Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
14/01/2024, 19:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Ransomware.Jigsaw.exe
Resource
win7-20231215-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
Ransomware.Jigsaw.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
15 signatures
150 seconds
General
-
Target
Ransomware.Jigsaw.exe
-
Size
283KB
-
MD5
2773e3dc59472296cb0024ba7715a64e
-
SHA1
27d99fbca067f478bb91cdbcb92f13a828b00859
-
SHA256
3ae96f73d805e1d3995253db4d910300d8442ea603737a1428b613061e7f61e7
-
SHA512
6ef530b209f8ec459cca66dbf2c31ec96c5f7d609f17fa3b877d276968032fbc6132ea4a45ed1450fb6c5d730a7c9349bf4481e28befaea6b119ec0ded842262
-
SSDEEP
6144:7fukPLPvucHiQQQ4uuy9ApZbZWxcZt+kTfMLJTOAZiYSXjjeqXus:7fu5cCT7yYlWi8kTfMLJTOAZiYSXjyqX
Score
10/10
Malware Config
Signatures
-
Jigsaw Ransomware
Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.
-
Renames multiple (239) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation Ransomware.Jigsaw.exe -
Executes dropped EXE 1 IoCs
pid Process 3376 drpbx.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\firefox.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Frfx\\firefox.exe" Ransomware.Jigsaw.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Lang\uz.txt drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\AppxManifest.xml drpbx.exe File created C:\Program Files\7-Zip\Lang\ro.txt.fun drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\networkmanifest.xml drpbx.exe File opened for modification C:\Program Files\PingPush.xlsb drpbx.exe File created C:\Program Files\7-Zip\Lang\ku-ckb.txt.fun drpbx.exe File created C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME.txt.fun drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxBlockMap.xml drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\hy.txt drpbx.exe File created C:\Program Files\7-Zip\Lang\hy.txt.fun drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\ne.txt drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxManifest.xml drpbx.exe File created C:\Program Files\7-Zip\Lang\co.txt.fun drpbx.exe File created C:\Program Files\7-Zip\Lang\ga.txt.fun drpbx.exe File created C:\Program Files\7-Zip\Lang\he.txt.fun drpbx.exe File created C:\Program Files\7-Zip\Lang\kaa.txt.fun drpbx.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\fy.txt drpbx.exe File created C:\Program Files (x86)\Microsoft\Edge\Edge.dat.fun drpbx.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\CortanaApp.ProjectedApi.xml drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\offlineStrings.js drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\networkmanifest.xml drpbx.exe File created C:\Program Files\VideoLAN\VLC\README.txt.fun drpbx.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml drpbx.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml drpbx.exe File created C:\Program Files\7-Zip\Lang\sk.txt.fun drpbx.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.fun drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\AppxBlockMap.xml drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxManifest.xml drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\BuildInfo.xml drpbx.exe File opened for modification C:\Program Files\TestBackup.asf drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\et.txt drpbx.exe File created C:\Program Files\7-Zip\Lang\sq.txt.fun drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\tt.txt drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxManifest.xml drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxBlockMap.xml drpbx.exe File opened for modification C:\Program Files\StepResume.xltm drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\VALoading.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\AppxManifest.xml drpbx.exe File opened for modification C:\Program Files\CheckpointUndo.xls drpbx.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\AppxManifest.xml drpbx.exe File opened for modification C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\hu.txt drpbx.exe File created C:\Program Files\7-Zip\Lang\lt.txt.fun drpbx.exe File opened for modification C:\Program Files\Windows Media Player\Media Renderer\DMR_120.jpg drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\AppxManifest.xml drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\offlineStrings.js drpbx.exe File opened for modification C:\Program Files (x86)\Microsoft.NET\RedistList\AssemblyList_4_client.xml drpbx.exe File created C:\Program Files\StepResume.xltm.fun drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\ky.txt drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\mng.txt drpbx.exe File created C:\Program Files\7-Zip\Lang\ms.txt.fun drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\pa-in.txt drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\th.txt drpbx.exe File opened for modification C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt drpbx.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml drpbx.exe File created C:\Program Files\7-Zip\Lang\et.txt.fun drpbx.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1504 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1504 taskmgr.exe Token: SeSystemProfilePrivilege 1504 taskmgr.exe Token: SeCreateGlobalPrivilege 1504 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4548 wrote to memory of 3376 4548 Ransomware.Jigsaw.exe 87 PID 4548 wrote to memory of 3376 4548 Ransomware.Jigsaw.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\Ransomware.Jigsaw.exe"C:\Users\Admin\AppData\Local\Temp\Ransomware.Jigsaw.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe"C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe" C:\Users\Admin\AppData\Local\Temp\Ransomware.Jigsaw.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3376
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1504
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
283KB
MD52773e3dc59472296cb0024ba7715a64e
SHA127d99fbca067f478bb91cdbcb92f13a828b00859
SHA2563ae96f73d805e1d3995253db4d910300d8442ea603737a1428b613061e7f61e7
SHA5126ef530b209f8ec459cca66dbf2c31ec96c5f7d609f17fa3b877d276968032fbc6132ea4a45ed1450fb6c5d730a7c9349bf4481e28befaea6b119ec0ded842262