jigsaw | 14ee5fe40e76955ea27cc715dd5849f10ce7dc992c234db67467bbb1757aa8f9

General

Target

14ee5fe40e76955ea27cc715dd5849f10ce7dc992c234db67467bbb1757aa8f9.exe
Size

136KB
MD5

17f29268c9f1c5d5bca8b2b66cd1044c
SHA1

16273c67d772dccd1bc9d375b1c9ffa25e83129c
SHA256

14ee5fe40e76955ea27cc715dd5849f10ce7dc992c234db67467bbb1757aa8f9
SHA512

bd4d3f760de8225626f748f0168188d40c283b1a5525234cb8ff63621ff5f5952c6d6bf6de464485784641ff7aa08d89979ad000d26feb34f44fc231287ab1db
SSDEEP

3072:zPpF+jHgCl1YERTwBl2kZUYxYID6KN4WWEES:zRPK1YERTeIkZVxYgT

Score

10^/10

jigsaw persistence ransomware

Malware Config

Signatures

Jigsaw Ransomware
Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.
ransomware jigsaw
Executes dropped EXE 1 IoCs

Processes:

drpbx.exe

pid process

1368 drpbx.exe

pid	process
1368	drpbx.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

14ee5fe40e76955ea27cc715dd5849f10ce7dc992c234db67467bbb1757aa8f9.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Windows\CurrentVersion\Run\firefox.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Frfx\\firefox.exe"	14ee5fe40e76955ea27cc715dd5849f10ce7dc992c234db67467bbb1757aa8f9.exe

Drops file in Program Files directory 64 IoCs

Processes:

drpbx.exe

description	ioc	process
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_babypink_Thumbnail.bmp	drpbx.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\icon.png	drpbx.exe
File created	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Urban.xml.locked	drpbx.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\logo.png	drpbx.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	drpbx.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt	drpbx.exe
File opened for modification	C:\Program Files\Java\jre7\README.txt	drpbx.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_travel_Thumbnail.bmp	drpbx.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\THIRDPARTYLICENSEREADME.txt	drpbx.exe
File opened for modification	C:\Program Files\Java\jre7\lib\jfr.jar	drpbx.exe
File created	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Oriel.xml.locked	drpbx.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\Microsoft.Office.InfoPath.xml	drpbx.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	drpbx.exe
File opened for modification	C:\Program Files\Windows Media Player\Media Renderer\avtransport.xml	drpbx.exe
File created	C:\Program Files\7-Zip\Lang\is.txt.locked	drpbx.exe
File created	C:\Program Files\7-Zip\Lang\mr.txt.locked	drpbx.exe
File opened for modification	C:\Program Files\7-Zip\Lang\va.txt	drpbx.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\Media Renderer\connectionmanager_dmr.xml	drpbx.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsjpn.xml	drpbx.exe
File opened for modification	C:\Program Files\Java\jre7\lib\alt-rt.jar	drpbx.exe
File created	C:\Program Files\OpenReset.jpg.locked	drpbx.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	drpbx.exe
File created	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Grid.xml.locked	drpbx.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\ApothecaryNewsletter.dotx	drpbx.exe
File created	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Concourse.xml.locked	drpbx.exe
File created	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Elemental.xml.locked	drpbx.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\1033\Mso Example Intl Setup File B.txt	drpbx.exe
File created	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Solstice.xml.locked	drpbx.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\ExecutiveMergeLetter.dotx	drpbx.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ExecutiveReport.dotx.locked	drpbx.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	drpbx.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Psychedelic.jpg	drpbx.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\include\jdwpTransport.h	drpbx.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\jvmti.h.locked	drpbx.exe
File created	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Module.xml.locked	drpbx.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ApothecaryNewsletter.dotx.locked	drpbx.exe
File opened for modification	C:\Program Files\OpenReset.jpg	drpbx.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\ShadesOfBlue.jpg	drpbx.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_ButtonGraphic.png	drpbx.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Bears.jpg	drpbx.exe
File created	C:\Program Files\7-Zip\Lang\sq.txt.locked	drpbx.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsplk.xml	drpbx.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	drpbx.exe
File created	C:\Program Files\7-Zip\Lang\th.txt.locked	drpbx.exe
File opened for modification	C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color32.jpg	drpbx.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeulm.dat	drpbx.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\hwruksh.dat	drpbx.exe
File created	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Austin.xml.locked	drpbx.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	drpbx.exe
File opened for modification	C:\Program Files\7-Zip\Lang\br.txt	drpbx.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt	drpbx.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	drpbx.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\OrangeCircles.jpg	drpbx.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_SelectionSubpictureA.png	drpbx.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\sa-jdi.jar	drpbx.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\ENUtxt.pdf	drpbx.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Apex.xml	drpbx.exe
File created	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Essential.xml.locked	drpbx.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	drpbx.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\Filters.xml	drpbx.exe
File created	C:\Program Files\7-Zip\Lang\ca.txt.locked	drpbx.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\Office Word 2003 Look.dotx.locked	drpbx.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_VideoInset.png	drpbx.exe
File created	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Composite.xml.locked	drpbx.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

14ee5fe40e76955ea27cc715dd5849f10ce7dc992c234db67467bbb1757aa8f9.exe

description	pid	process	target process
PID 1672 wrote to memory of 1368	1672	14ee5fe40e76955ea27cc715dd5849f10ce7dc992c234db67467bbb1757aa8f9.exe	drpbx.exe
PID 1672 wrote to memory of 1368	1672	14ee5fe40e76955ea27cc715dd5849f10ce7dc992c234db67467bbb1757aa8f9.exe	drpbx.exe
PID 1672 wrote to memory of 1368	1672	14ee5fe40e76955ea27cc715dd5849f10ce7dc992c234db67467bbb1757aa8f9.exe	drpbx.exe

C:\Users\Admin\AppData\Local\Temp\14ee5fe40e76955ea27cc715dd5849f10ce7dc992c234db67467bbb1757aa8f9.exe
"C:\Users\Admin\AppData\Local\Temp\14ee5fe40e76955ea27cc715dd5849f10ce7dc992c234db67467bbb1757aa8f9.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1672

C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe
"C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe" C:\Users\Admin\AppData\Local\Temp\14ee5fe40e76955ea27cc715dd5849f10ce7dc992c234db67467bbb1757aa8f9.exe
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1368

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe
Filesize
136KB

MD5
17f29268c9f1c5d5bca8b2b66cd1044c

SHA1
16273c67d772dccd1bc9d375b1c9ffa25e83129c

SHA256
14ee5fe40e76955ea27cc715dd5849f10ce7dc992c234db67467bbb1757aa8f9

SHA512
bd4d3f760de8225626f748f0168188d40c283b1a5525234cb8ff63621ff5f5952c6d6bf6de464485784641ff7aa08d89979ad000d26feb34f44fc231287ab1db

Download Submit
C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe
Filesize
136KB

MD5
17f29268c9f1c5d5bca8b2b66cd1044c

SHA1
16273c67d772dccd1bc9d375b1c9ffa25e83129c

SHA256
14ee5fe40e76955ea27cc715dd5849f10ce7dc992c234db67467bbb1757aa8f9

SHA512
bd4d3f760de8225626f748f0168188d40c283b1a5525234cb8ff63621ff5f5952c6d6bf6de464485784641ff7aa08d89979ad000d26feb34f44fc231287ab1db

Download Submit
memory/1368-10-0x000007FEF5800000-0x000007FEF619D000-memory.dmp

Filesize
9.6MB

Download
memory/1368-11-0x0000000002100000-0x0000000002180000-memory.dmp

Filesize
512KB

Download
memory/1368-12-0x000007FEF5800000-0x000007FEF619D000-memory.dmp

Filesize
9.6MB

Download
memory/1368-13-0x000007FEF5800000-0x000007FEF619D000-memory.dmp

Filesize
9.6MB

Download
memory/1368-14-0x0000000002100000-0x0000000002180000-memory.dmp

Filesize
512KB

Download
memory/1672-2-0x000007FEF5800000-0x000007FEF619D000-memory.dmp

Filesize
9.6MB

Download
memory/1672-1-0x0000000001E10000-0x0000000001E90000-memory.dmp

Filesize
512KB

Download
memory/1672-0-0x000007FEF5800000-0x000007FEF619D000-memory.dmp

Filesize
9.6MB

Download
memory/1672-9-0x000007FEF5800000-0x000007FEF619D000-memory.dmp

Filesize
9.6MB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads