Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    12-05-2024 03:18

General

  • Target

    37fa8fa315d60727ebce5fafa56690b8_JaffaCakes118.exe

  • Size

    240KB

  • MD5

    37fa8fa315d60727ebce5fafa56690b8

  • SHA1

    599c28e16fda50ab1377e900678084ae28557090

  • SHA256

    e398c99bd0f61a4590594dc912e4d4ad23c306df6bd00274e2756d1a28f3ef80

  • SHA512

    cc900fb64eececdd030be5d6b79ef4213f128cae0f4314e77ced24df573d54a68350c2bcd3c5f448e4c640d336ef4888bc2b9a5a6fca1ba39668df4b43c50b09

  • SSDEEP

    6144:6KprPZVxYg036R2eqHzs5oP+8fgsOznWqZajzCrY4Fi/f:HXxk3RHzsmP+agVznWqZa/Cr7AX

Malware Config

Signatures

  • Jigsaw Ransomware

    Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.

  • Renames multiple (1982) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\37fa8fa315d60727ebce5fafa56690b8_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\37fa8fa315d60727ebce5fafa56690b8_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1196
    • C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe
      "C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe" C:\Users\Admin\AppData\Local\Temp\37fa8fa315d60727ebce5fafa56690b8_JaffaCakes118.exe
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      PID:2180

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\invalid32x32.gif.fun

    Filesize

    160B

    MD5

    7bd31afefecc33ea1ce4d68e4747d075

    SHA1

    1f9a19ec5a29df36865ba77217914ed2700f8a43

    SHA256

    e2c4d17c1afed9177aa9b96a20769f55fa2402e3f7c0b794aa0afccbf25daba8

    SHA512

    c7a12dedc792ea8dc00910c43a2d4d52562098b6ef6fb20ef6d1a02f1c6a6cecef5cb38b053b292321f8aecaf0f5fe4724748e0d71ba0d0023153ef5c657fe30

  • C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe

    Filesize

    240KB

    MD5

    37fa8fa315d60727ebce5fafa56690b8

    SHA1

    599c28e16fda50ab1377e900678084ae28557090

    SHA256

    e398c99bd0f61a4590594dc912e4d4ad23c306df6bd00274e2756d1a28f3ef80

    SHA512

    cc900fb64eececdd030be5d6b79ef4213f128cae0f4314e77ced24df573d54a68350c2bcd3c5f448e4c640d336ef4888bc2b9a5a6fca1ba39668df4b43c50b09

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\container.dat.fun

    Filesize

    16B

    MD5

    bee170ea54aa2d72463f533de0c2fc71

    SHA1

    8eb53e2f1bbfe30326f8745d48ac2f94e85e5974

    SHA256

    9a8520991c071633598679cd3098f88c0789d3aa67e6114cec21033c2ab37960

    SHA512

    bcc05419a2f18209d57c27469ea524dade64c1fd984657fcbd2eed5368e18ea183b02323fae33f355115aeecb847e012b1d0b57cf8983751747e9ab0f8f59b4c

  • memory/1196-0-0x000007FEF552E000-0x000007FEF552F000-memory.dmp

    Filesize

    4KB

  • memory/1196-7-0x000007FEF5270000-0x000007FEF5C0D000-memory.dmp

    Filesize

    9.6MB

  • memory/1196-8-0x000007FEF5270000-0x000007FEF5C0D000-memory.dmp

    Filesize

    9.6MB

  • memory/2180-9-0x000007FEF5270000-0x000007FEF5C0D000-memory.dmp

    Filesize

    9.6MB

  • memory/2180-871-0x000007FEF5270000-0x000007FEF5C0D000-memory.dmp

    Filesize

    9.6MB

  • memory/2180-900-0x000007FEF5270000-0x000007FEF5C0D000-memory.dmp

    Filesize

    9.6MB

  • memory/2180-1922-0x000007FEF5270000-0x000007FEF5C0D000-memory.dmp

    Filesize

    9.6MB

  • memory/2180-2002-0x000007FEF5270000-0x000007FEF5C0D000-memory.dmp

    Filesize

    9.6MB

  • memory/2180-2005-0x000007FEF5270000-0x000007FEF5C0D000-memory.dmp

    Filesize

    9.6MB