Analysis
-
max time kernel
175s -
max time network
174s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
27-04-2023 01:39
Static task
static1
Behavioral task
behavioral1
Sample
youcant.exe
Resource
win10v2004-20230220-en
General
-
Target
youcant.exe
-
Size
2.0MB
-
MD5
22f2d4f9682ddadacf4fd6ead172e125
-
SHA1
e9e6775d034c8c86218b95fe5de1455609aa5dc1
-
SHA256
9004e4161cc50ac62f76988aefe4504df4fd636d12708630e825e0c7b74cd12d
-
SHA512
f821d6d89807a698e67eef75943d4e590be924bce3a1fbdaa7507641bce222c014e721f96a8a1083dff3c7d9e4445f62420949f5e0b3b9a97e2721415161ba7b
-
SSDEEP
49152:Ye0jbW6GNjiSZTKAzkltDhTCcVX8saTtWycoJkqXfd+/9AH9783FGpv8EAQkcZ:YANuSZTKA0t9FFPEVJkqXf0Fi80kEXkc
Malware Config
Signatures
-
Jigsaw Ransomware
Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
youcant.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation youcant.exe -
Executes dropped EXE 1 IoCs
Processes:
drpbx.exepid process 3488 drpbx.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
youcant.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\firefox.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Frfx\\firefox.exe" youcant.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
taskmgr.exepid process 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
taskmgr.exedescription pid process Token: SeDebugPrivilege 2196 taskmgr.exe Token: SeSystemProfilePrivilege 2196 taskmgr.exe Token: SeCreateGlobalPrivilege 2196 taskmgr.exe -
Suspicious use of FindShellTrayWindow 32 IoCs
Processes:
taskmgr.exepid process 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe -
Suspicious use of SendNotifyMessage 32 IoCs
Processes:
taskmgr.exepid process 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe 2196 taskmgr.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
youcant.exedescription pid process target process PID 1176 wrote to memory of 3488 1176 youcant.exe drpbx.exe PID 1176 wrote to memory of 3488 1176 youcant.exe drpbx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\youcant.exe"C:\Users\Admin\AppData\Local\Temp\youcant.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe"C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe" C:\Users\Admin\AppData\Local\Temp\youcant.exe2⤵
- Executes dropped EXE
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Drpbx\drpbx.exeFilesize
2.0MB
MD522f2d4f9682ddadacf4fd6ead172e125
SHA1e9e6775d034c8c86218b95fe5de1455609aa5dc1
SHA2569004e4161cc50ac62f76988aefe4504df4fd636d12708630e825e0c7b74cd12d
SHA512f821d6d89807a698e67eef75943d4e590be924bce3a1fbdaa7507641bce222c014e721f96a8a1083dff3c7d9e4445f62420949f5e0b3b9a97e2721415161ba7b
-
C:\Users\Admin\AppData\Local\Drpbx\drpbx.exeFilesize
2.0MB
MD522f2d4f9682ddadacf4fd6ead172e125
SHA1e9e6775d034c8c86218b95fe5de1455609aa5dc1
SHA2569004e4161cc50ac62f76988aefe4504df4fd636d12708630e825e0c7b74cd12d
SHA512f821d6d89807a698e67eef75943d4e590be924bce3a1fbdaa7507641bce222c014e721f96a8a1083dff3c7d9e4445f62420949f5e0b3b9a97e2721415161ba7b
-
C:\Users\Admin\AppData\Local\Drpbx\drpbx.exeFilesize
2.0MB
MD522f2d4f9682ddadacf4fd6ead172e125
SHA1e9e6775d034c8c86218b95fe5de1455609aa5dc1
SHA2569004e4161cc50ac62f76988aefe4504df4fd636d12708630e825e0c7b74cd12d
SHA512f821d6d89807a698e67eef75943d4e590be924bce3a1fbdaa7507641bce222c014e721f96a8a1083dff3c7d9e4445f62420949f5e0b3b9a97e2721415161ba7b
-
C:\Users\Admin\AppData\Roaming\Frfx\firefox.exeFilesize
2.0MB
MD522f2d4f9682ddadacf4fd6ead172e125
SHA1e9e6775d034c8c86218b95fe5de1455609aa5dc1
SHA2569004e4161cc50ac62f76988aefe4504df4fd636d12708630e825e0c7b74cd12d
SHA512f821d6d89807a698e67eef75943d4e590be924bce3a1fbdaa7507641bce222c014e721f96a8a1083dff3c7d9e4445f62420949f5e0b3b9a97e2721415161ba7b
-
memory/1176-133-0x000001A75CB10000-0x000001A75CD12000-memory.dmpFilesize
2.0MB
-
memory/2196-150-0x0000016D3A560000-0x0000016D3A561000-memory.dmpFilesize
4KB
-
memory/2196-149-0x0000016D3A560000-0x0000016D3A561000-memory.dmpFilesize
4KB
-
memory/2196-156-0x0000016D3A560000-0x0000016D3A561000-memory.dmpFilesize
4KB
-
memory/2196-155-0x0000016D3A560000-0x0000016D3A561000-memory.dmpFilesize
4KB
-
memory/2196-159-0x0000016D3A560000-0x0000016D3A561000-memory.dmpFilesize
4KB
-
memory/2196-158-0x0000016D3A560000-0x0000016D3A561000-memory.dmpFilesize
4KB
-
memory/2196-157-0x0000016D3A560000-0x0000016D3A561000-memory.dmpFilesize
4KB
-
memory/2196-154-0x0000016D3A560000-0x0000016D3A561000-memory.dmpFilesize
4KB
-
memory/2196-160-0x0000016D3A560000-0x0000016D3A561000-memory.dmpFilesize
4KB
-
memory/2196-148-0x0000016D3A560000-0x0000016D3A561000-memory.dmpFilesize
4KB