Analysis
-
max time kernel
202s -
max time network
205s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2023 08:32
Static task
static1
Behavioral task
behavioral1
Sample
youcant.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
General
-
Target
youcant.exe
-
Size
2.0MB
-
MD5
22f2d4f9682ddadacf4fd6ead172e125
-
SHA1
e9e6775d034c8c86218b95fe5de1455609aa5dc1
-
SHA256
9004e4161cc50ac62f76988aefe4504df4fd636d12708630e825e0c7b74cd12d
-
SHA512
f821d6d89807a698e67eef75943d4e590be924bce3a1fbdaa7507641bce222c014e721f96a8a1083dff3c7d9e4445f62420949f5e0b3b9a97e2721415161ba7b
-
SSDEEP
49152:Ye0jbW6GNjiSZTKAzkltDhTCcVX8saTtWycoJkqXfd+/9AH9783FGpv8EAQkcZ:YANuSZTKA0t9FFPEVJkqXf0Fi80kEXkc
Malware Config
Signatures
-
Jigsaw Ransomware
Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Control Panel\International\Geo\Nation youcant.exe -
Executes dropped EXE 3 IoCs
pid Process 4288 drpbx.exe 1368 firefox.exe 4712 firefox.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\firefox.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Frfx\\firefox.exe" youcant.exe Set value (str) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\firefox.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Frfx\\firefox.exe" firefox.exe Set value (str) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\firefox.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Frfx\\firefox.exe" firefox.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1092 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1092 taskmgr.exe Token: SeSystemProfilePrivilege 1092 taskmgr.exe Token: SeCreateGlobalPrivilege 1092 taskmgr.exe Token: SeSecurityPrivilege 1092 taskmgr.exe Token: SeTakeOwnershipPrivilege 1092 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe 1092 taskmgr.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4944 wrote to memory of 4288 4944 youcant.exe 83 PID 4944 wrote to memory of 4288 4944 youcant.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\youcant.exe"C:\Users\Admin\AppData\Local\Temp\youcant.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe"C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe" C:\Users\Admin\AppData\Local\Temp\youcant.exe2⤵
- Executes dropped EXE
PID:4288
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1092
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4340
-
C:\Users\Admin\AppData\Roaming\Frfx\firefox.exe"C:\Users\Admin\AppData\Roaming\Frfx\firefox.exe"1⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1368
-
C:\Users\Admin\AppData\Roaming\Frfx\firefox.exe"C:\Users\Admin\AppData\Roaming\Frfx\firefox.exe"1⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4712
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB
MD522f2d4f9682ddadacf4fd6ead172e125
SHA1e9e6775d034c8c86218b95fe5de1455609aa5dc1
SHA2569004e4161cc50ac62f76988aefe4504df4fd636d12708630e825e0c7b74cd12d
SHA512f821d6d89807a698e67eef75943d4e590be924bce3a1fbdaa7507641bce222c014e721f96a8a1083dff3c7d9e4445f62420949f5e0b3b9a97e2721415161ba7b
-
Filesize
2.0MB
MD522f2d4f9682ddadacf4fd6ead172e125
SHA1e9e6775d034c8c86218b95fe5de1455609aa5dc1
SHA2569004e4161cc50ac62f76988aefe4504df4fd636d12708630e825e0c7b74cd12d
SHA512f821d6d89807a698e67eef75943d4e590be924bce3a1fbdaa7507641bce222c014e721f96a8a1083dff3c7d9e4445f62420949f5e0b3b9a97e2721415161ba7b
-
Filesize
2.0MB
MD522f2d4f9682ddadacf4fd6ead172e125
SHA1e9e6775d034c8c86218b95fe5de1455609aa5dc1
SHA2569004e4161cc50ac62f76988aefe4504df4fd636d12708630e825e0c7b74cd12d
SHA512f821d6d89807a698e67eef75943d4e590be924bce3a1fbdaa7507641bce222c014e721f96a8a1083dff3c7d9e4445f62420949f5e0b3b9a97e2721415161ba7b
-
Filesize
1KB
MD5ce142db112eb084a845b51bba4046499
SHA124f28606441267f63679f056d895592c2e8943bd
SHA256a395e11ac859d80fdb3d7bc2bde33373e6479c803dde5d81a7ea05088826ce5c
SHA5125e036e4b724fb24252952f144b662b27b233fdf4b6296f19b3fb04b03bf77acccc8ff21201b1858379e51acba9c87d29deae8266a91d0d3cd2fc1d86cf44ecc4
-
Filesize
2.0MB
MD522f2d4f9682ddadacf4fd6ead172e125
SHA1e9e6775d034c8c86218b95fe5de1455609aa5dc1
SHA2569004e4161cc50ac62f76988aefe4504df4fd636d12708630e825e0c7b74cd12d
SHA512f821d6d89807a698e67eef75943d4e590be924bce3a1fbdaa7507641bce222c014e721f96a8a1083dff3c7d9e4445f62420949f5e0b3b9a97e2721415161ba7b
-
Filesize
2.0MB
MD522f2d4f9682ddadacf4fd6ead172e125
SHA1e9e6775d034c8c86218b95fe5de1455609aa5dc1
SHA2569004e4161cc50ac62f76988aefe4504df4fd636d12708630e825e0c7b74cd12d
SHA512f821d6d89807a698e67eef75943d4e590be924bce3a1fbdaa7507641bce222c014e721f96a8a1083dff3c7d9e4445f62420949f5e0b3b9a97e2721415161ba7b
-
Filesize
2.0MB
MD522f2d4f9682ddadacf4fd6ead172e125
SHA1e9e6775d034c8c86218b95fe5de1455609aa5dc1
SHA2569004e4161cc50ac62f76988aefe4504df4fd636d12708630e825e0c7b74cd12d
SHA512f821d6d89807a698e67eef75943d4e590be924bce3a1fbdaa7507641bce222c014e721f96a8a1083dff3c7d9e4445f62420949f5e0b3b9a97e2721415161ba7b