Overview

overview

10

Static

static

3

20a637cd63...b7.exe

windows7-x64

10

20a637cd63...b7.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    20a637cd6394c41636133b24d78d52a0e091c8012cee9dbf6c4060656f6c7cb7

  • Size

    65KB

  • Sample

    240130-gerhpabaam

  • MD5

    269de662c8b796f35e614a1aa807d769

  • SHA1

    43f32f0e0d952dba0bc2cb3c0657291f0930ec8a

  • SHA256

    20a637cd6394c41636133b24d78d52a0e091c8012cee9dbf6c4060656f6c7cb7

  • SHA512

    4d99243d079668e08342dc015e8f0749b452fd0ae4a1f7b7d047a1b499289ca6044691641db661f90978082e8262e43bcb6230f9e87e0f7f770d568d9b381009

  • SSDEEP

    1536:CjNlIZUY1sIzYi7D10Py7kCZnA37TuPAn:JZUYxYID6DUnArTuC

Score
10/10
jigsawpersistenceransomware

Malware Config

Targets

    • Target

      20a637cd6394c41636133b24d78d52a0e091c8012cee9dbf6c4060656f6c7cb7

    • Size

      65KB

    • MD5

      269de662c8b796f35e614a1aa807d769

    • SHA1

      43f32f0e0d952dba0bc2cb3c0657291f0930ec8a

    • SHA256

      20a637cd6394c41636133b24d78d52a0e091c8012cee9dbf6c4060656f6c7cb7

    • SHA512

      4d99243d079668e08342dc015e8f0749b452fd0ae4a1f7b7d047a1b499289ca6044691641db661f90978082e8262e43bcb6230f9e87e0f7f770d568d9b381009

    • SSDEEP

      1536:CjNlIZUY1sIzYi7D10Py7kCZnA37TuPAn:JZUYxYID6DUnArTuC

    Score
    10/10
    jigsawpersistenceransomware

    • Jigsaw Ransomware

      Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.

      ransomwarejigsaw

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks