Analysis

  • max time kernel
    142s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    30-01-2024 05:42

General

  • Target

    053cec40ef1b8c148c4c1f798509e8b33e0f86f81555307b65e9fdffd670b9fa.exe

  • Size

    249KB

  • MD5

    33862bca1fe73d44277e9ad4f0aa81e1

  • SHA1

    e900bf9dc2ad2b18e362c8d42ae8e8ce74fb3ff1

  • SHA256

    053cec40ef1b8c148c4c1f798509e8b33e0f86f81555307b65e9fdffd670b9fa

  • SHA512

    08c0ef71dcab39f772abf17b2c714bc89fe2add6fa61f734ea04c05770ad93a68e5fd9caf73d740c3c17dce1ebb0563b0bd82b20fc6a7e508a778bccbbf8384c

  • SSDEEP

    6144:VFVg9EpWQxCKDgqLSV2hIq45K4O4xDL1UnhvHNJ7h0W93MPNdLM7G:/VgGD4KNWViIq4pOOPipHlzsQ7

Malware Config

Signatures

  • Jigsaw Ransomware

    Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.

  • Renames multiple (2142) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX dump on OEP (original entry point) 7 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\053cec40ef1b8c148c4c1f798509e8b33e0f86f81555307b65e9fdffd670b9fa.exe
    "C:\Users\Admin\AppData\Local\Temp\053cec40ef1b8c148c4c1f798509e8b33e0f86f81555307b65e9fdffd670b9fa.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2724
    • C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe
      "C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe" C:\Users\Admin\AppData\Local\Temp\053cec40ef1b8c148c4c1f798509e8b33e0f86f81555307b65e9fdffd670b9fa.exe
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Suspicious use of AdjustPrivilegeToken
      PID:2528

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\invalid32x32.gif.zemblax

    Filesize

    160B

    MD5

    000e8c41d4a15fb34d0be0dbb56e3778

    SHA1

    00c4eae64ee6239d7c65d819c6ce1ac329224f8c

    SHA256

    8bdfa6a5b7de345cf0d4fe0e9c17d8b0e9db26d58b05b1b2ebbb3a05a068ff28

    SHA512

    775d832eb8ab73e4a93789917dca69edb6c91fbb426e02acf7c6e213ffb4575776187209d1c471fbf57c4621ea3c23d9850f6dfc2770d62c17de9d66710800af

  • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\epl-v10.html.zemblax

    Filesize

    12KB

    MD5

    bd42ba47ff97fd7e395c90f79e0f9508

    SHA1

    c2d8069ff6d72f3c63eeeac23933e5620f649d9d

    SHA256

    3ad6f0a5c15cd3e24aa59e9687649e0d8d8b85789f3feef68e22b61a34a183e5

    SHA512

    4eb6b58c46225f6e96bf41177892131384507cd8437e314426b797797c10960db52b84abd1fbf3cd845d1ed4bb8c67d2be3099a9ff5379a04d059b0557ef7fca

  • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\license.html.zemblax

    Filesize

    8KB

    MD5

    29c6678d44aa7966ae163d70dd9f3661

    SHA1

    04e2608b9497905befec2c9c74931cdd14c754e8

    SHA256

    f7634f4769d57b1fd7ff257cafd60a0b309194e610202dfd26fc5113d0abf834

    SHA512

    e80a6a0270d20e255f84ee6ef285b610b79731058f88272b8246e4f0c97222cebf2113d7ae70a1a145c0bec2a94fea5cb5abff0203a8be64c634a9b9b6a3b1b6

  • C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe

    Filesize

    106KB

    MD5

    92eac1178de80dfe4aeeb9883904ccb0

    SHA1

    ca6d32e9f7d4c92e21f91198de325ec9dabe67e5

    SHA256

    bb7b6a584dd8f5c3a89255dc8ae3d3e9d7e139e32912e9e4d454994b54b2e013

    SHA512

    d6dadd522c2f955199acbcfde064c2e12f686658b4591d5fa1587139c905b00b7b7f371ea08deb449520818ae7e5555cc86491d0bfcd897db8fcecc5b933c9b0

  • C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe

    Filesize

    133KB

    MD5

    b70ff142674e6d58a1377fd5d49f91fa

    SHA1

    cc8e446329e7a3049225f8858d0fefd06fd5e8b0

    SHA256

    4dfbfd3af1b1251dd425c9fb2d0840636a8b1cb73d78ded7ea750350c08397ec

    SHA512

    a5cac3c40636d28cc6a138f8605ff885d059121b4b9c9f83a5ceee8d457f5009d7320f34bed3a2b262972151f70e27e42f01d2dc7a00fc0381ec1d1cd0b5ab2f

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\container.dat.zemblax

    Filesize

    16B

    MD5

    cfdae8214d34112dbee6587664059558

    SHA1

    f649f45d08c46572a9a50476478ddaef7e964353

    SHA256

    33088cb514406f31e3d96a92c03294121ee9f24e176f7062625c2b36bee7a325

    SHA512

    c260f2c223ecbf233051ac1d6a1548ad188a2777085e9d43b02da41b291ff258e4c506f99636150847aa24918c7bbb703652fef2fe55b3f50f85b5bd8dd5f6e3

  • \Users\Admin\AppData\Local\Drpbx\drpbx.exe

    Filesize

    132KB

    MD5

    3ddf40a5059c6acd93744fcad4c97024

    SHA1

    4349c8ae7afdd60b97738d5324b9d62c6fa73a45

    SHA256

    8f3f697217e9cb81113567f9fa1f65f4fa5b4fbce4a382c2cfbf530d757d6136

    SHA512

    cdf2c8c6d7a6d1581b634976eac5b9274d00444cad97ac291adf7063aa24860c8d7e20541b3902daf95b0fd062a0d57b78658e9e634a24312b68ad908eddbe1f

  • memory/2528-2507-0x00000000021A0000-0x00000000021E0000-memory.dmp

    Filesize

    256KB

  • memory/2528-591-0x00000000021A0000-0x00000000021E0000-memory.dmp

    Filesize

    256KB

  • memory/2528-2501-0x00000000064E0000-0x00000000065E0000-memory.dmp

    Filesize

    1024KB

  • memory/2528-180-0x00000000741E0000-0x000000007478B000-memory.dmp

    Filesize

    5.7MB

  • memory/2528-2508-0x00000000064E0000-0x00000000065E0000-memory.dmp

    Filesize

    1024KB

  • memory/2528-178-0x0000000000400000-0x0000000000454000-memory.dmp

    Filesize

    336KB

  • memory/2528-595-0x00000000021A0000-0x00000000021E0000-memory.dmp

    Filesize

    256KB

  • memory/2528-594-0x00000000021A0000-0x00000000021E0000-memory.dmp

    Filesize

    256KB

  • memory/2528-593-0x00000000741E0000-0x000000007478B000-memory.dmp

    Filesize

    5.7MB

  • memory/2528-2500-0x00000000021A0000-0x00000000021E0000-memory.dmp

    Filesize

    256KB

  • memory/2528-590-0x00000000021A0000-0x00000000021E0000-memory.dmp

    Filesize

    256KB

  • memory/2528-589-0x00000000741E0000-0x000000007478B000-memory.dmp

    Filesize

    5.7MB

  • memory/2528-341-0x00000000021A0000-0x00000000021E0000-memory.dmp

    Filesize

    256KB

  • memory/2528-182-0x00000000021A0000-0x00000000021E0000-memory.dmp

    Filesize

    256KB

  • memory/2528-184-0x00000000021A0000-0x00000000021E0000-memory.dmp

    Filesize

    256KB

  • memory/2528-176-0x00000000021A0000-0x00000000021E0000-memory.dmp

    Filesize

    256KB

  • memory/2528-174-0x00000000021A0000-0x00000000021E0000-memory.dmp

    Filesize

    256KB

  • memory/2528-340-0x0000000000710000-0x0000000000711000-memory.dmp

    Filesize

    4KB

  • memory/2528-172-0x00000000741E0000-0x000000007478B000-memory.dmp

    Filesize

    5.7MB

  • memory/2724-52-0x0000000002170000-0x00000000021A4000-memory.dmp

    Filesize

    208KB

  • memory/2724-20-0x0000000002170000-0x00000000021A4000-memory.dmp

    Filesize

    208KB

  • memory/2724-193-0x00000000741E0000-0x000000007478B000-memory.dmp

    Filesize

    5.7MB

  • memory/2724-56-0x0000000002170000-0x00000000021A4000-memory.dmp

    Filesize

    208KB

  • memory/2724-171-0x0000000005100000-0x0000000005154000-memory.dmp

    Filesize

    336KB

  • memory/2724-163-0x0000000000540000-0x0000000000541000-memory.dmp

    Filesize

    4KB

  • memory/2724-58-0x0000000002170000-0x00000000021A4000-memory.dmp

    Filesize

    208KB

  • memory/2724-60-0x0000000002170000-0x00000000021A4000-memory.dmp

    Filesize

    208KB

  • memory/2724-62-0x0000000002170000-0x00000000021A4000-memory.dmp

    Filesize

    208KB

  • memory/2724-50-0x0000000002170000-0x00000000021A4000-memory.dmp

    Filesize

    208KB

  • memory/2724-48-0x0000000002170000-0x00000000021A4000-memory.dmp

    Filesize

    208KB

  • memory/2724-46-0x0000000002170000-0x00000000021A4000-memory.dmp

    Filesize

    208KB

  • memory/2724-44-0x0000000002170000-0x00000000021A4000-memory.dmp

    Filesize

    208KB

  • memory/2724-42-0x0000000002170000-0x00000000021A4000-memory.dmp

    Filesize

    208KB

  • memory/2724-40-0x0000000002170000-0x00000000021A4000-memory.dmp

    Filesize

    208KB

  • memory/2724-38-0x0000000002170000-0x00000000021A4000-memory.dmp

    Filesize

    208KB

  • memory/2724-36-0x0000000002170000-0x00000000021A4000-memory.dmp

    Filesize

    208KB

  • memory/2724-34-0x0000000002170000-0x00000000021A4000-memory.dmp

    Filesize

    208KB

  • memory/2724-26-0x0000000002170000-0x00000000021A4000-memory.dmp

    Filesize

    208KB

  • memory/2724-24-0x0000000002170000-0x00000000021A4000-memory.dmp

    Filesize

    208KB

  • memory/2724-22-0x0000000002170000-0x00000000021A4000-memory.dmp

    Filesize

    208KB

  • memory/2724-191-0x0000000000400000-0x0000000000454000-memory.dmp

    Filesize

    336KB

  • memory/2724-18-0x0000000002170000-0x00000000021A4000-memory.dmp

    Filesize

    208KB

  • memory/2724-16-0x0000000002170000-0x00000000021A4000-memory.dmp

    Filesize

    208KB

  • memory/2724-14-0x0000000002170000-0x00000000021A4000-memory.dmp

    Filesize

    208KB

  • memory/2724-12-0x0000000002170000-0x00000000021A4000-memory.dmp

    Filesize

    208KB

  • memory/2724-10-0x0000000002170000-0x00000000021A4000-memory.dmp

    Filesize

    208KB

  • memory/2724-64-0x0000000002170000-0x00000000021A4000-memory.dmp

    Filesize

    208KB

  • memory/2724-66-0x0000000002170000-0x00000000021A4000-memory.dmp

    Filesize

    208KB

  • memory/2724-68-0x0000000002170000-0x00000000021A4000-memory.dmp

    Filesize

    208KB

  • memory/2724-54-0x0000000002170000-0x00000000021A4000-memory.dmp

    Filesize

    208KB

  • memory/2724-28-0x0000000002170000-0x00000000021A4000-memory.dmp

    Filesize

    208KB

  • memory/2724-30-0x0000000002170000-0x00000000021A4000-memory.dmp

    Filesize

    208KB

  • memory/2724-32-0x0000000002170000-0x00000000021A4000-memory.dmp

    Filesize

    208KB

  • memory/2724-8-0x0000000002170000-0x00000000021A4000-memory.dmp

    Filesize

    208KB

  • memory/2724-6-0x0000000002170000-0x00000000021A4000-memory.dmp

    Filesize

    208KB

  • memory/2724-5-0x0000000002170000-0x00000000021A4000-memory.dmp

    Filesize

    208KB

  • memory/2724-2-0x00000000741E0000-0x000000007478B000-memory.dmp

    Filesize

    5.7MB

  • memory/2724-3-0x00000000021D0000-0x0000000002210000-memory.dmp

    Filesize

    256KB

  • memory/2724-4-0x00000000021D0000-0x0000000002210000-memory.dmp

    Filesize

    256KB

  • memory/2724-1-0x00000000741E0000-0x000000007478B000-memory.dmp

    Filesize

    5.7MB

  • memory/2724-0-0x0000000000400000-0x0000000000454000-memory.dmp

    Filesize

    336KB