jigsaw | 6f94e5747ba1aaa2bb666704ee65b37aac8aff47dbc321be2b607d47dd695e8f

Target

drpbx.exe
Size

125KB
MD5

7fab69dcc9fbee7ca91bef27dc551f63
SHA1

fe272f074373e80e2a00144e0fcc4de6e68cf0e3
SHA256

6f94e5747ba1aaa2bb666704ee65b37aac8aff47dbc321be2b607d47dd695e8f
SHA512

ac87841efd28941ee4b13142602b6f91a43b29136236d78ccde1ba838d453c9d9de5ab94ced8eaddb426f1b569ee8a3f593fdae04f02984b7fc337bccd0b3ae8

Score

10^/10

persistence ransomware jigsaw

Malware Config

Signatures

Jigsaw
Ransomware family first created in 2016. Named based on wallpaper set after infection.
ransomware jigsaw

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 580	2536	drpbx.exe	66
PID 2536 wrote to memory of 580	2536	drpbx.exe	66

Executes dropped EXE 1 IoCs

pid	Process
580	drpbx.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly	drpbx.exe
File created	C:\Windows\assembly\Desktop.ini	drpbx.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	drpbx.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	drpbx.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	drpbx.exe

Adds Run entry to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\firefox.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Frfx\\firefox.exe"	drpbx.exe

C:\Users\Admin\AppData\Local\Temp\drpbx.exe
"C:\Users\Admin\AppData\Local\Temp\drpbx.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Drops file in Windows directory
- Drops desktop.ini file(s)
- Adds Run entry to start application
PID:2536
- C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe
  "C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe" C:\Users\Admin\AppData\Local\Temp\drpbx.exe
  2⤵
  - Executes dropped EXE
  PID:580

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads