Overview

overview

10

Static

static

cats.exe

windows7_x64

10

cats.exe

windows10_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    13s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    21-04-2021 15:34

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    cats.exe

  • Size

    187KB

  • MD5

    d3a0e47edcf938a77670e7a287eac0f2

  • SHA1

    38c92837ca17c17ac9728d90a65a53196ed4fdd2

  • SHA256

    ae3f350f758e1d229c6ec9cf7fb8c201a7e756b5866c05ac20df987a384a049a

  • SHA512

    60962d0309d1cf84570000f883ce818f3f07570a5cad144e19ac4e7d3cbdcb5a0a85bc96e559a69041a4c538959284da01e636bd7df04cce25d8e8894e54f08a

Score
10/10
jigsawpersistenceransomwarespywarestealer

Malware Config

Signatures

  • Jigsaw Ransomware

    Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.

    ransomwarejigsaw
  • Executes dropped EXE 1 IoCs
  • Modifies extensions of user files 3 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cats.exe
    "C:\Users\Admin\AppData\Local\Temp\cats.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1832
    • C:\Users\Admin\AppData\Local\Google (x86)\Chrome32.exe
      "C:\Users\Admin\AppData\Local\Google (x86)\Chrome32.exe" C:\Users\Admin\AppData\Local\Temp\cats.exe
      2⤵
      • Executes dropped EXE
      • Modifies extensions of user files
      • Drops file in Program Files directory
      PID:1324

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Google (x86)\Chrome32.exe
    MD5

    d3a0e47edcf938a77670e7a287eac0f2

    SHA1

    38c92837ca17c17ac9728d90a65a53196ed4fdd2

    SHA256

    ae3f350f758e1d229c6ec9cf7fb8c201a7e756b5866c05ac20df987a384a049a

    SHA512

    60962d0309d1cf84570000f883ce818f3f07570a5cad144e19ac4e7d3cbdcb5a0a85bc96e559a69041a4c538959284da01e636bd7df04cce25d8e8894e54f08a

    Download Submit
  • C:\Users\Admin\AppData\Local\Google (x86)\Chrome32.exe
    MD5

    d3a0e47edcf938a77670e7a287eac0f2

    SHA1

    38c92837ca17c17ac9728d90a65a53196ed4fdd2

    SHA256

    ae3f350f758e1d229c6ec9cf7fb8c201a7e756b5866c05ac20df987a384a049a

    SHA512

    60962d0309d1cf84570000f883ce818f3f07570a5cad144e19ac4e7d3cbdcb5a0a85bc96e559a69041a4c538959284da01e636bd7df04cce25d8e8894e54f08a

    Download Submit
  • memory/1324-61-0x0000000000000000-mapping.dmp
    Download
  • memory/1324-64-0x00000000009F0000-0x00000000009F2000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1324-65-0x000007FEF2360000-0x000007FEF33F6000-memory.dmp
    Filesize

    16.6MB

    Download
  • memory/1324-66-0x00000000009FB000-0x0000000000A1A000-memory.dmp
    Filesize

    124KB

    Download
  • memory/1832-59-0x0000000002000000-0x0000000002002000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1832-60-0x000007FEF2360000-0x000007FEF33F6000-memory.dmp
    Filesize

    16.6MB

    Download