jigsaw | 534d36c2a613d28ab156b2a1ed102e6682665af525359dbc5d96c61150a9b0c2

General

Target

upscaled.mp4
Size

31.4MB
Sample

231204-zcwnqsfd2w
MD5

27e9544a35e67d1c7982404fd7bed4e3
SHA1

f73458c25a3a945f44a433294a9ef34ed6661e43
SHA256

534d36c2a613d28ab156b2a1ed102e6682665af525359dbc5d96c61150a9b0c2
SHA512

700d6e3aa82edf2b194009e9e3a56e05d0a3ad8feaedd5b9bc35f7fd5694fe102e9b27853842674c3612b9d6a5bf463ae0e6799528916eba1026d15f0fe0c554
SSDEEP

786432:clJ0XzmW0yXLods7Io4dfM3IQO8MJQFrOg7jocjZ9lhDdqm:5XzdbCegwIQMJQp/fxZ9l9dr

Score

10^/10

Malware Config

Targets

- Target
  
  upscaled.mp4
- Size
  
  31.4MB
- MD5
  
  27e9544a35e67d1c7982404fd7bed4e3
- SHA1
  
  f73458c25a3a945f44a433294a9ef34ed6661e43
- SHA256
  
  534d36c2a613d28ab156b2a1ed102e6682665af525359dbc5d96c61150a9b0c2
- SHA512
  
  700d6e3aa82edf2b194009e9e3a56e05d0a3ad8feaedd5b9bc35f7fd5694fe102e9b27853842674c3612b9d6a5bf463ae0e6799528916eba1026d15f0fe0c554
- SSDEEP
  
  786432:clJ0XzmW0yXLods7Io4dfM3IQO8MJQFrOg7jocjZ9lhDdqm:5XzdbCegwIQMJQp/fxZ9l9dr
Score

10^/10

jigsaw discovery persistence ransomware spyware stealer
- Jigsaw Ransomware
  Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.
  ransomware jigsaw
- Renames multiple (3726) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Registers COM server for autorun
  persistence
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2
behavioral1