Resubmissions

19-12-2024 08:32

241219-kfqvbsxmgl 10

19-12-2024 08:29

241219-kd1azswrh1 10

19-12-2024 08:22

241219-j9qkzsxkhl 10

19-12-2024 08:18

241219-j7clcaxkbl 6

19-12-2024 08:10

241219-j2wf9swmgz 7

19-12-2024 07:51

241219-jqbbyswnbq 8

19-12-2024 07:51

241219-jp8aaswnbm 3

19-12-2024 07:46

241219-jmcqlswmcm 3

19-12-2024 07:46

241219-jl6bjavrby 3

19-12-2024 07:46

241219-jlylpavray 3

General

  • Target

    b28242123ed2cf6000f0aa036844bd29

  • Size

    87KB

  • Sample

    240311-nrl73ahd82

  • MD5

    b28242123ed2cf6000f0aa036844bd29

  • SHA1

    915f41a6c59ed743803ea0ddde08927ffd623586

  • SHA256

    fd563cf7c0c862ab910cf558b5a123354b616e84902d277edf09f378ff6f9786

  • SHA512

    08e5966ca90f08c18c582e6c67d71186a6f9c025fc9f78020e1ce202814de094171111b7f3623d81f7371acdf92206446f7c0425e08e8f5f5b6fd969007d9fca

  • SSDEEP

    1536:0A1KsVHBnVJ0T1rFTQHUPx+nVP7ZSRILMZoXyqqEbzPCAdt6rFTc:0A1rVIrFTOUsnVP7sRILgAPCvrFTc

Malware Config

Targets

    • Target

      b28242123ed2cf6000f0aa036844bd29

    • Size

      87KB

    • MD5

      b28242123ed2cf6000f0aa036844bd29

    • SHA1

      915f41a6c59ed743803ea0ddde08927ffd623586

    • SHA256

      fd563cf7c0c862ab910cf558b5a123354b616e84902d277edf09f378ff6f9786

    • SHA512

      08e5966ca90f08c18c582e6c67d71186a6f9c025fc9f78020e1ce202814de094171111b7f3623d81f7371acdf92206446f7c0425e08e8f5f5b6fd969007d9fca

    • SSDEEP

      1536:0A1KsVHBnVJ0T1rFTQHUPx+nVP7ZSRILMZoXyqqEbzPCAdt6rFTc:0A1rVIrFTOUsnVP7sRILgAPCvrFTc

    • Jigsaw Ransomware

      Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.

    • Renames multiple (1272) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Modifies Installed Components in the registry

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Registers COM server for autorun

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Legitimate hosting services abused for malware hosting/C2

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.