Overview

overview

10

Static

static

Statement.pdf.msi

windows7_x64

6

Statement.pdf.msi

windows10-2004_x64

10

Resubmissions

19/07/2024, 15:23

240719-ssp3ka1dng10

09/10/2023, 22:48

231009-2rhrjagh7110

29/01/2023, 17:46

230129-wchv4afh6310

14/07/2022, 07:49

220714-jn2fcsdbgr10

Analysis

  • max time kernel
    151s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    14/07/2022, 07:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Statement.pdf.msi
  • Size 1.1MB
  • Sample220714-jn2fcsdbgr
  • SHA256 0921add95609d77f0c6195b2bec474b693ec217abb1db496f367c768bfbe7cca
  • MD5 SHA1 SHA512
Score
10/10
jigsawpersistenceransomware

Malware Config

Signatures

  • Jigsaw Ransomware

    Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.

    ransomwarejigsaw
  • Executes dropped EXE 2 IoCs
  • Modifies extensions of user files 5 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 11 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 57 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Statement.pdf.msi
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:3264
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3100
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3180
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 96AAFADEE50CA543026010D8857E67CC
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1848
      • C:\Windows\SysWOW64\expand.exe
        "C:\Windows\System32\expand.exe" -R files.cab -F:* files
        3⤵
        • Drops file in Windows directory
        PID:3560
      • C:\Users\Admin\AppData\Local\Temp\MW-ff6f5621-f598-4762-8d67-9c4d57d2477e\files\Wire_Transfer.docx.exe
        "C:\Users\Admin\AppData\Local\Temp\MW-ff6f5621-f598-4762-8d67-9c4d57d2477e\files\Wire_Transfer.docx.exe"
        3⤵
        • Executes dropped EXE
        • Checks computer location settings
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:508
        • C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe
          "C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe" C:\Users\Admin\AppData\Local\Temp\MW-ff6f5621-f598-4762-8d67-9c4d57d2477e\files\Wire_Transfer.docx.exe
          4⤵
          • Executes dropped EXE
          • Modifies extensions of user files
          • Drops file in Program Files directory
          PID:2232
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 6F61FE13CEA9159286BF2D809308F8E9 E Global\MSI0000
      2⤵
      • Loads dropped DLL
      PID:4840
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:3368

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        drpbx.exe
        • Path C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe
        • Size 282KB
        • SHA256 1fccbea75b44bae2ba147cf63facbbcf1cc440af4de9bde9a6d8d2f32bde420a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        drpbx.exe
        • Path C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe
        • Size 282KB
        • SHA256 1fccbea75b44bae2ba147cf63facbbcf1cc440af4de9bde9a6d8d2f32bde420a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        files.cab
        • Path C:\Users\Admin\AppData\Local\Temp\MW-ff6f5621-f598-4762-8d67-9c4d57d2477e\files.cab
        • Size 282KB
        • SHA256 1001621d1b1d3cbba8d28644b24d7c4ff165c13ab2850661b3ed863efb6d1759
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Wire_Transfer.docx.exe
        • Path C:\Users\Admin\AppData\Local\Temp\MW-ff6f5621-f598-4762-8d67-9c4d57d2477e\files\Wire_Transfer.docx.exe
        • Size 282KB
        • SHA256 1fccbea75b44bae2ba147cf63facbbcf1cc440af4de9bde9a6d8d2f32bde420a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Wire_Transfer.docx.exe
        • Path C:\Users\Admin\AppData\Local\Temp\MW-ff6f5621-f598-4762-8d67-9c4d57d2477e\files\Wire_Transfer.docx.exe
        • Size 282KB
        • SHA256 1fccbea75b44bae2ba147cf63facbbcf1cc440af4de9bde9a6d8d2f32bde420a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msiwrapper.ini
        • Path C:\Users\Admin\AppData\Local\Temp\MW-ff6f5621-f598-4762-8d67-9c4d57d2477e\msiwrapper.ini
        • Size 513B
        • SHA256 c6dd8adc672807581d872b866feaa197642266ac2ba1000a5e3d48ccc5d9bfe1
        • MD5 SHA1 SHA512
        Submit Download

        MSI57B5.tmp
        • Path C:\Windows\Installer\MSI57B5.tmp
        • Size 601KB
        • SHA256 8b590d235166ed734e376bcbb27491be8d5592682919e961ccac59b2aa19e909
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MSI57B5.tmp
        • Path C:\Windows\Installer\MSI57B5.tmp
        • Size 601KB
        • SHA256 8b590d235166ed734e376bcbb27491be8d5592682919e961ccac59b2aa19e909
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MSI730F.tmp
        • Path C:\Windows\Installer\MSI730F.tmp
        • Size 601KB
        • SHA256 8b590d235166ed734e376bcbb27491be8d5592682919e961ccac59b2aa19e909
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MSI730F.tmp
        • Path C:\Windows\Installer\MSI730F.tmp
        • Size 601KB
        • SHA256 8b590d235166ed734e376bcbb27491be8d5592682919e961ccac59b2aa19e909
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        metadata-2
        • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
        • Size 23.0MB
        • SHA256 695262c9da5bd8e901474bd5e2f99f25923bcf0915f69114132c00e808725d35
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        {3b783116-30ca-4c0a-891d-27ae2e084aee}_OnDiskSnapshotProp
        • Path \??\Volume{5acfaf36-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{3b783116-30ca-4c0a-891d-27ae2e084aee}_OnDiskSnapshotProp
        • Size 5KB
        • SHA256 1796f5c709102fa454b73541784a299f278b1e046410b7797e2971bb461e188e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/508-142-0x00007FFD5EFD0000-0x00007FFD5FA06000-memory.dmp
        Download

        memory/1848-134-0x00000000747D0000-0x00000000748A5000-memory.dmp
        Download

        memory/2232-146-0x00007FFD5EFD0000-0x00007FFD5FA06000-memory.dmp
        Download

        memory/4840-151-0x00000000747D0000-0x00000000748A5000-memory.dmp
        Download