Malware

JCry

JCry is a Windows ransomware family that encrypts victim files and demands payment in Bitcoin for decryption. It has been observed relying on user execution, including lures masquerading as an Adobe Flash Player update installer, to trigger infection. Execution chains associated with JCry use Windows scripting and command interpreters, including PowerShell, VBScript, and cmd.exe launching PowerShell, indicating a script-driven deployment model.

For persistence, JCry has been observed placing payloads in the Windows Startup directory so it will run again after reboot or user logon. To increase impact and hinder recovery, it deletes shadow copies, a common anti-recovery behavior used by ransomware to make restoration more difficult without backups. The combination of file encryption, persistence through startup-folder placement, script-based execution, and shadow-copy deletion is consistent with financially motivated ransomware operations targeting Windows systems.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

10 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

5 techniques

T1059.001PowerShellEvidence8

APT19 used PowerShell commands to execute payloads... APT28 downloads and executes PowerShell scripts... APT29 has used encoded PowerShell scripts... | used PowerShell commands to execute payloads

T1059.003Windows Command ShellEvidence4

The content repeatedly describes threat actors and malware using cmd.exe, the Windows command shell, to execute commands, launch payloads, run batch files, and automate actions on compromised hosts.

T1059.005Visual BasicEvidence3

APT-C-36 has embedded a VBScript within a malicious Word document which is executed upon the document opening.

T1204User ExecutionEvidence2

has attempted to get victims to launch malicious Microsoft Word attachments delivered via spearphishing emails... has required user execution of a malicious MSI installer... has been executed through user installation of an executable disguised as a flash installer.

T1204.002Malicious FileEvidence4

has used malicious files including VBS, LNK, and HTML for execution... has sent malicious files requiring direct victim interaction to execute... has used malicious .exe or .dll files disguised as documents or images.

Persistence

2 techniques

T1547Boot or Logon Autostart ExecutionEvidence1

C:\Users\[Username]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

T1547.001Registry Run Keys / Startup FolderEvidence7

The content repeatedly describes malware and threat actors establishing persistence by adding values under Registry Run keys such as HKCU\Software\Microsoft\Windows\CurrentVersion\Run and HKLM\Software\Microsoft\Windows\CurrentVersion\Run, and by placing shortcuts or files in Startup folders.

Privilege Escalation

2 techniques

T1547Boot or Logon Autostart ExecutionEvidence1

T1547.001Registry Run Keys / Startup FolderEvidence7

Stealth

1 technique

T1036MasqueradingEvidence1

executed through user installation of an executable disguised as a flash installer... malware look like Flash Player, Office, or PDF documents... compromised installation files for legitimate software.

Impact

2 techniques

T1486Data Encrypted for ImpactEvidence2

Multiple ransomware families and actors are described as encrypting victim filesystems/drives for extortion (e.g., Akira, Conti, Ryuk, WannaCry, NotPetya, etc.), often appending new extensions and dropping ransom notes.

T1490Inhibit System RecoveryEvidence3

Akira will delete system volume shadow copies via PowerShell commands. Avaddon deletes backups and shadow copies using native system tools. Babuk has the ability to delete shadow volumes using vssadmin.exe delete shadows /all /quiet. BlackCat can delete shadow copies using vssadmin.exe delete shadows /all /quiet and wmic.exe Shadowcopy Delete; it can also modify the boot loader using bcdedit /set {default} recoveryenabled No.

ACTIVITY FEED

Recent activity

22 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

22 SOURCESView more in app

mitre attack websiteNews

Oct 31, 2024

Inhibit System Recovery, Technique T1490 - Enterprise | MITRE ATT&CK®

Ransomware that deletes shadow copies to prevent easy data restoration.

mitre attack websiteNews

Oct 25, 2022

Command and Scripting Interpreter: Visual Basic, Sub-technique T1059.005 - Enterprise | MITRE ATT&CK®

Uses VBS scripts.

mitre attack websiteNews

Apr 25, 2022

Command and Scripting Interpreter: PowerShell, Sub-technique T1059.001 - Enterprise | MITRE ATT&CK®

Malware that uses PowerShell to execute payloads.

mitre attack websiteNews

Oct 21, 2021

Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Sub-technique T1547.001 - Enterprise | MITRE ATT&CK®

Ransomware that maintains persistence by placing payloads in the Startup directory.

+18 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping10

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

JCry