Overview

overview

10

Static

static

Statement.pdf.msi

windows10-2004-x64

10

Resubmissions

19-07-2024 15:23

240719-ssp3ka1dng 10

09-10-2023 22:48

231009-2rhrjagh71 10

29-01-2023 17:46

230129-wchv4afh63 10

14-07-2022 07:49

220714-jn2fcsdbgr 10

Analysis

  • max time kernel
    360s
  • max time network
    328s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-01-2023 17:46

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Statement.pdf.msi

  • Size

    1.1MB

  • MD5

    a362de111d5dff6bcdeaf4717af268b6

  • SHA1

    2e5104db35871c5bc7da2035d8b91398bb5d5e0e

  • SHA256

    0921add95609d77f0c6195b2bec474b693ec217abb1db496f367c768bfbe7cca

  • SHA512

    b48a18158a0dff9a9012952c467fcf69b8bfc53ceeacaf32a90fc4b7f3afd34465e676b282fa87f3c5c85b4780baf96cc754dcdeef77ba5330fa8c4fd1d20b72

  • SSDEEP

    12288:w6yilXxt+i9uJB5XladYq15U+F54Sy3JItYzpm+zF4KSlgNY/k09L4:byKtb9gXdqjF54/JuOplFB09

Score
10/10
jigsawpersistenceransomwarespywarestealer

Malware Config

Signatures

  • Jigsaw Ransomware

    Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.

    ransomwarejigsaw
  • Executes dropped EXE 2 IoCs
  • Modifies extensions of user files 4 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 11 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 8 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 60 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Statement.pdf.msi
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:4796
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5008
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2868
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 4E1251CB70C8D061D340395B7B20D442
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2116
      • C:\Windows\SysWOW64\expand.exe
        "C:\Windows\System32\expand.exe" -R files.cab -F:* files
        3⤵
        • Drops file in Windows directory
        PID:980
      • C:\Users\Admin\AppData\Local\Temp\MW-1c7d3372-0671-462e-b1eb-37d7fad90d83\files\Wire_Transfer.docx.exe
        "C:\Users\Admin\AppData\Local\Temp\MW-1c7d3372-0671-462e-b1eb-37d7fad90d83\files\Wire_Transfer.docx.exe"
        3⤵
        • Executes dropped EXE
        • Checks computer location settings
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:3132
        • C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe
          "C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe" C:\Users\Admin\AppData\Local\Temp\MW-1c7d3372-0671-462e-b1eb-37d7fad90d83\files\Wire_Transfer.docx.exe
          4⤵
          • Executes dropped EXE
          • Modifies extensions of user files
          • Drops file in Program Files directory
          PID:4980
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 59E02762118F6A5EA55F77D34F49D254 E Global\MSI0000
      2⤵
      • Loads dropped DLL
      PID:1004
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:4120
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:684

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe
    Filesize

    282KB

    MD5

    fba7f5f58a53322d0b85cc588cfaacd1

    SHA1

    da2617cb96dd02a075565de6a704551fd7995dab

    SHA256

    1fccbea75b44bae2ba147cf63facbbcf1cc440af4de9bde9a6d8d2f32bde420a

    SHA512

    c9a4cb9076aeccff2cd1409dcdd8046ffa524ce768459443c2d69f21ef9c3fc899e2db19bed0377852e8e626436a80d9f192258e7e320fd3e252c0073eb762db

    Download Submit

  • C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe
    Filesize

    282KB

    MD5

    fba7f5f58a53322d0b85cc588cfaacd1

    SHA1

    da2617cb96dd02a075565de6a704551fd7995dab

    SHA256

    1fccbea75b44bae2ba147cf63facbbcf1cc440af4de9bde9a6d8d2f32bde420a

    SHA512

    c9a4cb9076aeccff2cd1409dcdd8046ffa524ce768459443c2d69f21ef9c3fc899e2db19bed0377852e8e626436a80d9f192258e7e320fd3e252c0073eb762db

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\MW-1c7d3372-0671-462e-b1eb-37d7fad90d83\files.cab
    Filesize

    282KB

    MD5

    807718ec27e1cdf76ea45291e0b73dcb

    SHA1

    43fd298dff26c7cc2180d5b198ef23e0c37d578e

    SHA256

    1001621d1b1d3cbba8d28644b24d7c4ff165c13ab2850661b3ed863efb6d1759

    SHA512

    a01444e070e6cbcf6b0aeb00c54469ea2dcf36e841c9179bb8a8d4c316000ebab6cef72cfe21467cf283bbed8372ce4787f60296c985ab831c49e3d18646da43

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\MW-1c7d3372-0671-462e-b1eb-37d7fad90d83\files\Wire_Transfer.docx.exe
    Filesize

    282KB

    MD5

    fba7f5f58a53322d0b85cc588cfaacd1

    SHA1

    da2617cb96dd02a075565de6a704551fd7995dab

    SHA256

    1fccbea75b44bae2ba147cf63facbbcf1cc440af4de9bde9a6d8d2f32bde420a

    SHA512

    c9a4cb9076aeccff2cd1409dcdd8046ffa524ce768459443c2d69f21ef9c3fc899e2db19bed0377852e8e626436a80d9f192258e7e320fd3e252c0073eb762db

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\MW-1c7d3372-0671-462e-b1eb-37d7fad90d83\files\Wire_Transfer.docx.exe
    Filesize

    282KB

    MD5

    fba7f5f58a53322d0b85cc588cfaacd1

    SHA1

    da2617cb96dd02a075565de6a704551fd7995dab

    SHA256

    1fccbea75b44bae2ba147cf63facbbcf1cc440af4de9bde9a6d8d2f32bde420a

    SHA512

    c9a4cb9076aeccff2cd1409dcdd8046ffa524ce768459443c2d69f21ef9c3fc899e2db19bed0377852e8e626436a80d9f192258e7e320fd3e252c0073eb762db

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\MW-1c7d3372-0671-462e-b1eb-37d7fad90d83\msiwrapper.ini
    Filesize

    513B

    MD5

    97113cd51ec86350ba9134e50a1d17b1

    SHA1

    9019e1fef73a88ed9d30279599156a98066e2008

    SHA256

    343fc704b04441ea05fdffa8752053053e2f23f03111db9027d7739d67d8b35f

    SHA512

    919fb94dfeaaf62f044ecd824c1680a97a4c657c64928b3cae73e1082d0f32346670e585632ff0811a5ab8b23fe12b4b5c57e9a180df697a97fa211965b96daf

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Frfx\firefox.exe
    Filesize

    282KB

    MD5

    fba7f5f58a53322d0b85cc588cfaacd1

    SHA1

    da2617cb96dd02a075565de6a704551fd7995dab

    SHA256

    1fccbea75b44bae2ba147cf63facbbcf1cc440af4de9bde9a6d8d2f32bde420a

    SHA512

    c9a4cb9076aeccff2cd1409dcdd8046ffa524ce768459443c2d69f21ef9c3fc899e2db19bed0377852e8e626436a80d9f192258e7e320fd3e252c0073eb762db

    Download Submit

  • C:\Windows\Installer\MSI349D.tmp
    Filesize

    601KB

    MD5

    ffe70d3419a64f4be1982d5cdf1155f4

    SHA1

    c62e03d533925c871cb9caac853a1d3a33f60f34

    SHA256

    8b590d235166ed734e376bcbb27491be8d5592682919e961ccac59b2aa19e909

    SHA512

    5b2fd2c6cd1a8087be74a2b7ac04fce728a83c413bb041541314c534978d825818b250f3e1b81b3eeb4835800c6d66d40e7d7fd56fb582bc92c10566cee83675

    Download Submit

  • C:\Windows\Installer\MSI349D.tmp
    Filesize

    601KB

    MD5

    ffe70d3419a64f4be1982d5cdf1155f4

    SHA1

    c62e03d533925c871cb9caac853a1d3a33f60f34

    SHA256

    8b590d235166ed734e376bcbb27491be8d5592682919e961ccac59b2aa19e909

    SHA512

    5b2fd2c6cd1a8087be74a2b7ac04fce728a83c413bb041541314c534978d825818b250f3e1b81b3eeb4835800c6d66d40e7d7fd56fb582bc92c10566cee83675

    Download Submit

  • C:\Windows\Installer\MSI4364.tmp
    Filesize

    601KB

    MD5

    ffe70d3419a64f4be1982d5cdf1155f4

    SHA1

    c62e03d533925c871cb9caac853a1d3a33f60f34

    SHA256

    8b590d235166ed734e376bcbb27491be8d5592682919e961ccac59b2aa19e909

    SHA512

    5b2fd2c6cd1a8087be74a2b7ac04fce728a83c413bb041541314c534978d825818b250f3e1b81b3eeb4835800c6d66d40e7d7fd56fb582bc92c10566cee83675

    Download Submit

  • C:\Windows\Installer\MSI4364.tmp
    Filesize

    601KB

    MD5

    ffe70d3419a64f4be1982d5cdf1155f4

    SHA1

    c62e03d533925c871cb9caac853a1d3a33f60f34

    SHA256

    8b590d235166ed734e376bcbb27491be8d5592682919e961ccac59b2aa19e909

    SHA512

    5b2fd2c6cd1a8087be74a2b7ac04fce728a83c413bb041541314c534978d825818b250f3e1b81b3eeb4835800c6d66d40e7d7fd56fb582bc92c10566cee83675

    Download Submit

  • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
    Filesize

    23.0MB

    MD5

    72e0c9e5055907cf0b13830f61a2f153

    SHA1

    8143bbd10d0c00eacc3ece648543f65991209c3c

    SHA256

    36f192fce0364d2548cd0f806c2b304171ab1766fc2ee0eb0e7c83ad4d31af60

    SHA512

    1f8e4d99d47ee742e5978e11f8d82aee54b7bab3a8680cd1762ec4cedb3b7ae7e58c9b19d1b2069be60345f5d4fa31bfb36de07027fe243e150a80af78a98dd0

    Download Submit

  • \??\Volume{2fb4ccdc-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{51a88207-4b92-416d-8803-a7cfae8615ba}_OnDiskSnapshotProp
    Filesize

    5KB

    MD5

    4cc6cc1a7322a86bac1516128c836918

    SHA1

    e66769b23d64085aff74a9e8c0f07b5764d3bbb2

    SHA256

    ebe9b273820ce5347f80d1685af743b35738dfedbf3e1f61bd3c061ebac2b056

    SHA512

    f6480e88c0470d67c048a3766e5564ae5c055eac52b8945e3e75bb04e16d5c23fed506be8a2e36164352c33bcadfa31be2618ef2861920a4382e80ffa3326f61

    Download Submit

  • memory/2116-138-0x00000000744B0000-0x0000000074585000-memory.dmp

    Filesize

    852KB

    Download

  • memory/3132-142-0x00007FFE96420000-0x00007FFE96E56000-memory.dmp

    Filesize

    10.2MB

    Download

  • memory/4980-147-0x00007FFE96420000-0x00007FFE96E56000-memory.dmp

    Filesize

    10.2MB

    Download