Analysis
-
max time kernel
149s -
max time network
76s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
06-09-2022 13:14
Static task
static1
Behavioral task
behavioral1
Sample
992149ca2244ebd9ec96f01f29c73acce0dc5af609734077aea5978b5ce203a5.exe
Resource
win10-20220812-en
windows10-1703-x64
General
-
Target
992149ca2244ebd9ec96f01f29c73acce0dc5af609734077aea5978b5ce203a5.exe
-
Size
2.1MB
-
MD5
8cae61eff562d9b28d521900692bf516
-
SHA1
a38dd36172e145186b776bea4f5f2773504c68b0
-
SHA256
992149ca2244ebd9ec96f01f29c73acce0dc5af609734077aea5978b5ce203a5
-
SHA512
ff21a35638aaef98cf95e776d67a89cdf8ce98fd17f5f5ad52ed89ffa1b022f2e928061efb1543cbb112f750f6002ef62e08a68b7d047d19959acb06ffbc8565
-
SSDEEP
49152:amer6a3OsA3P+SJfWDzG5nEm6oPTOSi2z7BGsW:aHP3OP32SJODqKi6/IBGl
Malware Config
Signatures
-
Jigsaw Ransomware
Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.
-
Executes dropped EXE 1 IoCs
pid Process 3796 MicrosoftWordUpdate.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Run\update.exe = "C:\\Users\\Admin\\AppData\\Roaming\\MozillaFirefoxUpdate\\update.exe" 992149ca2244ebd9ec96f01f29c73acce0dc5af609734077aea5978b5ce203a5.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\rescache\_merged\4183903823\810424605.pri taskmgr.exe File created C:\Windows\rescache\_merged\1601268389\3877292338.pri taskmgr.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1756 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1756 taskmgr.exe Token: SeSystemProfilePrivilege 1756 taskmgr.exe Token: SeCreateGlobalPrivilege 1756 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3796 MicrosoftWordUpdate.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe 1756 taskmgr.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2704 wrote to memory of 3796 2704 992149ca2244ebd9ec96f01f29c73acce0dc5af609734077aea5978b5ce203a5.exe 66 PID 2704 wrote to memory of 3796 2704 992149ca2244ebd9ec96f01f29c73acce0dc5af609734077aea5978b5ce203a5.exe 66
Processes
-
C:\Users\Admin\AppData\Local\Temp\992149ca2244ebd9ec96f01f29c73acce0dc5af609734077aea5978b5ce203a5.exe"C:\Users\Admin\AppData\Local\Temp\992149ca2244ebd9ec96f01f29c73acce0dc5af609734077aea5978b5ce203a5.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\OfficeUpdate\MicrosoftWordUpdate.exe"C:\Users\Admin\AppData\Local\OfficeUpdate\MicrosoftWordUpdate.exe" C:\Users\Admin\AppData\Local\Temp\992149ca2244ebd9ec96f01f29c73acce0dc5af609734077aea5978b5ce203a5.exe2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
PID:3796
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1756
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD58cae61eff562d9b28d521900692bf516
SHA1a38dd36172e145186b776bea4f5f2773504c68b0
SHA256992149ca2244ebd9ec96f01f29c73acce0dc5af609734077aea5978b5ce203a5
SHA512ff21a35638aaef98cf95e776d67a89cdf8ce98fd17f5f5ad52ed89ffa1b022f2e928061efb1543cbb112f750f6002ef62e08a68b7d047d19959acb06ffbc8565
-
Filesize
2.1MB
MD58cae61eff562d9b28d521900692bf516
SHA1a38dd36172e145186b776bea4f5f2773504c68b0
SHA256992149ca2244ebd9ec96f01f29c73acce0dc5af609734077aea5978b5ce203a5
SHA512ff21a35638aaef98cf95e776d67a89cdf8ce98fd17f5f5ad52ed89ffa1b022f2e928061efb1543cbb112f750f6002ef62e08a68b7d047d19959acb06ffbc8565
-
Filesize
2.1MB
MD58cae61eff562d9b28d521900692bf516
SHA1a38dd36172e145186b776bea4f5f2773504c68b0
SHA256992149ca2244ebd9ec96f01f29c73acce0dc5af609734077aea5978b5ce203a5
SHA512ff21a35638aaef98cf95e776d67a89cdf8ce98fd17f5f5ad52ed89ffa1b022f2e928061efb1543cbb112f750f6002ef62e08a68b7d047d19959acb06ffbc8565