General

  • Target

    0e70bac97f8a8d4eda6347afe83c870b6f87f05f2fe3e7fb0bfcad7b29d0c5e5.exe

  • Size

    47KB

  • Sample

    240519-wlzj7sad87

  • MD5

    ed3a9817328547480076ef8e1e48bc0b

  • SHA1

    218a7b659078f07892d3e9a9905324b0eb95a5ba

  • SHA256

    0e70bac97f8a8d4eda6347afe83c870b6f87f05f2fe3e7fb0bfcad7b29d0c5e5

  • SHA512

    f0e44829ac76c832bf67bd11193f9d3fb91e13f34110c6dd9f751dc79e2605811a99f149e942509d8dfbb7e461adb6d95735ff6fd378527ea4755fbf98034bf4

  • SSDEEP

    768:BvqfRgrW3UJR/01V+FIpUY21RTjI4I17i6WrggpWxjW6msMev+JN5uMYqDYY:QfKrGUXyYFIpUYIpIRi7xyGsMev+JNwg

Malware Config

Targets

    • Target

      0e70bac97f8a8d4eda6347afe83c870b6f87f05f2fe3e7fb0bfcad7b29d0c5e5.exe

    • Size

      47KB

    • MD5

      ed3a9817328547480076ef8e1e48bc0b

    • SHA1

      218a7b659078f07892d3e9a9905324b0eb95a5ba

    • SHA256

      0e70bac97f8a8d4eda6347afe83c870b6f87f05f2fe3e7fb0bfcad7b29d0c5e5

    • SHA512

      f0e44829ac76c832bf67bd11193f9d3fb91e13f34110c6dd9f751dc79e2605811a99f149e942509d8dfbb7e461adb6d95735ff6fd378527ea4755fbf98034bf4

    • SSDEEP

      768:BvqfRgrW3UJR/01V+FIpUY21RTjI4I17i6WrggpWxjW6msMev+JN5uMYqDYY:QfKrGUXyYFIpUYIpIRi7xyGsMev+JNwg

    • Jigsaw Ransomware

      Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.

    • Renames multiple (2036) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks