Overview
overview
7Static
static
jetbra/???...?.html
windows7-x64
1jetbra/???...?.html
windows10-2004-x64
5jetbra/ja-...er.jar
windows7-x64
1jetbra/ja-...er.jar
windows10-2004-x64
1jetbra/plu...ns.jar
windows7-x64
1jetbra/plu...ns.jar
windows10-2004-x64
1jetbra/plu...me.jar
windows7-x64
1jetbra/plu...me.jar
windows10-2004-x64
1jetbra/plu...er.jar
windows7-x64
1jetbra/plu...er.jar
windows10-2004-x64
1jetbra/plu...rl.jar
windows7-x64
1jetbra/plu...rl.jar
windows10-2004-x64
1jetbra/scr...rs.vbs
windows7-x64
3jetbra/scr...rs.vbs
windows10-2004-x64
7jetbra/scr...er.vbs
windows7-x64
1jetbra/scr...er.vbs
windows10-2004-x64
1jetbra/scr...all.sh
ubuntu-18.04-amd64
5jetbra/scr...all.sh
debian-9-armhf
5jetbra/scr...all.sh
debian-9-mips
5jetbra/scr...all.sh
debian-9-mipsel
5jetbra/scr...rs.vbs
windows7-x64
3jetbra/scr...rs.vbs
windows10-2004-x64
7jetbra/scr...er.vbs
windows7-x64
1jetbra/scr...er.vbs
windows10-2004-x64
1jetbra/scr...all.sh
ubuntu-18.04-amd64
5jetbra/scr...all.sh
debian-9-armhf
5jetbra/scr...all.sh
debian-9-mips
5jetbra/scr...all.sh
debian-9-mipsel
5Analysis
-
max time kernel
42s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
16-08-2022 03:01
Static task
static1
Behavioral task
behavioral1
Sample
jetbra/?????????????????.html
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
jetbra/?????????????????.html
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
jetbra/ja-netfilter.jar
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
jetbra/ja-netfilter.jar
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
jetbra/plugins-jetbrains/dns.jar
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
jetbra/plugins-jetbrains/dns.jar
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
jetbra/plugins-jetbrains/hideme.jar
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
jetbra/plugins-jetbrains/hideme.jar
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
jetbra/plugins-jetbrains/power.jar
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
jetbra/plugins-jetbrains/power.jar
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
jetbra/plugins-jetbrains/url.jar
Resource
win7-20220812-en
Behavioral task
behavioral12
Sample
jetbra/plugins-jetbrains/url.jar
Resource
win10v2004-20220812-en
Behavioral task
behavioral13
Sample
jetbra/scripts/install-all-users.vbs
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
jetbra/scripts/install-all-users.vbs
Resource
win10v2004-20220812-en
Behavioral task
behavioral15
Sample
jetbra/scripts/install-current-user.vbs
Resource
win7-20220812-en
Behavioral task
behavioral16
Sample
jetbra/scripts/install-current-user.vbs
Resource
win10v2004-20220812-en
Behavioral task
behavioral17
Sample
jetbra/scripts/install.sh
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral18
Sample
jetbra/scripts/install.sh
Resource
debian9-armhf-en-20211208
Behavioral task
behavioral19
Sample
jetbra/scripts/install.sh
Resource
debian9-mipsbe-en-20211208
Behavioral task
behavioral20
Sample
jetbra/scripts/install.sh
Resource
debian9-mipsel-en-20211208
Behavioral task
behavioral21
Sample
jetbra/scripts/uninstall-all-users.vbs
Resource
win7-20220812-en
Behavioral task
behavioral22
Sample
jetbra/scripts/uninstall-all-users.vbs
Resource
win10v2004-20220812-en
Behavioral task
behavioral23
Sample
jetbra/scripts/uninstall-current-user.vbs
Resource
win7-20220812-en
Behavioral task
behavioral24
Sample
jetbra/scripts/uninstall-current-user.vbs
Resource
win10v2004-20220812-en
Behavioral task
behavioral25
Sample
jetbra/scripts/uninstall.sh
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral26
Sample
jetbra/scripts/uninstall.sh
Resource
debian9-armhf-en-20211208
Behavioral task
behavioral27
Sample
jetbra/scripts/uninstall.sh
Resource
debian9-mipsbe-en-20211208
Behavioral task
behavioral28
Sample
jetbra/scripts/uninstall.sh
Resource
debian9-mipsel-en-20211208
General
-
Target
jetbra/scripts/uninstall-all-users.vbs
-
Size
1KB
-
MD5
f8ea54322d35bce7f93af2b993a73d7e
-
SHA1
e8ec2bd8883202b9e44783ca7b5831c0df35d4db
-
SHA256
11811f0c25f30336a0c835dad7e30e7c9810392d207540c847da0e1b7c06ce72
-
SHA512
29acd1cbcb0885e9f7bdfd6659b0f7e6d812216c257fe72dace2cdebe9073a6850800cccf7e24d5602beacc6be98f3f63cb9edb173725b10fb9d225b85aa7742
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
WScript.exedescription pid process target process PID 1760 wrote to memory of 1600 1760 WScript.exe WScript.exe PID 1760 wrote to memory of 1600 1760 WScript.exe WScript.exe PID 1760 wrote to memory of 1600 1760 WScript.exe WScript.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jetbra\scripts\uninstall-all-users.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jetbra\scripts\uninstall-all-users.vbs" /elevate2⤵