Overview

overview

10

Static

static

3

cats.exe

windows7-x64

10

cats.exe

windows10-2004-x64

10

Resubmissions

09-10-2023 22:49

231009-2rxkpagh8y 10

30-03-2021 09:40

210330-ae6xfbdjpn 10

30-03-2021 09:36

210330-23qa4tgj4n 10

29-03-2021 16:32

210329-8v5z5a82en 10

Analysis

  • max time kernel
    150s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    09-10-2023 22:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    cats.exe

  • Size

    126KB

  • MD5

    e0d108435c58dc9403588e4dcab68275

  • SHA1

    7a7331423938020550ff3decd2e8b50b3ee5c87a

  • SHA256

    61cd0131cb4bf090c5ee7761566f6f7a778e78b37d220f0506f98632a2663ee8

  • SHA512

    2a5648ced91b75d928b4d71a8580c5bee75a5f27623f8c5071cd23b8cd85eaa8129ddb0aaf0a1fcca05fb1b7868a0fcd9306e9ddf2d3eaaf605c41cc7fde4a9e

  • SSDEEP

    3072:7+gYdgLNp0jPilel4+800N1lknzRxqmhda40U6hrnzRxqmhda40U6hK:6gvunnhdaLlrnnhdaLl

Score
10/10
jigsawpersistenceransomwarespywarestealer

Malware Config

Signatures

  • Jigsaw Ransomware

    Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.

    ransomwarejigsaw
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cats.exe
    "C:\Users\Admin\AppData\Local\Temp\cats.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2840
    • C:\Users\Admin\AppData\Local\Google (x86)\Chrome32.exe
      "C:\Users\Admin\AppData\Local\Google (x86)\Chrome32.exe" C:\Users\Admin\AppData\Local\Temp\cats.exe
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      PID:2628

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\invalid32x32.gif.cat
    Filesize

    160B

    MD5

    a8258060e35cd08265a3f658e6aa2963

    SHA1

    a67c6aeb6db7a488c84810feea22a2d6f7be9bc8

    SHA256

    e847f277e6adf5f94573c0f1b10ac15efd6ca48f34f9be52e9baec6e1f1de04b

    SHA512

    70ecf38aa25d92ffff7a24ea35c467c95b9a22dfdc99e0705d56527923cda574add21987ab98ae2b8c589e334141d6957a660a3e34a546c764c3e42069f50d45

    Download Submit
  • C:\Users\Admin\AppData\Local\Google (x86)\Chrome32.exe
    Filesize

    126KB

    MD5

    e0d108435c58dc9403588e4dcab68275

    SHA1

    7a7331423938020550ff3decd2e8b50b3ee5c87a

    SHA256

    61cd0131cb4bf090c5ee7761566f6f7a778e78b37d220f0506f98632a2663ee8

    SHA512

    2a5648ced91b75d928b4d71a8580c5bee75a5f27623f8c5071cd23b8cd85eaa8129ddb0aaf0a1fcca05fb1b7868a0fcd9306e9ddf2d3eaaf605c41cc7fde4a9e

    Download Submit
  • C:\Users\Admin\AppData\Local\Google (x86)\Chrome32.exe
    Filesize

    126KB

    MD5

    e0d108435c58dc9403588e4dcab68275

    SHA1

    7a7331423938020550ff3decd2e8b50b3ee5c87a

    SHA256

    61cd0131cb4bf090c5ee7761566f6f7a778e78b37d220f0506f98632a2663ee8

    SHA512

    2a5648ced91b75d928b4d71a8580c5bee75a5f27623f8c5071cd23b8cd85eaa8129ddb0aaf0a1fcca05fb1b7868a0fcd9306e9ddf2d3eaaf605c41cc7fde4a9e

    Download Submit
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\container.dat.cat
    Filesize

    16B

    MD5

    a2ec71f236b0da26c756b086bd502f09

    SHA1

    e9dc21e143a2aba3ca9eb634ed291ddf93b32e4b

    SHA256

    b4805a7f3e187212efacd5c2475bc8a30ce7274f8dae65858537a7f08b866717

    SHA512

    a1d0f50c760c9bc3ab50053633e2fd3bdca6d0de8f256b48b5c45c8bc20a93a7e2123b09c8ce5de3c9ef013d0f2c3de165d68f7748c89d629122ae6d498e9af3

    Download Submit
  • C:\Users\Admin\AppData\Roaming\System32Work\EncryptedFileList.txt
    Filesize

    183KB

    MD5

    9170cc26aaae5e760890b59a07cf476a

    SHA1

    f0057aed9e8e76f0c8f881e5f9e6fe080356f762

    SHA256

    ffb8093ca0ebc0fe273e464d2c7338fd35f48d36f4a05212716660e54b26c4e8

    SHA512

    000d0bd066e063545dc189ff9b5b8f97a753d7999007941fa1c0bda281ef2c290351bb0dfb38130ffdd052299c9f913707e8dec4e753fde321eceef029aff73f

    Download Submit
  • memory/2628-8-0x000007FEF5490000-0x000007FEF5E2D000-memory.dmp
    Filesize

    9.6MB

    Download
  • memory/2628-10-0x000007FEF5490000-0x000007FEF5E2D000-memory.dmp
    Filesize

    9.6MB

    Download
  • memory/2628-11-0x000007FEF5490000-0x000007FEF5E2D000-memory.dmp
    Filesize

    9.6MB

    Download
  • memory/2628-12-0x00000000009D0000-0x0000000000A50000-memory.dmp
    Filesize

    512KB

    Download
  • memory/2628-1980-0x00000000009D0000-0x0000000000A50000-memory.dmp
    Filesize

    512KB

    Download
  • memory/2628-1983-0x00000000009D0000-0x0000000000A50000-memory.dmp
    Filesize

    512KB

    Download
  • memory/2840-2-0x000007FEF5490000-0x000007FEF5E2D000-memory.dmp
    Filesize

    9.6MB

    Download
  • memory/2840-9-0x000007FEF5490000-0x000007FEF5E2D000-memory.dmp
    Filesize

    9.6MB

    Download
  • memory/2840-3-0x0000000002070000-0x00000000020F0000-memory.dmp
    Filesize

    512KB

    Download