Resubmissions
09-10-2023 22:49
231009-2ry4hsba26 1006-03-2021 22:23
210306-pfhc83235s 1005-06-2020 02:52
200605-jqylqtyzss 10Analysis
-
max time kernel
155s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
09-10-2023 22:49
General
-
Target
drpbx.exe
-
Size
125KB
-
MD5
7fab69dcc9fbee7ca91bef27dc551f63
-
SHA1
fe272f074373e80e2a00144e0fcc4de6e68cf0e3
-
SHA256
6f94e5747ba1aaa2bb666704ee65b37aac8aff47dbc321be2b607d47dd695e8f
-
SHA512
ac87841efd28941ee4b13142602b6f91a43b29136236d78ccde1ba838d453c9d9de5ab94ced8eaddb426f1b569ee8a3f593fdae04f02984b7fc337bccd0b3ae8
-
SSDEEP
3072:Bm8Bpv9GzLhceojAPZRP9A8b5CsMy7+zHWRFegvX:zzreokh9Ao5CXjCR3
Malware Config
Signatures
-
Jigsaw Ransomware
Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops desktop.ini file(s) 2 IoCs
-
Drops file in Windows directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\drpbx.exe"C:\Users\Admin\AppData\Local\Temp\drpbx.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe"C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe" C:\Users\Admin\AppData\Local\Temp\drpbx.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
125KB
MD57fab69dcc9fbee7ca91bef27dc551f63
SHA1fe272f074373e80e2a00144e0fcc4de6e68cf0e3
SHA2566f94e5747ba1aaa2bb666704ee65b37aac8aff47dbc321be2b607d47dd695e8f
SHA512ac87841efd28941ee4b13142602b6f91a43b29136236d78ccde1ba838d453c9d9de5ab94ced8eaddb426f1b569ee8a3f593fdae04f02984b7fc337bccd0b3ae8
-
Filesize
125KB
MD57fab69dcc9fbee7ca91bef27dc551f63
SHA1fe272f074373e80e2a00144e0fcc4de6e68cf0e3
SHA2566f94e5747ba1aaa2bb666704ee65b37aac8aff47dbc321be2b607d47dd695e8f
SHA512ac87841efd28941ee4b13142602b6f91a43b29136236d78ccde1ba838d453c9d9de5ab94ced8eaddb426f1b569ee8a3f593fdae04f02984b7fc337bccd0b3ae8
-
Filesize
125KB
MD57fab69dcc9fbee7ca91bef27dc551f63
SHA1fe272f074373e80e2a00144e0fcc4de6e68cf0e3
SHA2566f94e5747ba1aaa2bb666704ee65b37aac8aff47dbc321be2b607d47dd695e8f
SHA512ac87841efd28941ee4b13142602b6f91a43b29136236d78ccde1ba838d453c9d9de5ab94ced8eaddb426f1b569ee8a3f593fdae04f02984b7fc337bccd0b3ae8
-
Filesize
430B
MD5b9dd151cf6dceec97042df1c099716b3
SHA1e23397577275e9fde05193294abfa276864d449d
SHA256a7c47ef614feb0ba313143fe934a7e897e909f0d2939f31f42f4ef436d567e0c
SHA512fa21309b6f00daa342efe1eacc9aa402a55025d3eaf6d6bb6b346c6c3c9c28a3673478ce8b7f31f739a278289a990cf93382f7b4e0751a0fe67ea165b6c51fb4
-
Filesize
4.8MB
-
Filesize
624KB
-
Filesize
9.6MB
-
Filesize
80KB
-
Filesize
64KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
80KB
-
Filesize
64KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
64KB