Analysis
-
max time kernel
452s -
max time network
431s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
11-05-2022 20:30
Static task
static1
Behavioral task
behavioral1
Sample
Jigsaw.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Jigsaw.exe
Resource
win10v2004-20220414-en
General
-
Target
Jigsaw.exe
-
Size
283KB
-
MD5
2773e3dc59472296cb0024ba7715a64e
-
SHA1
27d99fbca067f478bb91cdbcb92f13a828b00859
-
SHA256
3ae96f73d805e1d3995253db4d910300d8442ea603737a1428b613061e7f61e7
-
SHA512
6ef530b209f8ec459cca66dbf2c31ec96c5f7d609f17fa3b877d276968032fbc6132ea4a45ed1450fb6c5d730a7c9349bf4481e28befaea6b119ec0ded842262
Malware Config
Signatures
-
Jigsaw Ransomware
Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.
-
Executes dropped EXE 1 IoCs
Processes:
drpbx.exepid process 4452 drpbx.exe -
Modifies extensions of user files 3 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
drpbx.exedescription ioc process File created C:\Users\Admin\Pictures\ClearSuspend.tif.fun drpbx.exe File created C:\Users\Admin\Pictures\SaveLimit.tif.fun drpbx.exe File created C:\Users\Admin\Pictures\SplitSync.raw.fun drpbx.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Jigsaw.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation Jigsaw.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Jigsaw.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\firefox.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Frfx\\firefox.exe" Jigsaw.exe -
Drops file in Program Files directory 64 IoCs
Processes:
drpbx.exedescription ioc process File opened for modification C:\Program Files\7-Zip\Lang\sq.txt drpbx.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.fun drpbx.exe File opened for modification C:\Program Files (x86)\Common Files\Services\verisign.bmp drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\ro.txt drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\sk.txt drpbx.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\AppxManifest.xml drpbx.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\blocklist.xml drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\BuildInfo.xml drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxBlockMap.xml drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.NET.Native.Framework.1.7_1.7.25531.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml drpbx.exe File created C:\Program Files\7-Zip\Lang\af.txt.fun drpbx.exe File created C:\Program Files\7-Zip\Lang\lt.txt.fun drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\mr.txt drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxManifest.xml drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\af.txt drpbx.exe File created C:\Program Files\7-Zip\Lang\fr.txt.fun drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\gl.txt drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml drpbx.exe File created C:\Program Files\7-Zip\Lang\mng.txt.fun drpbx.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\THIRDPARTYLICENSEREADME-JAVAFX.txt drpbx.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.fun drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\BuildInfo.xml drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_2019.807.41.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml drpbx.exe File opened for modification C:\Program Files (x86)\Windows Media Player\Media Renderer\DMR_48.png drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\is.txt drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\uk.txt drpbx.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.fun drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Services.Store.Engagement_10.0.18101.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxManifest.xml drpbx.exe File opened for modification C:\Program Files\ApproveResume.sql drpbx.exe File created C:\Program Files\UseCopy.asx.fun drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_2019.305.632.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_2019.904.1644.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml drpbx.exe File created C:\Program Files\7-Zip\Lang\he.txt.fun drpbx.exe File created C:\Program Files\7-Zip\Lang\pt-br.txt.fun drpbx.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.common.16.xml.fun drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxBlockMap.xml drpbx.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\THIRDPARTYLICENSEREADME-JAVAFX.txt drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Third Party Notices.txt drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\an.txt drpbx.exe File created C:\Program Files\7-Zip\Lang\et.txt.fun drpbx.exe File created C:\Program Files\7-Zip\Lang\ro.txt.fun drpbx.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml drpbx.exe File created C:\Program Files\VideoLAN\VLC\README.txt.fun drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppxManifest.xml drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxManifest.xml drpbx.exe File opened for modification C:\Program Files\WriteUpdate.tif drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\ext.txt drpbx.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.fun drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxManifest.xml drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxBlockMap.xml drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\mng.txt drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxManifest.xml drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxBlockMap.xml drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxManifest.xml drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\AppxManifest.xml drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\eo.txt drpbx.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
taskmgr.exepid process 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
taskmgr.exepid process 2024 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
taskmgr.exedescription pid process Token: SeDebugPrivilege 2024 taskmgr.exe Token: SeSystemProfilePrivilege 2024 taskmgr.exe Token: SeCreateGlobalPrivilege 2024 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
taskmgr.exepid process 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
taskmgr.exepid process 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe 2024 taskmgr.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
Jigsaw.exedescription pid process target process PID 5060 wrote to memory of 4452 5060 Jigsaw.exe drpbx.exe PID 5060 wrote to memory of 4452 5060 Jigsaw.exe drpbx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Jigsaw.exe"C:\Users\Admin\AppData\Local\Temp\Jigsaw.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe"C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe" C:\Users\Admin\AppData\Local\Temp\Jigsaw.exe2⤵
- Executes dropped EXE
- Modifies extensions of user files
- Drops file in Program Files directory
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Drpbx\drpbx.exeFilesize
283KB
MD52773e3dc59472296cb0024ba7715a64e
SHA127d99fbca067f478bb91cdbcb92f13a828b00859
SHA2563ae96f73d805e1d3995253db4d910300d8442ea603737a1428b613061e7f61e7
SHA5126ef530b209f8ec459cca66dbf2c31ec96c5f7d609f17fa3b877d276968032fbc6132ea4a45ed1450fb6c5d730a7c9349bf4481e28befaea6b119ec0ded842262
-
C:\Users\Admin\AppData\Local\Drpbx\drpbx.exeFilesize
283KB
MD52773e3dc59472296cb0024ba7715a64e
SHA127d99fbca067f478bb91cdbcb92f13a828b00859
SHA2563ae96f73d805e1d3995253db4d910300d8442ea603737a1428b613061e7f61e7
SHA5126ef530b209f8ec459cca66dbf2c31ec96c5f7d609f17fa3b877d276968032fbc6132ea4a45ed1450fb6c5d730a7c9349bf4481e28befaea6b119ec0ded842262
-
C:\Users\Admin\AppData\Roaming\Frfx\firefox.exeFilesize
283KB
MD52773e3dc59472296cb0024ba7715a64e
SHA127d99fbca067f478bb91cdbcb92f13a828b00859
SHA2563ae96f73d805e1d3995253db4d910300d8442ea603737a1428b613061e7f61e7
SHA5126ef530b209f8ec459cca66dbf2c31ec96c5f7d609f17fa3b877d276968032fbc6132ea4a45ed1450fb6c5d730a7c9349bf4481e28befaea6b119ec0ded842262
-
memory/4452-131-0x0000000000000000-mapping.dmp
-
memory/4452-134-0x00007FFABB300000-0x00007FFABBD36000-memory.dmpFilesize
10.2MB
-
memory/5060-130-0x00007FFABB300000-0x00007FFABBD36000-memory.dmpFilesize
10.2MB