jigsaw | b534355c974da421e12bedd40cc69ac2b8bea7126d0c58f5d2ab8c2999f42e87

General

Target

Jigsaw.zip
Size

239KB
Sample

231207-aqbhaagcgj
MD5

bccd9fe85eb31117cfe1fd877dd08fcd
SHA1

a4c89e4d1290b392e967483979dba92f3309f2bd
SHA256

b534355c974da421e12bedd40cc69ac2b8bea7126d0c58f5d2ab8c2999f42e87
SHA512

ca98d1c354a596c36a3e85a6f11478d3401bd8a1b8b9bc5dbb8504c30db5f0bf3e662977b627d4ae64ffc58a2bbf7ba902364c9554d66897f64964afb15173bb
SSDEEP

6144:5/vucHCQQQEwuyjADlZZuxcntYVecfdth:5OcitByWHu2eVecf9

Score

10^/10

Malware Config

Targets

- Target
  
  Jigsaw.zip
- Size
  
  239KB
- MD5
  
  bccd9fe85eb31117cfe1fd877dd08fcd
- SHA1
  
  a4c89e4d1290b392e967483979dba92f3309f2bd
- SHA256
  
  b534355c974da421e12bedd40cc69ac2b8bea7126d0c58f5d2ab8c2999f42e87
- SHA512
  
  ca98d1c354a596c36a3e85a6f11478d3401bd8a1b8b9bc5dbb8504c30db5f0bf3e662977b627d4ae64ffc58a2bbf7ba902364c9554d66897f64964afb15173bb
- SSDEEP
  
  6144:5/vucHCQQQEwuyjADlZZuxcntYVecfdth:5OcitByWHu2eVecf9
Score

10^/10

jigsaw persistence ransomware spyware stealer
- Jigsaw Ransomware
  Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.
  ransomware jigsaw
- Renames multiple (3711) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes itself
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
behavioral1
- Target
  
  2773e3dc59472296cb0024ba7715a64e.exe
- Size
  
  283KB
- MD5
  
  2773e3dc59472296cb0024ba7715a64e
- SHA1
  
  27d99fbca067f478bb91cdbcb92f13a828b00859
- SHA256
  
  3ae96f73d805e1d3995253db4d910300d8442ea603737a1428b613061e7f61e7
- SHA512
  
  6ef530b209f8ec459cca66dbf2c31ec96c5f7d609f17fa3b877d276968032fbc6132ea4a45ed1450fb6c5d730a7c9349bf4481e28befaea6b119ec0ded842262
- SSDEEP
  
  6144:7fukPLPvucHiQQQ4uuy9ApZbZWxcZt+kTfMLJTOAZiYSXjjeqXus:7fu5cCT7yYlWi8kTfMLJTOAZiYSXjyqX
Score

10^/10

jigsaw persistence ransomware spyware stealer
- Jigsaw Ransomware
  Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.
  ransomware jigsaw
- Renames multiple (3741) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
behavioral2