����Ղ�˪a"Lr�y9�����b���Xq�*�;}6�V~�G���YP���o�(g����(C|�Ĭ��O��m6lp��y`���XJ.E���ҽ���x���iB��m��cO���fvV�I���w�c�1�����4���e��X�J��7x����jL�]e��@�����W���|��\_3Ź��� ���\�5�+�U�� ��#��/��y�٢#c��cQ���^��FӥxK���ډm�e�J묺�L�:�4�i�����e�r#D�f*צ���[�컁��>�l8��}[Ξ�h�n��<[��DW%'���Jd��y��kw�1��U����Ł��;3X�دfSKŬ��jGs�GM�ѝ)�������@n�h)�E��ϊX)�e����4�1_P�B.0�Ђ�I�wj�[;�g'wp�z��!�K����k6�fS(�DLƎkb���`�Hi�}q� ��`<}Hɼ���AJ��線ş�~��<�r���b-�^=B�ܠ[�����e���T:��M�G�ʞt Z+�������d��P�G`��*N[W]|����m����N1q$S����AL�y�w�g��'@�_���0���-�����ؒr4��uL'h3�0#��&֗��8�X[� ��%��F~ �ȧ5�W߶B��4�R�5p�M��� ��v?l� }��%H��I"�!�OU��-6$FO�����N��gH��)�q�`h;8���m��BHή��u���O�6��n�m��O+��[cd�֞��P��;���D&[j����<���ַ�[!������:M^�0:oUa�f���5�V �V;�*�-kL)CK��OB����֭�(�^kS��=y�n���#���'~��:�-)ᣐ}Gpr��gw�1 |�A��S���!#����?��mS���� ����' ��P=7ޒ��;4���M���A����rz!�~� .�O��B�<��n��[���O�$���[]�������@�f��B=�5v�Gϰ���ZDJ6P�Ͱ�JI� #ix��-�f�w�[��� �j@g�-&��w�!N�Y�V�wo��\ u��)"O����V\Q��"����w��ֶ��U<Q@���̨a�j;I֍m���k��k�cr &xR'� 0�A��b��a��A$t�l����si��|���pQ~&v{��X�5L_�lQX����s��<�Q IBx������;�o�#�C��9f(���[O�ǩR���8��Q"�NQ�N |}� �Z��LEP���6�\|y��Ᏺ�il�c��;j��r�McY�=C8Kh����x� �k�d��~�� ��jԑ��(ǹndd$�݀����~ r��?������s.��6l�߂�/Җ��Ջ-�b?*O�Y\v&�������Ti2�D��������[g_�?������ N���)��F�JW���=B�Ż�+��UP�����(E4^��=3%�)����=w8��=�)U�e0 �k�xP�_.yĺ�8i$?K[�'!���y,�T���O_Q�AӍ�n���7��<t�5q5L��C�٬����ǚLI�Jv 7څ�7؝��>HTW+�otη<�05*-D�v0�W�m��z�#~�X�E#�I�gjd��N��X�`�}� A#�9��N�B��f tOtdDx~]�)�� �[4#Լ�Q����T�-����6|��i��C��e��\E���M�5D�g"&.�[P6�W��0�����yYvV�� O�G�{�[��S4�D��@� %�Ia{4���-*B���t� ���t�d��-7"� �,"x�a�.0����Fڅ�`%�'J!Vc�b&%˛�嚡@� �D $x��P/m�y ��r�4<C�Ԩ� ����;�z��m�L��R��;IJmT����,�^��i{�P� �tе�p\��(�J�[h��")z�*;N��+��z��H�aʻv�=![R��Ն��%��#���=��z�#*�fUe����7��;M5A7��ݵ�w�ş.v��[ �2P<,�\������[zO0`;�]�|J{p-N���Xlʡ���//��g����p�v������6��"�yF�l�]ec��&$䤅^��%)����a������3Ɋ�N��eTܚ�l�Y�oBҦ�Yh�� �r�y{��-�醎)�����˽�!�1�嘑���;!�Y����9��[* ht!wÊ �G��J�#|�Xi���P��Թ��ۄ�l���1�8�#{݃1�\Dйs��X��ʙ?p3x��y4�K"�Te���W�z������aU`Q�C�\QN,��D# ��h;sB��ұ[�ϕ&��ݞ��& �w_J�4x�^l�e� �o+%�H�[H8�|�ND�'�b{�פnJf����"���[d��0����`�� ̤K9���P%�J�+fb53����������o�Q�,˳^����'W��SM�]5!�!�u�����+�ns4���*�������¼�~�Z���Pj��߬��M��n gx��)?Ttn �yl�.����37�~�?��5Z�g>��rz�6��m� �:#���1�P4��n}o'�\��c��O2||��pE��NJl�MC����Pz�x�V���#��*�=0�����V��?5k;y�?�f���QX�Q�-�U��ە�e���'��)������+7gPoe.8����^�)׃�������_�!���bHD�BM���X���Y.Gp��Y��,F"�|=-�a)�T���h��UZ�p"ݍ?T0Zy2�r��9S� �� ��/Sz�~��Ɍ8�!;�/��#pC�a���n���C&d��N���1ބ2f�!ة�$o �'�RJ���# �N)�i]Cb�eqU�JK�����;J�W���ui���LH�ü�A?�~t#wT�-�`���:kt��/ь��k��d��-�k�[R��c��"�V�U�v~r�S��)��+�%Z�������7H\��z��NoT�a$=�C'�9u84)b,MB H���A�Z4d���yXQ��v3�O��P�W�%�D�<��[Nc�*�������l�
Static task
static1
Behavioral task
behavioral1
Sample
JiggyCleaner.exe
Resource
win10v2004-20230220-en
General
-
Target
JiggyCleaner.exe
-
Size
6.6MB
-
MD5
4a82b571bbc037fac6680d74ad47859e
-
SHA1
23058b67453fd887aa7d5fd89306e0c3d1eea094
-
SHA256
293a0f907a143044f3de2ac01455017115b83f9ad6a85738232e5e800920745a
-
SHA512
6f389ea30951ce67c32da3c80bed657315e736b644544f20f23f9ba4291afc09ee8ce90f4b46462aca05604a6e95e36fcb440176ce92af1639c9424cd6305923
-
SSDEEP
196608:JNj/9OaO47VbE6M8eg8Bv0C2tFyzM6po:JSpSbBAg8J2tEzMmo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JiggyCleaner.exe
Files
-
JiggyCleaner.exe.exe windows x64
7b88ea406f78e93a5f0afe04a05eebfd
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
RtlLookupFunctionEntry
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
advapi32
RegSetValueExW
msvcp140
?_Xlength_error@std@@YAXPEBD@Z
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memmove
api-ms-win-crt-runtime-l1-1-0
__p___argv
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-stdio-l1-1-0
__p__commode
api-ms-win-crt-conio-l1-1-0
_getch
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
user32
CharUpperBuffW
Exports
Exports
Sections
.text Size: - Virtual size: 861KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 150KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.(/s Size: - Virtual size: 4.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.I09 Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.x3j Size: 6.6MB - Virtual size: 6.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 216B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ