Analysis
-
max time kernel
82s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-05-2022 18:15
Static task
static1
Behavioral task
behavioral1
Sample
802fef4d4f81c443497362711a7d8611741c30373c96d3229d699f225552a5f5.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
802fef4d4f81c443497362711a7d8611741c30373c96d3229d699f225552a5f5.exe
Resource
win10v2004-20220414-en
General
-
Target
802fef4d4f81c443497362711a7d8611741c30373c96d3229d699f225552a5f5.exe
-
Size
78KB
-
MD5
c5eff77db7eb62c4066247adfcd64797
-
SHA1
acf5f645a1af2987c8a5398c12d03622feba9d35
-
SHA256
802fef4d4f81c443497362711a7d8611741c30373c96d3229d699f225552a5f5
-
SHA512
1610710c081064743dcfc9b7f5cdf42e63c9f78f3f55983c7f00ae6e60124489a5239cafb89375cc8e3d9d7696eeed7bb23f05dcda52644aafee651f69768dbd
Malware Config
Signatures
-
Jigsaw Ransomware
Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.
-
Executes dropped EXE 1 IoCs
pid Process 952 drpbx.exe -
Modifies extensions of user files 2 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File created C:\Users\Admin\Pictures\ExitPop.png.fun drpbx.exe File created C:\Users\Admin\Pictures\TestConnect.raw.fun drpbx.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\firefox.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Frfx\\firefox.exe" 802fef4d4f81c443497362711a7d8611741c30373c96d3229d699f225552a5f5.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.services.nl_zh_4.4.0.v20140623020002.jar.fun drpbx.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\js\picturePuzzle.js drpbx.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-lib-uihandler.jar.fun drpbx.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Earthy.gif drpbx.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Blue_Gradient.jpg drpbx.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationLeft_SelectionSubpicture.png drpbx.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_WMC_LogoText.png drpbx.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\11.png drpbx.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-sendopts.xml.fun drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\ast.txt drpbx.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\BlackTieResume.dotx drpbx.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\SplashImage.jpg drpbx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-api_ja.jar drpbx.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_box_top.png drpbx.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\TaskbarIconImagesMask256Colors.bmp.fun drpbx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.configuration_5.5.0.165303.jar drpbx.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_SlateBlue.gif.fun drpbx.exe File created C:\Program Files\VideoLAN\VLC\THANKS.txt.fun drpbx.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Memories_buttonClear.png drpbx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_pt_BR.jar drpbx.exe File opened for modification C:\Program Files\Java\jre7\lib\security\US_export_policy.jar drpbx.exe File created C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMFormServices\InfoPathOMFormServicesV12\Microsoft.Office.InfoPath.xml.fun drpbx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-masterfs-nio2.xml drpbx.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsViewAttachmentIcons.jpg drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\id.txt drpbx.exe File created C:\Program Files\7-Zip\Lang\sr-spc.txt.fun drpbx.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\QuickStyles\Perspective.dotx.fun drpbx.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.observable.nl_ja_4.4.0.v20140623020002.jar.fun drpbx.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ApothecaryNewsletter.dotx drpbx.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\activity16v.png drpbx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-ui.jar drpbx.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-uihandler.xml.fun drpbx.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_GreenTea.gif drpbx.exe File created C:\Program Files\7-Zip\Lang\th.txt.fun drpbx.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\EssentialLetter.dotx drpbx.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\LoginTool24x24Images.jpg.fun drpbx.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.swt.nl_ja_4.4.0.v20140623020002.jar.fun drpbx.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-new.png drpbx.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\js\clock.js drpbx.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-masterfs.jar.fun drpbx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-swing-plaf.xml drpbx.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-new_partly-cloudy.png drpbx.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waning-crescent.png drpbx.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\vlm.xml drpbx.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_FormsHomePage.gif drpbx.exe File created C:\Program Files\7-Zip\Lang\kaa.txt.fun drpbx.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-progress.xml.fun drpbx.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\attention.gif.fun drpbx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.filetransfer_5.0.0.v20140827-1444.jar drpbx.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application-views_zh_CN.jar.fun drpbx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-masterfs.xml drpbx.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-uisupport.jar.fun drpbx.exe File created C:\Program Files\7-Zip\Lang\ro.txt.fun drpbx.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-image-inset.png drpbx.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.rcp_4.3.100.v20141007-2301.jar.fun drpbx.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\People\Whistling.wav.fun drpbx.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_ContactLowMask.bmp drpbx.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler.jar.fun drpbx.exe File created C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Essential.xml.fun drpbx.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.jarprocessor.nl_zh_4.4.0.v20140623020002.jar.fun drpbx.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\js\calendar.js drpbx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-nodes.jar drpbx.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_Groove.gif drpbx.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multitabs_ja.jar.fun drpbx.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 780 wrote to memory of 952 780 802fef4d4f81c443497362711a7d8611741c30373c96d3229d699f225552a5f5.exe 27 PID 780 wrote to memory of 952 780 802fef4d4f81c443497362711a7d8611741c30373c96d3229d699f225552a5f5.exe 27 PID 780 wrote to memory of 952 780 802fef4d4f81c443497362711a7d8611741c30373c96d3229d699f225552a5f5.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\802fef4d4f81c443497362711a7d8611741c30373c96d3229d699f225552a5f5.exe"C:\Users\Admin\AppData\Local\Temp\802fef4d4f81c443497362711a7d8611741c30373c96d3229d699f225552a5f5.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:780 -
C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe"C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe" C:\Users\Admin\AppData\Local\Temp\802fef4d4f81c443497362711a7d8611741c30373c96d3229d699f225552a5f5.exe2⤵
- Executes dropped EXE
- Modifies extensions of user files
- Drops file in Program Files directory
PID:952
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
78KB
MD5c5eff77db7eb62c4066247adfcd64797
SHA1acf5f645a1af2987c8a5398c12d03622feba9d35
SHA256802fef4d4f81c443497362711a7d8611741c30373c96d3229d699f225552a5f5
SHA5121610710c081064743dcfc9b7f5cdf42e63c9f78f3f55983c7f00ae6e60124489a5239cafb89375cc8e3d9d7696eeed7bb23f05dcda52644aafee651f69768dbd
-
Filesize
78KB
MD5c5eff77db7eb62c4066247adfcd64797
SHA1acf5f645a1af2987c8a5398c12d03622feba9d35
SHA256802fef4d4f81c443497362711a7d8611741c30373c96d3229d699f225552a5f5
SHA5121610710c081064743dcfc9b7f5cdf42e63c9f78f3f55983c7f00ae6e60124489a5239cafb89375cc8e3d9d7696eeed7bb23f05dcda52644aafee651f69768dbd