General
-
Target
3ae96f73d805e1d3995253db4d910300d8442ea603737a1428b613061e7f61e7.exe.zip
-
Size
239KB
-
Sample
231201-sh1rbabc95
-
MD5
9a444db32d6afc4958dad3e6607ac0ec
-
SHA1
aeee8f8742836a22624828a566e7a5f6f94baf41
-
SHA256
ecd85292a085805306e61fc38fad0a8b229d10a2505ec217d92be3551c36eca9
-
SHA512
58400123750c3697f7a3ccfd52986889255ee52e515a9db8bca511ff0bbbedaa8a97763c2be861a871656f9690761e01b9aa3e642f1e1f79a1007015311cbc2f
-
SSDEEP
6144:Yhlx/73HQjj7cinI6oRytou50OPjxqBZ5+XTK:uxbH6PcX6oUb7xqxt
Static task
static1
Behavioral task
behavioral1
Sample
3ae96f73d805e1d3995253db4d910300d8442ea603737a1428b613061e7f61e7.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
3ae96f73d805e1d3995253db4d910300d8442ea603737a1428b613061e7f61e7.exe
Resource
win10v2004-20231127-en
Malware Config
Targets
-
-
Target
3ae96f73d805e1d3995253db4d910300d8442ea603737a1428b613061e7f61e7.exe
-
Size
283KB
-
MD5
2773e3dc59472296cb0024ba7715a64e
-
SHA1
27d99fbca067f478bb91cdbcb92f13a828b00859
-
SHA256
3ae96f73d805e1d3995253db4d910300d8442ea603737a1428b613061e7f61e7
-
SHA512
6ef530b209f8ec459cca66dbf2c31ec96c5f7d609f17fa3b877d276968032fbc6132ea4a45ed1450fb6c5d730a7c9349bf4481e28befaea6b119ec0ded842262
-
SSDEEP
6144:7fukPLPvucHiQQQ4uuy9ApZbZWxcZt+kTfMLJTOAZiYSXjjeqXus:7fu5cCT7yYlWi8kTfMLJTOAZiYSXjyqX
Score10/10-
Jigsaw Ransomware
Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.
-
Renames multiple (1971) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Renames multiple (230) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-