Overview

overview

10

Static

static

cats.exe

windows7_x64

10

cats.exe

windows10_x64

10

Resubmissions

09-10-2023 22:49

231009-2rxkpagh8y 10

30-03-2021 09:40

210330-ae6xfbdjpn 10

30-03-2021 09:36

210330-23qa4tgj4n 10

29-03-2021 16:32

210329-8v5z5a82en 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cats.exe

  • Size

    126KB

  • Sample

    210330-ae6xfbdjpn

  • MD5

    e0d108435c58dc9403588e4dcab68275

  • SHA1

    7a7331423938020550ff3decd2e8b50b3ee5c87a

  • SHA256

    61cd0131cb4bf090c5ee7761566f6f7a778e78b37d220f0506f98632a2663ee8

  • SHA512

    2a5648ced91b75d928b4d71a8580c5bee75a5f27623f8c5071cd23b8cd85eaa8129ddb0aaf0a1fcca05fb1b7868a0fcd9306e9ddf2d3eaaf605c41cc7fde4a9e

Score
10/10
jigsawpersistenceransomwarespywarestealer

Malware Config

Targets

    • Target

      cats.exe

    • Size

      126KB

    • MD5

      e0d108435c58dc9403588e4dcab68275

    • SHA1

      7a7331423938020550ff3decd2e8b50b3ee5c87a

    • SHA256

      61cd0131cb4bf090c5ee7761566f6f7a778e78b37d220f0506f98632a2663ee8

    • SHA512

      2a5648ced91b75d928b4d71a8580c5bee75a5f27623f8c5071cd23b8cd85eaa8129ddb0aaf0a1fcca05fb1b7868a0fcd9306e9ddf2d3eaaf605c41cc7fde4a9e

    Score
    10/10
    jigsawpersistenceransomwarespywarestealer

    • Jigsaw Ransomware

      Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.

      ransomwarejigsaw

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Executes dropped EXE

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks