Analysis

  • max time kernel
    121s
  • max time network
    134s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    28-04-2024 03:37

General

  • Target

    AntivirusDefender-main/JigsawRansomware/JigsawRansomware/JigsawRansomware/bin/Release/JigsawRansomware.vshost.exe

  • Size

    22KB

  • MD5

    da4e23aceac38213052dd9dead13571d

  • SHA1

    66e689243342762dd64f9bab998505d7cc453b6b

  • SHA256

    327983cff9c61c976b1cd64386a40ca18858178a2029ff4ece2c19388d0c61bd

  • SHA512

    7b957cda964a27c2c0b3a5ecf48fe2b01710dea3d01f444c0fa865d1c2bb8a0fb50faca55cb698bfb661de33fbc9d02119029f863905c644db7c013eba4432e6

  • SSDEEP

    384:OfIW5aWMS1q//0GftpBjAE+H3HRN7NslYa0dj:e/A58iCbHJao

Score
1/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\AntivirusDefender-main\JigsawRansomware\JigsawRansomware\JigsawRansomware\bin\Release\JigsawRansomware.vshost.exe
    "C:\Users\Admin\AppData\Local\Temp\AntivirusDefender-main\JigsawRansomware\JigsawRansomware\JigsawRansomware\bin\Release\JigsawRansomware.vshost.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2804
    • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 916
      2⤵
        PID:3048

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2804-9-0x000007FEF57A0000-0x000007FEF613D000-memory.dmp

      Filesize

      9.6MB

    • memory/2804-10-0x0000000000990000-0x0000000000A10000-memory.dmp

      Filesize

      512KB

    • memory/2804-12-0x000007FEF57A0000-0x000007FEF613D000-memory.dmp

      Filesize

      9.6MB

    • memory/2804-13-0x000007FEF57A0000-0x000007FEF613D000-memory.dmp

      Filesize

      9.6MB

    • memory/2804-14-0x0000000000990000-0x0000000000A10000-memory.dmp

      Filesize

      512KB

    • memory/3048-11-0x0000000000260000-0x0000000000261000-memory.dmp

      Filesize

      4KB