General
- Target 47145ecc729d25e288a6b7c512ec15c9dd07e36149578a882b38f772248d8174
- Size 305KB
- Sample220714-jn2fcsdbgr
- SHA256 47145ecc729d25e288a6b7c512ec15c9dd07e36149578a882b38f772248d8174
Score
10/10
Malware Config
Targets
-
- Target Statement.pdf.msi
- Size 1.1MB
- SHA256 0921add95609d77f0c6195b2bec474b693ec217abb1db496f367c768bfbe7cca
Score10/10Jigsaw Ransomware
Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.
Executes dropped EXE
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Loads dropped DLL
Adds Run key to start application
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.