Analysis
-
max time kernel
419s -
max time network
389s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
-
submitted
23-10-2023 03:53
General
-
Target
jigsaw.exe
-
Size
283KB
-
MD5
2773e3dc59472296cb0024ba7715a64e
-
SHA1
27d99fbca067f478bb91cdbcb92f13a828b00859
-
SHA256
3ae96f73d805e1d3995253db4d910300d8442ea603737a1428b613061e7f61e7
-
SHA512
6ef530b209f8ec459cca66dbf2c31ec96c5f7d609f17fa3b877d276968032fbc6132ea4a45ed1450fb6c5d730a7c9349bf4481e28befaea6b119ec0ded842262
-
SSDEEP
6144:7fukPLPvucHiQQQ4uuy9ApZbZWxcZt+kTfMLJTOAZiYSXjjeqXus:7fu5cCT7yYlWi8kTfMLJTOAZiYSXjyqX
Malware Config
Signatures
-
Jigsaw Ransomware
Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.
-
Renames multiple (1976) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Internet Explorer settings 1 TTPs 64 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 4 IoCs
-
Suspicious use of SetWindowsHookEx 16 IoCs
-
Suspicious use of WriteProcessMemory 26 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\jigsaw.exe"C:\Users\Admin\AppData\Local\Temp\jigsaw.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe"C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe" C:\Users\Admin\AppData\Local\Temp\jigsaw.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
-
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Windows Media Player\setup_wm.exe"C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding2⤵
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Desktop\HideStop.docx.fun1⤵
- Modifies registry class
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:548 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Documents\LimitClear.htm1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1536 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Documents\StopRequest.htm1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2656 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
160B
MD5580ee0344b7da2786da6a433a1e84893
SHA160f8c4dd5457e9834f5402cb326b1a2d3ca0ba7e
SHA25698b6c2ddfefc628d03ceaef9d69688674a6bc32eb707f9ed86bc8c75675c4513
SHA512356d2cdea3321e894b5b46ad1ea24c0e3c8be8e3c454b5bd300b7340cbb454e71fc89ca09ea0785b373b483e67c2f6f6bb408e489b0de4ff82d5ed69a75613ba
-
Filesize
304B
MD569ccb306b3a7112476d989336168b541
SHA1d2c897ce5ade7cabef476eccaa76ec8396b66201
SHA256dcd9fdbbf8166b65277dbce2d52f37272dc8f60cfe9e40d8747dd3443fa0d2aa
SHA5124e0adac2635b33ca46cfc7b269f928cbd4e6ead8102022c476086743d6e1985de1104e51201005272eaeb103cf8a1a4ffb852a3f26f84239110db3006f2e076a
-
Filesize
304B
MD53b1a0520430d9d9a717f8ea2e2433508
SHA12022a2e7fbb9bc3371cbd3a41c5519b15bfd7ea0
SHA2564ad259a909c8c5f2bb3595849103562b259563135d5ed7ec5f11ba798bd3480a
SHA51250b22363d82ec8e21cb2aa458890e7c09f781762fd81d66b68ebbec4ee3510842b3b2be0dda61689f564861256798ea1b4b926093fc5b48318207da2dfd02705
-
Filesize
304B
MD5a60be03b7bed92b92748a03c608b3699
SHA1f7d4005a58a7a508f820d8f5edf3423f30ee21fa
SHA2565f19e6c787c4105a0571858902be79ed63876f018d74e3455feb00d1761bcf89
SHA51201429463d4fbd7da7786c6ca5dc35658d6acccba711fb60dadd893a2e0520a5cc1642f967dc0681e82579b2cdeaacbcaeeeaf24b41fde417e078ab96efafb574
-
Filesize
304B
MD56a2a012d31f97877b7af4cbcffcb9b2e
SHA1b5d50c1733b8831950b29f010c8e9e051be26c46
SHA256a4e6778c0cbd144af2c529aeb1b28911a1fe0cbe1709394ce950361dc1fcbaba
SHA512000efe42e232f558c1960400c80e5dad528554cd986b29484b2d3619ee13f14920851cc76198f4871ed60edc586c82e412771fd0e6ed475edd8b8d7bc6c017fa
-
Filesize
304B
MD58644ed103f2b46d9e4537fed877fce54
SHA1e8aee71ffc40316a68c9226f6601d17b85161207
SHA256c29899f5045133f2bfa2782fcb8d103a57263590d0e31eeded9630b07185e7dd
SHA512a90c9dc66fa2b78f980bfce7f5eeffcf850f554873a4282c3d4e03c1a45fb33a2cb13ba7c8b398552d6e0f682a40dd66f1c64e3e6943d54b639906184acb7ffd
-
Filesize
304B
MD52a802dc6f7e7c923695bb89891c391aa
SHA1d49f10748f829412302a552ea90494ad6a247191
SHA2569de1515ef2a4e5bf872c006325dff18535f6ceeebef626f3ddb99c1fc97ee881
SHA512412d21d6508cad1d4aec1d8b29b810943810852ff82484ada2b651a75795b5dc12d8104db222d95bc92c98baceef66a2002c76d9c42278f28da6fa1b2725ea95
-
Filesize
304B
MD5be8e50d84958097bd07433a0effb1f23
SHA1c8984724fd1012942a3f49e2ae1478217afa7049
SHA256d63f0dd4d99227a49a02aab9afe53285681001099beef0c3b9c6bb476150e965
SHA5127620f70eebc67cf004be96f97ebdae9d2f45a0172714b350580c186facba54b45312a004a1ba6ddac24f3d9971441c37e72fbcabd8658b142700fce0410b41c2
-
Filesize
304B
MD5529852da9256490e144fadac5382aed2
SHA149760d6de1fe1104378508f1e875a72d5d60d536
SHA2568beafde017f25a26bf45dbfc76379657f772f2f635de420d190e9e50e3e65b25
SHA512f7960187718cf4b3b0239f44a67935a45322e1f503689a6c9e5f978ff74e1e3d06c12b43731f98e2972efc7d4ad328b5947db2a9bb30781e57e076496541b8b8
-
Filesize
304B
MD5b2a77678a11e58081deaa328e5a52ab8
SHA1e98f1b29b7f9c35a5533df0c4e67e5eaee3edc72
SHA2560f295c90ba1cc7ad043b2ced260b1a5a96f60353e41fcdaae00d86b2f96dee44
SHA51235707eb9b7d2dab7179047bd50140d0978b1013dd6ee19e9511e9a21ee2dc4a246fd679c03097b2771044a2f367d3e48fe72fcc94209c5d6844a768fa6817e1c
-
Filesize
304B
MD50659f96e9456f77c46666b51222ac92a
SHA12cd95e0d42b1ce470d2c247761adcf73c14d91b2
SHA256ac8fd189617370fab02828c28bc3bfc9843273503623fc575021b97c5f546f72
SHA512b3ac606d1206370ce71e826f70d9e45dceffa7de62a669b2db273c9c32e5e66bcc9fbb6a7617ca8dd28d51e80561d54df793ecc1bcc4def342153f72b58b6005
-
Filesize
304B
MD519b14735cd381624c50bbe08fcd45513
SHA117e958a371cbf29937178689af7e7cfd8fdafa5e
SHA25614046a44d841303a64f5091b44507691cf707e06dfdb8b24a67fc50ba9fe750b
SHA512873716b44d500cf2d8dcc08c815f1daf374ee19e06e3c128e560573eb1d585a95f2a19f78878c08ce14252947dcb21a801821f6c3aab29ffa09d7d42d29cfdd2
-
Filesize
304B
MD5986a23179c71fb9364210d22a9df0c4d
SHA1e4661b3e90a77c25debe1e635cc9a474349c2d36
SHA2566a7124ba6c9b4c7b4b0f3a5b74426cb92d914d66a6e7dddbdf2654c917e733ca
SHA512acc0a0fc29975cf0deed9def5ce4d2223a02e357015b55c8466611c70cee68771928bcb397eadcd5067d1ed829030f3f00e647e14ab7afaaf9ae1aa9d5975b1a
-
Filesize
304B
MD582d68595ca6cc0e1481c90631305d5ca
SHA158a46707d9f29b48b5206e77aa94278124de89ec
SHA256266f1ec7669e1fd7ca4cee77073f0a192430aaf24c5af61544ead43a4b8a2059
SHA512e75bef74768f5a74ef7aedef2a0d04941337c997cf40c3f8463fa644211387f6eeccf346da4527bf88615767dc5bb1289fa68fea6684653e9d1688c334fd1807
-
Filesize
304B
MD5c7cf8b8f4df87dcf4ed92e0469a43860
SHA10405cbbf65c7f8ad9f2da754263f75daee1968e4
SHA256993a8f6ad1f8f83016276d2909d647ae951252be525fa01bebe40a6c79ba1e4d
SHA5124297cf4f716555c609eec0fa128a6b5bf15251efd8022088c5930bc52c39d1146db9f54465dee1c986ce2dba38ce062d7425f876d05bd73c0875536d1ae1f0d2
-
Filesize
304B
MD513a09572976285bdfeaa1169f8192abe
SHA1c9de76d714af8c81113bb28d4f6b9732d1b2543d
SHA25647cb735e61164ea1ddafac751009bea9636b9fe14b4184106fb7226a60eeb312
SHA512227deb7d68b04dfa5319160930b811c69aa5e85b2a38d1df553693a56c77cf51ef230e2cba0445490b1a1a15c34efd97d8610d8c3d5318735d96c4f9bf2bfa8f
-
Filesize
304B
MD5e64606aae719885cfc21219ff391fe6d
SHA1184ce7ebecb9eb5ed6de79229ecc3fbd147cfb6a
SHA256ba09ba96a60ec55c2296e8469a749694917a37c8fed9389dd0137205b39e56ce
SHA5127c5982b751a260f06fe6324a31b510b95899999c3154afa19614d261206863499c7d0d0f41855c56df93bc4cfb3964f7c4f3d90f1b093f68dbef53645ed11073
-
Filesize
304B
MD5f8457de26fbcaf58ce7321fc2b978cae
SHA11aa4d4fa6a3b0a865e6499166bccf340f04d176f
SHA256f9390d99e681586160e4efc85f0339ee2005f6c27771e3597ecb027fdfdd6e08
SHA51283322b4e33bccf53dfe1b110ee0451560fec3a2f1c6f88fc463b21452896b0db49c54402a066b89051e656f98e8f6ee086b08ac671f80a1be5ebd48836bcd011
-
Filesize
304B
MD584f3415e9dba074bc5b68c1f85da7502
SHA1b271d339908bdceaef0ab1381259dd20d281d759
SHA256e7baed4078b4c96c06a4b344e963a6a1f767505ea36c0ad4033c48c707a1dcfc
SHA512daf88e2782abf232bb30bebf2858c90cc94e28b49a192bdceecc2b0350784e96d61711359689c15a3b568e56e380d59793ef3a17c4c7f0ad12b72d748e93a549
-
Filesize
304B
MD51f15a4b5cd78fb9cbc8314321f21b3ee
SHA17d2130957876494ff7230e761a9b5ecb3386ba13
SHA256d98d047f8528b9b47854194c14fd7705f44842a0c8f9dcbdd9acb26da52bb97a
SHA5123bd0b4557b3cb1c401a45cbc4015d69cdd2e3c893559c02d912b3e4833b438b41a681fd68d9f5ae2ff396d5d54401661bcaec428b6b267f572d9692a0f41ae7a
-
Filesize
304B
MD595b835f7cd957f07ef0f17d1d991a955
SHA12741696e8c901d5bf831b334043597e38893b7e5
SHA25677558d1e8d4d6d9734a9842e2ad54656187e06ae084a1c88e6e296beec0a08ed
SHA512776569d8026b10d8b0e16d7678843140f182f83fa3983c193f14fe420cc11aebb1854c48e79b05b99a79e040e29767217262260d1d2524a5f7930627fdb26cd2
-
Filesize
304B
MD522683d023317ee7905770fea0d9caa0c
SHA1e9ee31af0966c12112adc9e041b6372b152e5833
SHA256bcfbcbb3058d066cead78cc715942a63e1e1f0281b149e80ed3a7e256dcc4a1e
SHA5126574b387915d15174aa889b87b3afa25386f44fdf78a64d470f52d8a1cfd36808a69e311f85c82ca466ebc19e3e6fe7a6bdf3143df323d7bf6d3abefd4f0b636
-
Filesize
283KB
MD52773e3dc59472296cb0024ba7715a64e
SHA127d99fbca067f478bb91cdbcb92f13a828b00859
SHA2563ae96f73d805e1d3995253db4d910300d8442ea603737a1428b613061e7f61e7
SHA5126ef530b209f8ec459cca66dbf2c31ec96c5f7d609f17fa3b877d276968032fbc6132ea4a45ed1450fb6c5d730a7c9349bf4481e28befaea6b119ec0ded842262
-
Filesize
283KB
MD52773e3dc59472296cb0024ba7715a64e
SHA127d99fbca067f478bb91cdbcb92f13a828b00859
SHA2563ae96f73d805e1d3995253db4d910300d8442ea603737a1428b613061e7f61e7
SHA5126ef530b209f8ec459cca66dbf2c31ec96c5f7d609f17fa3b877d276968032fbc6132ea4a45ed1450fb6c5d730a7c9349bf4481e28befaea6b119ec0ded842262
-
Filesize
5KB
MD5ac739abeded00e40ae79455e43d16300
SHA10c352e4c16a79d1da1ae49293fa02cace91d45df
SHA256edf6da551b585db36fcb55f9104afb44b500e6a78ae3571d7c1de1bfc0f23997
SHA512dd58966353e497b5c5aa58ce4bb3ffb8255e6b30be84931e84689a339024e67332b80d9a693de1a9345fafe05230f351969984d065319bf26eb7bb146056fcf3
-
Filesize
5KB
MD567dfd7546be9f4cad46311d75ceb4cd5
SHA1e285c9082d69f42d9dfae5a844e6f5c705ba3557
SHA25686410012310481109626bfd8b02e404f0693e20ad8130f8336d0b79196757a06
SHA512d8f7c4c21f92bfac760ab0dcbf8a42880ac24e6ebd18391702072098aee647769057d9f682173c820b2446a745a0f63212f479a9603c5b9e83c396c868bc3b90
-
Filesize
7KB
MD560a57d0ad746e4fef31cea817dad4b7e
SHA1dcd77826b6dc4bcc4272c2d700eccef73cfb0198
SHA256210f18ce6b5d4558f7bf9345c699bb71eb9dfe3158db7582a1fc62321983e5d2
SHA51237fde3a257bbed8b3f67a17df256e696c4c06b83b24de390e7c4f3e35c10e6422fbbdb31d98bf51d66c91e3c51de9d0caae37a7c12946b35ebba2a0099279b68
-
Filesize
4KB
MD5098c380690422a8c6bdc0711666ef92b
SHA178dd5ca7eb7b84e2cdf0258314c19ba7bcc4a329
SHA256010edf99764b44406e88aaacd9f49038055826622630569b05c226d8907709b1
SHA5126c405a7b20f8b603617fb044113c04979d6bf8f4a832aa8ba1baaf736877aecf5e6074e25fb34d2ae38814a1a4ad34b940d8c47c4694111dd95a5e81b6f68da3
-
Filesize
4KB
MD5a1a95900650316f238beb67eb419de39
SHA152b3cb71792e6bca42d37bcb41df9cb8386da985
SHA25659ad380b27c02a98a53459e727e357613558afca9124b1dd50d352da17e8b720
SHA5129feac249f2a0d4d7f347308c9906f363553fe6248914934557809da7065999c51e340593b9d66bce47e37c442373af5a39e8ed49efbaa41f84ba7db4d1be53e5
-
Filesize
61KB
MD5f3441b8572aae8801c04f3060b550443
SHA14ef0a35436125d6821831ef36c28ffaf196cda15
SHA2566720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA5125ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9
-
Filesize
163KB
MD59441737383d21192400eca82fda910ec
SHA1725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA5127608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf
-
Filesize
546B
MD5df03e65b8e082f24dab09c57bc9c6241
SHA16b0dacbf38744c9a381830e6a5dc4c71bd7cedbf
SHA256155b9c588061c71832af329fafa5678835d9153b8fbb7592195ae953d0c455ba
SHA512ef1cc8d27fbc5da5daab854c933d3914b84ee539d4d2f0126dc1a04a830c5599e39a923c80257653638b1b99b0073a7174cc164be5887181730883c752ba2f99
-
Filesize
523B
MD5d58da90d6dc51f97cb84dfbffe2b2300
SHA15f86b06b992a3146cb698a99932ead57a5ec4666
SHA25693acdb79543d9248ca3fca661f3ac287e6004e4b3dafd79d4c4070794ffbf2ad
SHA5127f1e95e5aa4c8a0e4c967135c78f22f4505f2a48bbc619924d0096bf4a94d469389b9e8488c12edacfba819517b8376546687d1145660ad1f49d8c20a744e636
-
Filesize
16KB
MD535c28324347ca266734371ee31abdfbe
SHA1786e041922292601df2a42f6b8f0092741a73929
SHA2566a657aa51d87326e1cecdcc35303350fb23d1b8eeac14a8f7db3754d4c35274a
SHA51292db67f430468d0ab4c1b1c5bcd909e0811d9358e51b97e96aaaabc0b925b43e369e7928853abd5b7fa22a55a98f1fc2269862b1b65ac455b8d2809d4ab98a54
-
Filesize
16B
MD58ebcc5ca5ac09a09376801ecdd6f3792
SHA181187142b138e0245d5d0bc511f7c46c30df3e14
SHA256619e246fc0ac11320ff9e322a979948d949494b0c18217f4d794e1b398818880
SHA512cec50bfc6ad2f57f16da99459f40f2d424c6d5691685fa1053284f46c8c8c8a975d7bcb1f3521c4f3fbdc310cf4714e29404aa23be6021e2e267c97b090dc650
-
Filesize
512KB
-
Filesize
9.6MB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
456KB
-
Filesize
512KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
224KB
-
Filesize
9.6MB
-
Filesize
512KB
