Analysis
-
max time kernel
147s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
30-01-2024 05:43
General
-
Target
3efc575b6cfd36e57a7b244a860160a35e76c0945bdad1bd79294a1816887467.exe
-
Size
2.4MB
-
MD5
c2c5848ec8ae11e84d42521c527f75ca
-
SHA1
d8d98dff64297d4cf8a227a2c138efc4774942b2
-
SHA256
3efc575b6cfd36e57a7b244a860160a35e76c0945bdad1bd79294a1816887467
-
SHA512
10e3f210c2d98c090ce3a65be2ff70279c07c1bf3dcb06a48dbfaa34ab6471ed0e8f2a35fbf5bd0c9b61b1c55493c5042daa32556b4b28e22c28e8d80c5d0846
-
SSDEEP
49152:3rKiRwG7r2ie/XMK+kLg7SdqnCvIUdJi0l2Css5qq2nY4/gX1aNnUm5vL:3RXK+b7ScCvFPx3Kr48UmN
Malware Config
Signatures
-
Jigsaw Ransomware
Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.
-
Renames multiple (2613) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 17 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3efc575b6cfd36e57a7b244a860160a35e76c0945bdad1bd79294a1816887467.exe"C:\Users\Admin\AppData\Local\Temp\3efc575b6cfd36e57a7b244a860160a35e76c0945bdad1bd79294a1816887467.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe"C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe" C:\Users\Admin\AppData\Local\Temp\3efc575b6cfd36e57a7b244a860160a35e76c0945bdad1bd79294a1816887467.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
160B
MD5000e8c41d4a15fb34d0be0dbb56e3778
SHA100c4eae64ee6239d7c65d819c6ce1ac329224f8c
SHA2568bdfa6a5b7de345cf0d4fe0e9c17d8b0e9db26d58b05b1b2ebbb3a05a068ff28
SHA512775d832eb8ab73e4a93789917dca69edb6c91fbb426e02acf7c6e213ffb4575776187209d1c471fbf57c4621ea3c23d9850f6dfc2770d62c17de9d66710800af
-
Filesize
12KB
MD5bd42ba47ff97fd7e395c90f79e0f9508
SHA1c2d8069ff6d72f3c63eeeac23933e5620f649d9d
SHA2563ad6f0a5c15cd3e24aa59e9687649e0d8d8b85789f3feef68e22b61a34a183e5
SHA5124eb6b58c46225f6e96bf41177892131384507cd8437e314426b797797c10960db52b84abd1fbf3cd845d1ed4bb8c67d2be3099a9ff5379a04d059b0557ef7fca
-
Filesize
8KB
MD529c6678d44aa7966ae163d70dd9f3661
SHA104e2608b9497905befec2c9c74931cdd14c754e8
SHA256f7634f4769d57b1fd7ff257cafd60a0b309194e610202dfd26fc5113d0abf834
SHA512e80a6a0270d20e255f84ee6ef285b610b79731058f88272b8246e4f0c97222cebf2113d7ae70a1a145c0bec2a94fea5cb5abff0203a8be64c634a9b9b6a3b1b6
-
Filesize
140KB
MD5347fc49ebff58163b5ee2e51e3fe34e2
SHA18c70a4cdf18a01fcbfba9a9d3cf0724fe8e46548
SHA25698698e36a6814b1058ce9859c0720ac9587806bc2d502d3632abfea5e94724d7
SHA512ae591783236e373456a7dda20f0e092bef027dbe47ecab14a74fd9a3e5165954a1eed134414c840fd6e17efc63e74cc3c4a334e9ab456f05f83cc72b8ef2b9dc
-
Filesize
64KB
MD5de953251162e1353fbf81ff7ab89b779
SHA198f46e72661bcd87248e8bb7f65944c8281a9419
SHA256973354a82d1db512c1da20f43db8fe36b9fd2e1816cb497c4e5e056af8f0a97b
SHA512934c0b6501a20ff270e60c7e9f67261d4f48d0c88c1d4fba29126edba3d47f15676778c24c1a3150d546238f585a810409bea3e07317ff41a35d365744eb8282
-
Filesize
120KB
MD5a950da4d87701e016d540880cb97afb6
SHA11db8604ce816ac2bfc8c23f9f5c4c326dd924ae1
SHA256bf77e43fd027d099334fbc67520c7bd5f21bbb0cb2715bfbf2753924bac93712
SHA512784c06653880ff51a1701ea700e47d6f54dab4ac5f71bd18a070f3e3dbf1e6ea754cc5998d7b1195bf83a4db15b1a66f6cf8269faaf988f4cf5de85300c0314d
-
Filesize
2.4MB
MD5c2c5848ec8ae11e84d42521c527f75ca
SHA1d8d98dff64297d4cf8a227a2c138efc4774942b2
SHA2563efc575b6cfd36e57a7b244a860160a35e76c0945bdad1bd79294a1816887467
SHA51210e3f210c2d98c090ce3a65be2ff70279c07c1bf3dcb06a48dbfaa34ab6471ed0e8f2a35fbf5bd0c9b61b1c55493c5042daa32556b4b28e22c28e8d80c5d0846
-
Filesize
16B
MD5cfdae8214d34112dbee6587664059558
SHA1f649f45d08c46572a9a50476478ddaef7e964353
SHA25633088cb514406f31e3d96a92c03294121ee9f24e176f7062625c2b36bee7a325
SHA512c260f2c223ecbf233051ac1d6a1548ad188a2777085e9d43b02da41b291ff258e4c506f99636150847aa24918c7bbb703652fef2fe55b3f50f85b5bd8dd5f6e3
-
Filesize
1.3MB
MD5ca868dff21852b082bfb5bb299287d93
SHA1dc46856bc36b5871b316da7171616736d4055c74
SHA25651c611b16b58e066d3554e74b13a1edd44b0252bdf8041f6d8f060fc08876d48
SHA512ac25032feb35391d98b3d4135176a4b415fe4a1f9cb559e1db7422b279b8fad86cf8df4a50d13d13fb614bf877b333c96b0f986b76ad7ac1d598f5c6f15d53e5
-
Filesize
145KB
MD52ecfc14fc895c70ca3b8e1ddedbf4f16
SHA1cc36f02b23e2e00d052993d5ae4ac4ef8e6968fa
SHA256eb3e3cfc473607d6db8b6c2ae70a994607054de8a167da6e7361ad7a80785966
SHA512a15de82a6be6c3b30068970d5fddabcab1ef3fa2643917c9871317e782bb645f5a43b22b80a0283b5f6e3ecab9e61c7003a96907764a0e9509325bcea7301657
-
Filesize
9.7MB
-
Filesize
3.8MB
-
Filesize
9.7MB
-
Filesize
9.7MB
-
Filesize
256KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
4KB
-
Filesize
3.8MB
-
Filesize
9.7MB
-
Filesize
9.7MB
-
Filesize
3.8MB
-
Filesize
256KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
9.7MB
-
Filesize
9.7MB
-
Filesize
9.7MB
-
Filesize
9.7MB
-
Filesize
9.7MB
-
Filesize
9.7MB
-
Filesize
9.7MB
-
Filesize
9.7MB
-
Filesize
256KB
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
3.8MB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
9.7MB
-
Filesize
9.7MB
-
Filesize
9.7MB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
9.7MB
-
Filesize
9.7MB
-
Filesize
9.7MB
