179.85.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Installer
Version:
135.0.3179.85
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\install\{aecff422-f851-41c7-bbb1-fa3e67e0c351}\edgemitmp_41582.tmp\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\wevtapi.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
1324powershell.exe -NoProfile -windowstyle hidden try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 } catch {}; Invoke-WebRequest -Uri "https://go.microsoft.com/fwlink/p/?LinkId=2124703" -OutFile "$env:TEMP\MicrosoftEdgeWebview2Setup.exe" ; Start-Process -FilePath "$env:TEMP\MicrosoftEdgeWebview2Setup.exe" -ArgumentList ('/silent', '/install') -WaitC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3156\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SrTasks.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4620\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4812C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\Install\{AECFF422-F851-41C7-BBB1-FA3E67E0C351}\EDGEMITMP_41582.tmp\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\EdgeWebView\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=135.0.7049.96 --annotation=exe=C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\Install\{AECFF422-F851-41C7-BBB1-FA3E67E0C351}\EDGEMITMP_41582.tmp\setup.exe --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=135.0.3179.85 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0x7ff660f67608,0x7ff660f67614,0x7ff660f67620C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\Install\{AECFF422-F851-41C7-BBB1-FA3E67E0C351}\EDGEMITMP_41582.tmp\setup.exe—setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Installer
Version:
135.0.3179.85
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\install\{aecff422-f851-41c7-bbb1-fa3e67e0c351}\edgemitmp_41582.tmp\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\wevtapi.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
5728"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\Install\{AECFF422-F851-41C7-BBB1-FA3E67E0C351}\MicrosoftEdge_X64_135.0.3179.85.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --user-levelC:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\Install\{AECFF422-F851-41C7-BBB1-FA3E67E0C351}\MicrosoftEdge_X64_135.0.3179.85.exe
MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Installer
Version:
135.0.3179.85
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\install\{aecff422-f851-41c7-bbb1-fa3e67e0c351}\microsoftedge_x64_135.0.3179.85.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\shell32.dll
6048C:\WINDOWS\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:11C:\Windows\System32\SrTasks.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Windows System Protection background tasks.
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\srtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6148"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\1.3.195.49\MicrosoftEdgeUpdateComRegisterShell64.exe" /user C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\1.3.195.49\MicrosoftEdgeUpdateComRegisterShell64.exe—MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update COM Registration Helper
Exit code:
0
Version:
1.3.195.49
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\1.3.195.49\microsoftedgeupdatecomregistershell64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
6620C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7416"C:\Windows\System32\msiexec.exe" /i C:\Users\admin\AppData\Local\Temp\jjsploit_8.14.1_x64_en-US.msiC:\Windows\System32\msiexec.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
Total events
15 971
Read events
13 958
Write events
1 957
Delete events
56

Modification events

(PID) Process:(7508) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Leave)
Value:
4800000000000000C7F441E84FB1DB01541D0000F41E0000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7508) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Enter)
Value:
4800000000000000C7F441E84FB1DB01541D0000F41E0000D10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7508) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
480000000000000064B246E84FB1DB01541D0000F41E0000D00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7508) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
48000000000000000E39E0E74FB1DB01541D0000F41E0000D50700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7508) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Enter)
Value:
48000000000000000E39E0E74FB1DB01541D0000F41E0000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7508) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Leave)
Value:
4800000000000000C26244E84FB1DB01541D0000F41E0000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7508) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
11
(PID) Process:(7508) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssapiPublisher
Operation:writeName:IDENTIFY (Enter)
Value:
4800000000000000B242ADE84FB1DB01541D0000801F0000E8030000010000000000000000000000E0E2BA359EDA674294F42D43C125E91000000000000000000000000000000000
(PID) Process:(7508) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
4800000000000000BCDEAAE84FB1DB01541D0000F41E0000D30700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7944) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer
Operation:writeName:IDENTIFY (Enter)
Value:
48000000000000002BBDB6E84FB1DB01081F0000A01F0000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
205
Suspicious files
22
Text files
21
Unknown types
0

Dropped files

PID
Process
Filename
Type
7508msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
7508msiexec.exeC:\Windows\Installer\11172e.msi —
MD5:—
SHA256:—
7508msiexec.exeC:\System Volume Information\SPP\snapshot-2binary
MD5:A71B7F66FA2A8487245AA41174E24BD7
SHA256:12FB694C4741F90C29F050991CCE7078E47F063A54F59BAB37B8D5F3C3E51836
7416msiexec.exeC:\Users\admin\AppData\Local\Temp\MSICF77.tmpexecutable
MD5:CFBB8568BD3711A97E6124C56FCFA8D9
SHA256:7F47D98AB25CFEA9B3A2E898C3376CC9BA1CD893B4948B0C27CAA530FD0E34CC
7508msiexec.exeC:\Windows\Temp\~DF63D51124BEBECDB6.TMPbinary
MD5:8EECBE08378B9FBDA95F987E514029F9
SHA256:89FB97DADE0CAA4B8C761884FAD67043C61A9F0321406940359F19B366277A43
7508msiexec.exeC:\Windows\Installer\MSI1DA7.tmpbinary
MD5:54225056993F396C15E4E355ED9BD217
SHA256:06BF74A6AD4C0D9F334F689511EDEF7A3C39ED30B17B0B85B08C48019354C20F
7508msiexec.exeC:\Program Files\jjsploit\resources\luascripts\general\magnetizeto.luabinary
MD5:BEFD3490DAD3A1F6DBD3DBD9092642D4
SHA256:0BE4DDF7198A0E7DE42BE0E2869039B664C71256D52242F8C25F067E58C2C558
7508msiexec.exeC:\Program Files\jjsploit\resources\luascripts\animations\jumpland.luatext
MD5:2899EC217AEF73B127C9328785012EEF
SHA256:7D4CA7B02C90B0B21D64C2BAA6E5940DCCE895DB5BC125D0E993A5A883186721
7508msiexec.exeC:\Program Files\jjsploit\resources\luascripts\animations\walkthrough.luatext
MD5:348E2FCFE114EF12E8DB7AE75F24DE15
SHA256:10409B6D213DB5683EC415FA1A8CDE85B38FD057C9AA7B88C3FE4FBB19CD54B0
7508msiexec.exeC:\Program Files\jjsploit\resources\luascripts\general\fly.luabinary
MD5:54A3C002B2B1E311B6488B5796094457
SHA256:4F4098A0CCAD434E7CF4684DF559858BDDD5D17768F4C8BF89B0BED072575A47
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
33
DNS requests
19
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.53.40.178:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.53.40.178:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1188
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
1188
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
2772
svchost.exe
HEAD
200
2.16.168.108:80
http://msedge.f.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/821829a5-e0d2-4f3c-b4d9-1df49411de7e?P1=1745688298&P2=404&P3=2&P4=nWK1RwCe84qMY7r2WF%2blCHxFkBiHydvhUq65ty2xFwsacgYZ8vxnT6Urek6Ge5i5AQAtw45ATjnvXH%2fDHASdwQ%3d%3d
unknown
—
—
whitelisted
2772
svchost.exe
GET
200
2.16.168.108:80
http://msedge.f.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/821829a5-e0d2-4f3c-b4d9-1df49411de7e?P1=1745688298&P2=404&P3=2&P4=nWK1RwCe84qMY7r2WF%2blCHxFkBiHydvhUq65ty2xFwsacgYZ8vxnT6Urek6Ge5i5AQAtw45ATjnvXH%2fDHASdwQ%3d%3d
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
MoUsoCoreWorker.exe
23.53.40.178:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.53.40.178:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2112
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.5:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 23.53.40.178
  • 23.53.40.176
whitelisted
google.com
  • 216.58.212.174
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.160.5
  • 20.190.160.2
  • 20.190.160.132
  • 20.190.160.128
  • 40.126.32.72
  • 40.126.32.134
  • 20.190.160.130
  • 20.190.160.66
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
go.microsoft.com
  • 23.213.166.81
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted

Threats

PID
Process
Class
Message
2772
svchost.exe
Misc activity
ET INFO Packed Executable Download
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
jjsploit_8.14.1_x64_en-US.msi