Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
09-10-2023 22:49
Static task
static1
Behavioral task
behavioral1
Sample
rBlbqI2.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
rBlbqI2.exe
Resource
win10v2004-20230915-en
General
-
Target
rBlbqI2.exe
-
Size
291KB
-
MD5
2fec9bf50de5395f799b23a1099b10d6
-
SHA1
6000969e75d7d7a3fa1b908bdb9d5daeb5f2534e
-
SHA256
df049efbfa7ac0b76c8daff5d792c550c7a7a24f6e9e887d01a01013c9caa763
-
SHA512
5f6885fb1940ee4f84507e2b7929f637d8f264a5c77329aeae31803b772608ea93370177017f90f6f8d8bc9e0b30eb8607ed120d4ead68104fd70feec71a9ab8
-
SSDEEP
6144:pdSK04ETTZ+4TBpvjLCnVlBpevKBauJirVuD05VSKJ:poL4EnU4T/vjLeVlayRihuA5D
Malware Config
Signatures
-
Jigsaw Ransomware
Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.
-
Executes dropped EXE 1 IoCs
Processes:
drpbx.exepid process 752 drpbx.exe -
Loads dropped DLL 1 IoCs
Processes:
rBlbqI2.exepid process 1996 rBlbqI2.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
rBlbqI2.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Windows\CurrentVersion\Run\firefox.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Frfx\\firefox.exe" rBlbqI2.exe -
Drops file in Program Files directory 64 IoCs
Processes:
drpbx.exedescription ioc process File opened for modification C:\Program Files\ResetTrace.xlsx drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\ba.txt drpbx.exe File created C:\Program Files\7-Zip\Lang\sr-spl.txt.zemblax drpbx.exe File opened for modification C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw120.jpg drpbx.exe File opened for modification C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color32.jpg drpbx.exe File created C:\Program Files\7-Zip\Lang\fi.txt.zemblax drpbx.exe File created C:\Program Files\7-Zip\Lang\io.txt.zemblax drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\it.txt drpbx.exe File created C:\Program Files\RequestInstall.pptx.zemblax drpbx.exe File created C:\Program Files\Mozilla Firefox\firefox.VisualElementsManifest.xml.zemblax drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\cs.txt drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\da.txt drpbx.exe File created C:\Program Files\7-Zip\Lang\el.txt.zemblax drpbx.exe File created C:\Program Files\7-Zip\Lang\kk.txt.zemblax drpbx.exe File created C:\Program Files\7-Zip\Lang\ku.txt.zemblax drpbx.exe File created C:\Program Files\7-Zip\Lang\sv.txt.zemblax drpbx.exe File opened for modification C:\Program Files\Windows Media Player\Media Renderer\avtransport.xml drpbx.exe File opened for modification C:\Program Files\Windows NT\TableTextService\TableTextServiceYi.txt drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\kk.txt drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\lij.txt drpbx.exe File opened for modification C:\Program Files\Windows NT\TableTextService\TableTextServiceArray.txt drpbx.exe File opened for modification C:\Program Files\PingUnlock.png drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\eo.txt drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\fi.txt drpbx.exe File created C:\Program Files\7-Zip\Lang\ga.txt.zemblax drpbx.exe File created C:\Program Files\7-Zip\Lang\hu.txt.zemblax drpbx.exe File created C:\Program Files\7-Zip\Lang\an.txt.zemblax drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\ga.txt drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\ps.txt drpbx.exe File opened for modification C:\Program Files\Windows Media Player\Media Renderer\DMR_48.png drpbx.exe File created C:\Program Files (x86)\Microsoft.NET\RedistList\AssemblyList_4_extended.xml.zemblax drpbx.exe File created C:\Program Files\WriteSubmit.pptx.zemblax drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\kab.txt drpbx.exe File created C:\Program Files\7-Zip\Lang\kab.txt.zemblax drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\mng2.txt drpbx.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Microsoft.BusinessData.xml drpbx.exe File created C:\Program Files\Microsoft Office\Office14\Mso Example Setup File A.txt.zemblax drpbx.exe File opened for modification C:\Program Files\VideoLAN\VLC\COPYING.txt drpbx.exe File opened for modification C:\Program Files\VideoLAN\VLC\README.txt drpbx.exe File created C:\Program Files\PingUnlock.png.zemblax drpbx.exe File created C:\Program Files\7-Zip\Lang\ar.txt.zemblax drpbx.exe File created C:\Program Files\7-Zip\Lang\ba.txt.zemblax drpbx.exe File created C:\Program Files\7-Zip\Lang\is.txt.zemblax drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\mn.txt drpbx.exe File created C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt.zemblax drpbx.exe File created C:\Program Files\VideoLAN\VLC\README.txt.zemblax drpbx.exe File opened for modification C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw48.bmp drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\ar.txt drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\de.txt drpbx.exe File created C:\Program Files\7-Zip\Lang\fr.txt.zemblax drpbx.exe File created C:\Program Files\7-Zip\Lang\fur.txt.zemblax drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\ug.txt drpbx.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SketchPadTestSchema.xml drpbx.exe File created C:\Program Files\7-Zip\Lang\af.txt.zemblax drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\ku.txt drpbx.exe File created C:\Program Files\7-Zip\Lang\ky.txt.zemblax drpbx.exe File created C:\Program Files\7-Zip\Lang\lt.txt.zemblax drpbx.exe File opened for modification C:\Program Files (x86)\Windows Media Player\Media Renderer\avtransport.xml drpbx.exe File created C:\Program Files\7-Zip\Lang\ru.txt.zemblax drpbx.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\FreeCellMCE.png drpbx.exe File opened for modification C:\Program Files (x86)\Windows NT\TableTextService\TableTextServiceSimplifiedZhengMa.txt drpbx.exe File created C:\Program Files\RemoveNew.mpa.zemblax drpbx.exe File created C:\Program Files\RestartConvertFrom.avi.zemblax drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\br.txt drpbx.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
rBlbqI2.exedrpbx.exedescription pid process Token: SeDebugPrivilege 1996 rBlbqI2.exe Token: SeDebugPrivilege 752 drpbx.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
rBlbqI2.exedescription pid process target process PID 1996 wrote to memory of 752 1996 rBlbqI2.exe drpbx.exe PID 1996 wrote to memory of 752 1996 rBlbqI2.exe drpbx.exe PID 1996 wrote to memory of 752 1996 rBlbqI2.exe drpbx.exe PID 1996 wrote to memory of 752 1996 rBlbqI2.exe drpbx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\rBlbqI2.exe"C:\Users\Admin\AppData\Local\Temp\rBlbqI2.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe"C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe" C:\Users\Admin\AppData\Local\Temp\rBlbqI2.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Drpbx\drpbx.exeFilesize
291KB
MD52fec9bf50de5395f799b23a1099b10d6
SHA16000969e75d7d7a3fa1b908bdb9d5daeb5f2534e
SHA256df049efbfa7ac0b76c8daff5d792c550c7a7a24f6e9e887d01a01013c9caa763
SHA5125f6885fb1940ee4f84507e2b7929f637d8f264a5c77329aeae31803b772608ea93370177017f90f6f8d8bc9e0b30eb8607ed120d4ead68104fd70feec71a9ab8
-
C:\Users\Admin\AppData\Local\Drpbx\drpbx.exeFilesize
291KB
MD52fec9bf50de5395f799b23a1099b10d6
SHA16000969e75d7d7a3fa1b908bdb9d5daeb5f2534e
SHA256df049efbfa7ac0b76c8daff5d792c550c7a7a24f6e9e887d01a01013c9caa763
SHA5125f6885fb1940ee4f84507e2b7929f637d8f264a5c77329aeae31803b772608ea93370177017f90f6f8d8bc9e0b30eb8607ed120d4ead68104fd70feec71a9ab8
-
\Users\Admin\AppData\Local\Drpbx\drpbx.exeFilesize
291KB
MD52fec9bf50de5395f799b23a1099b10d6
SHA16000969e75d7d7a3fa1b908bdb9d5daeb5f2534e
SHA256df049efbfa7ac0b76c8daff5d792c550c7a7a24f6e9e887d01a01013c9caa763
SHA5125f6885fb1940ee4f84507e2b7929f637d8f264a5c77329aeae31803b772608ea93370177017f90f6f8d8bc9e0b30eb8607ed120d4ead68104fd70feec71a9ab8
-
memory/752-189-0x00000000740F0000-0x000000007469B000-memory.dmpFilesize
5.7MB
-
memory/752-192-0x0000000001F60000-0x0000000001FA0000-memory.dmpFilesize
256KB
-
memory/752-191-0x0000000001F60000-0x0000000001FA0000-memory.dmpFilesize
256KB
-
memory/752-344-0x0000000001F40000-0x0000000001F41000-memory.dmpFilesize
4KB
-
memory/752-190-0x0000000001F60000-0x0000000001FA0000-memory.dmpFilesize
256KB
-
memory/752-186-0x0000000001F60000-0x0000000001FA0000-memory.dmpFilesize
256KB
-
memory/752-184-0x0000000001F60000-0x0000000001FA0000-memory.dmpFilesize
256KB
-
memory/752-182-0x0000000001F60000-0x0000000001FA0000-memory.dmpFilesize
256KB
-
memory/752-177-0x00000000740F0000-0x000000007469B000-memory.dmpFilesize
5.7MB
-
memory/752-176-0x00000000740F0000-0x000000007469B000-memory.dmpFilesize
5.7MB
-
memory/752-345-0x0000000001F60000-0x0000000001FA0000-memory.dmpFilesize
256KB
-
memory/752-367-0x0000000001F60000-0x0000000001FA0000-memory.dmpFilesize
256KB
-
memory/1996-21-0x0000000004570000-0x00000000045A4000-memory.dmpFilesize
208KB
-
memory/1996-69-0x0000000004570000-0x00000000045A4000-memory.dmpFilesize
208KB
-
memory/1996-25-0x0000000004570000-0x00000000045A4000-memory.dmpFilesize
208KB
-
memory/1996-27-0x0000000004570000-0x00000000045A4000-memory.dmpFilesize
208KB
-
memory/1996-29-0x0000000004570000-0x00000000045A4000-memory.dmpFilesize
208KB
-
memory/1996-33-0x0000000004570000-0x00000000045A4000-memory.dmpFilesize
208KB
-
memory/1996-37-0x0000000004570000-0x00000000045A4000-memory.dmpFilesize
208KB
-
memory/1996-41-0x0000000004570000-0x00000000045A4000-memory.dmpFilesize
208KB
-
memory/1996-43-0x0000000004570000-0x00000000045A4000-memory.dmpFilesize
208KB
-
memory/1996-45-0x0000000004570000-0x00000000045A4000-memory.dmpFilesize
208KB
-
memory/1996-47-0x0000000004570000-0x00000000045A4000-memory.dmpFilesize
208KB
-
memory/1996-49-0x0000000004570000-0x00000000045A4000-memory.dmpFilesize
208KB
-
memory/1996-53-0x0000000004570000-0x00000000045A4000-memory.dmpFilesize
208KB
-
memory/1996-57-0x0000000004570000-0x00000000045A4000-memory.dmpFilesize
208KB
-
memory/1996-61-0x0000000004570000-0x00000000045A4000-memory.dmpFilesize
208KB
-
memory/1996-65-0x0000000004570000-0x00000000045A4000-memory.dmpFilesize
208KB
-
memory/1996-63-0x0000000004570000-0x00000000045A4000-memory.dmpFilesize
208KB
-
memory/1996-59-0x0000000004570000-0x00000000045A4000-memory.dmpFilesize
208KB
-
memory/1996-55-0x0000000004570000-0x00000000045A4000-memory.dmpFilesize
208KB
-
memory/1996-51-0x0000000004570000-0x00000000045A4000-memory.dmpFilesize
208KB
-
memory/1996-39-0x0000000004570000-0x00000000045A4000-memory.dmpFilesize
208KB
-
memory/1996-35-0x0000000004570000-0x00000000045A4000-memory.dmpFilesize
208KB
-
memory/1996-31-0x0000000004570000-0x00000000045A4000-memory.dmpFilesize
208KB
-
memory/1996-23-0x0000000004570000-0x00000000045A4000-memory.dmpFilesize
208KB
-
memory/1996-71-0x0000000004570000-0x00000000045A4000-memory.dmpFilesize
208KB
-
memory/1996-67-0x0000000004570000-0x00000000045A4000-memory.dmpFilesize
208KB
-
memory/1996-166-0x0000000001F60000-0x0000000001F61000-memory.dmpFilesize
4KB
-
memory/1996-167-0x00000000020E0000-0x0000000002120000-memory.dmpFilesize
256KB
-
memory/1996-170-0x00000000020E0000-0x0000000002120000-memory.dmpFilesize
256KB
-
memory/1996-0-0x00000000740F0000-0x000000007469B000-memory.dmpFilesize
5.7MB
-
memory/1996-19-0x0000000004570000-0x00000000045A4000-memory.dmpFilesize
208KB
-
memory/1996-17-0x0000000004570000-0x00000000045A4000-memory.dmpFilesize
208KB
-
memory/1996-15-0x0000000004570000-0x00000000045A4000-memory.dmpFilesize
208KB
-
memory/1996-179-0x00000000740F0000-0x000000007469B000-memory.dmpFilesize
5.7MB
-
memory/1996-13-0x0000000004570000-0x00000000045A4000-memory.dmpFilesize
208KB
-
memory/1996-11-0x0000000004570000-0x00000000045A4000-memory.dmpFilesize
208KB
-
memory/1996-9-0x0000000004570000-0x00000000045A4000-memory.dmpFilesize
208KB
-
memory/1996-8-0x0000000004570000-0x00000000045A4000-memory.dmpFilesize
208KB
-
memory/1996-7-0x00000000020E0000-0x0000000002120000-memory.dmpFilesize
256KB
-
memory/1996-6-0x00000000020E0000-0x0000000002120000-memory.dmpFilesize
256KB
-
memory/1996-5-0x00000000740F0000-0x000000007469B000-memory.dmpFilesize
5.7MB
-
memory/1996-4-0x00000000020E0000-0x0000000002120000-memory.dmpFilesize
256KB
-
memory/1996-3-0x00000000740F0000-0x000000007469B000-memory.dmpFilesize
5.7MB
-
memory/1996-2-0x00000000020E0000-0x0000000002120000-memory.dmpFilesize
256KB
-
memory/1996-1-0x00000000740F0000-0x000000007469B000-memory.dmpFilesize
5.7MB