Overview

overview

10

Static

static

3

ff3.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ff3.exe

  • Size

    7.9MB

  • Sample

    240329-wyzqqsfc67

  • MD5

    b1f1f050af21507b5bd62b480f4b9c34

  • SHA1

    5504b18fff8a83d56b9e9e6632c9fd9c63504342

  • SHA256

    6120ecd92b2bb3b99e7dfff5e840e80ae2500fbfb8991913f7ebe1c79375d273

  • SHA512

    4947d0ee0ed239757091bed5e16a5df2b86115d9c3762467080a3dce6de47cf817389ab769c898a731beb9f7a8a5956f9cc84dadf4ecae83137a2d20b2a08b8a

  • SSDEEP

    98304:qqW2snOP6yvIEr91XOi9oxuga+wCnmOQ30uABd/p8aOTRCSOB/hMoL7t0HvJzk7L:qqnkff+HoxJirP4

Score
10/10
jigsawpersistenceransomwarespywarestealer

Malware Config

Targets

    • Target

      ff3.exe

    • Size

      7.9MB

    • MD5

      b1f1f050af21507b5bd62b480f4b9c34

    • SHA1

      5504b18fff8a83d56b9e9e6632c9fd9c63504342

    • SHA256

      6120ecd92b2bb3b99e7dfff5e840e80ae2500fbfb8991913f7ebe1c79375d273

    • SHA512

      4947d0ee0ed239757091bed5e16a5df2b86115d9c3762467080a3dce6de47cf817389ab769c898a731beb9f7a8a5956f9cc84dadf4ecae83137a2d20b2a08b8a

    • SSDEEP

      98304:qqW2snOP6yvIEr91XOi9oxuga+wCnmOQ30uABd/p8aOTRCSOB/hMoL7t0HvJzk7L:qqnkff+HoxJirP4

    Score
    10/10
    jigsawpersistenceransomwarespywarestealer

    • Jigsaw Ransomware

      Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.

      ransomwarejigsaw

    • Renames multiple (3710) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks