Resubmissions

19-05-2024 13:56

240519-q8s32sah73 10

11-05-2024 08:02

240511-jxchlafd8x 10

Analysis

  • max time kernel
    140s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    11-05-2024 08:02

General

  • Target

    JigsawRansomware.exe

  • Size

    47KB

  • MD5

    ed3a9817328547480076ef8e1e48bc0b

  • SHA1

    218a7b659078f07892d3e9a9905324b0eb95a5ba

  • SHA256

    0e70bac97f8a8d4eda6347afe83c870b6f87f05f2fe3e7fb0bfcad7b29d0c5e5

  • SHA512

    f0e44829ac76c832bf67bd11193f9d3fb91e13f34110c6dd9f751dc79e2605811a99f149e942509d8dfbb7e461adb6d95735ff6fd378527ea4755fbf98034bf4

  • SSDEEP

    768:BvqfRgrW3UJR/01V+FIpUY21RTjI4I17i6WrggpWxjW6msMev+JN5uMYqDYY:QfKrGUXyYFIpUYIpIRi7xyGsMev+JNwg

Malware Config

Signatures

  • Jigsaw Ransomware

    Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.

  • Renames multiple (2014) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JigsawRansomware.exe
    "C:\Users\Admin\AppData\Local\Temp\JigsawRansomware.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1976
    • C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe
      "C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe" C:\Users\Admin\AppData\Local\Temp\JigsawRansomware.exe
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Suspicious use of FindShellTrayWindow
      PID:2328
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    1⤵
      PID:1804

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\invalid32x32.gif.fun

      Filesize

      160B

      MD5

      000e8c41d4a15fb34d0be0dbb56e3778

      SHA1

      00c4eae64ee6239d7c65d819c6ce1ac329224f8c

      SHA256

      8bdfa6a5b7de345cf0d4fe0e9c17d8b0e9db26d58b05b1b2ebbb3a05a068ff28

      SHA512

      775d832eb8ab73e4a93789917dca69edb6c91fbb426e02acf7c6e213ffb4575776187209d1c471fbf57c4621ea3c23d9850f6dfc2770d62c17de9d66710800af

    • C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe

      Filesize

      47KB

      MD5

      ed3a9817328547480076ef8e1e48bc0b

      SHA1

      218a7b659078f07892d3e9a9905324b0eb95a5ba

      SHA256

      0e70bac97f8a8d4eda6347afe83c870b6f87f05f2fe3e7fb0bfcad7b29d0c5e5

      SHA512

      f0e44829ac76c832bf67bd11193f9d3fb91e13f34110c6dd9f751dc79e2605811a99f149e942509d8dfbb7e461adb6d95735ff6fd378527ea4755fbf98034bf4

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\container.dat.fun

      Filesize

      16B

      MD5

      cfdae8214d34112dbee6587664059558

      SHA1

      f649f45d08c46572a9a50476478ddaef7e964353

      SHA256

      33088cb514406f31e3d96a92c03294121ee9f24e176f7062625c2b36bee7a325

      SHA512

      c260f2c223ecbf233051ac1d6a1548ad188a2777085e9d43b02da41b291ff258e4c506f99636150847aa24918c7bbb703652fef2fe55b3f50f85b5bd8dd5f6e3

    • memory/1976-9-0x000007FEF5D90000-0x000007FEF672D000-memory.dmp

      Filesize

      9.6MB

    • memory/1976-0-0x000007FEF604E000-0x000007FEF604F000-memory.dmp

      Filesize

      4KB

    • memory/1976-1-0x0000000000400000-0x0000000000416000-memory.dmp

      Filesize

      88KB

    • memory/1976-4-0x000007FEF5D90000-0x000007FEF672D000-memory.dmp

      Filesize

      9.6MB

    • memory/1976-11-0x000007FEF5D90000-0x000007FEF672D000-memory.dmp

      Filesize

      9.6MB

    • memory/2328-246-0x000007FEF5D90000-0x000007FEF672D000-memory.dmp

      Filesize

      9.6MB

    • memory/2328-245-0x000007FEF5D90000-0x000007FEF672D000-memory.dmp

      Filesize

      9.6MB

    • memory/2328-244-0x000007FEF5D90000-0x000007FEF672D000-memory.dmp

      Filesize

      9.6MB

    • memory/2328-12-0x000007FEF5D90000-0x000007FEF672D000-memory.dmp

      Filesize

      9.6MB

    • memory/2328-10-0x000007FEF5D90000-0x000007FEF672D000-memory.dmp

      Filesize

      9.6MB

    • memory/2328-2037-0x000007FEF5D90000-0x000007FEF672D000-memory.dmp

      Filesize

      9.6MB

    • memory/2328-2039-0x000007FEF5D90000-0x000007FEF672D000-memory.dmp

      Filesize

      9.6MB

    • memory/2328-2041-0x000007FEF5D90000-0x000007FEF672D000-memory.dmp

      Filesize

      9.6MB

    • memory/2328-2042-0x000007FEF5D90000-0x000007FEF672D000-memory.dmp

      Filesize

      9.6MB