Analysis
-
max time kernel
508s -
max time network
499s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30-12-2023 23:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Jigsaw2.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
16 signatures
300 seconds
General
-
Target
Jigsaw2.exe
-
Size
291KB
-
MD5
2fec9bf50de5395f799b23a1099b10d6
-
SHA1
6000969e75d7d7a3fa1b908bdb9d5daeb5f2534e
-
SHA256
df049efbfa7ac0b76c8daff5d792c550c7a7a24f6e9e887d01a01013c9caa763
-
SHA512
5f6885fb1940ee4f84507e2b7929f637d8f264a5c77329aeae31803b772608ea93370177017f90f6f8d8bc9e0b30eb8607ed120d4ead68104fd70feec71a9ab8
-
SSDEEP
6144:pdSK04ETTZ+4TBpvjLCnVlBpevKBauJirVuD05VSKJ:poL4EnU4T/vjLeVlayRihuA5D
Score
10/10
Malware Config
Signatures
-
Jigsaw Ransomware
Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.
-
Renames multiple (238) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation Jigsaw2.exe -
Executes dropped EXE 1 IoCs
pid Process 1148 drpbx.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\firefox.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Frfx\\firefox.exe" Jigsaw2.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created C:\Windows\assembly\Desktop.ini Jigsaw2.exe File opened for modification C:\Windows\assembly\Desktop.ini Jigsaw2.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\ne.txt drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\nn.txt drpbx.exe File created C:\Program Files\7-Zip\Lang\tg.txt.zemblax drpbx.exe File created C:\Program Files\7-Zip\Lang\tt.txt.zemblax drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\BuildInfo.xml drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxManifest.xml drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml drpbx.exe File opened for modification C:\Program Files\7-Zip\License.txt drpbx.exe File created C:\Program Files\7-Zip\Lang\ko.txt.zemblax drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\msapp-error.html drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_2019.729.2301.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.NET.Native.Runtime.2.2_2.2.27328.0_x64__8wekyb3d8bbwe\logo.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\AppxManifest.xml drpbx.exe File created C:\Program Files\7-Zip\Lang\co.txt.zemblax drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\mr.txt drpbx.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00.UWPDesktop_14.0.27629.0_x64__8wekyb3d8bbwe\AppxManifest.xml drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxBlockMap.xml drpbx.exe File created C:\Program Files\7-Zip\Lang\it.txt.zemblax drpbx.exe File created C:\Program Files\7-Zip\Lang\nn.txt.zemblax drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-tw.txt drpbx.exe File opened for modification C:\Program Files\Java\jdk-1.8\README.html drpbx.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.zemblax drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\bg.txt drpbx.exe File opened for modification C:\Program Files (x86)\Windows NT\TableTextService\TableTextServiceYi.txt drpbx.exe File created C:\Program Files\7-Zip\Lang\fur.txt.zemblax drpbx.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml drpbx.exe File opened for modification C:\Program Files\Windows Media Player\Media Renderer\RenderingControl.xml drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxManifest.xml drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\BuildInfo.xml drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.513.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml drpbx.exe File created C:\Program Files\7-Zip\Lang\es.txt.zemblax drpbx.exe File created C:\Program Files\7-Zip\Lang\sr-spl.txt.zemblax drpbx.exe File opened for modification C:\Program Files\Java\jdk-1.8\jvisualvm.txt drpbx.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.zemblax drpbx.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3102-0000-1000-0000000FF1CE.xml.zemblax drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\cy.txt drpbx.exe File created C:\Program Files\7-Zip\Lang\ta.txt.zemblax drpbx.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml drpbx.exe File opened for modification C:\Program Files (x86)\Windows Media Player\Media Renderer\connectionmanager_dmr.xml drpbx.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml drpbx.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.common.16.xml.zemblax drpbx.exe File created C:\Program Files\VideoLAN\VLC\THANKS.txt.zemblax drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxManifest.xml drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\AppxManifest.xml drpbx.exe File created C:\Program Files\Java\jdk-1.8\javafx-src.zip.zemblax drpbx.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.UI.Xaml.2.0_2.1810.18004.0_x64__8wekyb3d8bbwe\logo.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\AppxManifest.xml drpbx.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\AppxManifest.xml drpbx.exe File opened for modification C:\Program Files (x86)\Windows Media Player\Media Renderer\RenderingControl_DMP.xml drpbx.exe File opened for modification C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color48.jpg drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\AppxManifest.xml drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxBlockMap.xml drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\AppxManifest.xml drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.NET.Native.Framework.1.7_1.7.25531.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml drpbx.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.zemblax drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\BuildInfo.xml drpbx.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\assembly Jigsaw2.exe File created C:\Windows\assembly\Desktop.ini Jigsaw2.exe File opened for modification C:\Windows\assembly\Desktop.ini Jigsaw2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1728 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1728 taskmgr.exe Token: SeSystemProfilePrivilege 1728 taskmgr.exe Token: SeCreateGlobalPrivilege 1728 taskmgr.exe Token: SeDebugPrivilege 4792 Jigsaw2.exe Token: SeDebugPrivilege 1148 drpbx.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe 1728 taskmgr.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4792 wrote to memory of 1148 4792 Jigsaw2.exe 110 PID 4792 wrote to memory of 1148 4792 Jigsaw2.exe 110 PID 4792 wrote to memory of 1148 4792 Jigsaw2.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\Jigsaw2.exe"C:\Users\Admin\AppData\Local\Temp\Jigsaw2.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe"C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe" C:\Users\Admin\AppData\Local\Temp\Jigsaw2.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:1148
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1728
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
291KB
MD52fec9bf50de5395f799b23a1099b10d6
SHA16000969e75d7d7a3fa1b908bdb9d5daeb5f2534e
SHA256df049efbfa7ac0b76c8daff5d792c550c7a7a24f6e9e887d01a01013c9caa763
SHA5125f6885fb1940ee4f84507e2b7929f637d8f264a5c77329aeae31803b772608ea93370177017f90f6f8d8bc9e0b30eb8607ed120d4ead68104fd70feec71a9ab8