b3af58566437f83301cd884feaaa2c4b6c827498969a2abbe48afc03351facb3

General
Target

b3af58566437f83301cd884feaaa2c4b6c827498969a2abbe48afc03351facb3.exe

Filesize

41KB

Completed

05-11-2020 14:39

Score
10 /10
MD5

0efb06144ff6e9eb6bdc03fafa5167a7

SHA1

894bc02320d1308462ce004cf06e1bb1841d22c2

SHA256

b3af58566437f83301cd884feaaa2c4b6c827498969a2abbe48afc03351facb3

Malware Config
Signatures 7

Filter: none

Collection
Credential Access
Defense Evasion
Persistence
  • Jigsaw Ransomware

    Description

    Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.

  • Executes dropped EXE
    AcroRd32.exe

    Reported IOCs

    pidprocess
    1208AcroRd32.exe
  • Modifies extensions of user files
    AcroRd32.exe

    Description

    Ransomware generally changes the extension on encrypted files.

    Tags

    Reported IOCs

    descriptioniocprocess
    File createdC:\Users\Admin\Pictures\ProtectPop.tif.v315AcroRd32.exe
    File createdC:\Users\Admin\Pictures\RestoreDebug.tif.v315AcroRd32.exe
    File createdC:\Users\Admin\Pictures\UnpublishCompare.png.v315AcroRd32.exe
    File createdC:\Users\Admin\Pictures\EditRequest.png.v315AcroRd32.exe
    File createdC:\Users\Admin\Pictures\PingRestart.raw.v315AcroRd32.exe
  • Reads user/profile data of web browsers

    Description

    Infostealers often target stored browser data, which can include saved credentials etc.

    Tags

    TTPs

    Data from Local SystemCredentials in Files
  • Adds Run key to start application
    b3af58566437f83301cd884feaaa2c4b6c827498969a2abbe48afc03351facb3.exe

    TTPs

    Registry Run Keys / Startup FolderModify Registry

    Reported IOCs

    descriptioniocprocess
    Set value (str)\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\Chrome32.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Google (x86)\\Chrome32.exe"b3af58566437f83301cd884feaaa2c4b6c827498969a2abbe48afc03351facb3.exe
  • Drops file in Program Files directory
    AcroRd32.exe

    Reported IOCs

    descriptioniocprocess
    File opened for modificationC:\Program Files\DVD Maker\Shared\DvdStyles\Postage_SelectionSubpicture.pngAcroRd32.exe
    File opened for modificationC:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_performance_Thumbnail.bmpAcroRd32.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\Templates\1033\UrbanPhotoAlbum.potxAcroRd32.exe
    File createdC:\Program Files\Java\jre7\lib\security\US_export_policy.jar.v315AcroRd32.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.widgets.nl_ja_4.4.0.v20140623020002.jarAcroRd32.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.eclipse.nl_zh_4.4.0.v20140623020002.jarAcroRd32.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.forms.nl_zh_4.4.0.v20140623020002.jarAcroRd32.exe
    File opened for modificationC:\Program Files\7-Zip\Lang\lv.txtAcroRd32.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\Office14\1033\QuickStyles\Formal.dotxAcroRd32.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\NotifierDisableDownArrow.jpgAcroRd32.exe
    File createdC:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\utilityfunctions.js.v315AcroRd32.exe
    File opened for modificationC:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\vintage.pngAcroRd32.exe
    File opened for modificationC:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\layers.pngAcroRd32.exe
    File opened for modificationC:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\system_s.pngAcroRd32.exe
    File createdC:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-applemenu.jar.v315AcroRd32.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_alignleft.gifAcroRd32.exe
    File createdC:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-execution.xml.v315AcroRd32.exe
    File createdC:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-cli_ja.jar.v315AcroRd32.exe
    File createdC:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-sampler.xml.v315AcroRd32.exe
    File opened for modificationC:\Program Files\Windows Media Player\Media Renderer\DMR_120.pngAcroRd32.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.databinding.nl_zh_4.4.0.v20140623020002.jarAcroRd32.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_SlateBlue.gifAcroRd32.exe
    File createdC:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-keymap_ja.jar.v315AcroRd32.exe
    File createdC:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_diagonals-thick_20_666666_40x40.png.v315AcroRd32.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\Dataset.zipAcroRd32.exe
    File createdC:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\jaccess.jar.v315AcroRd32.exe
    File createdC:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-keyring-impl.jar.v315AcroRd32.exe
    File createdC:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_LightSpirit.gif.v315AcroRd32.exe
    File createdC:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util_zh_CN.jar.v315AcroRd32.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\ChessIconImages.bmpAcroRd32.exe
    File opened for modificationC:\Program Files\DVD Maker\Shared\DvdStyles\Pets\rollinghills.pngAcroRd32.exe
    File opened for modificationC:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_corner_bottom_right.pngAcroRd32.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.nl_zh_4.4.0.v20140623020002.jarAcroRd32.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core.xmlAcroRd32.exe
    File opened for modificationC:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\logo.pngAcroRd32.exe
    File opened for modificationC:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\19.pngAcroRd32.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\utilityfunctions.jsAcroRd32.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePage.gifAcroRd32.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\console_view.pngAcroRd32.exe
    File opened for modificationC:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\dial.pngAcroRd32.exe
    File createdC:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\SketchIconImages.bmp.v315AcroRd32.exe
    File opened for modificationC:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\trad_settings.pngAcroRd32.exe
    File createdC:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.nl_ja_4.4.0.v20140623020002.jar.v315AcroRd32.exe
    File opened for modificationC:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\in_sidebar\bg_sidebar.pngAcroRd32.exe
    File createdC:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-oql.xml.v315AcroRd32.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-sa.xmlAcroRd32.exe
    File createdC:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\CircleIcons.jpg.v315AcroRd32.exe
    File createdC:\Program Files (x86)\Microsoft Office\Templates\1033\EssentialResume.dotx.v315AcroRd32.exe
    File opened for modificationC:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\baseAltGr_rtl.xmlAcroRd32.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvm_zh_CN.jarAcroRd32.exe
    File opened for modificationC:\Program Files\Common Files\Microsoft Shared\ink\hwrusalm.datAcroRd32.exe
    File opened for modificationC:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\27.pngAcroRd32.exe
    File createdC:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-sampler_ja.jar.v315AcroRd32.exe
    File opened for modificationC:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\logo.pngAcroRd32.exe
    File createdC:\Program Files\VideoLAN\VLC\THANKS.txt.v315AcroRd32.exe
    File createdC:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Couture.xml.v315AcroRd32.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-application-views.jarAcroRd32.exe
    File createdC:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-dialogs_ja.jar.v315AcroRd32.exe
    File opened for modificationC:\Program Files\7-Zip\Lang\kaa.txtAcroRd32.exe
    File opened for modificationC:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_rainy.pngAcroRd32.exe
    File createdC:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\splash.gif.v315AcroRd32.exe
    File createdC:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.renderers.swt_0.12.1.v20140903-1023.jar.v315AcroRd32.exe
    File createdC:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\Resource.zip.v315AcroRd32.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\InformationIcon.jpgAcroRd32.exe
  • Suspicious use of WriteProcessMemory
    b3af58566437f83301cd884feaaa2c4b6c827498969a2abbe48afc03351facb3.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1084 wrote to memory of 12081084b3af58566437f83301cd884feaaa2c4b6c827498969a2abbe48afc03351facb3.exeAcroRd32.exe
    PID 1084 wrote to memory of 12081084b3af58566437f83301cd884feaaa2c4b6c827498969a2abbe48afc03351facb3.exeAcroRd32.exe
    PID 1084 wrote to memory of 12081084b3af58566437f83301cd884feaaa2c4b6c827498969a2abbe48afc03351facb3.exeAcroRd32.exe
Processes 2
  • C:\Users\Admin\AppData\Local\Temp\b3af58566437f83301cd884feaaa2c4b6c827498969a2abbe48afc03351facb3.exe
    "C:\Users\Admin\AppData\Local\Temp\b3af58566437f83301cd884feaaa2c4b6c827498969a2abbe48afc03351facb3.exe"
    Adds Run key to start application
    Suspicious use of WriteProcessMemory
    PID:1084
    • C:\Users\Admin\AppData\Local\Adobe (x86)\AcroRd32.exe
      "C:\Users\Admin\AppData\Local\Adobe (x86)\AcroRd32.exe" C:\Users\Admin\AppData\Local\Temp\b3af58566437f83301cd884feaaa2c4b6c827498969a2abbe48afc03351facb3.exe
      Executes dropped EXE
      Modifies extensions of user files
      Drops file in Program Files directory
      PID:1208
Network
MITRE ATT&CK Matrix
Command and Control
    Credential Access
    Defense Evasion
    Discovery
      Execution
        Exfiltration
          Impact
            Initial Access
              Lateral Movement
                Privilege Escalation
                  Replay Monitor
                  00:00 00:00
                  Downloads
                  • C:\Users\Admin\AppData\Local\Adobe (x86)\AcroRd32.exe

                    MD5

                    0efb06144ff6e9eb6bdc03fafa5167a7

                    SHA1

                    894bc02320d1308462ce004cf06e1bb1841d22c2

                    SHA256

                    b3af58566437f83301cd884feaaa2c4b6c827498969a2abbe48afc03351facb3

                    SHA512

                    a4e4f538ad17d32c63f5b6b5be26115931480544ca921bec09bbe0dcb0989455fb29a8ddd97c3e14b4b1250b9aa8b19aa0e0849fcf1dd57f2d3f934f7e973a96

                  • C:\Users\Admin\AppData\Local\Adobe (x86)\AcroRd32.exe

                    MD5

                    0efb06144ff6e9eb6bdc03fafa5167a7

                    SHA1

                    894bc02320d1308462ce004cf06e1bb1841d22c2

                    SHA256

                    b3af58566437f83301cd884feaaa2c4b6c827498969a2abbe48afc03351facb3

                    SHA512

                    a4e4f538ad17d32c63f5b6b5be26115931480544ca921bec09bbe0dcb0989455fb29a8ddd97c3e14b4b1250b9aa8b19aa0e0849fcf1dd57f2d3f934f7e973a96

                  • memory/1084-1-0x000007FEF5DE0000-0x000007FEF677D000-memory.dmp

                  • memory/1084-0-0x000007FEF5DE0000-0x000007FEF677D000-memory.dmp

                  • memory/1208-7-0x000000001C680000-0x000000001C6A0000-memory.dmp

                  • memory/1208-5-0x000007FEF5DE0000-0x000007FEF677D000-memory.dmp

                  • memory/1208-6-0x000007FEF5DE0000-0x000007FEF677D000-memory.dmp

                  • memory/1208-2-0x0000000000000000-mapping.dmp

                  • memory/1208-245-0x000000001C680000-0x000000001C710000-memory.dmp

                  • memory/1208-839-0x000000001C0D0000-0x000000001C150000-memory.dmp

                  • memory/1208-861-0x000000001C0D0000-0x000000001C130000-memory.dmp

                  • memory/1208-905-0x000000001C0D0000-0x000000001C120000-memory.dmp

                  • memory/1208-949-0x000000001C0D0000-0x000000001C140000-memory.dmp

                  • memory/1208-959-0x000000001C160000-0x000000001C162000-memory.dmp

                  • memory/1208-1155-0x000000001C020000-0x000000001C060000-memory.dmp