Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
09-10-2023 22:49
Static task
static1
Behavioral task
behavioral1
Sample
20a637cd6394c41636133b24d78d52a0e091c8012cee9dbf6c4060656f6c7cb7.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
20a637cd6394c41636133b24d78d52a0e091c8012cee9dbf6c4060656f6c7cb7.exe
Resource
win10v2004-20230915-en
General
-
Target
20a637cd6394c41636133b24d78d52a0e091c8012cee9dbf6c4060656f6c7cb7.exe
-
Size
65KB
-
MD5
269de662c8b796f35e614a1aa807d769
-
SHA1
43f32f0e0d952dba0bc2cb3c0657291f0930ec8a
-
SHA256
20a637cd6394c41636133b24d78d52a0e091c8012cee9dbf6c4060656f6c7cb7
-
SHA512
4d99243d079668e08342dc015e8f0749b452fd0ae4a1f7b7d047a1b499289ca6044691641db661f90978082e8262e43bcb6230f9e87e0f7f770d568d9b381009
-
SSDEEP
1536:CjNlIZUY1sIzYi7D10Py7kCZnA37TuPAn:JZUYxYID6DUnArTuC
Malware Config
Signatures
-
Jigsaw Ransomware
Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.
-
Executes dropped EXE 1 IoCs
Processes:
drpbx.exepid process 2840 drpbx.exe -
Loads dropped DLL 1 IoCs
Processes:
20a637cd6394c41636133b24d78d52a0e091c8012cee9dbf6c4060656f6c7cb7.exepid process 2268 20a637cd6394c41636133b24d78d52a0e091c8012cee9dbf6c4060656f6c7cb7.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
20a637cd6394c41636133b24d78d52a0e091c8012cee9dbf6c4060656f6c7cb7.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Windows\CurrentVersion\Run\firefox.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Frfx\\firefox.exe" 20a637cd6394c41636133b24d78d52a0e091c8012cee9dbf6c4060656f6c7cb7.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 icanhazip.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
20a637cd6394c41636133b24d78d52a0e091c8012cee9dbf6c4060656f6c7cb7.exedescription pid process target process PID 2268 wrote to memory of 2840 2268 20a637cd6394c41636133b24d78d52a0e091c8012cee9dbf6c4060656f6c7cb7.exe drpbx.exe PID 2268 wrote to memory of 2840 2268 20a637cd6394c41636133b24d78d52a0e091c8012cee9dbf6c4060656f6c7cb7.exe drpbx.exe PID 2268 wrote to memory of 2840 2268 20a637cd6394c41636133b24d78d52a0e091c8012cee9dbf6c4060656f6c7cb7.exe drpbx.exe PID 2268 wrote to memory of 2840 2268 20a637cd6394c41636133b24d78d52a0e091c8012cee9dbf6c4060656f6c7cb7.exe drpbx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\20a637cd6394c41636133b24d78d52a0e091c8012cee9dbf6c4060656f6c7cb7.exe"C:\Users\Admin\AppData\Local\Temp\20a637cd6394c41636133b24d78d52a0e091c8012cee9dbf6c4060656f6c7cb7.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe"C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe" C:\Users\Admin\AppData\Local\Temp\20a637cd6394c41636133b24d78d52a0e091c8012cee9dbf6c4060656f6c7cb7.exe2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Drpbx\drpbx.exeFilesize
65KB
MD5269de662c8b796f35e614a1aa807d769
SHA143f32f0e0d952dba0bc2cb3c0657291f0930ec8a
SHA25620a637cd6394c41636133b24d78d52a0e091c8012cee9dbf6c4060656f6c7cb7
SHA5124d99243d079668e08342dc015e8f0749b452fd0ae4a1f7b7d047a1b499289ca6044691641db661f90978082e8262e43bcb6230f9e87e0f7f770d568d9b381009
-
C:\Users\Admin\AppData\Local\Drpbx\drpbx.exeFilesize
65KB
MD5269de662c8b796f35e614a1aa807d769
SHA143f32f0e0d952dba0bc2cb3c0657291f0930ec8a
SHA25620a637cd6394c41636133b24d78d52a0e091c8012cee9dbf6c4060656f6c7cb7
SHA5124d99243d079668e08342dc015e8f0749b452fd0ae4a1f7b7d047a1b499289ca6044691641db661f90978082e8262e43bcb6230f9e87e0f7f770d568d9b381009
-
C:\Users\Admin\AppData\Local\Drpbx\drpbx.exeFilesize
65KB
MD5269de662c8b796f35e614a1aa807d769
SHA143f32f0e0d952dba0bc2cb3c0657291f0930ec8a
SHA25620a637cd6394c41636133b24d78d52a0e091c8012cee9dbf6c4060656f6c7cb7
SHA5124d99243d079668e08342dc015e8f0749b452fd0ae4a1f7b7d047a1b499289ca6044691641db661f90978082e8262e43bcb6230f9e87e0f7f770d568d9b381009
-
\Users\Admin\AppData\Local\Drpbx\drpbx.exeFilesize
65KB
MD5269de662c8b796f35e614a1aa807d769
SHA143f32f0e0d952dba0bc2cb3c0657291f0930ec8a
SHA25620a637cd6394c41636133b24d78d52a0e091c8012cee9dbf6c4060656f6c7cb7
SHA5124d99243d079668e08342dc015e8f0749b452fd0ae4a1f7b7d047a1b499289ca6044691641db661f90978082e8262e43bcb6230f9e87e0f7f770d568d9b381009
-
memory/2268-0-0x0000000074F80000-0x000000007552B000-memory.dmpFilesize
5.7MB
-
memory/2268-1-0x0000000074F80000-0x000000007552B000-memory.dmpFilesize
5.7MB
-
memory/2268-2-0x0000000000A60000-0x0000000000AA0000-memory.dmpFilesize
256KB
-
memory/2268-11-0x0000000074F80000-0x000000007552B000-memory.dmpFilesize
5.7MB
-
memory/2840-12-0x0000000074F80000-0x000000007552B000-memory.dmpFilesize
5.7MB
-
memory/2840-13-0x00000000009E0000-0x0000000000A20000-memory.dmpFilesize
256KB
-
memory/2840-14-0x0000000074F80000-0x000000007552B000-memory.dmpFilesize
5.7MB
-
memory/2840-15-0x0000000074F80000-0x000000007552B000-memory.dmpFilesize
5.7MB