File name:

JJSploit_7.1.3_x86_en-US.msi

Full analysis: https://app.any.run/tasks/7b6cccb0-ccc2-4830-a501-54a753ecb1f1
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: May 21, 2023, 19:00:55
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: JJSploit, Author: wearedevs, Keywords: Installer, Comments: This installer database contains the logic and data required to install JJSploit., Template: Intel;0, Revision Number: {7A380861-6564-4B79-A6B7-C5B6E7F12EA0}, Create Time/Date: Thu Mar 30 11:30:48 2023, Last Saved Time/Date: Thu Mar 30 11:30:48 2023, Number of Pages: 450, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.11.2.4516), Security: 2
MD5:

89B39AAFA577686CE2890FF00A22F7D6

SHA1:

1259BB1962D23F242EBE340F359B3825A31989D4

SHA256:

DFDB140D98307146CBDBC726CC1F4897ACC14288C95FD8BFC5AB29F91C895FA3

SSDEEP:

98304:oni7F600rU+xmX0VumSuS2eaYbC8wSKyWatyiGoMNjbLmf19+I3NlNi3bywir:Gi7F6MiVVBS2e3bC8wS+QGZNYpi2

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 1820)

    • Application was dropped or rewritten from another process

      • MicrosoftEdgeWebview2Setup.exe (PID: 3840)
      • MicrosoftEdgeUpdate.exe (PID: 1168)
      • MicrosoftEdgeUpdate.exe (PID: 2436)
      • MicrosoftEdgeUpdate.exe (PID: 3880)
      • MicrosoftEdgeUpdate.exe (PID: 1788)
      • MicrosoftEdgeUpdate.exe (PID: 2300)
      • MicrosoftEdgeUpdate.exe (PID: 240)
      • JJSploit.exe (PID: 3136)

    • Loads dropped or rewritten executable

      • MicrosoftEdgeUpdate.exe (PID: 1788)
      • MicrosoftEdgeUpdate.exe (PID: 1168)
      • MicrosoftEdgeUpdate.exe (PID: 2436)
      • MicrosoftEdgeUpdate.exe (PID: 2300)
      • MicrosoftEdgeUpdate.exe (PID: 3880)
      • MicrosoftEdgeUpdate.exe (PID: 240)
      • msiexec.exe (PID: 2704)

    • The DLL Hijacking

      • msedgewebview2.exe (PID: 1004)
      • msedgewebview2.exe (PID: 3512)

  • SUSPICIOUS

    • Executes as Windows Service

      • VSSVC.exe (PID: 2964)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 1836)
      • powershell.exe (PID: 1820)
      • MicrosoftEdgeWebview2Setup.exe (PID: 3840)
      • MicrosoftEdgeUpdate.exe (PID: 3880)
      • MicrosoftEdge_X86_109.0.1518.100.exe (PID: 2720)
      • setup.exe (PID: 2852)

    • Powershell scripting: start process

      • msiexec.exe (PID: 1836)

    • The process bypasses the loading of PowerShell profile settings

      • msiexec.exe (PID: 1836)

    • Request a resource from the Internet using PowerShell's cmdlet

      • msiexec.exe (PID: 1836)

    • Starts POWERSHELL.EXE for commands execution

      • msiexec.exe (PID: 1836)

    • Reads the Internet Settings

      • powershell.exe (PID: 1820)
      • MicrosoftEdgeUpdate.exe (PID: 2300)
      • MicrosoftEdgeUpdate.exe (PID: 2436)
      • MicrosoftEdgeUpdate.exe (PID: 240)
      • msiexec.exe (PID: 2704)
      • cmd.exe (PID: 4028)
      • cmd.exe (PID: 3696)
      • msedgewebview2.exe (PID: 2228)
      • JJSploit.exe (PID: 3136)

    • Creates/Modifies COM task schedule object

      • MicrosoftEdgeUpdate.exe (PID: 1788)

    • Starts itself from another location

      • MicrosoftEdgeUpdate.exe (PID: 3880)

    • Reads settings of System Certificates

      • MicrosoftEdgeUpdate.exe (PID: 2300)
      • MicrosoftEdgeUpdate.exe (PID: 2436)
      • MicrosoftEdgeUpdate.exe (PID: 240)
      • msedgewebview2.exe (PID: 2228)
      • JJSploit.exe (PID: 3136)

    • The Powershell connects to the Internet

      • powershell.exe (PID: 1820)

    • Checks Windows Trust Settings

      • MicrosoftEdgeUpdate.exe (PID: 2300)
      • MicrosoftEdgeUpdate.exe (PID: 2436)
      • MicrosoftEdgeUpdate.exe (PID: 240)

    • Reads security settings of Internet Explorer

      • MicrosoftEdgeUpdate.exe (PID: 2300)
      • MicrosoftEdgeUpdate.exe (PID: 2436)
      • MicrosoftEdgeUpdate.exe (PID: 240)

    • Unusual connection from system programs

      • powershell.exe (PID: 1820)

    • Application launched itself

      • MicrosoftEdgeUpdate.exe (PID: 2436)
      • msedgewebview2.exe (PID: 2228)

    • Starts CMD.EXE for commands execution

      • JJSploit.exe (PID: 3136)

  • INFO

    • Checks supported languages

      • msiexec.exe (PID: 1836)
      • msiexec.exe (PID: 2704)
      • MicrosoftEdgeWebview2Setup.exe (PID: 3840)
      • MicrosoftEdgeUpdate.exe (PID: 3880)
      • MicrosoftEdgeUpdate.exe (PID: 2300)
      • MicrosoftEdgeUpdate.exe (PID: 1788)
      • MicrosoftEdgeUpdate.exe (PID: 1168)
      • MicrosoftEdgeUpdate.exe (PID: 2436)
      • MicrosoftEdge_X86_109.0.1518.100.exe (PID: 2720)
      • setup.exe (PID: 2852)
      • MicrosoftEdgeUpdate.exe (PID: 240)
      • JJSploit.exe (PID: 3136)
      • msedgewebview2.exe (PID: 3096)
      • msedgewebview2.exe (PID: 2228)
      • msedgewebview2.exe (PID: 4000)
      • msedgewebview2.exe (PID: 1924)
      • msedgewebview2.exe (PID: 3512)
      • msedgewebview2.exe (PID: 1004)
      • msedgewebview2.exe (PID: 2212)
      • wmpnscfg.exe (PID: 3668)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 3964)

    • Application launched itself

      • msiexec.exe (PID: 1836)
      • iexplore.exe (PID: 1776)
      • iexplore.exe (PID: 1572)

    • The process checks LSA protection

      • msiexec.exe (PID: 1836)
      • msiexec.exe (PID: 3964)
      • VSSVC.exe (PID: 2964)
      • msiexec.exe (PID: 2704)
      • MicrosoftEdgeUpdate.exe (PID: 3880)
      • MicrosoftEdgeUpdate.exe (PID: 2300)
      • MicrosoftEdgeUpdate.exe (PID: 1168)
      • MicrosoftEdgeUpdate.exe (PID: 2436)
      • setup.exe (PID: 2852)
      • MicrosoftEdgeUpdate.exe (PID: 240)
      • JJSploit.exe (PID: 3136)
      • msedgewebview2.exe (PID: 2228)
      • wmpnscfg.exe (PID: 3668)

    • Reads the computer name

      • msiexec.exe (PID: 2704)
      • msiexec.exe (PID: 1836)
      • MicrosoftEdgeUpdate.exe (PID: 3880)
      • MicrosoftEdgeUpdate.exe (PID: 1788)
      • MicrosoftEdgeUpdate.exe (PID: 2300)
      • MicrosoftEdgeUpdate.exe (PID: 1168)
      • MicrosoftEdgeUpdate.exe (PID: 2436)
      • MicrosoftEdge_X86_109.0.1518.100.exe (PID: 2720)
      • setup.exe (PID: 2852)
      • MicrosoftEdgeUpdate.exe (PID: 240)
      • JJSploit.exe (PID: 3136)
      • msedgewebview2.exe (PID: 2228)
      • msedgewebview2.exe (PID: 2212)
      • msedgewebview2.exe (PID: 1004)
      • msedgewebview2.exe (PID: 3512)
      • wmpnscfg.exe (PID: 3668)

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 2704)
      • msiexec.exe (PID: 1836)
      • MicrosoftEdgeUpdate.exe (PID: 3880)
      • MicrosoftEdgeUpdate.exe (PID: 1168)
      • MicrosoftEdgeUpdate.exe (PID: 2300)
      • MicrosoftEdgeUpdate.exe (PID: 2436)
      • MicrosoftEdgeUpdate.exe (PID: 240)
      • msedgewebview2.exe (PID: 2228)
      • JJSploit.exe (PID: 3136)
      • wmpnscfg.exe (PID: 3668)

    • Create files in a temporary directory

      • msiexec.exe (PID: 1836)
      • powershell.exe (PID: 1820)
      • MicrosoftEdgeUpdate.exe (PID: 3880)
      • MicrosoftEdgeUpdate.exe (PID: 2300)
      • MicrosoftEdgeWebview2Setup.exe (PID: 3840)
      • MicrosoftEdgeUpdate.exe (PID: 240)
      • iexplore.exe (PID: 1776)
      • iexplore.exe (PID: 1572)
      • msedgewebview2.exe (PID: 2228)

    • The executable file from the user directory is run by the Powershell process

      • MicrosoftEdgeWebview2Setup.exe (PID: 3840)

    • Creates files or folders in the user directory

      • MicrosoftEdgeUpdate.exe (PID: 3880)
      • MicrosoftEdgeUpdate.exe (PID: 2436)
      • MicrosoftEdge_X86_109.0.1518.100.exe (PID: 2720)
      • msedgewebview2.exe (PID: 3096)
      • setup.exe (PID: 2852)
      • msedgewebview2.exe (PID: 2212)
      • msedgewebview2.exe (PID: 2228)

    • Reads Environment values

      • MicrosoftEdgeUpdate.exe (PID: 2300)
      • MicrosoftEdgeUpdate.exe (PID: 240)

    • Checks proxy server information

      • MicrosoftEdgeUpdate.exe (PID: 2300)
      • MicrosoftEdgeUpdate.exe (PID: 240)
      • JJSploit.exe (PID: 3136)

    • Process checks computer location settings

      • msedgewebview2.exe (PID: 2228)
      • msedgewebview2.exe (PID: 1924)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 3668)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (98.5)
.msi | Microsoft Installer (100)

EXIF

FlashPix

Security: Read-only recommended
Software: Windows Installer XML Toolset (3.11.2.4516)
Words: 2
Pages: 450
ModifyDate: 2023:03:30 11:30:48
CreateDate: 2023:03:30 11:30:48
RevisionNumber: {7A380861-6564-4B79-A6B7-C5B6E7F12EA0}
Template: Intel;0
Comments: This installer database contains the logic and data required to install JJSploit.
Keywords: Installer
Author: wearedevs
Subject: JJSploit
Title: Installation Database
CodePage: Windows Latin 1 (Western European)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
74
Monitored processes
29
Malicious processes
16
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start msiexec.exe msiexec.exe msiexec.exe no specs vssvc.exe no specs powershell.exe microsoftedgewebview2setup.exe microsoftedgeupdate.exe microsoftedgeupdate.exe no specs microsoftedgeupdate.exe microsoftedgeupdate.exe no specs microsoftedgeupdate.exe microsoftedge_x86_109.0.1518.100.exe setup.exe microsoftedgeupdate.exe jjsploit.exe cmd.exe no specs cmd.exe no specs iexplore.exe iexplore.exe msedgewebview2.exe msedgewebview2.exe no specs iexplore.exe iexplore.exe msedgewebview2.exe no specs msedgewebview2.exe msedgewebview2.exe no specs msedgewebview2.exe no specs msedgewebview2.exe no specs wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
240"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzUuMjciIHNoZWxsX3ZlcnNpb249IjEuMy4xNzUuMjciIGlzbWFjaGluZT0iMCIgc2Vzc2lvbmlkPSJ7RUIzQzdDNDctQzE4MC00NTAwLUE0REUtRTA0MkFEMUYxMkJEfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InswQTgyMzM1RC1FNjkwLTQ3RDItODEyNi1EQjU5NEQ0NDUyQjR9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iNCIgcGh5c21lbW9yeT0iMyIgZGlza190eXBlPSIwIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSI2LjEuNzYwMS4yNDU0NiIgc3A9IlNlcnZpY2UgUGFjayAxIiBhcmNoPSJ4ODYiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IkRFTEwiIHByb2R1Y3RfbmFtZT0iREVMTCIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTA5LjAuMTUxOC4xMDAiIGxhbmc9ImVuIiBicmFuZD0iIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9Ii0xIiBpbnN0YWxsZGF0ZT0iLTEiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTEyMzEwOTM3NTAiLz48ZXZlbnQgZXZlbnR0eXBlPSI1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMTIzMTA5Mzc1MCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEyMDQyMDMxMjUwIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuZi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy8yMzY4ZjIwOC0wYWJmLTQzMGYtYmE1ZC1kMzZhZDAxZGFhZWQ_UDE9MTY4NTMwMDQ5MSZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1lOFQzamlJNUtMZDhZNlVNMEgzR3ZYeEtUVDVsbDJXdlR3OElvZnR3ejJURmFjNEElMmYyalExTDZiSXBkNVo5JTJiYzF6NnFUakhxT3U0JTJiTm52THdvZmthZyUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjEyODM2MTg4OCIgdG90YWw9IjEyODM2MTg4OCIgZG93bmxvYWRfdGltZV9tcz0iNzgyNjUiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMjA0MjE4NzUwMCIgc291cmNlX3VybF9pbmRleD0iMCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEyMDYxODc1MDAwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NjA4IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMjI0NzM0Mzc1MCIgc291cmNlX3VybF9pbmRleD0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjEwNzgiIGRvd25sb2FkX3RpbWVfbXM9IjgxMTA5IiBkb3dubG9hZGVkPSIxMjgzNjE4ODgiIHRvdGFsPSIxMjgzNjE4ODgiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIwIiBpbnN0YWxsX3RpbWVfbXM9IjE4NTQ3Ii8-PC9hcHA-PC9yZXF1ZXN0PgC:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.175.27
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\lpk.dll
796"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1776 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
1004"C:\Users\admin\AppData\Local\Microsoft\EdgeWebView\Application\109.0.1518.100\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=JJSploit.exe --webview-exe-version=7.1.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1164 --field-trial-handle=1204,i,843965709739972756,2700985329418601155,131072 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:2C:\Users\admin\AppData\Local\Microsoft\EdgeWebView\Application\109.0.1518.100\msedgewebview2.exe—msedgewebview2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge WebView2
Exit code:
0
Version:
109.0.1518.100
Modules
Images
c:\users\admin\appdata\local\microsoft\edgewebview\application\109.0.1518.100\msedgewebview2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\microsoft\edgewebview\application\109.0.1518.100\msedge_elf.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
1168"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=false" /installsource otherinstallcmd /sessionid "{EB3C7C47-C180-4500-A4DE-E042AD1F12BD}" /silentC:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe—MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.175.27
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1572"C:\Program Files\Internet Explorer\iexplore.exe" https://www.youtube.com/@Omnidev_C:\Program Files\Internet Explorer\iexplore.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
1776"C:\Program Files\Internet Explorer\iexplore.exe" https://www.youtube.com/@WeAreDevsExploitsC:\Program Files\Internet Explorer\iexplore.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
c:\windows\system32\version.dll
1788"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserverC:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe—MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.175.27
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1820powershell.exe -NoProfile -windowstyle hidden try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 } catch {}; Invoke-WebRequest -Uri "https://go.microsoft.com/fwlink/p/?LinkId=2124703" -OutFile "$env:TEMP\MicrosoftEdgeWebview2Setup.exe" ; Start-Process -FilePath "$env:TEMP\MicrosoftEdgeWebview2Setup.exe" -ArgumentList ('/silent', '/install') -WaitC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
1836C:\Windows\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1924"C:\Users\admin\AppData\Local\Microsoft\EdgeWebView\Application\109.0.1518.100\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=JJSploit.exe --webview-exe-version=7.1.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=2168 --field-trial-handle=1204,i,843965709739972756,2700985329418601155,131072 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:1C:\Users\admin\AppData\Local\Microsoft\EdgeWebView\Application\109.0.1518.100\msedgewebview2.exe—msedgewebview2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge WebView2
Exit code:
0
Version:
109.0.1518.100
Modules
Images
c:\users\admin\appdata\local\microsoft\edgewebview\application\109.0.1518.100\msedgewebview2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\microsoft\edgewebview\application\109.0.1518.100\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
58 533
Read events
55 390
Write events
3 105
Delete events
38

Modification events

(PID) Process:(1836) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
400000000000000011460B5E93FAD801F40E00002C040000D5070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1836) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
400000000000000011460B5E93FAD801F40E00002C040000D0070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1836) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
69
(PID) Process:(1836) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
4000000000000000F965AD5E93FAD801F40E00002C040000D3070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1836) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Leave)
Value:
4000000000000000B533446193FAD801F40E00002C040000D3070000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1836) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppAddInterestingComponents (Enter)
Value:
4000000000000000B533446193FAD801F40E00002C040000D4070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1836) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppAddInterestingComponents (Leave)
Value:
40000000000000001745766193FAD801F40E00002C040000D4070000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1836) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppCreate (Leave)
Value:
4000000000000000050A216393FAD801F40E00002C040000D0070000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1836) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Leave)
Value:
4000000000000000050A216393FAD801F40E00002C040000D5070000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1836) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore
Operation:writeName:FirstRun
Value:
0
Executable files
207
Suspicious files
105
Text files
91
Unknown types
3

Dropped files

PID
Process
Filename
Type
1836msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
1836msiexec.exeC:\Windows\Installer\110c9f.msi —
MD5:—
SHA256:—
1836msiexec.exeC:\System Volume Information\SPP\OnlineMetadataCache\{2e60665a-fbc0-43e8-ad63-38b5a85b4af1}_OnDiskSnapshotPropbinary
MD5:6A9DDA185B491AFD54920AEFAF9E140C
SHA256:CF5C18E0CC113F6A92D5B4B2078BBAD6A3CF5CF54948E404B3938DDAEB11458F
1836msiexec.exeC:\Program Files\JJSploit\resources\luascripts\animations\dab.luatext
MD5:FB2C8F520063C5BB68EA74E15D5633C4
SHA256:43F4602D306D3546201E663F1940F7CE39870549A892F9ED79BC37E090ECAF2F
1836msiexec.exeC:\Program Files\JJSploit\resources\luascripts\animations\energizegui.luatext
MD5:ED3DFB140AFC2DD6D0E743E98AFDFCDF
SHA256:0529358B29F4F6E153742CB96123BCD7E6E1EA4E865EA0AA9BBE0FEC0C5D0152
1836msiexec.exeC:\Program Files\JJSploit\JJSploit.exeexecutable
MD5:7B0CD24F6573F45F707381896445DC20
SHA256:5CAAB958FDE69FBAE9BD0F3DBEE8398EF616C0DC1245CD2C0F17AC9E15C8C777
3964msiexec.exeC:\Users\admin\AppData\Local\Temp\MSIF426.tmpexecutable
MD5:4FDD16752561CF585FED1506914D73E0
SHA256:AECD2D2FE766F6D439ACC2BBF1346930ECC535012CF5AD7B3273D2875237B7E7
1836msiexec.exeC:\Program Files\JJSploit\resources\luascripts\animations\walkthrough.luatext
MD5:9163555C03919DD219EA4D9148EB8197
SHA256:BDBB65085C0243F9BBB52E93A69A986124454D9ECEE5C715E3F2DCD945B55D7C
1836msiexec.exeC:\Users\admin\AppData\Local\Temp\~DF3BBF63ED3217C907.TMPbinary
MD5:05D3F2FCA515D54057B8C8A6C97A98C3
SHA256:69041B7C697487B4669D0FC91263DF3DF01E64B2A8F1B66E0998F1CBD4D2A713
1836msiexec.exeC:\Windows\Installer\110ca0.ipibinary
MD5:820971AA6F18CA8C9988908DC25F09BC
SHA256:D7AF21046FD8B1EB6E10641D00C50E8ADF117EA3517039A1F959A80E1EBE8E2B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
19
TCP/UDP connections
64
DNS requests
33
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
852
svchost.exe
HEAD
200
95.140.236.128:80
http://msedge.f.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/2368f208-0abf-430f-ba5d-d36ad01daaed?P1=1685300491&P2=404&P3=2&P4=e8T3jiI5KLd8Y6UM0H3GvXxKTT5ll2WvTw8Ioftwz2TFac4A%2f2jQ1L6bIpd5Z9%2bc1z6qTjHqOu4%2bNnvLwofkag%3d%3d
GB
—
—
whitelisted
2056
iexplore.exe
GET
200
142.250.184.195:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
US
der
1.41 Kb
whitelisted
796
iexplore.exe
GET
200
142.250.184.195:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
US
der
1.41 Kb
whitelisted
852
svchost.exe
GET
200
95.140.236.128:80
http://msedge.f.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/2368f208-0abf-430f-ba5d-d36ad01daaed?P1=1685300491&P2=404&P3=2&P4=e8T3jiI5KLd8Y6UM0H3GvXxKTT5ll2WvTw8Ioftwz2TFac4A%2f2jQ1L6bIpd5Z9%2bc1z6qTjHqOu4%2bNnvLwofkag%3d%3d
GB
executable
122 Mb
whitelisted
2300
MicrosoftEdgeUpdate.exe
GET
200
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?99f96bd7f4d36907
US
compressed
4.70 Kb
whitelisted
796
iexplore.exe
GET
200
142.250.184.195:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCKAgeMOHW67xJ3VcHkxGl9
US
binary
472 b
whitelisted
2056
iexplore.exe
GET
200
142.250.184.195:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFRJdTSkekFdCkkVOnklDzo%3D
US
der
471 b
whitelisted
796
iexplore.exe
GET
200
142.250.184.195:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
US
der
724 b
whitelisted
2300
MicrosoftEdgeUpdate.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAxq6XzO1ZmDhpCgCp6lMhQ%3D
US
der
471 b
whitelisted
2056
iexplore.exe
GET
200
142.250.184.195:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
US
der
724 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3416
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1076
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1820
powershell.exe
204.79.197.219:443
msedge.sf.dl.delivery.mp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
2300
MicrosoftEdgeUpdate.exe
209.197.3.8:80
ctldl.windowsupdate.com
STACKPATH-CDN
US
whitelisted
2300
MicrosoftEdgeUpdate.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
240
MicrosoftEdgeUpdate.exe
20.42.73.27:443
self.events.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
suspicious
852
svchost.exe
95.140.236.128:80
msedge.f.tlu.dl.delivery.mp.microsoft.com
LLNW
US
malicious
240
MicrosoftEdgeUpdate.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
go.microsoft.com
  • 104.102.40.139
whitelisted
msedge.sf.dl.delivery.mp.microsoft.com
  • 204.79.197.219
whitelisted
config.edge.skype.com
  • 13.107.42.16
malicious
msedge.api.cdp.microsoft.com
  • 20.7.47.135
whitelisted
self.events.data.microsoft.com
  • 13.89.178.27
  • 20.42.73.27
whitelisted
ctldl.windowsupdate.com
  • 209.197.3.8
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
msedge.f.tlu.dl.delivery.mp.microsoft.com
  • 95.140.236.128
  • 178.79.242.0
whitelisted
www.youtube.com
  • 142.250.186.78
  • 142.250.186.110
  • 142.250.181.238
  • 142.250.184.206
  • 142.250.184.238
  • 142.250.186.142
  • 142.250.186.174
  • 142.250.186.46
  • 172.217.18.14
  • 172.217.16.206
  • 172.217.23.110
  • 172.217.18.110
  • 216.58.212.174
  • 142.250.74.206
  • 216.58.212.142
  • 142.250.185.78
whitelisted
ocsp.pki.goog
  • 142.250.184.195
whitelisted

Threats

PID
Process
Class
Message
—
—
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
Process
Message
msedgewebview2.exe
RecursiveDirectoryCreate( C:\Users\admin\AppData\Local\net.wearedevs directory exists )
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
JJSploit_7.1.3_x86_en-US.msi