malware

JCry S0389

Type: malware
Created: 18 June 2019
Last modified: 25 April 2025

JCry is ransomware written in Go. It was identified as apart of the #OpJerusalem 2019 campaign.[1]

Techniques33rd pct

Tactics32nd pct

Threat groupsNone recorded

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Standing S0389

Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
	Detects javaw.exe in AppData folder as used by Adwind / JRAT	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Visual Basic JavaScript	-	high	Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community	2017-11-10	2022-10-09	1fac1481-2dbc-48b2-9096-753c49b4ec71
	Detects javaw.exe in AppData folder as used by Adwind / JRAT	Generic	test	file_event	windows	Sysmon	Execution Command and Scripting Interpreter Visual Basic JavaScript	-	high	Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community	2017-11-10	2022-12-02	0bcfabcb-7929-47f4-93d6-b33fb67d34d1
	Detects the deletion of all backups or system state backups via "wbadmin.exe". (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Impact Inhibit System Recovery	-	high	frack113, Nasreddine Bencherchali (Nextron Systems)	2021-12-13	2024-05-10	639c9081-f482-47d3-a0bd-ddee3d4ecd76
	Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe	Generic	test	ps_module	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell	-	medium	Roberto Rodriguez @Cyb3rWard0g	2019-08-11	2025-10-17	64e8e417-c19a-475a-8d19-98ea705394cc
	Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe	Generic	test	pipe_created	windows	Sysmon	Execution Command and Scripting Interpreter PowerShell	-	medium	Roberto Rodriguez @Cyb3rWard0g, Tim Shelton	2019-09-12	2025-10-07	58cb02d5-78ce-4692-b3e1-dce850aae41a
	Detects loading of Amsi.dll by uncommon processes	Hunting	test	image_load	windows	Sysmon	Impact Inhibit System Recovery	-	low	frack113	2023-03-12	2026-06-29	facd1549-e416-48e0-b8c4-41d7215eedc8
	Detects a highly relevant Antivirus alert that reports ransomware. (...)	Generic	test	antivirus	-	-	Impact Data Encrypted for Impact	-	critical	Florian Roth (Nextron Systems), Arnim Rupp	2022-05-12	2026-06-15	4c6ca276-d4d0-4a8c-9e4c-d69832f8671f
	Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled.	Generic	experimental	-	windows	AppLocker	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Visual Basic Python Execution User Execution Malicious File	-	medium	heyyanu	2026-03-26	—	557e3bd3-7f21-495d-8d50-7c8bdfb8041c
	Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.	Generic	test	-	windows	AppLocker	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Visual Basic Python Execution User Execution Malicious File	-	medium	Pushkarev Dmitry	2020-06-28	2025-12-03	401e5d00-b944-11ea-8f9a-00163ecd60ae
Splunk	The following analytic detects the creation of AWS KMS keys with an encryption policy accessible to everyone, including external entities. (...)	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Impact Data Encrypted for Impact	-	medium	Patrick Bareiss, Splunk	2020-10-27	2026-05-13	16ae9076-d1d5-411c-8fdd-457504b33dac
Splunk	The following analytic detects when AWS S3 bucket versioning is suspended by a user. (...)	Anomaly	stable	cloud_audit	-	AWS CloudTrail · AWS	Impact Inhibit System Recovery	-	medium	Patrick Bareiss, Splunk	2022-10-04	2026-05-13	f32598bb-fa5f-4afd-8ab3-0263cc28efbc
Splunk	The following analytic detects the creation of AWS KMS keys with an encryption policy accessible to everyone, including external entities. (...)	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Impact Data Encrypted for Impact	-	medium	Rod Soto, Patrick Bareiss Splunk	2020-10-27	2026-05-13	c79c164f-4b21-4847-98f9-cf6a9f49179e
Splunk	The following analytic identifies users with KMS keys performing encryption operations on S3 buckets. (...)	Anomaly	stable	cloud_audit	-	AWS CloudTrail · AWS	Impact Data Encrypted for Impact	-	medium	Rod Soto, Patrick Bareiss Splunk	2020-10-27	2026-05-13	884a5f59-eec7-4f4a-948b-dbde18225fdc
Splunk	The following analytic detects when AWS S3 bucket versioning is suspended by a user. (...)	Anomaly	stable	cloud_audit	-	AWS CloudTrail · AWS	Impact Inhibit System Recovery	-	medium	Bhavin Patel, Splunk	2023-05-01	2026-05-13	657902a9-987d-4879-a1b2-e7a65512824b
	Identifies disabling of default Amazon Elastic Block Store (EBS) encryption in the current region. (...)	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Impact Data Encrypted for Impact Impact Data Manipulation	-	medium	Sittikorn S	2021-06-29	2021-08-20	16124c2d-e40b-4fcc-8f2c-5ab7870a2223
	Detects changes to the EC2 instance startup script. (...)	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Unix Shell	-	high	faloker	2020-02-12	2022-06-07	1ab3c5ed-5baf-417b-bb6b-78ca33f6c3df
	Detects the import or deletion of key material in AWS KMS, which can be used as part of ransomware attacks. (...)	Generic	experimental	cloud_audit	-	AWS CloudTrail · AWS	Impact Data Encrypted for Impact Resource Development Stage Capabilities Install Digital Certificate	-	high	toopricey	2025-10-18	—	1279262f-1464-422f-ac0d-5b545320c526
	Detects when S3 bucket versioning is disabled. (...)	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Impact Inhibit System Recovery	-	medium	Sean Johnstone \| Unit 42	2023-10-28	—	a136ac98-b2bc-4189-a14d-f0d0388e57a7
	Detects the specific Windows execution chain and process tree associated with the Axios NPM supply chain compromise. (...)	Emerging	experimental	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Windows Command Shell Visual Basic Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	f6c27ecc-d890-4452-80e6-2e274a10e097
	Detects deletion of files with extensions often used for backup files. (...)	Generic	test	file_delete	windows	Sysmon	Impact Inhibit System Recovery	-	medium	frack113	2022-01-02	2023-02-15	06125661-3814-4e03-bfa2-1e4411c60ac3
	focuses on trivial artifacts observed in variants of prevalent offensive ps1 payloads, including Cob (...)	Generic	test	ps_module	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell	-	critical	ok @securonix invrep_de, oscd.community	2020-10-09	2022-12-25	8d31a8ce-46b5-4dd6-bdc3-680931f1db86
	Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Deobfuscate/Decode Files or Information Stealth Obfuscated Files or Information	-	high	Florian Roth (Nextron Systems)	2020-01-29	2023-01-26	e32d4572-9826-4738-b651-95fa63747e8a
Splunk	The following analytic detects the creation of a batch file (.bat) within the Windows system directory tree, specifically in the System32 or SysWOW64 folders. (...)	Anomaly	stable	file_event	windows	Sysmon	Execution User Execution Malicious File	-	medium	Steven Dick, Michael Haag, Rico Valdez, Splunk	2020-04-29	2026-07-02	503d17cb-9eab-4cf8-a20e-01d5c6987ae3	-
Splunk	The following analytic detects the execution of a suspicious `bcdedit` command that reconfigures a host from safe mode back to normal boot. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Impact Inhibit System Recovery	-	medium	Teoderick Contreras, Splunk	2021-09-07	2026-05-13	dc7a8004-0f18-11ec-8c54-acde48001122
Splunk	The following analytic detects modifications to the Windows error recovery boot configurations using bcdedit.exe with flags such as "recoveryenabled" and "no". (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Impact Inhibit System Recovery	-	medium	Michael Haag, Splunk	2021-01-11	2026-10-02	809b31d2-5462-11eb-ae93-0242ac130002
	Detects default file names outputted by the BloodHound collection tool SharpHound	Generic	test	file_event	windows	Sysmon	Discovery Account Discovery Local Account Domain Account Execution Command and Scripting Interpreter PowerShell Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	-	high	C.J. May	2022-08-09	2026-02-19	02773bed-83bf-469f-b7ff-e676e7d78bab
	Detect access to files and shares with names and extensions used by BlueSky ransomware which could indicate a current or previous encryption attempt.	Emerging	test	file_event	windows	WinEventLog Security	Impact Data Encrypted for Impact	-	high	j4son	2023-05-23	—	eee8311f-a752-44f0-bf2f-6b007db16300
	Detects the use of the bcdedit command to tamper with the boot configuration data. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security	Impact Inhibit System Recovery	-	high	E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community	2019-10-24	2023-02-15	1444443e-6757-43e4-9ea4-c8fc705f79a2
	Detects powershell execution with that make use of to the bxor (Bitwise XOR). (...)	Hunting	test	ps_classic_start	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell	-	low	Teymur Kheirkhabarov, Harish Segar	2020-06-29	2024-12-11	812837bb-b17f-45e9-8bd0-0ec35d2e3bd6
	Detects calls to cmdlets that are used to export certificates from the local certificate store. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Credential Access Unsecured Credentials Private Keys	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-05-18	—	9e716b33-63b2-46da-86a4-bd3c3b9b5dfb
	Detects changing the PowerShell script execution policy to a potentially insecure level using the "-ExecutionPolicy" flag.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell	-	medium	frack113	2021-11-01	2025-10-07	87e3c4e8-a6a8-4ad9-bb4f-46e7ff99a180
	Detects changing the PowerShell script execution policy to a potentially insecure level using the "Set-ExecutionPolicy" cmdlet.	Generic	test	ps_script	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell	-	medium	frack113	2021-10-20	2023-12-14	61d0475c-173f-4844-86f7-f3eebae1c66b
Splunk	The following analytic detects the execution of a suspicious `bcdedit` command that configures a host to boot in safe mode with network support. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Impact Inhibit System Recovery	-	medium	Teoderick Contreras, Splunk	2021-09-07	2026-05-13	81f1dce0-0f18-11ec-a5d7-acde48001122
	Detects execution of ChromeLoader malware via a registered scheduled task	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task Persistence Software Extensions	-	high	@kostastsale	2022-01-10	—	0a74c5a9-1b71-4475-9af2-7829d320d5c2
	Modifications to a config that will serve an adversary's impacts or persistence	Generic	test	authentication	-	Cisco AAA · Cisco	Impact Data Manipulation Transmitted Data Manipulation Impact Inhibit System Recovery Execution, Persistence, Privilege Escalation Scheduled Task/Job Persistence Server Software Component	-	medium	Austin Clark	2019-08-12	2025-04-28	671ffc77-50a7-464f-9e3d-9ea2b493b26b	-
Splunk	This analytic detects suspicious use of 'mshta.exe' or 'rundll32.exe' invoking 'mshtml.dll' or the ' (...)	Anomaly	stable	network_connection	-	Cisco NVM · Cisco	Execution Command and Scripting Interpreter Visual Basic Stealth System Binary Proxy Execution Mshta	-	medium	Nasreddine Bencherchali, Splunk	2025-07-01	2026-09-22	f2a9df84-9b01-4a21-9e3a-7aa1a217f69e
Splunk	This analytic detects script execution (`wscript.exe` or `cscript.exe`) triggered from compressed fi (...)	Anomaly	stable	network_connection	-	Cisco NVM · Cisco	Execution Command and Scripting Interpreter Visual Basic Execution User Execution Malicious File	-	medium	Nasreddine Bencherchali, Splunk	2025-07-01	2026-09-22	8b07c2c9-0cde-4c44-9fa6-59dcf2b25777
Splunk	The following analytic detects potential reverse shell activity by identifying connections involving ports commonly associated with remote access tools, shell listeners, or tunneling utilities. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Execution Command and Scripting Interpreter PowerShell Command and Control Ingress Tool Transfer Command and Control Non-Standard Port Privilege Escalation, Stealth Process Injection Command and Control Remote Access Tools Lateral Movement Remote Services	-	medium	Nasreddine Bencherchali, Splunk	2025-04-03	2026-05-13	d85c05c8-42c0-4e4a-87e7-4e1bb3e844e3
Splunk	This analytic detects exploitation activity of CVE-2023-27532 using Cisco Secure Firewall Intrusion Events. (...)	Generic	stable	firewall	-	Cisco Secure Firewall · Cisco	Execution Command and Scripting Interpreter PowerShell Initial Access Exploit Public-Facing Application Lateral Movement Exploitation of Remote Services Credential Access OS Credential Dumping LSASS Memory	CVE-2023-27532	medium	Nasreddine Bencherchali, Splunk, Talos NTDR	2025-04-16	2026-05-13	7b7c2e92-f0b2-48d2-9c9b-b8de52b6b2ae
	Detects modification of Windows Registry Classes keys used for persistence. (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)	2019-10-25	2025-10-22	9df5f547-c86a-433e-b533-f2794357e242
	Detects CLR DLL being loaded by an Office Product	Generic	test	image_load	windows	Sysmon	Execution User Execution Malicious File	-	medium	Antonlovesdnb	2020-02-19	2023-03-29	d13c43f0-f66b-4279-8b2c-5912077c1780
Splunk	The following analytic detects the use of `cmd.exe /c` to execute commands, a technique often employed by adversaries and malware to run batch commands or invoke other shells like PowerShell. (...)	Hunting	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Execution Command and Scripting Interpreter Windows Command Shell	CVE-2021-44228	medium	Teoderick Contreras, Bhavin Patel, Splunk	2021-10-21	2026-05-13	54a6ed00-3256-11ec-b031-acde48001122
Splunk	The following analytic identifies the use of named-pipe impersonation for privilege escalation, commonly associated with Cobalt Strike and similar frameworks. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Execution Command and Scripting Interpreter Windows Command Shell Persistence, Privilege Escalation Create or Modify System Process Windows Service	-	medium	Michael Haag, Splunk	2021-05-27	2026-05-13	eb277ba0-b96b-11eb-b00e-acde48001122
	Detects Windows command lines that miss a space before or after the /c flag when running a command using the cmd.exe. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell	-	high	Florian Roth (Nextron Systems)	2022-08-23	2026-05-13	a16980c2-0c56-4de0-9a79-17971979efdd
	Detects a suspicious command line execution that includes an URL and AppData string in the command l (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Command and Control Ingress Tool Transfer	-	medium	Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community	2019-01-16	2021-11-27	1ac8666b-046f-4201-8aba-1951aaec03a3
	Detects modification of autostart extensibility point (ASEP) in registry.	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split), wagga (name)	2019-10-25	2025-10-22	f59c3faf-50f3-464b-9f4c-1b67ab512d99
	detects the usage of path traversal in conhost.exe indicating possible command/argument confusion/hi (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Windows Command Shell	-	high	Nasreddine Bencherchali (Nextron Systems)	2022-06-14	—	ee5e119b-1f75-4b34-add8-3be976961e39
	Detects usage of the "ConvertTo-SecureString" cmdlet via the commandline. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	medium	Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton	2020-10-11	2023-02-01	74403157-20f5-415d-89a7-c505779585cf
	Detects the execution of the builtin "copy" command that targets a shadow copy (sometimes used to co (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Impact Inhibit System Recovery	-	high	Max Altgelt (Nextron Systems), Tobias Michalski (Nextron Systems)	2021-08-09	2023-03-07	c73124a7-3e89-44a3-bdc1-25fe4df754b1
Splunk	The following analytic detects potential exploitation of the CrushFTP authentication bypass vulnerability (CVE-2025-31161). (...)	Generic	stable	file_event	-	CrushFTP	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Initial Access Exploit Public-Facing Application	CVE-2025-31161	medium	Michael Haag, Splunk	2025-04-14	2026-09-08	82eb7f64-d219-4e21-acfe-956de84c1a35

Title

Description

JCry S0389

JCry MITRE reference S0389

Standing S0389

Reach

Coverage

JCry detections S0389