jigsaw | df049efbfa7ac0b76c8daff5d792c550c7a7a24f6e9e887d01a01013c9caa763

Analysis

max time kernel
99s
max time network
103s
platform
windows10-1703_x64
resource
win10-20230831-en
resource tags

arch:x64arch:x86image:win10-20230831-enlocale:en-usos:windows10-1703-x64system
submitted
11-09-2023 13:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

df049efbfa7ac0b76c8daff5d792c550c7a7a24f6e9e887d01a01013c9caa763.exe
Size

291KB
MD5

2fec9bf50de5395f799b23a1099b10d6
SHA1

6000969e75d7d7a3fa1b908bdb9d5daeb5f2534e
SHA256

df049efbfa7ac0b76c8daff5d792c550c7a7a24f6e9e887d01a01013c9caa763
SHA512

5f6885fb1940ee4f84507e2b7929f637d8f264a5c77329aeae31803b772608ea93370177017f90f6f8d8bc9e0b30eb8607ed120d4ead68104fd70feec71a9ab8
SSDEEP

6144:pdSK04ETTZ+4TBpvjLCnVlBpevKBauJirVuD05VSKJ:poL4EnU4T/vjLeVlayRihuA5D

Score

10^/10

jigsaw persistence ransomware

Malware Config

Signatures

Jigsaw Ransomware
Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.
ransomware jigsaw

Executes dropped EXE 1 IoCs

pid	Process
2820	drpbx.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3229154902-1540650024-2860248029-1000\Software\Microsoft\Windows\CurrentVersion\Run\firefox.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Frfx\\firefox.exe"	df049efbfa7ac0b76c8daff5d792c550c7a7a24f6e9e887d01a01013c9caa763.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	df049efbfa7ac0b76c8daff5d792c550c7a7a24f6e9e887d01a01013c9caa763.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	df049efbfa7ac0b76c8daff5d792c550c7a7a24f6e9e887d01a01013c9caa763.exe

Drops file in Program Files directory 30 IoCs

description	ioc	Process
File created	C:\Program Files\DenySearch.wma.zemblax	drpbx.exe
File opened for modification	C:\Program Files\SubmitExport.mp3	drpbx.exe
File created	C:\Program Files\WaitSkip.rtf.zemblax	drpbx.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	drpbx.exe
File created	C:\Program Files\7-Zip\License.txt.zemblax	drpbx.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	drpbx.exe
File created	C:\Program Files\ProtectRename.xlsx.zemblax	drpbx.exe
File created	C:\Program Files\RepairRemove.dot.zemblax	drpbx.exe
File opened for modification	C:\Program Files\WaitSkip.rtf	drpbx.exe
File opened for modification	C:\Program Files\Microsoft Office\ThinAppXManifest.xml	drpbx.exe
File created	C:\Program Files\Mozilla Firefox\private_browsing.VisualElementsManifest.xml.zemblax	drpbx.exe
File created	C:\Program Files\DenyCopy.jpeg.zemblax	drpbx.exe
File opened for modification	C:\Program Files\DenySearch.wma	drpbx.exe
File opened for modification	C:\Program Files\Microsoft Office\AppXManifest.xml	drpbx.exe
File opened for modification	C:\Program Files\Windows Defender\ThirdPartyNotices.txt	drpbx.exe
File opened for modification	C:\Program Files\DenyCopy.jpeg	drpbx.exe
File opened for modification	C:\Program Files\ProtectRename.xlsx	drpbx.exe
File opened for modification	C:\Program Files\RepairRemove.dot	drpbx.exe
File created	C:\Program Files\7-Zip\readme.txt.zemblax	drpbx.exe
File opened for modification	C:\Program Files\Microsoft Office\FileSystemMetadata.xml	drpbx.exe
File created	C:\Program Files\Mozilla Firefox\firefox.VisualElementsManifest.xml.zemblax	drpbx.exe
File opened for modification	C:\Program Files\Windows Defender\Defendericon.png	drpbx.exe
File created	C:\Program Files\SubmitExport.mp3.zemblax	drpbx.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	drpbx.exe
File created	C:\Program Files\7-Zip\History.txt.zemblax	drpbx.exe
File created	C:\Program Files\Microsoft Office\FileSystemMetadata.xml.zemblax	drpbx.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.VisualElementsManifest.xml	drpbx.exe
File created	C:\Program Files\Microsoft Office\AppXManifest.xml.zemblax	drpbx.exe
File created	C:\Program Files\Microsoft Office\ThinAppXManifest.xml.zemblax	drpbx.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.VisualElementsManifest.xml	drpbx.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly	df049efbfa7ac0b76c8daff5d792c550c7a7a24f6e9e887d01a01013c9caa763.exe
File created	C:\Windows\assembly\Desktop.ini	df049efbfa7ac0b76c8daff5d792c550c7a7a24f6e9e887d01a01013c9caa763.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	df049efbfa7ac0b76c8daff5d792c550c7a7a24f6e9e887d01a01013c9caa763.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4252	df049efbfa7ac0b76c8daff5d792c550c7a7a24f6e9e887d01a01013c9caa763.exe
Token: SeDebugPrivilege	2820	drpbx.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4252 wrote to memory of 2820	4252	df049efbfa7ac0b76c8daff5d792c550c7a7a24f6e9e887d01a01013c9caa763.exe	70
PID 4252 wrote to memory of 2820	4252	df049efbfa7ac0b76c8daff5d792c550c7a7a24f6e9e887d01a01013c9caa763.exe	70
PID 4252 wrote to memory of 2820	4252	df049efbfa7ac0b76c8daff5d792c550c7a7a24f6e9e887d01a01013c9caa763.exe	70

C:\Users\Admin\AppData\Local\Temp\df049efbfa7ac0b76c8daff5d792c550c7a7a24f6e9e887d01a01013c9caa763.exe
"C:\Users\Admin\AppData\Local\Temp\df049efbfa7ac0b76c8daff5d792c550c7a7a24f6e9e887d01a01013c9caa763.exe"
1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4252
- C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe
  "C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe" C:\Users\Admin\AppData\Local\Temp\df049efbfa7ac0b76c8daff5d792c550c7a7a24f6e9e887d01a01013c9caa763.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of AdjustPrivilegeToken
  PID:2820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe

Filesize
291KB

MD5
2fec9bf50de5395f799b23a1099b10d6

SHA1
6000969e75d7d7a3fa1b908bdb9d5daeb5f2534e

SHA256
df049efbfa7ac0b76c8daff5d792c550c7a7a24f6e9e887d01a01013c9caa763

SHA512
5f6885fb1940ee4f84507e2b7929f637d8f264a5c77329aeae31803b772608ea93370177017f90f6f8d8bc9e0b30eb8607ed120d4ead68104fd70feec71a9ab8

Download Submit
C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe

Filesize
291KB

MD5
2fec9bf50de5395f799b23a1099b10d6

SHA1
6000969e75d7d7a3fa1b908bdb9d5daeb5f2534e

SHA256
df049efbfa7ac0b76c8daff5d792c550c7a7a24f6e9e887d01a01013c9caa763

SHA512
5f6885fb1940ee4f84507e2b7929f637d8f264a5c77329aeae31803b772608ea93370177017f90f6f8d8bc9e0b30eb8607ed120d4ead68104fd70feec71a9ab8

Download Submit
memory/2820-339-0x0000000002310000-0x0000000002311000-memory.dmp

Filesize
4KB

Download
memory/2820-184-0x0000000000610000-0x0000000000620000-memory.dmp

Filesize
64KB

Download
memory/2820-343-0x0000000000610000-0x0000000000620000-memory.dmp

Filesize
64KB

Download
memory/2820-341-0x0000000000610000-0x0000000000620000-memory.dmp

Filesize
64KB

Download
memory/2820-342-0x0000000000610000-0x0000000000620000-memory.dmp

Filesize
64KB

Download
memory/2820-340-0x0000000073FC0000-0x0000000074570000-memory.dmp

Filesize
5.7MB

Download
memory/2820-345-0x0000000000610000-0x0000000000620000-memory.dmp

Filesize
64KB

Download
memory/2820-344-0x0000000000610000-0x0000000000620000-memory.dmp

Filesize
64KB

Download
memory/2820-181-0x0000000000610000-0x0000000000620000-memory.dmp

Filesize
64KB

Download
memory/2820-183-0x0000000000610000-0x0000000000620000-memory.dmp

Filesize
64KB

Download
memory/2820-179-0x0000000073FC0000-0x0000000074570000-memory.dmp

Filesize
5.7MB

Download
memory/2820-176-0x0000000000610000-0x0000000000620000-memory.dmp

Filesize
64KB

Download
memory/2820-175-0x0000000073FC0000-0x0000000074570000-memory.dmp

Filesize
5.7MB

Download
memory/2820-366-0x0000000000610000-0x0000000000620000-memory.dmp

Filesize
64KB

Download
memory/4252-23-0x0000000002760000-0x0000000002794000-memory.dmp

Filesize
208KB

Download
memory/4252-69-0x0000000002760000-0x0000000002794000-memory.dmp

Filesize
208KB

Download
memory/4252-31-0x0000000002760000-0x0000000002794000-memory.dmp

Filesize
208KB

Download
memory/4252-33-0x0000000002760000-0x0000000002794000-memory.dmp

Filesize
208KB

Download
memory/4252-35-0x0000000002760000-0x0000000002794000-memory.dmp

Filesize
208KB

Download
memory/4252-37-0x0000000002760000-0x0000000002794000-memory.dmp

Filesize
208KB

Download
memory/4252-39-0x0000000002760000-0x0000000002794000-memory.dmp

Filesize
208KB

Download
memory/4252-41-0x0000000002760000-0x0000000002794000-memory.dmp

Filesize
208KB

Download
memory/4252-43-0x0000000002760000-0x0000000002794000-memory.dmp

Filesize
208KB

Download
memory/4252-45-0x0000000002760000-0x0000000002794000-memory.dmp

Filesize
208KB

Download
memory/4252-47-0x0000000002760000-0x0000000002794000-memory.dmp

Filesize
208KB

Download
memory/4252-49-0x0000000002760000-0x0000000002794000-memory.dmp

Filesize
208KB

Download
memory/4252-51-0x0000000002760000-0x0000000002794000-memory.dmp

Filesize
208KB

Download
memory/4252-53-0x0000000002760000-0x0000000002794000-memory.dmp

Filesize
208KB

Download
memory/4252-55-0x0000000002760000-0x0000000002794000-memory.dmp

Filesize
208KB

Download
memory/4252-57-0x0000000002760000-0x0000000002794000-memory.dmp

Filesize
208KB

Download
memory/4252-59-0x0000000002760000-0x0000000002794000-memory.dmp

Filesize
208KB

Download
memory/4252-61-0x0000000002760000-0x0000000002794000-memory.dmp

Filesize
208KB

Download
memory/4252-63-0x0000000002760000-0x0000000002794000-memory.dmp

Filesize
208KB

Download
memory/4252-65-0x0000000002760000-0x0000000002794000-memory.dmp

Filesize
208KB

Download
memory/4252-67-0x0000000002760000-0x0000000002794000-memory.dmp

Filesize
208KB

Download
memory/4252-29-0x0000000002760000-0x0000000002794000-memory.dmp

Filesize
208KB

Download
memory/4252-71-0x0000000002760000-0x0000000002794000-memory.dmp

Filesize
208KB

Download
memory/4252-166-0x0000000005040000-0x0000000005041000-memory.dmp

Filesize
4KB

Download
memory/4252-27-0x0000000002760000-0x0000000002794000-memory.dmp

Filesize
208KB

Download
memory/4252-25-0x0000000002760000-0x0000000002794000-memory.dmp

Filesize
208KB

Download
memory/4252-174-0x0000000073FC0000-0x0000000074570000-memory.dmp

Filesize
5.7MB

Download
memory/4252-0-0x0000000073FC0000-0x0000000074570000-memory.dmp

Filesize
5.7MB

Download
memory/4252-21-0x0000000002760000-0x0000000002794000-memory.dmp

Filesize
208KB

Download
memory/4252-19-0x0000000002760000-0x0000000002794000-memory.dmp

Filesize
208KB

Download
memory/4252-17-0x0000000002760000-0x0000000002794000-memory.dmp

Filesize
208KB

Download
memory/4252-15-0x0000000002760000-0x0000000002794000-memory.dmp

Filesize
208KB

Download
memory/4252-13-0x0000000002760000-0x0000000002794000-memory.dmp

Filesize
208KB

Download
memory/4252-11-0x0000000002760000-0x0000000002794000-memory.dmp

Filesize
208KB

Download
memory/4252-7-0x0000000002760000-0x0000000002794000-memory.dmp

Filesize
208KB

Download
memory/4252-9-0x0000000002760000-0x0000000002794000-memory.dmp

Filesize
208KB

Download
memory/4252-8-0x00000000027A0000-0x00000000027B0000-memory.dmp

Filesize
64KB

Download
memory/4252-6-0x00000000027A0000-0x00000000027B0000-memory.dmp

Filesize
64KB

Download
memory/4252-5-0x00000000027A0000-0x00000000027B0000-memory.dmp

Filesize
64KB

Download
memory/4252-4-0x00000000027A0000-0x00000000027B0000-memory.dmp

Filesize
64KB

Download
memory/4252-3-0x0000000073FC0000-0x0000000074570000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads