jigsaw | 9004e4161cc50ac62f76988aefe4504df4fd636d12708630e825e0c7b74cd12d

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30-01-2024 05:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9004e4161cc50ac62f76988aefe4504df4fd636d12708630e825e0c7b74cd12d.exe
Size

2.0MB
MD5

22f2d4f9682ddadacf4fd6ead172e125
SHA1

e9e6775d034c8c86218b95fe5de1455609aa5dc1
SHA256

9004e4161cc50ac62f76988aefe4504df4fd636d12708630e825e0c7b74cd12d
SHA512

f821d6d89807a698e67eef75943d4e590be924bce3a1fbdaa7507641bce222c014e721f96a8a1083dff3c7d9e4445f62420949f5e0b3b9a97e2721415161ba7b
SSDEEP

49152:Ye0jbW6GNjiSZTKAzkltDhTCcVX8saTtWycoJkqXfd+/9AH9783FGpv8EAQkcZ:YANuSZTKA0t9FFPEVJkqXf0Fi80kEXkc

Score

10^/10

jigsaw persistence ransomware

Malware Config

Signatures

Jigsaw Ransomware
Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.
ransomware jigsaw

Executes dropped EXE 1 IoCs

pid	Process
2620	drpbx.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Windows\CurrentVersion\Run\firefox.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Frfx\\firefox.exe"	9004e4161cc50ac62f76988aefe4504df4fd636d12708630e825e0c7b74cd12d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 2620	2928	9004e4161cc50ac62f76988aefe4504df4fd636d12708630e825e0c7b74cd12d.exe	28
PID 2928 wrote to memory of 2620	2928	9004e4161cc50ac62f76988aefe4504df4fd636d12708630e825e0c7b74cd12d.exe	28
PID 2928 wrote to memory of 2620	2928	9004e4161cc50ac62f76988aefe4504df4fd636d12708630e825e0c7b74cd12d.exe	28

C:\Users\Admin\AppData\Local\Temp\9004e4161cc50ac62f76988aefe4504df4fd636d12708630e825e0c7b74cd12d.exe
"C:\Users\Admin\AppData\Local\Temp\9004e4161cc50ac62f76988aefe4504df4fd636d12708630e825e0c7b74cd12d.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe
  "C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe" C:\Users\Admin\AppData\Local\Temp\9004e4161cc50ac62f76988aefe4504df4fd636d12708630e825e0c7b74cd12d.exe
  2⤵
  - Executes dropped EXE
  PID:2620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe

Filesize
271KB

MD5
7fa68a32b93a0e356aa1ce6dc9af9c43

SHA1
fc14e7c701722ef10d8fbc7e417cd36ad00b8734

SHA256
2f04eea2c20e4ac5e8c7cd9a9a6b6a105aca0b0ecc31bb03b95d80a92de779b8

SHA512
52368d7f1df10039304f4416a990c5fe76405b41f578efe2b907ffbddcdee449f42848b458bf472196124e1c26945fdcf67121ff322d4b671730e97a8bbc49c0

Download Submit
C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe

Filesize
333KB

MD5
cb8845873547fbfcf5b9b1d94041b6b8

SHA1
49f6ca3fc49b18ece3cfaf1691a06a979af8219e

SHA256
7fd1faa590eb93a351da77e9efc2703dc58e5ab1c18a82df97f0914cf58730c0

SHA512
020b9504a111bb83722168e1c2e656f0300af3fa1d4c8434afee0ddb2fe76e12310d464fb60add9ae12410a389708753f4b7fbb9490ef9127aa43e13e0752725

Download Submit
memory/2620-10-0x0000000000250000-0x0000000000452000-memory.dmp

Filesize
2.0MB

Download
memory/2620-9-0x000007FEF5EE0000-0x000007FEF68CC000-memory.dmp

Filesize
9.9MB

Download
memory/2620-13-0x000007FEF5EE0000-0x000007FEF68CC000-memory.dmp

Filesize
9.9MB

Download
memory/2620-12-0x00000000007F0000-0x000000000084A000-memory.dmp

Filesize
360KB

Download
memory/2620-11-0x000000001B0E0000-0x000000001B160000-memory.dmp

Filesize
512KB

Download
memory/2928-0-0x0000000001210000-0x0000000001412000-memory.dmp

Filesize
2.0MB

Download
memory/2928-1-0x000007FEF5EE0000-0x000007FEF68CC000-memory.dmp

Filesize
9.9MB

Download
memory/2928-8-0x000007FEF5EE0000-0x000007FEF68CC000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads