Analysis
- max time kernel
8s - max time network
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
06/07/2026, 12:26
General
- Target 22a1f50db97e2f91417a668d7c31379012b9f756d37a6697220b10aaf1f8b585.exe
- Size 240KB
- Sample260706-pmjf2se17t
- SHA256 22a1f50db97e2f91417a668d7c31379012b9f756d37a6697220b10aaf1f8b585
Malware Config
Signatures
- Family: JelagggSolution
JelagggSolution is a Windows ransomware written in C#.
- Detects JelagggSolution ransomware 2 IoCs
- Renames multiple (138) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Drops desktop.ini file(s) 14 IoCs
- Sets desktop wallpaper using registry 2 TTPs 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 2 IoCs
- Opens file in notepad (likely ransom note) 2 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\22a1f50db97e2f91417a668d7c31379012b9f756d37a6697220b10aaf1f8b585.exe"C:\Users\Admin\AppData\Local\Temp\22a1f50db97e2f91417a668d7c31379012b9f756d37a6697220b10aaf1f8b585.exe"1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\README.txt2⤵
- System Location Discovery: System Language Discovery
- Opens file in notepad (likely ransom note)
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\usb_maker.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\discord.exeC:\Users\Admin\AppData\Local\discord.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\README.txt2⤵
- System Location Discovery: System Language Discovery
- Opens file in notepad (likely ransom note)
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\usb_maker.bat" "2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
discord.exe
ID
usb_maker.bat
README.txt
bpc.jpg
image4fZqKyQzwDi0sZSbvaF=X0cuauVXoX.jpg
memory/5320-4-0x00000000747C0000-0x0000000074F7C000-memory.dmp
memory/5320-5-0x0000000005950000-0x000000000595A000-memory.dmp
memory/5320-0-0x00000000747D2000-0x00000000747D3000-memory.dmp
memory/5320-3-0x0000000005770000-0x0000000005802000-memory.dmp
memory/5320-2-0x0000000005C50000-0x000000000620A000-memory.dmp
memory/5320-1-0x0000000000BF0000-0x0000000000C32000-memory.dmp
memory/5320-435-0x00000000747D2000-0x00000000747D3000-memory.dmp
memory/5320-437-0x00000000747C0000-0x0000000074F7C000-memory.dmp
memory/5880-24-0x00000000747C0000-0x0000000074F7C000-memory.dmp
memory/5880-27-0x00000000747C0000-0x0000000074F7C000-memory.dmp
memory/5880-436-0x00000000747C0000-0x0000000074F7C000-memory.dmp