Overview
overview
7Static
static
7jsdata/JSHJ.dll
windows10-2004-x64
3jsdata/JSHJ.dll
windows11-ltsc_2024-x64
3jsdata/WinIo.dll
windows10-2004-x64
3jsdata/WinIo.dll
windows11-ltsc_2024-x64
3jsdata/WinIo.sys
windows10-2004-x64
3jsdata/WinIo.sys
windows11-ltsc_2024-x64
3jsdata/fx.exe
windows10-2004-x64
3jsdata/fx.exe
windows11-ltsc_2024-x64
3jsdata/js.exe
windows10-2004-x64
6jsdata/js.exe
windows11-ltsc_2024-x64
6jsdata/jsy.exe
windows10-2004-x64
3jsdata/jsy.exe
windows11-ltsc_2024-x64
3jsq.exe
windows10-2004-x64
3jsq.exe
windows11-ltsc_2024-x64
3Analysis
- max time kernel
148s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/09/2026, 18:43
Behavioral task
behavioral1
Sample
jsdata/JSHJ.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral2
Sample
jsdata/JSHJ.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral3
Sample
jsdata/WinIo.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral4
Sample
jsdata/WinIo.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral5
Sample
jsdata/WinIo.sys
Resource
win10v2004-20260911-en
Behavioral task
behavioral6
Sample
jsdata/WinIo.sys
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral7
Sample
jsdata/fx.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral8
Sample
jsdata/fx.exe
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral9
Sample
jsdata/js.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral10
Sample
jsdata/js.exe
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral11
Sample
jsdata/jsy.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral12
Sample
jsdata/jsy.exe
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral13
Sample
jsq.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral14
Sample
jsq.exe
Resource
win11ltsc2024-20260911-en
General
- Target jsdata/fx.exe
- Size 764KB
- Sample260925-xda3bagh73
- SHA256 4d8b5ab87a43e60ce3e78293b296016fc3c31b4951b6ba80abe1d2e857ad0339
- MD5 2b537771b996a3c60d3d51459b80fa11
- SHA1 aa42f278d4f65c69b40824b8938adca06bb7430b
- SHA512 796e07ac4144e947af21f3df8069d6cb273078528d001cb440d6d89e021bc0aa29114aaac3b72a4241d556ac9c1e98c5e58bc6dfd867da7fce243ca2b28b4c63
- SSDEEP 12288:uws4gSJi0t9M+5m5/qoT9gsKYSh8qbcWnNihbJr1d1qdoBBhlBZRbjHWe6zvy88R:v+MMR1tZIR9NkbBHu2BhpFWqv9bT
- TLSH T15CF4234EB65DDD9BF4D18CB23FAA4165861E7E0B3D4F3B2F0139935E08F0A209897985
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Program crash 1 IoCs
pid pid_target Process procid_target 5172 3892 WerFault.exe 87 - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fx.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3892 fx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jsdata\fx.exe"C:\Users\Admin\AppData\Local\Temp\jsdata\fx.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3892 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3892 -s 5882⤵
- Program crash
PID:5172
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3892 -ip 38921⤵PID:4260