Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
07-06-2024 19:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
VirusShare_4c153eacdfa8807f1c8fd98e5267da4b.exe
Resource
win7-20240221-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
VirusShare_4c153eacdfa8807f1c8fd98e5267da4b.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
VirusShare_4c153eacdfa8807f1c8fd98e5267da4b.exe
-
Size
2.3MB
-
MD5
4c153eacdfa8807f1c8fd98e5267da4b
-
SHA1
ce42e2c694ca4737ae68d3c9e333554c55afee27
-
SHA256
31823040d8ccb20eab0b8653d01af370a6537017e69ead69f6f7b73d6ef7ac14
-
SHA512
b2352099a41460c5c210774e5e63f85bd3c8898b58a3348444b35f233fdac50d2cedec68b7695a10109c3493f430c1e85fe039352d66756c5f6f9e9b0793d851
-
SSDEEP
24576:oF0rCLbf5rqziUnd5l1kqo/wvX0muSOcFjiWrO/iK1ubRM24RWCJG6h/ekExcZ4R:q607QiUnx1k4B9iWrTbi2AhDRek1Z4
Score
10/10
Malware Config
Signatures
-
Jigsaw Ransomware
Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.
-
Renames multiple (2002) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE 1 IoCs
pid Process 1248 drpbx.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\firefox.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Frfx\\firefox.exe" VirusShare_4c153eacdfa8807f1c8fd98e5267da4b.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\StopLock.xlsx drpbx.exe File created C:\Program Files (x86)\Microsoft Office\Templates\Presentation Designs\Maple.gif.kkk drpbx.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\play_rest.png drpbx.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\js\settings.js drpbx.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\CommsIncomingImage.jpg drpbx.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_divider_right.png drpbx.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_left_pressed.png drpbx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin_2.0.100.v20131209-2144.jar drpbx.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_center.gif.kkk drpbx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-sa.xml drpbx.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ExecutiveResume.dotx drpbx.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-next-static.png drpbx.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\header-background.png drpbx.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\ChessIconImages.bmp.kkk drpbx.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.property.nl_ja_4.4.0.v20140623020002.jar.kkk drpbx.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf_3.4.0.v20140827-1444.jar.kkk drpbx.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\background.png drpbx.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-waning-gibbous_partly-cloudy.png drpbx.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.ui_5.5.0.165303.jar.kkk drpbx.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\macroprogress.gif drpbx.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Civic.xml drpbx.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\timer_up.png drpbx.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\macroprogress.gif.kkk drpbx.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-queries_zh_CN.jar.kkk drpbx.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ffd27a_256x240.png drpbx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.lucene.analysis_3.5.0.v20120725-1805.jar drpbx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-editor-mimelookup-impl.jar drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\ga.txt drpbx.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\icon.png drpbx.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.jarprocessor.nl_zh_4.4.0.v20140623020002.jar.kkk drpbx.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\feature.xml.kkk drpbx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-lib-profiler-ui.jar drpbx.exe File created C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Verve.xml.kkk drpbx.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\DiscussionToolIconImages.jpg.kkk drpbx.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-waxing-crescent.png drpbx.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\viewDblClick.js.kkk drpbx.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\SplashImageMask.bmp.kkk drpbx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-core.xml drpbx.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\AppConfigurationInternal.zip drpbx.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrcommonlm.dat drpbx.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationLeft_ButtonGraphic.png drpbx.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_corner_bottom_right.png drpbx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-swing-tabcontrol.xml drpbx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-api-annotations-common.xml drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\tt.txt drpbx.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waxing-gibbous.png drpbx.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.bidi_0.10.0.v20130327-1442.jar.kkk drpbx.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Computers\computericonMask.bmp drpbx.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ffffff_256x240.png drpbx.exe File created C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Equity.xml.kkk drpbx.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground_PAL.wmv drpbx.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\StopIconMask.bmp.kkk drpbx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\org-openide-filesystems_zh_CN.jar drpbx.exe File created C:\Program Files\7-Zip\Lang\pt-br.txt.kkk drpbx.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\ShadesOfBlue.jpg drpbx.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-options-api.xml.kkk drpbx.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-templates_ja.jar.kkk drpbx.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host-remote.xml.kkk drpbx.exe File created C:\Program Files\ResumeSwitch.jpeg.kkk drpbx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgePackages.h drpbx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.batik.css_1.7.0.v201011041433.jar drpbx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.sat4j.core_2.3.5.v201308161310.jar drpbx.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\js\weather.js drpbx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\feature.xml drpbx.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2132 VirusShare_4c153eacdfa8807f1c8fd98e5267da4b.exe Token: 33 2132 VirusShare_4c153eacdfa8807f1c8fd98e5267da4b.exe Token: SeIncBasePriorityPrivilege 2132 VirusShare_4c153eacdfa8807f1c8fd98e5267da4b.exe Token: SeDebugPrivilege 1248 drpbx.exe Token: 33 1248 drpbx.exe Token: SeIncBasePriorityPrivilege 1248 drpbx.exe Token: 33 1248 drpbx.exe Token: SeIncBasePriorityPrivilege 1248 drpbx.exe Token: 33 1248 drpbx.exe Token: SeIncBasePriorityPrivilege 1248 drpbx.exe Token: 33 1248 drpbx.exe Token: SeIncBasePriorityPrivilege 1248 drpbx.exe Token: 33 1248 drpbx.exe Token: SeIncBasePriorityPrivilege 1248 drpbx.exe Token: 33 1248 drpbx.exe Token: SeIncBasePriorityPrivilege 1248 drpbx.exe Token: 33 1248 drpbx.exe Token: SeIncBasePriorityPrivilege 1248 drpbx.exe Token: 33 1248 drpbx.exe Token: SeIncBasePriorityPrivilege 1248 drpbx.exe Token: 33 1248 drpbx.exe Token: SeIncBasePriorityPrivilege 1248 drpbx.exe Token: 33 1248 drpbx.exe Token: SeIncBasePriorityPrivilege 1248 drpbx.exe Token: 33 1248 drpbx.exe Token: SeIncBasePriorityPrivilege 1248 drpbx.exe Token: 33 1248 drpbx.exe Token: SeIncBasePriorityPrivilege 1248 drpbx.exe Token: 33 1248 drpbx.exe Token: SeIncBasePriorityPrivilege 1248 drpbx.exe Token: 33 1248 drpbx.exe Token: SeIncBasePriorityPrivilege 1248 drpbx.exe Token: 33 1248 drpbx.exe Token: SeIncBasePriorityPrivilege 1248 drpbx.exe Token: 33 1248 drpbx.exe Token: SeIncBasePriorityPrivilege 1248 drpbx.exe Token: 33 1248 drpbx.exe Token: SeIncBasePriorityPrivilege 1248 drpbx.exe Token: 33 1248 drpbx.exe Token: SeIncBasePriorityPrivilege 1248 drpbx.exe Token: 33 1248 drpbx.exe Token: SeIncBasePriorityPrivilege 1248 drpbx.exe Token: 33 1248 drpbx.exe Token: SeIncBasePriorityPrivilege 1248 drpbx.exe Token: 33 1248 drpbx.exe Token: SeIncBasePriorityPrivilege 1248 drpbx.exe Token: 33 1248 drpbx.exe Token: SeIncBasePriorityPrivilege 1248 drpbx.exe Token: 33 1248 drpbx.exe Token: SeIncBasePriorityPrivilege 1248 drpbx.exe Token: 33 1248 drpbx.exe Token: SeIncBasePriorityPrivilege 1248 drpbx.exe Token: 33 1248 drpbx.exe Token: SeIncBasePriorityPrivilege 1248 drpbx.exe Token: 33 1248 drpbx.exe Token: SeIncBasePriorityPrivilege 1248 drpbx.exe Token: 33 1248 drpbx.exe Token: SeIncBasePriorityPrivilege 1248 drpbx.exe Token: 33 1248 drpbx.exe Token: SeIncBasePriorityPrivilege 1248 drpbx.exe Token: 33 1248 drpbx.exe Token: SeIncBasePriorityPrivilege 1248 drpbx.exe Token: 33 1248 drpbx.exe Token: SeIncBasePriorityPrivilege 1248 drpbx.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2132 wrote to memory of 1248 2132 VirusShare_4c153eacdfa8807f1c8fd98e5267da4b.exe 28 PID 2132 wrote to memory of 1248 2132 VirusShare_4c153eacdfa8807f1c8fd98e5267da4b.exe 28 PID 2132 wrote to memory of 1248 2132 VirusShare_4c153eacdfa8807f1c8fd98e5267da4b.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\VirusShare_4c153eacdfa8807f1c8fd98e5267da4b.exe"C:\Users\Admin\AppData\Local\Temp\VirusShare_4c153eacdfa8807f1c8fd98e5267da4b.exe"1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe"C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe" C:\Users\Admin\AppData\Local\Temp\VirusShare_4c153eacdfa8807f1c8fd98e5267da4b.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:1248
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
160B
MD5c55a44def54d2d4ad446279e2396fd53
SHA1f77e9719392509d2faadeb953d40a3810c100b83
SHA256257c16c6967bc37b43934987963025ef860d83c198a5a0dc380f72638d6b47f6
SHA512bd8f3b07592b9036ccd6778cf98e1604ee4e93f3273aed09869dd8ecd1a5c084bf2cadca3eb718c09bbc20487f19ad8848f8dc6e613b5b6155df741fd43a0c59
-
Filesize
2.3MB
MD54c153eacdfa8807f1c8fd98e5267da4b
SHA1ce42e2c694ca4737ae68d3c9e333554c55afee27
SHA25631823040d8ccb20eab0b8653d01af370a6537017e69ead69f6f7b73d6ef7ac14
SHA512b2352099a41460c5c210774e5e63f85bd3c8898b58a3348444b35f233fdac50d2cedec68b7695a10109c3493f430c1e85fe039352d66756c5f6f9e9b0793d851
-
Filesize
16B
MD5f676080bd90886ac2ecf680ac3162244
SHA130a721d56041472fcf0c255c3c05c89b76093101
SHA2566e658c85e1ac3f1599673a2374ad5e8fb94520fe68b3f6eefdf108c42acc6414
SHA512b654a04f020ca0ccb0e9f7ab964e0d6a998b15b02ec47cbcccfd1274b99fddeccdca688b1d39e3d82de28610624f8765b1f5ac52895072f7c4cdb824f1658960
