Overview
overview
7Static
static
jetbra/???...?.html
windows7-x64
1jetbra/???...?.html
windows10-2004-x64
5jetbra/ja-...er.jar
windows7-x64
1jetbra/ja-...er.jar
windows10-2004-x64
1jetbra/plu...ns.jar
windows7-x64
1jetbra/plu...ns.jar
windows10-2004-x64
1jetbra/plu...me.jar
windows7-x64
1jetbra/plu...me.jar
windows10-2004-x64
1jetbra/plu...er.jar
windows7-x64
1jetbra/plu...er.jar
windows10-2004-x64
1jetbra/plu...rl.jar
windows7-x64
1jetbra/plu...rl.jar
windows10-2004-x64
1jetbra/scr...rs.vbs
windows7-x64
3jetbra/scr...rs.vbs
windows10-2004-x64
7jetbra/scr...er.vbs
windows7-x64
1jetbra/scr...er.vbs
windows10-2004-x64
1jetbra/scr...all.sh
ubuntu-18.04-amd64
5jetbra/scr...all.sh
debian-9-armhf
5jetbra/scr...all.sh
debian-9-mips
5jetbra/scr...all.sh
debian-9-mipsel
5jetbra/scr...rs.vbs
windows7-x64
3jetbra/scr...rs.vbs
windows10-2004-x64
7jetbra/scr...er.vbs
windows7-x64
1jetbra/scr...er.vbs
windows10-2004-x64
1jetbra/scr...all.sh
ubuntu-18.04-amd64
5jetbra/scr...all.sh
debian-9-armhf
5jetbra/scr...all.sh
debian-9-mips
5jetbra/scr...all.sh
debian-9-mipsel
5Analysis
-
max time kernel
103s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
16-08-2022 03:01
Static task
static1
Behavioral task
behavioral1
Sample
jetbra/?????????????????.html
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
jetbra/?????????????????.html
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
jetbra/ja-netfilter.jar
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
jetbra/ja-netfilter.jar
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
jetbra/plugins-jetbrains/dns.jar
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
jetbra/plugins-jetbrains/dns.jar
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
jetbra/plugins-jetbrains/hideme.jar
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
jetbra/plugins-jetbrains/hideme.jar
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
jetbra/plugins-jetbrains/power.jar
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
jetbra/plugins-jetbrains/power.jar
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
jetbra/plugins-jetbrains/url.jar
Resource
win7-20220812-en
Behavioral task
behavioral12
Sample
jetbra/plugins-jetbrains/url.jar
Resource
win10v2004-20220812-en
Behavioral task
behavioral13
Sample
jetbra/scripts/install-all-users.vbs
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
jetbra/scripts/install-all-users.vbs
Resource
win10v2004-20220812-en
Behavioral task
behavioral15
Sample
jetbra/scripts/install-current-user.vbs
Resource
win7-20220812-en
Behavioral task
behavioral16
Sample
jetbra/scripts/install-current-user.vbs
Resource
win10v2004-20220812-en
Behavioral task
behavioral17
Sample
jetbra/scripts/install.sh
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral18
Sample
jetbra/scripts/install.sh
Resource
debian9-armhf-en-20211208
Behavioral task
behavioral19
Sample
jetbra/scripts/install.sh
Resource
debian9-mipsbe-en-20211208
Behavioral task
behavioral20
Sample
jetbra/scripts/install.sh
Resource
debian9-mipsel-en-20211208
Behavioral task
behavioral21
Sample
jetbra/scripts/uninstall-all-users.vbs
Resource
win7-20220812-en
Behavioral task
behavioral22
Sample
jetbra/scripts/uninstall-all-users.vbs
Resource
win10v2004-20220812-en
Behavioral task
behavioral23
Sample
jetbra/scripts/uninstall-current-user.vbs
Resource
win7-20220812-en
Behavioral task
behavioral24
Sample
jetbra/scripts/uninstall-current-user.vbs
Resource
win10v2004-20220812-en
Behavioral task
behavioral25
Sample
jetbra/scripts/uninstall.sh
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral26
Sample
jetbra/scripts/uninstall.sh
Resource
debian9-armhf-en-20211208
Behavioral task
behavioral27
Sample
jetbra/scripts/uninstall.sh
Resource
debian9-mipsbe-en-20211208
Behavioral task
behavioral28
Sample
jetbra/scripts/uninstall.sh
Resource
debian9-mipsel-en-20211208
General
-
Target
jetbra/scripts/install-all-users.vbs
-
Size
2KB
-
MD5
7bd1e1b7aa11ad5a13a6ec23b8afb549
-
SHA1
46194b9c7ac66a5446afbcf172ffd7743b53da44
-
SHA256
26a6ab6fa87ade5e2384bd539bcd8f01e9400b3ab636de9843c92b8099c96493
-
SHA512
230868a57888e897886efb11c32d6c8c79f9ae1bbca4637a4d78d8ad148348bfceff9b7e41106c5281d550d27ed5158ad9faf0cd2df75d7085277bae08061e5c
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
WScript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation WScript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
WScript.exedescription pid process target process PID 2112 wrote to memory of 4804 2112 WScript.exe WScript.exe PID 2112 wrote to memory of 4804 2112 WScript.exe WScript.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jetbra\scripts\install-all-users.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jetbra\scripts\install-all-users.vbs" /elevate2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4804-132-0x0000000000000000-mapping.dmp