a48f9786b00f0ad4455e6d020e027c0323173bc935d3d11bca7ba0f29b316d18

Analysis

max time kernel
148s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/06/2026, 10:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jatqsqvd.djs.exe
Size 1.6MB
Sample260623-m3rfgsb15q
SHA256 a48f9786b00f0ad4455e6d020e027c0323173bc935d3d11bca7ba0f29b316d18
MD5 654a3a08f6a8d451f4145cbe8d0e9e12
SHA1 30664ce22e5a32bc4e5721d72b25745b9330b5af
SHA512 a37952446d505deb94b4f5006c755fd60e05dddec203aa28b0037cd9532c744802fb572f8c5165d1bfb566484cc45a4e4a59d6db56bfdee7b68b9e7e57b28cb9
SSDEEP 12288:Kbnlt4OAeFAmUWUfZa8BdTgcEz9KV1C8w9+0xz9OjSmRLLpcQ15m1ovIFXl+znv6:fLmmrhgRK1D0xzQjSSVcC+V0vmbERnC3
TLSH
T175755B72B5127166CCC144F9D61272538EBCB6B82B31E1F6A83D421DB8FB1E807B7661
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	jatqsqvd.djs.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	jatqsqvd.djs.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2652	jatqsqvd.djs.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	jatqsqvd.djs.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	jatqsqvd.djs.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	jatqsqvd.djs.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	jatqsqvd.djs.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor	jatqsqvd.djs.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion	jatqsqvd.djs.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2652	jatqsqvd.djs.exe
2652	jatqsqvd.djs.exe
2652	jatqsqvd.djs.exe
2652	jatqsqvd.djs.exe
2652	jatqsqvd.djs.exe
2652	jatqsqvd.djs.exe

C:\Users\Admin\AppData\Local\Temp\jatqsqvd.djs.exe
"C:\Users\Admin\AppData\Local\Temp\jatqsqvd.djs.exe"
1⤵
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks for VirtualBox DLLs, possible anti-VM trick
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:2652

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2652-0-0x00007FF928800000-0x00007FF928A63000-memory.dmp

Download

memory/2652-4-0x0000020252BF0000-0x0000020252C44000-memory.dmp

Download