Overview

overview

10

Static

static

Statement.pdf.msi

windows7_x64

6

Statement.pdf.msi

windows10-2004_x64

10

Resubmissions

19-07-2024 15:23

240719-ssp3ka1dng 10

09-10-2023 22:48

231009-2rhrjagh71 10

29-01-2023 17:46

230129-wchv4afh63 10

14-07-2022 07:49

220714-jn2fcsdbgr 10

Analysis

  • max time kernel
    151s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    14-07-2022 07:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Statement.pdf.msi

  • Size

    1.1MB

  • MD5

    a362de111d5dff6bcdeaf4717af268b6

  • SHA1

    2e5104db35871c5bc7da2035d8b91398bb5d5e0e

  • SHA256

    0921add95609d77f0c6195b2bec474b693ec217abb1db496f367c768bfbe7cca

  • SHA512

    b48a18158a0dff9a9012952c467fcf69b8bfc53ceeacaf32a90fc4b7f3afd34465e676b282fa87f3c5c85b4780baf96cc754dcdeef77ba5330fa8c4fd1d20b72

Score
10/10
jigsawpersistenceransomware

Malware Config

Signatures

  • Jigsaw Ransomware

    Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.

    ransomwarejigsaw
  • Executes dropped EXE 2 IoCs
  • Modifies extensions of user files 5 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 11 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 57 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Statement.pdf.msi
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:3264
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3100
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3180
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 96AAFADEE50CA543026010D8857E67CC
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1848
      • C:\Windows\SysWOW64\expand.exe
        "C:\Windows\System32\expand.exe" -R files.cab -F:* files
        3⤵
        • Drops file in Windows directory
        PID:3560
      • C:\Users\Admin\AppData\Local\Temp\MW-ff6f5621-f598-4762-8d67-9c4d57d2477e\files\Wire_Transfer.docx.exe
        "C:\Users\Admin\AppData\Local\Temp\MW-ff6f5621-f598-4762-8d67-9c4d57d2477e\files\Wire_Transfer.docx.exe"
        3⤵
        • Executes dropped EXE
        • Checks computer location settings
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:508
        • C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe
          "C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe" C:\Users\Admin\AppData\Local\Temp\MW-ff6f5621-f598-4762-8d67-9c4d57d2477e\files\Wire_Transfer.docx.exe
          4⤵
          • Executes dropped EXE
          • Modifies extensions of user files
          • Drops file in Program Files directory
          PID:2232
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 6F61FE13CEA9159286BF2D809308F8E9 E Global\MSI0000
      2⤵
      • Loads dropped DLL
      PID:4840
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:3368

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe
    Filesize

    282KB

    MD5

    fba7f5f58a53322d0b85cc588cfaacd1

    SHA1

    da2617cb96dd02a075565de6a704551fd7995dab

    SHA256

    1fccbea75b44bae2ba147cf63facbbcf1cc440af4de9bde9a6d8d2f32bde420a

    SHA512

    c9a4cb9076aeccff2cd1409dcdd8046ffa524ce768459443c2d69f21ef9c3fc899e2db19bed0377852e8e626436a80d9f192258e7e320fd3e252c0073eb762db

    Download Submit

  • C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe
    Filesize

    282KB

    MD5

    fba7f5f58a53322d0b85cc588cfaacd1

    SHA1

    da2617cb96dd02a075565de6a704551fd7995dab

    SHA256

    1fccbea75b44bae2ba147cf63facbbcf1cc440af4de9bde9a6d8d2f32bde420a

    SHA512

    c9a4cb9076aeccff2cd1409dcdd8046ffa524ce768459443c2d69f21ef9c3fc899e2db19bed0377852e8e626436a80d9f192258e7e320fd3e252c0073eb762db

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\MW-ff6f5621-f598-4762-8d67-9c4d57d2477e\files.cab
    Filesize

    282KB

    MD5

    807718ec27e1cdf76ea45291e0b73dcb

    SHA1

    43fd298dff26c7cc2180d5b198ef23e0c37d578e

    SHA256

    1001621d1b1d3cbba8d28644b24d7c4ff165c13ab2850661b3ed863efb6d1759

    SHA512

    a01444e070e6cbcf6b0aeb00c54469ea2dcf36e841c9179bb8a8d4c316000ebab6cef72cfe21467cf283bbed8372ce4787f60296c985ab831c49e3d18646da43

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\MW-ff6f5621-f598-4762-8d67-9c4d57d2477e\files\Wire_Transfer.docx.exe
    Filesize

    282KB

    MD5

    fba7f5f58a53322d0b85cc588cfaacd1

    SHA1

    da2617cb96dd02a075565de6a704551fd7995dab

    SHA256

    1fccbea75b44bae2ba147cf63facbbcf1cc440af4de9bde9a6d8d2f32bde420a

    SHA512

    c9a4cb9076aeccff2cd1409dcdd8046ffa524ce768459443c2d69f21ef9c3fc899e2db19bed0377852e8e626436a80d9f192258e7e320fd3e252c0073eb762db

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\MW-ff6f5621-f598-4762-8d67-9c4d57d2477e\files\Wire_Transfer.docx.exe
    Filesize

    282KB

    MD5

    fba7f5f58a53322d0b85cc588cfaacd1

    SHA1

    da2617cb96dd02a075565de6a704551fd7995dab

    SHA256

    1fccbea75b44bae2ba147cf63facbbcf1cc440af4de9bde9a6d8d2f32bde420a

    SHA512

    c9a4cb9076aeccff2cd1409dcdd8046ffa524ce768459443c2d69f21ef9c3fc899e2db19bed0377852e8e626436a80d9f192258e7e320fd3e252c0073eb762db

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\MW-ff6f5621-f598-4762-8d67-9c4d57d2477e\msiwrapper.ini
    Filesize

    513B

    MD5

    90a9dbe346d375d1096a92aed413ac5e

    SHA1

    ab60f850388bc327c16961afb12fd828e63fce95

    SHA256

    c6dd8adc672807581d872b866feaa197642266ac2ba1000a5e3d48ccc5d9bfe1

    SHA512

    a74a2cffed9c682eb8f074e97a3584a609f890559358bc3b43ca819539b25c5c92275c882aa874720c7a96f8c2fcbcb738228f936bf273309b9378e3cd464c44

    Download Submit

  • C:\Windows\Installer\MSI57B5.tmp
    Filesize

    601KB

    MD5

    ffe70d3419a64f4be1982d5cdf1155f4

    SHA1

    c62e03d533925c871cb9caac853a1d3a33f60f34

    SHA256

    8b590d235166ed734e376bcbb27491be8d5592682919e961ccac59b2aa19e909

    SHA512

    5b2fd2c6cd1a8087be74a2b7ac04fce728a83c413bb041541314c534978d825818b250f3e1b81b3eeb4835800c6d66d40e7d7fd56fb582bc92c10566cee83675

    Download Submit

  • C:\Windows\Installer\MSI57B5.tmp
    Filesize

    601KB

    MD5

    ffe70d3419a64f4be1982d5cdf1155f4

    SHA1

    c62e03d533925c871cb9caac853a1d3a33f60f34

    SHA256

    8b590d235166ed734e376bcbb27491be8d5592682919e961ccac59b2aa19e909

    SHA512

    5b2fd2c6cd1a8087be74a2b7ac04fce728a83c413bb041541314c534978d825818b250f3e1b81b3eeb4835800c6d66d40e7d7fd56fb582bc92c10566cee83675

    Download Submit

  • C:\Windows\Installer\MSI730F.tmp
    Filesize

    601KB

    MD5

    ffe70d3419a64f4be1982d5cdf1155f4

    SHA1

    c62e03d533925c871cb9caac853a1d3a33f60f34

    SHA256

    8b590d235166ed734e376bcbb27491be8d5592682919e961ccac59b2aa19e909

    SHA512

    5b2fd2c6cd1a8087be74a2b7ac04fce728a83c413bb041541314c534978d825818b250f3e1b81b3eeb4835800c6d66d40e7d7fd56fb582bc92c10566cee83675

    Download Submit

  • C:\Windows\Installer\MSI730F.tmp
    Filesize

    601KB

    MD5

    ffe70d3419a64f4be1982d5cdf1155f4

    SHA1

    c62e03d533925c871cb9caac853a1d3a33f60f34

    SHA256

    8b590d235166ed734e376bcbb27491be8d5592682919e961ccac59b2aa19e909

    SHA512

    5b2fd2c6cd1a8087be74a2b7ac04fce728a83c413bb041541314c534978d825818b250f3e1b81b3eeb4835800c6d66d40e7d7fd56fb582bc92c10566cee83675

    Download Submit

  • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
    Filesize

    23.0MB

    MD5

    f54995a4febf875467a786220c788829

    SHA1

    a3178ddab431bdef40995552c232cd92c4e6bce2

    SHA256

    695262c9da5bd8e901474bd5e2f99f25923bcf0915f69114132c00e808725d35

    SHA512

    9199311bc491acfd45194dc5bd9ca0ed8070e3edf7a554a5e7689225a75c5a3542d54fc7051f884001a24397c70eabd5d70b190a316ce582c6e6eaeef2f3fcc1

    Download Submit

  • \??\Volume{5acfaf36-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{3b783116-30ca-4c0a-891d-27ae2e084aee}_OnDiskSnapshotProp
    Filesize

    5KB

    MD5

    b4dae10fdf82dad6d04dfb0e2e99e1d2

    SHA1

    9627f25309d3682e3bd7726f14c34207161cfb2b

    SHA256

    1796f5c709102fa454b73541784a299f278b1e046410b7797e2971bb461e188e

    SHA512

    4d2fe71db354860633779e64075a82c214d42255dbbfe48dca00bec07d968e05e2437ab8ed7bb7a5df64f473ef1701bc49d59154c8b09f6ba947f62b58c4535b

    Download Submit

  • memory/508-142-0x00007FFD5EFD0000-0x00007FFD5FA06000-memory.dmp

    Filesize

    10.2MB

    Download

  • memory/1848-134-0x00000000747D0000-0x00000000748A5000-memory.dmp

    Filesize

    852KB

    Download

  • memory/2232-146-0x00007FFD5EFD0000-0x00007FFD5FA06000-memory.dmp

    Filesize

    10.2MB

    Download

  • memory/4840-151-0x00000000747D0000-0x00000000748A5000-memory.dmp

    Filesize

    852KB

    Download