Analysis

  • max time kernel
    143s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    30-01-2024 05:44

General

  • Target

    95b7cfcdbe25fce19e887510d5da55ffdff66b3ef6db7400977f9bb94f9fec2c.exe

  • Size

    5.3MB

  • MD5

    79b6d4f066d1875b18de19ad54177fa7

  • SHA1

    d99188afd625268875b1050bd561a72c51d51d38

  • SHA256

    95b7cfcdbe25fce19e887510d5da55ffdff66b3ef6db7400977f9bb94f9fec2c

  • SHA512

    365ac763dfd0986ad06acfc6b5d6a1c124ec8816d5a5ddc05f4145a91bb6fd50b7e97b4fa3d309adfe4995f57375583c619d919ecdcc1b3c792cdef9e6414cd6

  • SSDEEP

    49152:CGUKMViI+OozP3w5C49ckglrOugdutUeUCyLQrO/LH:IK0iI+HPA

Malware Config

Signatures

  • Jigsaw Ransomware

    Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.

  • Renames multiple (2092) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX dump on OEP (original entry point) 7 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\95b7cfcdbe25fce19e887510d5da55ffdff66b3ef6db7400977f9bb94f9fec2c.exe
    "C:\Users\Admin\AppData\Local\Temp\95b7cfcdbe25fce19e887510d5da55ffdff66b3ef6db7400977f9bb94f9fec2c.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2564
    • C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe
      "C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe" C:\Users\Admin\AppData\Local\Temp\95b7cfcdbe25fce19e887510d5da55ffdff66b3ef6db7400977f9bb94f9fec2c.exe
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Suspicious use of AdjustPrivilegeToken
      PID:372

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\invalid32x32.gif.zemblax

    Filesize

    160B

    MD5

    000e8c41d4a15fb34d0be0dbb56e3778

    SHA1

    00c4eae64ee6239d7c65d819c6ce1ac329224f8c

    SHA256

    8bdfa6a5b7de345cf0d4fe0e9c17d8b0e9db26d58b05b1b2ebbb3a05a068ff28

    SHA512

    775d832eb8ab73e4a93789917dca69edb6c91fbb426e02acf7c6e213ffb4575776187209d1c471fbf57c4621ea3c23d9850f6dfc2770d62c17de9d66710800af

  • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\epl-v10.html.zemblax

    Filesize

    12KB

    MD5

    bd42ba47ff97fd7e395c90f79e0f9508

    SHA1

    c2d8069ff6d72f3c63eeeac23933e5620f649d9d

    SHA256

    3ad6f0a5c15cd3e24aa59e9687649e0d8d8b85789f3feef68e22b61a34a183e5

    SHA512

    4eb6b58c46225f6e96bf41177892131384507cd8437e314426b797797c10960db52b84abd1fbf3cd845d1ed4bb8c67d2be3099a9ff5379a04d059b0557ef7fca

  • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\license.html.zemblax

    Filesize

    8KB

    MD5

    29c6678d44aa7966ae163d70dd9f3661

    SHA1

    04e2608b9497905befec2c9c74931cdd14c754e8

    SHA256

    f7634f4769d57b1fd7ff257cafd60a0b309194e610202dfd26fc5113d0abf834

    SHA512

    e80a6a0270d20e255f84ee6ef285b610b79731058f88272b8246e4f0c97222cebf2113d7ae70a1a145c0bec2a94fea5cb5abff0203a8be64c634a9b9b6a3b1b6

  • C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe

    Filesize

    134KB

    MD5

    0dcea20697ee8d55a543627b06ceb3cd

    SHA1

    33268528a73c4095bff810d012b2ab9384c01b33

    SHA256

    751e481669b52edabe1f44a7d6bbf4cdcb12fa13e08e0c1f00325ebbd5e76ead

    SHA512

    ae6e2726a311ff3851340a9f52839f963923990d1ea34644ce921114624ac560e957012f36aa912817d8cf595224550277f036ca9828b39093d4b1ef2e608131

  • C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe

    Filesize

    133KB

    MD5

    aebab744da08df109a49a5a849d575f3

    SHA1

    a39f583bab052b357463de57570f905cc35f99e3

    SHA256

    bd4846da0808c0ae4c642cea3477b0404a0689a9dd44017caaaf803c17c5a4c8

    SHA512

    330680938f6bf394e5cc10a317c45959b37c3d26996378681db857c517587040bdbc45447bbfedd694f46a2a5f8e20e6bd88931b209499b843b8ca6d7e7cf449

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\container.dat.zemblax

    Filesize

    16B

    MD5

    cfdae8214d34112dbee6587664059558

    SHA1

    f649f45d08c46572a9a50476478ddaef7e964353

    SHA256

    33088cb514406f31e3d96a92c03294121ee9f24e176f7062625c2b36bee7a325

    SHA512

    c260f2c223ecbf233051ac1d6a1548ad188a2777085e9d43b02da41b291ff258e4c506f99636150847aa24918c7bbb703652fef2fe55b3f50f85b5bd8dd5f6e3

  • \Users\Admin\AppData\Local\Drpbx\drpbx.exe

    Filesize

    12KB

    MD5

    d24ec82a4d319cd22ea140e307996a90

    SHA1

    b84a2c99c98cf45e7e104dcc2bff1330c2f660f0

    SHA256

    b10c8ae59fe50e09bd51f7da9750fbadadf6960694558f1bdd902c5912a1866c

    SHA512

    1920922f1adea644e62e604254d4570750287e3bdd4af0f895a1d81a7d6a7c08275dc06f2e7644eb2bebb075b7f5f8cd5381455c4298758009d8fe1ae130da21

  • memory/372-582-0x0000000000400000-0x0000000000454000-memory.dmp

    Filesize

    336KB

  • memory/372-340-0x0000000002210000-0x0000000002250000-memory.dmp

    Filesize

    256KB

  • memory/372-585-0x0000000074D10000-0x00000000752BB000-memory.dmp

    Filesize

    5.7MB

  • memory/372-586-0x0000000002210000-0x0000000002250000-memory.dmp

    Filesize

    256KB

  • memory/372-580-0x0000000002210000-0x0000000002250000-memory.dmp

    Filesize

    256KB

  • memory/372-581-0x0000000002210000-0x0000000002250000-memory.dmp

    Filesize

    256KB

  • memory/372-583-0x0000000074D10000-0x00000000752BB000-memory.dmp

    Filesize

    5.7MB

  • memory/372-2455-0x0000000002210000-0x0000000002250000-memory.dmp

    Filesize

    256KB

  • memory/372-353-0x0000000002210000-0x0000000002250000-memory.dmp

    Filesize

    256KB

  • memory/372-2462-0x0000000006160000-0x0000000006260000-memory.dmp

    Filesize

    1024KB

  • memory/372-339-0x0000000001FB0000-0x0000000001FB1000-memory.dmp

    Filesize

    4KB

  • memory/372-2461-0x0000000002210000-0x0000000002250000-memory.dmp

    Filesize

    256KB

  • memory/372-177-0x0000000002210000-0x0000000002250000-memory.dmp

    Filesize

    256KB

  • memory/372-184-0x0000000002210000-0x0000000002250000-memory.dmp

    Filesize

    256KB

  • memory/372-183-0x0000000074D10000-0x00000000752BB000-memory.dmp

    Filesize

    5.7MB

  • memory/372-179-0x0000000002210000-0x0000000002250000-memory.dmp

    Filesize

    256KB

  • memory/372-2456-0x0000000006160000-0x0000000006260000-memory.dmp

    Filesize

    1024KB

  • memory/372-174-0x0000000074D10000-0x00000000752BB000-memory.dmp

    Filesize

    5.7MB

  • memory/372-172-0x0000000002210000-0x0000000002250000-memory.dmp

    Filesize

    256KB

  • memory/372-171-0x0000000000400000-0x0000000000454000-memory.dmp

    Filesize

    336KB

  • memory/2564-59-0x0000000001F10000-0x0000000001F44000-memory.dmp

    Filesize

    208KB

  • memory/2564-13-0x0000000001F10000-0x0000000001F44000-memory.dmp

    Filesize

    208KB

  • memory/2564-29-0x0000000001F10000-0x0000000001F44000-memory.dmp

    Filesize

    208KB

  • memory/2564-33-0x0000000001F10000-0x0000000001F44000-memory.dmp

    Filesize

    208KB

  • memory/2564-35-0x0000000001F10000-0x0000000001F44000-memory.dmp

    Filesize

    208KB

  • memory/2564-170-0x0000000004BF0000-0x0000000004C44000-memory.dmp

    Filesize

    336KB

  • memory/2564-37-0x0000000001F10000-0x0000000001F44000-memory.dmp

    Filesize

    208KB

  • memory/2564-39-0x0000000001F10000-0x0000000001F44000-memory.dmp

    Filesize

    208KB

  • memory/2564-41-0x0000000001F10000-0x0000000001F44000-memory.dmp

    Filesize

    208KB

  • memory/2564-45-0x0000000001F10000-0x0000000001F44000-memory.dmp

    Filesize

    208KB

  • memory/2564-162-0x0000000002240000-0x0000000002241000-memory.dmp

    Filesize

    4KB

  • memory/2564-181-0x0000000074D10000-0x00000000752BB000-memory.dmp

    Filesize

    5.7MB

  • memory/2564-178-0x0000000000400000-0x0000000000454000-memory.dmp

    Filesize

    336KB

  • memory/2564-47-0x0000000001F10000-0x0000000001F44000-memory.dmp

    Filesize

    208KB

  • memory/2564-49-0x0000000001F10000-0x0000000001F44000-memory.dmp

    Filesize

    208KB

  • memory/2564-25-0x0000000001F10000-0x0000000001F44000-memory.dmp

    Filesize

    208KB

  • memory/2564-23-0x0000000001F10000-0x0000000001F44000-memory.dmp

    Filesize

    208KB

  • memory/2564-0-0x0000000000400000-0x0000000000454000-memory.dmp

    Filesize

    336KB

  • memory/2564-19-0x0000000001F10000-0x0000000001F44000-memory.dmp

    Filesize

    208KB

  • memory/2564-17-0x0000000001F10000-0x0000000001F44000-memory.dmp

    Filesize

    208KB

  • memory/2564-15-0x0000000001F10000-0x0000000001F44000-memory.dmp

    Filesize

    208KB

  • memory/2564-27-0x0000000001F10000-0x0000000001F44000-memory.dmp

    Filesize

    208KB

  • memory/2564-11-0x0000000001F10000-0x0000000001F44000-memory.dmp

    Filesize

    208KB

  • memory/2564-5-0x0000000001F10000-0x0000000001F44000-memory.dmp

    Filesize

    208KB

  • memory/2564-4-0x0000000001F10000-0x0000000001F44000-memory.dmp

    Filesize

    208KB

  • memory/2564-61-0x0000000001F10000-0x0000000001F44000-memory.dmp

    Filesize

    208KB

  • memory/2564-63-0x0000000001F10000-0x0000000001F44000-memory.dmp

    Filesize

    208KB

  • memory/2564-65-0x0000000001F10000-0x0000000001F44000-memory.dmp

    Filesize

    208KB

  • memory/2564-67-0x0000000001F10000-0x0000000001F44000-memory.dmp

    Filesize

    208KB

  • memory/2564-51-0x0000000001F10000-0x0000000001F44000-memory.dmp

    Filesize

    208KB

  • memory/2564-55-0x0000000001F10000-0x0000000001F44000-memory.dmp

    Filesize

    208KB

  • memory/2564-57-0x0000000001F10000-0x0000000001F44000-memory.dmp

    Filesize

    208KB

  • memory/2564-53-0x0000000001F10000-0x0000000001F44000-memory.dmp

    Filesize

    208KB

  • memory/2564-43-0x0000000001F10000-0x0000000001F44000-memory.dmp

    Filesize

    208KB

  • memory/2564-31-0x0000000001F10000-0x0000000001F44000-memory.dmp

    Filesize

    208KB

  • memory/2564-21-0x0000000001F10000-0x0000000001F44000-memory.dmp

    Filesize

    208KB

  • memory/2564-9-0x0000000001F10000-0x0000000001F44000-memory.dmp

    Filesize

    208KB

  • memory/2564-7-0x0000000001F10000-0x0000000001F44000-memory.dmp

    Filesize

    208KB

  • memory/2564-2-0x0000000074D10000-0x00000000752BB000-memory.dmp

    Filesize

    5.7MB

  • memory/2564-3-0x0000000000260000-0x00000000002A0000-memory.dmp

    Filesize

    256KB

  • memory/2564-1-0x0000000074D10000-0x00000000752BB000-memory.dmp

    Filesize

    5.7MB