jigsaw | 20a637cd6394c41636133b24d78d52a0e091c8012cee9dbf6c4060656f6c7cb7 | Triage

Resubmissions

09-10-2023 22:49

231009-2rt5kagh8t 10

12-06-2022 11:51

220612-n1jtasaden 10

Sharing

General

Target

20a637cd6394c41636133b24d78d52a0e091c8012cee9dbf6c4060656f6c7cb7
Size

65KB
Sample

220612-n1jtasaden
MD5

269de662c8b796f35e614a1aa807d769
SHA1

43f32f0e0d952dba0bc2cb3c0657291f0930ec8a
SHA256

20a637cd6394c41636133b24d78d52a0e091c8012cee9dbf6c4060656f6c7cb7
SHA512

4d99243d079668e08342dc015e8f0749b452fd0ae4a1f7b7d047a1b499289ca6044691641db661f90978082e8262e43bcb6230f9e87e0f7f770d568d9b381009

Score

10^/10

jigsaw persistence ransomware

Malware Config

Targets

- Target
  
  20a637cd6394c41636133b24d78d52a0e091c8012cee9dbf6c4060656f6c7cb7
- Size
  
  65KB
- MD5
  
  269de662c8b796f35e614a1aa807d769
- SHA1
  
  43f32f0e0d952dba0bc2cb3c0657291f0930ec8a
- SHA256
  
  20a637cd6394c41636133b24d78d52a0e091c8012cee9dbf6c4060656f6c7cb7
- SHA512
  
  4d99243d079668e08342dc015e8f0749b452fd0ae4a1f7b7d047a1b499289ca6044691641db661f90978082e8262e43bcb6230f9e87e0f7f770d568d9b381009
Score

10^/10

jigsaw persistence ransomware
- Jigsaw Ransomware
  Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.
  ransomware jigsaw
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

jigsawpersistenceransomware

behavioral2