jigsaw | b3af58566437f83301cd884feaaa2c4b6c827498969a2abbe48afc03351facb3 | Triage

Resubmissions

09-10-2023 22:49

231009-2rx68aba24 10

05-11-2020 14:34

201105-wwra1hx6zn 10

Sharing

General

Target

b3af58566437f83301cd884feaaa2c4b6c827498969a2abbe48afc03351facb3
Size

41KB
Sample

231009-2rx68aba24
MD5

0efb06144ff6e9eb6bdc03fafa5167a7
SHA1

894bc02320d1308462ce004cf06e1bb1841d22c2
SHA256

b3af58566437f83301cd884feaaa2c4b6c827498969a2abbe48afc03351facb3
SHA512

a4e4f538ad17d32c63f5b6b5be26115931480544ca921bec09bbe0dcb0989455fb29a8ddd97c3e14b4b1250b9aa8b19aa0e0849fcf1dd57f2d3f934f7e973a96
SSDEEP

768:P/qD8gHkDXmFY26O92PdAIAabphLyUvQX9EmY17cefj:PYtNFY2noyvGp8HmN

Score

10^/10

jigsaw persistence ransomware spyware stealer

Malware Config

Targets

- Target
  
  b3af58566437f83301cd884feaaa2c4b6c827498969a2abbe48afc03351facb3
- Size
  
  41KB
- MD5
  
  0efb06144ff6e9eb6bdc03fafa5167a7
- SHA1
  
  894bc02320d1308462ce004cf06e1bb1841d22c2
- SHA256
  
  b3af58566437f83301cd884feaaa2c4b6c827498969a2abbe48afc03351facb3
- SHA512
  
  a4e4f538ad17d32c63f5b6b5be26115931480544ca921bec09bbe0dcb0989455fb29a8ddd97c3e14b4b1250b9aa8b19aa0e0849fcf1dd57f2d3f934f7e973a96
- SSDEEP
  
  768:P/qD8gHkDXmFY26O92PdAIAabphLyUvQX9EmY17cefj:PYtNFY2noyvGp8HmN
Score

10^/10

jigsaw persistence ransomware spyware stealer
- Jigsaw Ransomware
  Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.
  ransomware jigsaw
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

jigsawpersistenceransomwarespywarestealer

behavioral2

jigsawpersistenceransomwarespywarestealer