Resubmissions
19-07-2024 15:21
240719-srpqea1dkd 1009-10-2023 22:49
231009-2rxkpagh8y 1030-03-2021 09:40
210330-ae6xfbdjpn 1030-03-2021 09:36
210330-23qa4tgj4n 1029-03-2021 16:32
210329-8v5z5a82en 10Analysis
-
max time kernel
150s -
max time network
105s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
30-03-2021 09:36
Static task
static1
Behavioral task
behavioral1
Sample
cats.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
cats.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
cats.exe
-
Size
126KB
-
MD5
e0d108435c58dc9403588e4dcab68275
-
SHA1
7a7331423938020550ff3decd2e8b50b3ee5c87a
-
SHA256
61cd0131cb4bf090c5ee7761566f6f7a778e78b37d220f0506f98632a2663ee8
-
SHA512
2a5648ced91b75d928b4d71a8580c5bee75a5f27623f8c5071cd23b8cd85eaa8129ddb0aaf0a1fcca05fb1b7868a0fcd9306e9ddf2d3eaaf605c41cc7fde4a9e
Score
10/10
Malware Config
Signatures
-
Jigsaw Ransomware
Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.
-
Executes dropped EXE 1 IoCs
pid Process 3596 Chrome32.exe -
Modifies extensions of user files 2 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File created C:\Users\Admin\Pictures\ResolveClear.tif.cat Chrome32.exe File created C:\Users\Admin\Pictures\WaitCompare.raw.cat Chrome32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\firefox.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Frfx\\firefox.exe" cats.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.nl_ja_4.4.0.v20140623020002.jar Chrome32.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.osgi.nl_zh_4.4.0.v20140623020002.jar.cat Chrome32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\pt-br\ui-strings.js Chrome32.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.scale-200.png Chrome32.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\mc.jar Chrome32.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-white_targetsize-16_altform-unplated.png Chrome32.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PeopleAppList.scale-200.png Chrome32.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-24.png Chrome32.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.osgi.nl_ja_4.4.0.v20140623020002.jar.cat Chrome32.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\xe_60x42.png Chrome32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\arrow-right-pressed.gif Chrome32.exe File created C:\Program Files\7-Zip\Lang\pa-in.txt.cat Chrome32.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\3007_40x40x32.png Chrome32.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\HowToPlay\TriPeaks\Goal_5.jpg Chrome32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\HomeBanner_Light.pdf Chrome32.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ja-jp\ui-strings.js.cat Chrome32.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.browser.attach_5.5.0.165303.jar.cat Chrome32.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.docs_5.5.0.165303.jar Chrome32.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\Office\Ungroup.scale-100.png Chrome32.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-24_altform-unplated_contrast-white.png Chrome32.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-96.png Chrome32.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\Assets\Images\Tiles\Square44x44Logo.scale-200.png Chrome32.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\ke_16x11.png Chrome32.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_filterselected-hover_32.svg.cat Chrome32.exe File created C:\Program Files\Microsoft Office\root\rsod\powerview.x-none.msi.16.x-none.boot.tree.dat.cat Chrome32.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\Assets\PeopleAppList.targetsize-24.png Chrome32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\cs-cz\ui-strings.js Chrome32.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ko-kr\ui-strings.js.cat Chrome32.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\ws_60x42.png Chrome32.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-20_contrast-black.png Chrome32.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-125_8wekyb3d8bbwe\Assets\contrast-white\SplashScreen.scale-125_contrast-white.png Chrome32.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsStoreLogo.scale-200.png Chrome32.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account-select\js\plugin.js.cat Chrome32.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\OutlookMailWideTile.scale-400.png Chrome32.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\ThemeCreation\lobby_add_photos_mobile.png Chrome32.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\Assets\GetStartedWideTile.scale-100_contrast-black.png Chrome32.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\tr-tr\ui-strings.js.cat Chrome32.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\XboxApp.UI\Resources\Images\Home-Placeholder.png Chrome32.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-80.png Chrome32.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\TextureBitmaps\granite.jpg Chrome32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-100.png Chrome32.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Audio\RibbonHit_A.wav Chrome32.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.core.nl_ja_4.4.0.v20140623020002.jar.cat Chrome32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\it-it\ui-strings.js Chrome32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\da-dk\AppStore_icon.svg Chrome32.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-30.png Chrome32.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-96.png Chrome32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-180.png Chrome32.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.win32.nl_ja_4.4.0.v20140623020002.jar Chrome32.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\8268_48x48x32.png Chrome32.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.console.nl_ja_4.4.0.v20140623020002.jar Chrome32.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\Assets\Square71x71Logo.scale-200.png Chrome32.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\2876_20x20x32.png Chrome32.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-60.png Chrome32.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailAppList.targetsize-30.png Chrome32.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-200_8wekyb3d8bbwe\Assets\contrast-white\LargeLogo.scale-200_contrast-white.png Chrome32.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-core-io-ui.jar.cat Chrome32.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RTL\LargeTile.scale-200.png Chrome32.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\10911_24x24x32.png Chrome32.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Audio\opt-in-ad-popup.wav Chrome32.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\SearchEmail2x.png.cat Chrome32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ro-ro\ui-strings.js Chrome32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\it-it\ui-strings.js Chrome32.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-140_8wekyb3d8bbwe\Assets\Office\DeselectAll.scale-140.png Chrome32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1236 taskmgr.exe Token: SeSystemProfilePrivilege 1236 taskmgr.exe Token: SeCreateGlobalPrivilege 1236 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe 1236 taskmgr.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4684 wrote to memory of 3596 4684 cats.exe 75 PID 4684 wrote to memory of 3596 4684 cats.exe 75
Processes
-
C:\Users\Admin\AppData\Local\Temp\cats.exe"C:\Users\Admin\AppData\Local\Temp\cats.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Users\Admin\AppData\Local\Google (x86)\Chrome32.exe"C:\Users\Admin\AppData\Local\Google (x86)\Chrome32.exe" C:\Users\Admin\AppData\Local\Temp\cats.exe2⤵
- Executes dropped EXE
- Modifies extensions of user files
- Drops file in Program Files directory
PID:3596
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1236