Analysis
-
max time kernel
167s -
max time network
12s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
05-11-2020 14:34
Static task
static1
Behavioral task
behavioral1
Sample
b3af58566437f83301cd884feaaa2c4b6c827498969a2abbe48afc03351facb3.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
b3af58566437f83301cd884feaaa2c4b6c827498969a2abbe48afc03351facb3.exe
Resource
win10v20201028
General
-
Target
b3af58566437f83301cd884feaaa2c4b6c827498969a2abbe48afc03351facb3.exe
-
Size
41KB
-
MD5
0efb06144ff6e9eb6bdc03fafa5167a7
-
SHA1
894bc02320d1308462ce004cf06e1bb1841d22c2
-
SHA256
b3af58566437f83301cd884feaaa2c4b6c827498969a2abbe48afc03351facb3
-
SHA512
a4e4f538ad17d32c63f5b6b5be26115931480544ca921bec09bbe0dcb0989455fb29a8ddd97c3e14b4b1250b9aa8b19aa0e0849fcf1dd57f2d3f934f7e973a96
Malware Config
Signatures
-
Jigsaw Ransomware
Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.
-
Executes dropped EXE 1 IoCs
Processes:
AcroRd32.exepid process 1208 AcroRd32.exe -
Modifies extensions of user files 5 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
AcroRd32.exedescription ioc process File created C:\Users\Admin\Pictures\ProtectPop.tif.v315 AcroRd32.exe File created C:\Users\Admin\Pictures\RestoreDebug.tif.v315 AcroRd32.exe File created C:\Users\Admin\Pictures\UnpublishCompare.png.v315 AcroRd32.exe File created C:\Users\Admin\Pictures\EditRequest.png.v315 AcroRd32.exe File created C:\Users\Admin\Pictures\PingRestart.raw.v315 AcroRd32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
b3af58566437f83301cd884feaaa2c4b6c827498969a2abbe48afc03351facb3.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\Chrome32.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Google (x86)\\Chrome32.exe" b3af58566437f83301cd884feaaa2c4b6c827498969a2abbe48afc03351facb3.exe -
Drops file in Program Files directory 4928 IoCs
Processes:
AcroRd32.exedescription ioc process File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_SelectionSubpicture.png AcroRd32.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_performance_Thumbnail.bmp AcroRd32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\UrbanPhotoAlbum.potx AcroRd32.exe File created C:\Program Files\Java\jre7\lib\security\US_export_policy.jar.v315 AcroRd32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.widgets.nl_ja_4.4.0.v20140623020002.jar AcroRd32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.eclipse.nl_zh_4.4.0.v20140623020002.jar AcroRd32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.forms.nl_zh_4.4.0.v20140623020002.jar AcroRd32.exe File opened for modification C:\Program Files\7-Zip\Lang\lv.txt AcroRd32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\QuickStyles\Formal.dotx AcroRd32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\NotifierDisableDownArrow.jpg AcroRd32.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\utilityfunctions.js.v315 AcroRd32.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\vintage.png AcroRd32.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\layers.png AcroRd32.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\system_s.png AcroRd32.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-applemenu.jar.v315 AcroRd32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_alignleft.gif AcroRd32.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-execution.xml.v315 AcroRd32.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-cli_ja.jar.v315 AcroRd32.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-sampler.xml.v315 AcroRd32.exe File opened for modification C:\Program Files\Windows Media Player\Media Renderer\DMR_120.png AcroRd32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.databinding.nl_zh_4.4.0.v20140623020002.jar AcroRd32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_SlateBlue.gif AcroRd32.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-keymap_ja.jar.v315 AcroRd32.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_diagonals-thick_20_666666_40x40.png.v315 AcroRd32.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\Dataset.zip AcroRd32.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\jaccess.jar.v315 AcroRd32.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-keyring-impl.jar.v315 AcroRd32.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_LightSpirit.gif.v315 AcroRd32.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util_zh_CN.jar.v315 AcroRd32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\ChessIconImages.bmp AcroRd32.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\rollinghills.png AcroRd32.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_corner_bottom_right.png AcroRd32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.nl_zh_4.4.0.v20140623020002.jar AcroRd32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core.xml AcroRd32.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\logo.png AcroRd32.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\19.png AcroRd32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\utilityfunctions.js AcroRd32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePage.gif AcroRd32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\console_view.png AcroRd32.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\dial.png AcroRd32.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\SketchIconImages.bmp.v315 AcroRd32.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\trad_settings.png AcroRd32.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.nl_ja_4.4.0.v20140623020002.jar.v315 AcroRd32.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\in_sidebar\bg_sidebar.png AcroRd32.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-oql.xml.v315 AcroRd32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-sa.xml AcroRd32.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\CircleIcons.jpg.v315 AcroRd32.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\EssentialResume.dotx.v315 AcroRd32.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\baseAltGr_rtl.xml AcroRd32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvm_zh_CN.jar AcroRd32.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrusalm.dat AcroRd32.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\27.png AcroRd32.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-sampler_ja.jar.v315 AcroRd32.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\logo.png AcroRd32.exe File created C:\Program Files\VideoLAN\VLC\THANKS.txt.v315 AcroRd32.exe File created C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Couture.xml.v315 AcroRd32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-application-views.jar AcroRd32.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-dialogs_ja.jar.v315 AcroRd32.exe File opened for modification C:\Program Files\7-Zip\Lang\kaa.txt AcroRd32.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_rainy.png AcroRd32.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\splash.gif.v315 AcroRd32.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.renderers.swt_0.12.1.v20140903-1023.jar.v315 AcroRd32.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\Resource.zip.v315 AcroRd32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\InformationIcon.jpg AcroRd32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
b3af58566437f83301cd884feaaa2c4b6c827498969a2abbe48afc03351facb3.exedescription pid process target process PID 1084 wrote to memory of 1208 1084 b3af58566437f83301cd884feaaa2c4b6c827498969a2abbe48afc03351facb3.exe AcroRd32.exe PID 1084 wrote to memory of 1208 1084 b3af58566437f83301cd884feaaa2c4b6c827498969a2abbe48afc03351facb3.exe AcroRd32.exe PID 1084 wrote to memory of 1208 1084 b3af58566437f83301cd884feaaa2c4b6c827498969a2abbe48afc03351facb3.exe AcroRd32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b3af58566437f83301cd884feaaa2c4b6c827498969a2abbe48afc03351facb3.exe"C:\Users\Admin\AppData\Local\Temp\b3af58566437f83301cd884feaaa2c4b6c827498969a2abbe48afc03351facb3.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Adobe (x86)\AcroRd32.exe"C:\Users\Admin\AppData\Local\Adobe (x86)\AcroRd32.exe" C:\Users\Admin\AppData\Local\Temp\b3af58566437f83301cd884feaaa2c4b6c827498969a2abbe48afc03351facb3.exe2⤵
- Executes dropped EXE
- Modifies extensions of user files
- Drops file in Program Files directory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Adobe (x86)\AcroRd32.exeMD5
0efb06144ff6e9eb6bdc03fafa5167a7
SHA1894bc02320d1308462ce004cf06e1bb1841d22c2
SHA256b3af58566437f83301cd884feaaa2c4b6c827498969a2abbe48afc03351facb3
SHA512a4e4f538ad17d32c63f5b6b5be26115931480544ca921bec09bbe0dcb0989455fb29a8ddd97c3e14b4b1250b9aa8b19aa0e0849fcf1dd57f2d3f934f7e973a96
-
C:\Users\Admin\AppData\Local\Adobe (x86)\AcroRd32.exeMD5
0efb06144ff6e9eb6bdc03fafa5167a7
SHA1894bc02320d1308462ce004cf06e1bb1841d22c2
SHA256b3af58566437f83301cd884feaaa2c4b6c827498969a2abbe48afc03351facb3
SHA512a4e4f538ad17d32c63f5b6b5be26115931480544ca921bec09bbe0dcb0989455fb29a8ddd97c3e14b4b1250b9aa8b19aa0e0849fcf1dd57f2d3f934f7e973a96
-
memory/1084-1-0x000007FEF5DE0000-0x000007FEF677D000-memory.dmpFilesize
9.6MB
-
memory/1084-0-0x000007FEF5DE0000-0x000007FEF677D000-memory.dmpFilesize
9.6MB
-
memory/1208-6-0x000007FEF5DE0000-0x000007FEF677D000-memory.dmpFilesize
9.6MB
-
memory/1208-5-0x000007FEF5DE0000-0x000007FEF677D000-memory.dmpFilesize
9.6MB
-
memory/1208-2-0x0000000000000000-mapping.dmp
-
memory/1208-7-0x000000001C680000-0x000000001C6A0000-memory.dmpFilesize
128KB
-
memory/1208-245-0x000000001C680000-0x000000001C710000-memory.dmpFilesize
576KB
-
memory/1208-839-0x000000001C0D0000-0x000000001C150000-memory.dmpFilesize
512KB
-
memory/1208-861-0x000000001C0D0000-0x000000001C130000-memory.dmpFilesize
384KB
-
memory/1208-905-0x000000001C0D0000-0x000000001C120000-memory.dmpFilesize
320KB
-
memory/1208-949-0x000000001C0D0000-0x000000001C140000-memory.dmpFilesize
448KB
-
memory/1208-959-0x000000001C160000-0x000000001C162000-memory.dmpFilesize
8KB
-
memory/1208-1155-0x000000001C020000-0x000000001C060000-memory.dmpFilesize
256KB