Overview
overview
3Static
static
356元1年_...��.url
windows7-x64
156元1年_...��.url
windows10-2004-x64
1jetbra/ja-...er.jar
windows7-x64
1jetbra/ja-...er.jar
windows10-2004-x64
1jetbra/plu...ns.jar
windows7-x64
1jetbra/plu...ns.jar
windows10-2004-x64
1jetbra/plu...me.jar
windows7-x64
1jetbra/plu...me.jar
windows10-2004-x64
1jetbra/plu...er.jar
windows7-x64
1jetbra/plu...er.jar
windows10-2004-x64
1jetbra/plu...rl.jar
windows7-x64
1jetbra/plu...rl.jar
windows10-2004-x64
1jetbra/scr...rs.vbs
windows7-x64
1jetbra/scr...rs.vbs
windows10-2004-x64
3jetbra/scr...er.vbs
windows7-x64
1jetbra/scr...er.vbs
windows10-2004-x64
1jetbra/scr...all.sh
ubuntu-18.04-amd64
3jetbra/scr...all.sh
debian-9-armhf
3jetbra/scr...all.sh
debian-9-mips
1jetbra/scr...all.sh
debian-9-mipsel
3jetbra/scr...rs.vbs
windows7-x64
3jetbra/scr...rs.vbs
windows10-2004-x64
3jetbra/scr...er.vbs
windows7-x64
1jetbra/scr...er.vbs
windows10-2004-x64
1jetbra/scr...all.sh
ubuntu-18.04-amd64
3jetbra/scr...all.sh
debian-9-armhf
3jetbra/scr...all.sh
debian-9-mips
3jetbra/scr...all.sh
debian-9-mipsel
3使用说�...��.pdf
windows7-x64
1使用说�...��.pdf
windows10-2004-x64
1Analysis
-
max time kernel
142s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
17-08-2023 05:25
Behavioral task
behavioral1
Sample
56元1年_购买正版授权.url
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
56元1年_购买正版授权.url
Resource
win10v2004-20230703-en
Behavioral task
behavioral3
Sample
jetbra/ja-netfilter.jar
Resource
win7-20230712-en
Behavioral task
behavioral4
Sample
jetbra/ja-netfilter.jar
Resource
win10v2004-20230703-en
Behavioral task
behavioral5
Sample
jetbra/plugins-jetbrains/dns.jar
Resource
win7-20230712-en
Behavioral task
behavioral6
Sample
jetbra/plugins-jetbrains/dns.jar
Resource
win10v2004-20230703-en
Behavioral task
behavioral7
Sample
jetbra/plugins-jetbrains/hideme.jar
Resource
win7-20230712-en
Behavioral task
behavioral8
Sample
jetbra/plugins-jetbrains/hideme.jar
Resource
win10v2004-20230703-en
Behavioral task
behavioral9
Sample
jetbra/plugins-jetbrains/power.jar
Resource
win7-20230712-en
Behavioral task
behavioral10
Sample
jetbra/plugins-jetbrains/power.jar
Resource
win10v2004-20230703-en
Behavioral task
behavioral11
Sample
jetbra/plugins-jetbrains/url.jar
Resource
win7-20230712-en
Behavioral task
behavioral12
Sample
jetbra/plugins-jetbrains/url.jar
Resource
win10v2004-20230703-en
Behavioral task
behavioral13
Sample
jetbra/scripts/install-all-users.vbs
Resource
win7-20230712-en
Behavioral task
behavioral14
Sample
jetbra/scripts/install-all-users.vbs
Resource
win10v2004-20230703-en
Behavioral task
behavioral15
Sample
jetbra/scripts/install-current-user.vbs
Resource
win7-20230712-en
Behavioral task
behavioral16
Sample
jetbra/scripts/install-current-user.vbs
Resource
win10v2004-20230703-en
Behavioral task
behavioral17
Sample
jetbra/scripts/install.sh
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral18
Sample
jetbra/scripts/install.sh
Resource
debian9-armhf-20221111-en
Behavioral task
behavioral19
Sample
jetbra/scripts/install.sh
Resource
debian9-mipsbe-20221125-en
Behavioral task
behavioral20
Sample
jetbra/scripts/install.sh
Resource
debian9-mipsel-en-20211208
Behavioral task
behavioral21
Sample
jetbra/scripts/uninstall-all-users.vbs
Resource
win7-20230712-en
Behavioral task
behavioral22
Sample
jetbra/scripts/uninstall-all-users.vbs
Resource
win10v2004-20230703-en
Behavioral task
behavioral23
Sample
jetbra/scripts/uninstall-current-user.vbs
Resource
win7-20230712-en
Behavioral task
behavioral24
Sample
jetbra/scripts/uninstall-current-user.vbs
Resource
win10v2004-20230703-en
Behavioral task
behavioral25
Sample
jetbra/scripts/uninstall.sh
Resource
ubuntu1804-amd64-20230621-en
Behavioral task
behavioral26
Sample
jetbra/scripts/uninstall.sh
Resource
debian9-armhf-20221125-en
Behavioral task
behavioral27
Sample
jetbra/scripts/uninstall.sh
Resource
debian9-mipsbe-en-20211208
Behavioral task
behavioral28
Sample
jetbra/scripts/uninstall.sh
Resource
debian9-mipsel-20221111-en
Behavioral task
behavioral29
Sample
使用说明(必读).pdf
Resource
win7-20230712-en
Behavioral task
behavioral30
Sample
使用说明(必读).pdf
Resource
win10v2004-20230703-en
General
-
Target
jetbra/scripts/uninstall-all-users.vbs
-
Size
1KB
-
MD5
f8ea54322d35bce7f93af2b993a73d7e
-
SHA1
e8ec2bd8883202b9e44783ca7b5831c0df35d4db
-
SHA256
11811f0c25f30336a0c835dad7e30e7c9810392d207540c847da0e1b7c06ce72
-
SHA512
29acd1cbcb0885e9f7bdfd6659b0f7e6d812216c257fe72dace2cdebe9073a6850800cccf7e24d5602beacc6be98f3f63cb9edb173725b10fb9d225b85aa7742
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1640 wrote to memory of 3264 1640 WScript.exe 82 PID 1640 wrote to memory of 3264 1640 WScript.exe 82
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jetbra\scripts\uninstall-all-users.vbs"1⤵
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jetbra\scripts\uninstall-all-users.vbs" /elevate2⤵PID:3264
-