Analysis

  • max time kernel
    121s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    07-06-2024 17:21

General

  • Target

    VirusShare_3bee1d24189d4941f68b96da6e207be4.exe

  • Size

    436KB

  • MD5

    3bee1d24189d4941f68b96da6e207be4

  • SHA1

    dce911b1c05da965c8733935723b88bc29d12756

  • SHA256

    a375201f22b6e71d8ea0f81266242e4638e1754aeee14059e9c5e39026d6c710

  • SHA512

    a40b01c630ff2c4b90a2e1bbf285c5d558193ee0fba79a3210a56408087ca828292269945e3202f65b8eb038a565b1ea8a18d185864ba9dc4073a3633c86ca29

  • SSDEEP

    12288:5l9mnmYK1bcy9oNm3/oK14MfZGLBddXLA:cqzONmQrBM

Malware Config

Signatures

  • Jigsaw Ransomware

    Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.

  • Renames multiple (2051) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\VirusShare_3bee1d24189d4941f68b96da6e207be4.exe
    "C:\Users\Admin\AppData\Local\Temp\VirusShare_3bee1d24189d4941f68b96da6e207be4.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2804
    • C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe
      "C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe" C:\Users\Admin\AppData\Local\Temp\VirusShare_3bee1d24189d4941f68b96da6e207be4.exe
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      PID:2892

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\invalid32x32.gif.gws

    Filesize

    160B

    MD5

    4624905679a8c26eb3cbcf0bea34785e

    SHA1

    341765659db6ac5dca240a2d559f9767b5ce1252

    SHA256

    799474c262c09de278cab1562154797551483d7e4cdfad242bdf51df82136e06

    SHA512

    25abe41f1b7e95c1371c59d15c27850a207a6221e77413ae3cef50b4c49cb98174f2c6da57f0be62658a545840ae5b55f80f2d24a54bc183babe408369cbc907

  • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\epl-v10.html.gws

    Filesize

    12KB

    MD5

    0642d2d543656090f67737542375d065

    SHA1

    e3712203384538166b0a6210643839d4225e5fae

    SHA256

    324f68091cf265d5fa4232d04155acddb152f7472cab54d433d84c62ece3daa8

    SHA512

    95cf9164922e1b7670d59bc00f2d8a0a9927d97054016c9324bc0121ab964656bb19bebcf6cd020cc6f633d63aa4c3860eea2c1a591142fb3a948235ec22f431

  • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\license.html.gws

    Filesize

    8KB

    MD5

    c62616ef21e492ce9e19f3b534f9f787

    SHA1

    95ba44c7bad9f3c3d64da082db80718438c7f32d

    SHA256

    5b64a36ad55a43e802597f343ba1dadf70a9a00304d60d20e08f58f94ebb9581

    SHA512

    bfdfd2c35a77e1c3d81b3448e0d1a0fb1527bb7a9884d179d64b35ca0c97c5b9c76fda8d9fa6dc4332e18e0962e6fa43de3d5266d9df49643c28769b77d285fd

  • C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe

    Filesize

    436KB

    MD5

    3bee1d24189d4941f68b96da6e207be4

    SHA1

    dce911b1c05da965c8733935723b88bc29d12756

    SHA256

    a375201f22b6e71d8ea0f81266242e4638e1754aeee14059e9c5e39026d6c710

    SHA512

    a40b01c630ff2c4b90a2e1bbf285c5d558193ee0fba79a3210a56408087ca828292269945e3202f65b8eb038a565b1ea8a18d185864ba9dc4073a3633c86ca29

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\container.dat.gws

    Filesize

    16B

    MD5

    c3a747554556df614575dc417c3cf9d9

    SHA1

    2e71688b2013bc93b1c5c01e5fd902a32a62007e

    SHA256

    da1f992586145a03fec57464a38b8bb928cafd8fa9996386732e83a6de555ed7

    SHA512

    eb740b56bfc85d2c5be11af614cb413a0f0e055d6d2311d4790d86ad71c59a2ec4f13e09d04a180e3279c22ac320cfa38892bd0f6a5e8e04299ed64b2d514c2d

  • memory/2804-1-0x000007FEF57A0000-0x000007FEF613D000-memory.dmp

    Filesize

    9.6MB

  • memory/2804-10-0x000007FEF57A0000-0x000007FEF613D000-memory.dmp

    Filesize

    9.6MB

  • memory/2804-0-0x000007FEF5A5E000-0x000007FEF5A5F000-memory.dmp

    Filesize

    4KB

  • memory/2804-5-0x000007FEF57A0000-0x000007FEF613D000-memory.dmp

    Filesize

    9.6MB

  • memory/2892-9-0x000007FEF57A0000-0x000007FEF613D000-memory.dmp

    Filesize

    9.6MB

  • memory/2892-256-0x000007FEF57A0000-0x000007FEF613D000-memory.dmp

    Filesize

    9.6MB

  • memory/2892-255-0x000007FEF57A0000-0x000007FEF613D000-memory.dmp

    Filesize

    9.6MB

  • memory/2892-254-0x000007FEF57A0000-0x000007FEF613D000-memory.dmp

    Filesize

    9.6MB

  • memory/2892-11-0x000007FEF57A0000-0x000007FEF613D000-memory.dmp

    Filesize

    9.6MB

  • memory/2892-2073-0x000007FEF57A0000-0x000007FEF613D000-memory.dmp

    Filesize

    9.6MB

  • memory/2892-2076-0x000007FEF57A0000-0x000007FEF613D000-memory.dmp

    Filesize

    9.6MB