Analysis
-
max time kernel
95s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
27-10-2022 04:15
Static task
static1
Behavioral task
behavioral1
Sample
9f3c538a1118f82d49a993967c520be4c7f14ad994eb17c4d778e5d7f32241a7.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
9f3c538a1118f82d49a993967c520be4c7f14ad994eb17c4d778e5d7f32241a7.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
9f3c538a1118f82d49a993967c520be4c7f14ad994eb17c4d778e5d7f32241a7.exe
-
Size
421KB
-
MD5
1ff8649e8f8d0652d583b9a648161d3f
-
SHA1
3441ff983221742ed460f8310e49203b5dc59a15
-
SHA256
9f3c538a1118f82d49a993967c520be4c7f14ad994eb17c4d778e5d7f32241a7
-
SHA512
ff67f2584c3646506ad346bac71676e6dd3923e14136e31613cc4bc6a67fe221e4520c034b7ce8c64a4cf2d5ac18e9c083e5e1a630c211cc29ff78d7685a226d
-
SSDEEP
12288:2w1pOfl/oUzs8vwfzNquSgkE9tSF/aXx:3po/oUNwfpqVrktOc
Score
10/10
Malware Config
Signatures
-
Jigsaw Ransomware
Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.
-
Executes dropped EXE 1 IoCs
pid Process 1372 drpbx.exe -
Modifies extensions of user files 6 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File created C:\Users\Admin\Pictures\MountRegister.raw.fun drpbx.exe File created C:\Users\Admin\Pictures\RedoClose.raw.fun drpbx.exe File created C:\Users\Admin\Pictures\ResolveGet.tif.fun drpbx.exe File created C:\Users\Admin\Pictures\RestartSkip.tif.fun drpbx.exe File created C:\Users\Admin\Pictures\CompareSuspend.png.fun drpbx.exe File created C:\Users\Admin\Pictures\JoinDismount.raw.fun drpbx.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\firefox.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Frfx\\firefox.exe" 9f3c538a1118f82d49a993967c520be4c7f14ad994eb17c4d778e5d7f32241a7.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_sent.gif drpbx.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.nl_zh_4.4.0.v20140623020002.jar.fun drpbx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-profiler.xml drpbx.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ef8c08_256x240.png.fun drpbx.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Full\pushplaysubpicture.png drpbx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\win32\jawt_md.h drpbx.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-waning-crescent_partly-cloudy.png drpbx.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_browser.gif drpbx.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\TipsImageMask.bmp.fun drpbx.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\images\delete_over.png drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\be.txt drpbx.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Microsoft.BusinessData.xml.fun drpbx.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrenclm.dat drpbx.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\gadget.xml drpbx.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_GreenTea.gif.fun drpbx.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\heart_glass_Thumbnail.bmp drpbx.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_double_orange.png drpbx.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\dial.png drpbx.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\js\library.js drpbx.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_FileOffMask.bmp.fun drpbx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPBlue.png drpbx.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\drag.png drpbx.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Waveform.xml drpbx.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.batik.util_1.7.0.v201011041433.jar.fun drpbx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-application-views.xml drpbx.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\validation.js.fun drpbx.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-ui_ja.jar.fun drpbx.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_rightarrow.png drpbx.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\CircleSubpicture.png drpbx.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\11.png drpbx.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\graph_up.png drpbx.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_MediumMAsk.bmp drpbx.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\dialdot_lrg.png drpbx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.nl_zh_4.4.0.v20140623020002.jar drpbx.exe File opened for modification C:\Program Files\Windows Media Player\Network Sharing\ContentDirectory.xml drpbx.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\logo.png drpbx.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationLeft_ButtonGraphic.png drpbx.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_corner_top_right.png drpbx.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\1.png drpbx.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.docs_5.5.0.165303.jar.fun drpbx.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\js\localizedStrings.js drpbx.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-sa.jar.fun drpbx.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationUp_SelectionSubpicture.png drpbx.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\resources.jar.fun drpbx.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_box_left.png drpbx.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormToolImages.jpg.fun drpbx.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\Tulip.jpg drpbx.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_gray_cloudy.png drpbx.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\splash.gif.fun drpbx.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.win32.x86_64.nl_zh_4.4.0.v20140623020002.jar.fun drpbx.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\en-US\js\timeZones.js drpbx.exe File created C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\Microsoft.Office.InfoPath.xml.fun drpbx.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bNext.png drpbx.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\prev_down.png drpbx.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\js\settings.js drpbx.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_center.gif.fun drpbx.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\background.gif.fun drpbx.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-annotations-common.xml.fun drpbx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-awt.xml drpbx.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\helpmap.txt drpbx.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\validation.js drpbx.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\console_view.png.fun drpbx.exe File created C:\Program Files\Microsoft Office\Office14\Mso Example Setup File A.txt.fun drpbx.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\dial_lrg.png drpbx.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1100 wrote to memory of 1372 1100 9f3c538a1118f82d49a993967c520be4c7f14ad994eb17c4d778e5d7f32241a7.exe 28 PID 1100 wrote to memory of 1372 1100 9f3c538a1118f82d49a993967c520be4c7f14ad994eb17c4d778e5d7f32241a7.exe 28 PID 1100 wrote to memory of 1372 1100 9f3c538a1118f82d49a993967c520be4c7f14ad994eb17c4d778e5d7f32241a7.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\9f3c538a1118f82d49a993967c520be4c7f14ad994eb17c4d778e5d7f32241a7.exe"C:\Users\Admin\AppData\Local\Temp\9f3c538a1118f82d49a993967c520be4c7f14ad994eb17c4d778e5d7f32241a7.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe"C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe" C:\Users\Admin\AppData\Local\Temp\9f3c538a1118f82d49a993967c520be4c7f14ad994eb17c4d778e5d7f32241a7.exe2⤵
- Executes dropped EXE
- Modifies extensions of user files
- Drops file in Program Files directory
PID:1372
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
421KB
MD51ff8649e8f8d0652d583b9a648161d3f
SHA13441ff983221742ed460f8310e49203b5dc59a15
SHA2569f3c538a1118f82d49a993967c520be4c7f14ad994eb17c4d778e5d7f32241a7
SHA512ff67f2584c3646506ad346bac71676e6dd3923e14136e31613cc4bc6a67fe221e4520c034b7ce8c64a4cf2d5ac18e9c083e5e1a630c211cc29ff78d7685a226d
-
Filesize
421KB
MD51ff8649e8f8d0652d583b9a648161d3f
SHA13441ff983221742ed460f8310e49203b5dc59a15
SHA2569f3c538a1118f82d49a993967c520be4c7f14ad994eb17c4d778e5d7f32241a7
SHA512ff67f2584c3646506ad346bac71676e6dd3923e14136e31613cc4bc6a67fe221e4520c034b7ce8c64a4cf2d5ac18e9c083e5e1a630c211cc29ff78d7685a226d