Analysis
-
max time kernel
135s -
max time network
59s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
07-07-2021 16:14
General
-
Target
4ba36ecc13f6b08e1523fa7f8fd228b739d1f6918c5c7f9779c536b91dbb3def.exe
-
Size
31.4MB
-
MD5
5e522e76e656ec090c8555b61fbcf226
-
SHA1
6248d98b60c13b2d89caaa8059d29d4183616047
-
SHA256
4ba36ecc13f6b08e1523fa7f8fd228b739d1f6918c5c7f9779c536b91dbb3def
-
SHA512
b1f4a0f0aea64ab76d0635fac5d159a2dd9df73f0944b0bafb66d6bec16e6887e5c412334ffe7418d2609df07ab5732f8fd4c387181d5c33465f499d86c7a2d4
Malware Config
Signatures
-
Jigsaw Ransomware
Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.
-
Executes dropped EXE 1 IoCs
-
Modifies extensions of user files 4 IoCs
Ransomware generally changes the extension on encrypted files.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4ba36ecc13f6b08e1523fa7f8fd228b739d1f6918c5c7f9779c536b91dbb3def.exe"C:\Users\Admin\AppData\Local\Temp\4ba36ecc13f6b08e1523fa7f8fd228b739d1f6918c5c7f9779c536b91dbb3def.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe"C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe" C:\Users\Admin\AppData\Local\Temp\4ba36ecc13f6b08e1523fa7f8fd228b739d1f6918c5c7f9779c536b91dbb3def.exe2⤵
- Executes dropped EXE
- Modifies extensions of user files
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exedw20.exe -x -s 5763⤵
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Drpbx\drpbx.exeMD5
5e522e76e656ec090c8555b61fbcf226
SHA16248d98b60c13b2d89caaa8059d29d4183616047
SHA2564ba36ecc13f6b08e1523fa7f8fd228b739d1f6918c5c7f9779c536b91dbb3def
SHA512b1f4a0f0aea64ab76d0635fac5d159a2dd9df73f0944b0bafb66d6bec16e6887e5c412334ffe7418d2609df07ab5732f8fd4c387181d5c33465f499d86c7a2d4
-
C:\Users\Admin\AppData\Local\Drpbx\drpbx.exeMD5
5e522e76e656ec090c8555b61fbcf226
SHA16248d98b60c13b2d89caaa8059d29d4183616047
SHA2564ba36ecc13f6b08e1523fa7f8fd228b739d1f6918c5c7f9779c536b91dbb3def
SHA512b1f4a0f0aea64ab76d0635fac5d159a2dd9df73f0944b0bafb66d6bec16e6887e5c412334ffe7418d2609df07ab5732f8fd4c387181d5c33465f499d86c7a2d4
-
memory/268-67-0x00000000020A0000-0x00000000020A2000-memory.dmpFilesize
8KB
-
memory/268-72-0x00000000020C9000-0x00000000020CB000-memory.dmpFilesize
8KB
-
memory/268-62-0x0000000000000000-mapping.dmp
-
memory/268-65-0x000007FEF2CB0000-0x000007FEF3D46000-memory.dmpFilesize
16.6MB
-
memory/268-68-0x00000000020A6000-0x00000000020C5000-memory.dmpFilesize
124KB
-
memory/1424-69-0x0000000000000000-mapping.dmp
-
memory/1424-70-0x000007FEFBAE1000-0x000007FEFBAE3000-memory.dmpFilesize
8KB
-
memory/1424-71-0x0000000001DE0000-0x0000000001DE1000-memory.dmpFilesize
4KB
-
memory/1516-66-0x0000000000626000-0x0000000000645000-memory.dmpFilesize
124KB
-
memory/1516-60-0x0000000000620000-0x0000000000622000-memory.dmpFilesize
8KB
-
memory/1516-61-0x000007FEF2CB0000-0x000007FEF3D46000-memory.dmpFilesize
16.6MB