General
- Target 47145ecc729d25e288a6b7c512ec15c9dd07e36149578a882b38f772248d8174
- Size 305KB
- Sample220714-jn2fcsdbgr
- SHA256 47145ecc729d25e288a6b7c512ec15c9dd07e36149578a882b38f772248d8174
Score
10/10
Malware Config
Targets
-
- Target Statement.pdf.msi
- Size 1.1MB
- SHA256 0921add95609d77f0c6195b2bec474b693ec217abb1db496f367c768bfbe7cca
Score10/10-
Jigsaw Ransomware
Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.
-
Executes dropped EXE
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.