General
-
Target
802fef4d4f81c443497362711a7d8611741c30373c96d3229d699f225552a5f5
-
Size
78KB
-
Sample
240130-ge3wqahga2
-
MD5
c5eff77db7eb62c4066247adfcd64797
-
SHA1
acf5f645a1af2987c8a5398c12d03622feba9d35
-
SHA256
802fef4d4f81c443497362711a7d8611741c30373c96d3229d699f225552a5f5
-
SHA512
1610710c081064743dcfc9b7f5cdf42e63c9f78f3f55983c7f00ae6e60124489a5239cafb89375cc8e3d9d7696eeed7bb23f05dcda52644aafee651f69768dbd
-
SSDEEP
1536:m3l0Bj+w0lplDHFNGlNEQZwS+g+vkjf9Hy+D00m:m3lkCwQplDleNGS+g+kjfEb
Static task
static1
Behavioral task
behavioral1
Sample
802fef4d4f81c443497362711a7d8611741c30373c96d3229d699f225552a5f5.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
802fef4d4f81c443497362711a7d8611741c30373c96d3229d699f225552a5f5.exe
Resource
win10v2004-20231215-en
Malware Config
Targets
-
-
Target
802fef4d4f81c443497362711a7d8611741c30373c96d3229d699f225552a5f5
-
Size
78KB
-
MD5
c5eff77db7eb62c4066247adfcd64797
-
SHA1
acf5f645a1af2987c8a5398c12d03622feba9d35
-
SHA256
802fef4d4f81c443497362711a7d8611741c30373c96d3229d699f225552a5f5
-
SHA512
1610710c081064743dcfc9b7f5cdf42e63c9f78f3f55983c7f00ae6e60124489a5239cafb89375cc8e3d9d7696eeed7bb23f05dcda52644aafee651f69768dbd
-
SSDEEP
1536:m3l0Bj+w0lplDHFNGlNEQZwS+g+vkjf9Hy+D00m:m3lkCwQplDleNGS+g+kjfEb
Score10/10-
Jigsaw Ransomware
Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.
-
Renames multiple (2014) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-