Overview
overview
3Static
static
1jodit-react-main.zip
windows7-x64
1jodit-react-main.zip
windows10-2004-x64
1__MACOSX/....t-main
windows7-x64
3__MACOSX/....t-main
windows10-2004-x64
3__MACOSX/j...config
windows7-x64
3__MACOSX/j...config
windows10-2004-x64
3jodit-reac...trc.js
windows7-x64
1jodit-reac...trc.js
windows10-2004-x64
1jodit-reac...ATE.md
windows7-x64
3jodit-reac...ATE.md
windows10-2004-x64
3jodit-reac...ATE.md
windows7-x64
3jodit-reac...ATE.md
windows10-2004-x64
3jodit-reac...on.yml
windows7-x64
3jodit-reac...on.yml
windows10-2004-x64
3jodit-reac...se.yml
windows7-x64
3jodit-reac...se.yml
windows10-2004-x64
3jodit-reac...ignore
windows7-x64
3jodit-reac...ignore
windows10-2004-x64
3jodit-reac...ignore
windows7-x64
3jodit-reac...ignore
windows10-2004-x64
3jodit-reac....npmrc
windows7-x64
3jodit-reac....npmrc
windows10-2004-x64
3jodit-reac....nvmrc
windows7-x64
3jodit-reac....nvmrc
windows10-2004-x64
3jodit-reac...c.json
windows7-x64
3jodit-reac...c.json
windows10-2004-x64
3jodit-reac...LOG.md
windows7-x64
3jodit-reac...LOG.md
windows10-2004-x64
3jodit-reac...ICENSE
windows7-x64
1jodit-reac...ICENSE
windows10-2004-x64
1jodit-reac...DME.md
windows7-x64
3jodit-reac...DME.md
windows10-2004-x64
3Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
02/05/2024, 06:27
Static task
static1
Behavioral task
behavioral1
Sample
jodit-react-main.zip
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
jodit-react-main.zip
Resource
win10v2004-20240419-en
Behavioral task
behavioral3
Sample
__MACOSX/._jodit-react-main
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
__MACOSX/._jodit-react-main
Resource
win10v2004-20240419-en
Behavioral task
behavioral5
Sample
__MACOSX/jodit-react-main/._.editorconfig
Resource
win7-20240220-en
Behavioral task
behavioral6
Sample
__MACOSX/jodit-react-main/._.editorconfig
Resource
win10v2004-20240419-en
Behavioral task
behavioral7
Sample
jodit-react-main/.eslintrc.js
Resource
win7-20240419-en
Behavioral task
behavioral8
Sample
jodit-react-main/.eslintrc.js
Resource
win10v2004-20240426-en
Behavioral task
behavioral9
Sample
jodit-react-main/.github/ISSUE_TEMPLATE.md
Resource
win7-20231129-en
Behavioral task
behavioral10
Sample
jodit-react-main/.github/ISSUE_TEMPLATE.md
Resource
win10v2004-20240419-en
Behavioral task
behavioral11
Sample
jodit-react-main/.github/PULL_REQUEST_TEMPLATE.md
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
jodit-react-main/.github/PULL_REQUEST_TEMPLATE.md
Resource
win10v2004-20240419-en
Behavioral task
behavioral13
Sample
jodit-react-main/.github/workflows/new-version.yml
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
jodit-react-main/.github/workflows/new-version.yml
Resource
win10v2004-20240419-en
Behavioral task
behavioral15
Sample
jodit-react-main/.github/workflows/release.yml
Resource
win7-20240215-en
Behavioral task
behavioral16
Sample
jodit-react-main/.github/workflows/release.yml
Resource
win10v2004-20240419-en
Behavioral task
behavioral17
Sample
jodit-react-main/.gitignore
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
jodit-react-main/.gitignore
Resource
win10v2004-20240426-en
Behavioral task
behavioral19
Sample
jodit-react-main/.npmignore
Resource
win7-20231129-en
Behavioral task
behavioral20
Sample
jodit-react-main/.npmignore
Resource
win10v2004-20240426-en
Behavioral task
behavioral21
Sample
jodit-react-main/.npmrc
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
jodit-react-main/.npmrc
Resource
win10v2004-20240419-en
Behavioral task
behavioral23
Sample
jodit-react-main/.nvmrc
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
jodit-react-main/.nvmrc
Resource
win10v2004-20240419-en
Behavioral task
behavioral25
Sample
jodit-react-main/.prettierrc.json
Resource
win7-20240419-en
Behavioral task
behavioral26
Sample
jodit-react-main/.prettierrc.json
Resource
win10v2004-20240419-en
Behavioral task
behavioral27
Sample
jodit-react-main/CHANGELOG.md
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
jodit-react-main/CHANGELOG.md
Resource
win10v2004-20240419-en
Behavioral task
behavioral29
Sample
jodit-react-main/LICENSE
Resource
win7-20240215-en
Behavioral task
behavioral30
Sample
jodit-react-main/LICENSE
Resource
win10v2004-20240419-en
Behavioral task
behavioral31
Sample
jodit-react-main/README.md
Resource
win7-20240419-en
Behavioral task
behavioral32
Sample
jodit-react-main/README.md
Resource
win10v2004-20240419-en
General
-
Target
jodit-react-main/.gitignore
-
Size
56B
-
MD5
77a03d6f07a476013d36d003457189c7
-
SHA1
6aa2c5f7b62ce0f18d1602cc3bc7638fbb217c97
-
SHA256
bc8dfafe08bd67c860dae7474fa392ccb314987e7644dd3daaa0529e0462c61f
-
SHA512
3b559d81a307b60c3b4ed04be86b3e3dc8a8305d738ebe35f3b4d5d222934e0cc5f729ec645befdc27f8ea902db24ae85fc547cbf7aa7c765eb293ed910f70a5
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\gitignore_auto_file\ rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.gitignore\ = "gitignore_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\gitignore_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\gitignore_auto_file\shell\Read\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\gitignore_auto_file rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.gitignore rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\gitignore_auto_file\shell\Read rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\gitignore_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2768 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2768 AcroRd32.exe 2768 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2044 wrote to memory of 2524 2044 cmd.exe 29 PID 2044 wrote to memory of 2524 2044 cmd.exe 29 PID 2044 wrote to memory of 2524 2044 cmd.exe 29 PID 2524 wrote to memory of 2768 2524 rundll32.exe 30 PID 2524 wrote to memory of 2768 2524 rundll32.exe 30 PID 2524 wrote to memory of 2768 2524 rundll32.exe 30 PID 2524 wrote to memory of 2768 2524 rundll32.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\jodit-react-main\.gitignore1⤵
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\jodit-react-main\.gitignore2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\jodit-react-main\.gitignore"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2768
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD59e65fbb11cbf1923bb75a8d1dd865471
SHA1e38955d729c1e716c0818220b43dab1159a2a4bf
SHA2560bd981ed451dc1effb0a8c176bd8acd58a6de85e437cb3c052df9f0a511fe747
SHA512259981067c3c6d22f2760207aaadc5a5ef4b4cf1c90fdf0fb8f86e74a6dfe07e557f65296b70817be725e9310b0abe6fc94fd955aad75d65997ad085b3cba876