File name:

JJSploit.exe

Full analysis: https://app.any.run/tasks/86059a9c-17c0-4390-a843-910a959fa777
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: February 23, 2025, 02:25:00
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
evasion
xworm
remote
stealer
umbralstealer
discord
exfiltration
loader
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections
MD5:

F29FD0BB7218E3CF63AB6040BE0A1698

SHA1:

C078E4888D6E1CF6C75A4141D51A1D375C2F71C8

SHA256:

CCBCC6269218D292A06DB3D9896DC621598A76794881FFBEB6F093D8B54E1C43

SSDEEP:

98304:04t6ZmQuYt+0ga9SiYgURFCZLQ7XYQycuKShbh854EG+kwJ9CFvlx2JgAgpF2lLu:t8GYgN5OweKf5B4xGY

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses Task Scheduler to run other applications

      • JJSplo.exe (PID: 3092)

    • Create files in the Startup directory

      • JJSplo.exe (PID: 3092)
      • JJSploitInjector.exe (PID: 3260)

    • Changes the autorun value in the registry

      • JJSplo.exe (PID: 3092)
      • MicrosoftEdgeUpdate.exe (PID: 7152)

    • Adds path to the Windows Defender exclusion list

      • JJSploitInjector.exe (PID: 3260)

    • Changes settings for real-time protection

      • powershell.exe (PID: 6508)

    • XWORM has been detected (YARA)

      • JJSplo.exe (PID: 3092)

    • Changes settings for checking scripts for malicious actions

      • powershell.exe (PID: 6508)

    • Changes settings for sending potential threat samples to Microsoft servers

      • powershell.exe (PID: 6508)

    • Changes settings for reporting to Microsoft Active Protection Service (MAPS)

      • powershell.exe (PID: 6508)

    • Changes settings for protection against network attacks (IPS)

      • powershell.exe (PID: 6508)

    • Changes antivirus protection settings for downloading files from the Internet (IOAVProtection)

      • powershell.exe (PID: 6508)

    • Changes Controlled Folder Access settings

      • powershell.exe (PID: 6508)

    • XWORM has been detected (SURICATA)

      • JJSplo.exe (PID: 3092)

    • Steals credentials from Web Browsers

      • JJSploitInjector.exe (PID: 3260)

    • Actions looks like stealing of personal data

      • JJSploitInjector.exe (PID: 3260)

    • UMBRALSTEALER has been detected (SURICATA)

      • JJSploitInjector.exe (PID: 3260)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 6792)

    • Starts CMD.EXE for self-deleting

      • JJSploitInjector.exe (PID: 3260)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • JJSploit.exe (PID: 904)
      • JJSploitInjector.exe (PID: 6032)
      • JJSplo.exe (PID: 3092)
      • MicrosoftEdgeUpdate.exe (PID: 7152)
      • MicrosoftEdgeUpdate.exe (PID: 6412)

    • Executable content was dropped or overwritten

      • JJSploit.exe (PID: 904)
      • JJSplo.exe (PID: 3092)
      • JJSploitInjector.exe (PID: 3260)
      • MicrosoftEdgeWebview2Setup.exe (PID: 7120)
      • powershell.exe (PID: 6792)
      • MicrosoftEdgeUpdate.exe (PID: 7152)
      • MicrosoftEdge_X64_133.0.3065.82.exe (PID: 6404)

    • Uses WMIC.EXE to obtain Windows Installer data

      • JJSploitInjector.exe (PID: 6032)
      • JJSploitInjector.exe (PID: 3260)

    • Checks for external IP

      • svchost.exe (PID: 2192)
      • JJSploitInjector.exe (PID: 6032)
      • JJSplo.exe (PID: 3092)
      • JJSploitInjector.exe (PID: 3260)

    • Accesses product unique identifier via WMI (SCRIPT)

      • WMIC.exe (PID: 5000)
      • WMIC.exe (PID: 4672)
      • WMIC.exe (PID: 7140)

    • Reads the date of Windows installation

      • JJSploitInjector.exe (PID: 6032)
      • JJSplo.exe (PID: 3092)

    • Application launched itself

      • JJSploitInjector.exe (PID: 6032)
      • setup.exe (PID: 3808)

    • Uses ATTRIB.EXE to modify file attributes

      • JJSploitInjector.exe (PID: 3260)

    • Starts POWERSHELL.EXE for commands execution

      • JJSploitInjector.exe (PID: 3260)
      • msiexec.exe (PID: 3208)

    • Executes as Windows Service

      • VSSVC.exe (PID: 6244)

    • Connects to unusual port

      • JJSplo.exe (PID: 3092)

    • Script disables Windows Defender's real-time protection

      • JJSploitInjector.exe (PID: 3260)

    • Script disables Windows Defender's IPS

      • JJSploitInjector.exe (PID: 3260)

    • Contacting a server suspected of hosting an CnC

      • JJSplo.exe (PID: 3092)

    • Script adds exclusion path to Windows Defender

      • JJSploitInjector.exe (PID: 3260)

    • Accesses operating system name via WMI (SCRIPT)

      • WMIC.exe (PID: 6976)

    • Uses WMIC.EXE to obtain operating system information

      • JJSploitInjector.exe (PID: 3260)

    • Uses WMIC.EXE to obtain computer system information

      • JJSploitInjector.exe (PID: 3260)

    • Uses WMIC.EXE to obtain a list of video controllers

      • JJSploitInjector.exe (PID: 3260)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 3208)

    • Starts process via Powershell

      • powershell.exe (PID: 6792)

    • Downloads file from URI via Powershell

      • powershell.exe (PID: 6792)

    • Accesses video controller name via WMI (SCRIPT)

      • WMIC.exe (PID: 436)

    • The process connected to a server suspected of theft

      • JJSploitInjector.exe (PID: 3260)

    • The process bypasses the loading of PowerShell profile settings

      • msiexec.exe (PID: 3208)

    • Starts a Microsoft application from unusual location

      • MicrosoftEdgeWebview2Setup.exe (PID: 7120)
      • MicrosoftEdgeUpdate.exe (PID: 7152)

    • Process drops legitimate windows executable

      • MicrosoftEdgeWebview2Setup.exe (PID: 7120)
      • powershell.exe (PID: 6792)
      • MicrosoftEdgeUpdate.exe (PID: 7152)
      • MicrosoftEdge_X64_133.0.3065.82.exe (PID: 6404)

    • Manipulates environment variables

      • powershell.exe (PID: 6792)

    • Gets or sets the security protocol (POWERSHELL)

      • powershell.exe (PID: 6792)

    • Starts CMD.EXE for commands execution

      • JJSploitInjector.exe (PID: 3260)

    • Starts itself from another location

      • MicrosoftEdgeUpdate.exe (PID: 7152)

    • Creates/Modifies COM task schedule object

      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6204)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6420)
      • MicrosoftEdgeUpdate.exe (PID: 6184)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 732)

    • The process executes via Task Scheduler

      • System32.exe (PID: 6864)
      • System32.exe (PID: 1224)

    • Checks Windows Trust Settings

      • MicrosoftEdgeUpdate.exe (PID: 6412)

  • INFO

    • Reads the computer name

      • JJSploit.exe (PID: 904)
      • JJSploitInjector.exe (PID: 6032)
      • JJSplo.exe (PID: 3092)
      • msiexec.exe (PID: 3208)
      • JJSploitInjector.exe (PID: 3260)
      • msiexec.exe (PID: 3564)
      • MicrosoftEdgeUpdate.exe (PID: 7152)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6204)
      • MicrosoftEdgeUpdate.exe (PID: 6184)
      • MicrosoftEdgeUpdate.exe (PID: 1348)
      • MicrosoftEdgeUpdate.exe (PID: 3508)
      • MicrosoftEdgeUpdate.exe (PID: 6412)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 732)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6420)
      • System32.exe (PID: 6864)
      • System32.exe (PID: 1224)
      • MicrosoftEdge_X64_133.0.3065.82.exe (PID: 6404)
      • setup.exe (PID: 3808)

    • Checks supported languages

      • JJSploit.exe (PID: 904)
      • JJSplo.exe (PID: 3092)
      • msiexec.exe (PID: 3208)
      • JJSploitInjector.exe (PID: 6032)
      • JJSploitInjector.exe (PID: 3260)
      • msiexec.exe (PID: 3564)
      • MicrosoftEdgeWebview2Setup.exe (PID: 7120)
      • MicrosoftEdgeUpdate.exe (PID: 6184)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6204)
      • MicrosoftEdgeUpdate.exe (PID: 7152)
      • MicrosoftEdgeUpdate.exe (PID: 3508)
      • MicrosoftEdgeUpdate.exe (PID: 1348)
      • MicrosoftEdgeUpdate.exe (PID: 6412)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 732)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6420)
      • System32.exe (PID: 1224)
      • MicrosoftEdge_X64_133.0.3065.82.exe (PID: 6404)
      • setup.exe (PID: 3808)
      • System32.exe (PID: 6864)
      • setup.exe (PID: 776)

    • Process checks computer location settings

      • JJSploit.exe (PID: 904)
      • JJSploitInjector.exe (PID: 6032)
      • JJSplo.exe (PID: 3092)
      • MicrosoftEdgeUpdate.exe (PID: 7152)

    • Create files in a temporary directory

      • JJSploit.exe (PID: 904)
      • JJSplo.exe (PID: 3092)
      • JJSploitInjector.exe (PID: 3260)
      • MicrosoftEdgeWebview2Setup.exe (PID: 7120)
      • MicrosoftEdgeUpdate.exe (PID: 7152)

    • Disables trace logs

      • JJSploitInjector.exe (PID: 6032)
      • JJSplo.exe (PID: 3092)
      • JJSploitInjector.exe (PID: 3260)
      • powershell.exe (PID: 6792)

    • Checks proxy server information

      • JJSploitInjector.exe (PID: 6032)
      • JJSplo.exe (PID: 3092)
      • JJSploitInjector.exe (PID: 3260)
      • powershell.exe (PID: 6792)
      • MicrosoftEdgeUpdate.exe (PID: 3508)
      • MicrosoftEdgeUpdate.exe (PID: 6412)

    • Reads Environment values

      • JJSploitInjector.exe (PID: 6032)
      • JJSplo.exe (PID: 3092)
      • JJSploitInjector.exe (PID: 3260)
      • MicrosoftEdgeUpdate.exe (PID: 3508)

    • Reads the machine GUID from the registry

      • JJSploitInjector.exe (PID: 6032)
      • JJSplo.exe (PID: 3092)
      • JJSploitInjector.exe (PID: 3260)
      • MicrosoftEdgeUpdate.exe (PID: 3508)
      • MicrosoftEdgeUpdate.exe (PID: 6412)
      • System32.exe (PID: 6864)
      • System32.exe (PID: 1224)

    • Reads the software policy settings

      • JJSploitInjector.exe (PID: 6032)
      • JJSploitInjector.exe (PID: 3260)
      • MicrosoftEdgeUpdate.exe (PID: 3508)
      • MicrosoftEdgeUpdate.exe (PID: 6412)

    • Reads security settings of Internet Explorer

      • WMIC.exe (PID: 5000)
      • WMIC.exe (PID: 4672)
      • WMIC.exe (PID: 6976)
      • WMIC.exe (PID: 7060)
      • WMIC.exe (PID: 7140)
      • WMIC.exe (PID: 436)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 6076)
      • msiexec.exe (PID: 3208)

    • Creates files or folders in the user directory

      • JJSplo.exe (PID: 3092)
      • MicrosoftEdgeUpdate.exe (PID: 7152)
      • MicrosoftEdgeUpdate.exe (PID: 6412)
      • MicrosoftEdge_X64_133.0.3065.82.exe (PID: 6404)
      • setup.exe (PID: 776)
      • setup.exe (PID: 3808)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 5392)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 5392)
      • powershell.exe (PID: 6656)
      • powershell.exe (PID: 6812)
      • powershell.exe (PID: 6508)

    • Creates files in the program directory

      • JJSploitInjector.exe (PID: 3260)

    • Manages system restore points

      • SrTasks.exe (PID: 6516)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 3208)

    • The executable file from the user directory is run by the Powershell process

      • MicrosoftEdgeWebview2Setup.exe (PID: 7120)

    • The sample compiled with english language support

      • MicrosoftEdgeWebview2Setup.exe (PID: 7120)
      • powershell.exe (PID: 6792)
      • MicrosoftEdgeUpdate.exe (PID: 7152)
      • MicrosoftEdge_X64_133.0.3065.82.exe (PID: 6404)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

XWorm

(PID) Process(3092) JJSplo.exe
C2study-conclusions.gl.at.ply.gg:20142
Keys
AES<123456789>
Options
Splitter<Xwormmm>
Sleep time3
USB drop nameXWorm V5.6
MutexNEKafszCzWIeHsPj
No Malware configuration.

TRiD

.exe | InstallShield setup (53.2)
.exe | Win32 Executable Delphi generic (17.5)
.scr | Windows screen saver (16.1)
.exe | Win32 Executable (generic) (5.5)
.exe | Win16/32 Executable Delphi generic (2.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:19 22:22:17+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 5120
InitializedDataSize: 6959104
UninitializedDataSize: -
EntryPoint: 0x20cc
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileDescription:
FileVersion: 1.0.0.0
InternalName: JJspoit.exe
LegalCopyright:
OriginalFileName: JJspoit.exe
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
180
Monitored processes
56
Malicious processes
10
Suspicious processes
0

Behavior graph

Click at the process to see the details
start jjsploit.exe jjsploitinjector.exe #XWORM jjsplo.exe msiexec.exe msiexec.exe wmic.exe no specs conhost.exe no specs svchost.exe #UMBRALSTEALER jjsploitinjector.exe schtasks.exe no specs conhost.exe no specs msiexec.exe no specs wmic.exe no specs conhost.exe no specs attrib.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs vssvc.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs wmic.exe no specs conhost.exe no specs wmic.exe no specs conhost.exe no specs wmic.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs wmic.exe no specs conhost.exe no specs srtasks.exe no specs conhost.exe no specs powershell.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs microsoftedgewebview2setup.exe microsoftedgeupdate.exe microsoftedgeupdate.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdate.exe microsoftedgeupdate.exe no specs microsoftedgeupdate.exe system32.exe no specs system32.exe no specs microsoftedge_x64_133.0.3065.82.exe setup.exe no specs setup.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
396\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—WMIC.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
436"wmic" path win32_VideoController get nameC:\Windows\System32\wbem\WMIC.exe—JJSploitInjector.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
732"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\1.3.195.43\MicrosoftEdgeUpdateComRegisterShell64.exe" /user C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\1.3.195.43\MicrosoftEdgeUpdateComRegisterShell64.exe—MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update COM Registration Helper
Exit code:
0
Version:
1.3.195.43
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\1.3.195.43\microsoftedgeupdatecomregistershell64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
776C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\Install\{9D19A30B-6D2E-4F05-AB26-F11E30A24473}\EDGEMITMP_7C178.tmp\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\EdgeWebView\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.127 --annotation=exe=C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\Install\{9D19A30B-6D2E-4F05-AB26-F11E30A24473}\EDGEMITMP_7C178.tmp\setup.exe --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.82 --initial-client-data=0x240,0x244,0x248,0x21c,0x24c,0x7ff6fad57a68,0x7ff6fad57a74,0x7ff6fad57a80C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\Install\{9D19A30B-6D2E-4F05-AB26-F11E30A24473}\EDGEMITMP_7C178.tmp\setup.exe—setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Installer
Version:
133.0.3065.82
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\install\{9d19a30b-6d2e-4f05-ab26-f11e30a24473}\edgemitmp_7c178.tmp\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
904"C:\Users\admin\Desktop\JJSploit.exe" C:\Users\admin\Desktop\JJSploit.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\jjsploit.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
1224"C:\Users\admin\AppData\Local\Temp\System32.exe"C:\Users\admin\AppData\Local\Temp\System32.exe—svchost.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\system32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1348"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=false" /installsource otherinstallcmd /sessionid "{8AE3DC19-6CC7-4084-9F1A-3E1749D17649}" /silentC:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe—MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Version:
1.3.195.43
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ole32.dll
c:\windows\syswow64\ucrtbase.dll
1572"attrib.exe" +h +s "C:\Users\admin\AppData\Local\Temp\JJSploitInjector.exe"C:\Windows\System32\attrib.exe—JJSploitInjector.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Attribute Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\attrib.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\fsutilext.dll
2008\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—WMIC.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2192C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
Total events
56 300
Read events
52 943
Write events
3 301
Delete events
56

Modification events

(PID) Process:(6032) JJSploitInjector.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\JJSploitInjector_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6032) JJSploitInjector.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\JJSploitInjector_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6032) JJSploitInjector.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\JJSploitInjector_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(6032) JJSploitInjector.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\JJSploitInjector_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(6032) JJSploitInjector.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\JJSploitInjector_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(6032) JJSploitInjector.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\JJSploitInjector_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(6032) JJSploitInjector.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\JJSploitInjector_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(6032) JJSploitInjector.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\JJSploitInjector_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6032) JJSploitInjector.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\JJSploitInjector_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6032) JJSploitInjector.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\JJSploitInjector_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
209
Suspicious files
28
Text files
32
Unknown types
3

Dropped files

PID
Process
Filename
Type
904JJSploit.exeC:\Users\admin\AppData\Local\Temp\jjsploit_8.12.2_x64_en-US (1).msi —
MD5:—
SHA256:—
904JJSploit.exeC:\Users\admin\AppData\Local\Temp\JJSploitInjector.exeexecutable
MD5:760861BFE626A80DCF4D2B13F8D8C76A
SHA256:4ECF8BC1C1E327565B66512A335D72C376D4189F11FC8F751B0D2CD337EA8339
6508powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_mwhv3adg.q0b.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6656powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_5vvn0ni3.wou.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
3260JJSploitInjector.exeC:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\1x6Uk.screxecutable
MD5:760861BFE626A80DCF4D2B13F8D8C76A
SHA256:4ECF8BC1C1E327565B66512A335D72C376D4189F11FC8F751B0D2CD337EA8339
5392powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:8EDB30580C10A1C3E8AC4865E3776527
SHA256:511B3B4271A16158692561D445E65F0F49C4A1BE1FF8A5B4017306B191E91B0A
3092JJSplo.exeC:\Users\admin\AppData\Local\Temp\System32.exeexecutable
MD5:C5BA230193B7F217C0E512A5CB8606E8
SHA256:D363B1ECFAD886B1368AA54A7E0F1438A615B80010A06EE5B5E2E8CD44D1FBC9
6656powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_sjsulhqr.my2.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6812powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_hzs2aztx.iu1.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
3208msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
21
TCP/UDP connections
52
DNS requests
18
Threats
48

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
204
142.250.186.35:443
https://gstatic.com/generate_204
US
—
—
unknown
640
svchost.exe
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
DE
binary
1.01 Kb
whitelisted
3576
RUXIMICS.exe
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
DE
binary
1.01 Kb
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
DE
binary
1.01 Kb
whitelisted
3576
RUXIMICS.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
DE
binary
973 b
whitelisted
6032
JJSploitInjector.exe
GET
200
208.95.112.1:80
http://ip-api.com/line/?fields=hosting
US
text
6 b
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
DE
binary
973 b
whitelisted
3092
JJSplo.exe
GET
200
208.95.112.1:80
http://ip-api.com/line/?fields=hosting
US
text
6 b
whitelisted
—
—
GET
204
142.250.186.35:443
https://gstatic.com/generate_204
US
—
—
unknown
3260
JJSploitInjector.exe
GET
200
208.95.112.1:80
http://ip-api.com/line/?fields=hosting
US
text
6 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
640
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3576
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4712
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6032
JJSploitInjector.exe
142.250.184.227:443
gstatic.com
GOOGLE
US
whitelisted
3576
RUXIMICS.exe
23.53.40.176:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
640
svchost.exe
23.53.40.176:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
23.53.40.176:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
3576
RUXIMICS.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 4.231.128.59
whitelisted
google.com
  • 142.250.186.110
whitelisted
gstatic.com
  • 142.250.184.227
whitelisted
crl.microsoft.com
  • 23.53.40.176
  • 23.53.40.178
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
ip-api.com
  • 208.95.112.1
whitelisted
www.bing.com
  • 184.86.251.22
  • 184.86.251.27
whitelisted
study-conclusions.gl.at.ply.gg
  • 147.185.221.26
unknown
discord.com
  • 162.159.138.232
  • 162.159.136.232
  • 162.159.128.233
  • 162.159.135.232
  • 162.159.137.232
whitelisted
go.microsoft.com
  • 184.30.249.239
whitelisted

Threats

PID
Process
Class
Message
2192
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
2192
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
6032
JJSploitInjector.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
6032
JJSploitInjector.exe
Device Retrieving External IP Address Detected
POLICY [ANY.RUN] External Hosting Lookup by ip-api
3092
JJSplo.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
3092
JJSplo.exe
Device Retrieving External IP Address Detected
POLICY [ANY.RUN] External Hosting Lookup by ip-api
3260
JJSploitInjector.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
3260
JJSploitInjector.exe
Device Retrieving External IP Address Detected
POLICY [ANY.RUN] External Hosting Lookup by ip-api
2192
svchost.exe
Potentially Bad Traffic
ET INFO playit .gg Tunneling Domain in DNS Lookup
2192
svchost.exe
A Network Trojan was detected
MALWARE [ANY.RUN] Suspected domain Associated with Malware Distribution (.ply .gg)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
JJSploit.exe