Analysis
-
max time kernel
99s -
max time network
462s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
-
submitted
30-06-2024 23:32
General
-
Target
5cc851c0bce31e62a7c293c01117e5d80383b97ce97c040f2c08cfaa29380037.exe
-
Size
676KB
-
MD5
c1ed709a4375516d25889357d0660f00
-
SHA1
3f16cd69f3772b9aa51ff2b528f95227e7caed6f
-
SHA256
5cc851c0bce31e62a7c293c01117e5d80383b97ce97c040f2c08cfaa29380037
-
SHA512
215cc02a53e3d0eff52f511c516fd5d87726926984e84cd18a7b35c3783792a0ee050e736f2c72bc28d42f1975bb6314d9f0f9e28766839db257c7c500c81ac0
-
SSDEEP
12288:CDWaTyXxfuXcaUl32k9ozkqkArFWt86fS9Cx6XK:CDWDfhai32k9631rFHYS9h
Malware Config
Extracted
C:\Users\Admin\AppData\Local\chrme\chrome.exe
Signatures
-
Jigsaw Ransomware
Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.
-
Renames multiple (721) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5cc851c0bce31e62a7c293c01117e5d80383b97ce97c040f2c08cfaa29380037.exe"C:\Users\Admin\AppData\Local\Temp\5cc851c0bce31e62a7c293c01117e5d80383b97ce97c040f2c08cfaa29380037.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\chrme\chrome.exe"C:\Users\Admin\AppData\Local\chrme\chrome.exe" C:\Users\Admin\AppData\Local\Temp\5cc851c0bce31e62a7c293c01117e5d80383b97ce97c040f2c08cfaa29380037.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
720B
MD56ca3c948e7d757d06a347cbbcd938435
SHA124f90deea92cbcd9c8272e0b7dc712107d2183ca
SHA2569153202b6d3713731916df3192f6e89f6914fdf73103de398d46403ea4fa1ed1
SHA512e5889822093c9446186c7dbf6b0092c9dedc47c90ae17afefb99fba7f963d59a141a9c1fb9f00df2c1188d857c50a83c03f7531c8884c6a48a144e1205a59bac
-
Filesize
7KB
MD5a612a1ca153321e1315bf7138deaede9
SHA15e257b4da48735a9d7b7075dd333255d9da40fe3
SHA2569c02e675fae520439d2e17d611dc6495e45c7647912a292ed9c17553212cc896
SHA5123784f749f4b190d5a0c00537c9f54272db5cdbff03e1b32e68fe7b343931fb72f97394bde519b7a9ecdd68baa15744dd2e03dad9039a822129242a02ba8419f2
-
Filesize
7KB
MD5d7ea380bbee72d80570c20e28d919434
SHA1f37de5d4974245ad3d0fdd6ceb0b21ea151e0df8
SHA2563b603fd9bebbf580eba7bdfc1c856eb34a537c2e4fa04aab954310852526ec06
SHA51287b59fb1a33f56e5272500505a64b3a39848bad5705fa88933d4f86d878d8e7bdb032e39f4cd9f24efc09434de91d79c97423f153ee02f4da51787021b82fb30
-
Filesize
15KB
MD5ff77ad92a36c43545035d2c7a1258d25
SHA10c6cdca6665bfc477b9db0eb9524683315a4a38c
SHA256c3efa3f75f083944951058f20ad6132f2beb697051a682445f15d557841298e1
SHA512a9dbb93c0900b2daba7c11609db904ec47d9aa0465445299b231073c9f4b73ae7f5411ad024b702e5398cb5d4c59182cb6cd6133734fd3b9de7783b4064cf51f
-
Filesize
8KB
MD5f6958603232ceac6f500a8147b1a59c0
SHA17532583168b31f67384d463c84d20224c13b8269
SHA2567f59c6901e9498857d618432e8191244ca2956566b605a6164c003cea1867b51
SHA5124b7883b78dbc48a3c8bd2d76ccbda645c69bcfeaccc8ae18594a05f3650ac2ca63d473c9487031022c25a4666f7a9e4497725c612e879ba41d64cc03a7fbe58e
-
Filesize
17KB
MD5f7a793ddcadefc367b1a95fc750eba3a
SHA163dc5cbfc85ac29b5b22b7b6c9b455f993b2105a
SHA2560bf61c63acca0596fea352f3bf5275b67e15d670e84a01710d1de977f4170b36
SHA512a7874de092872472b0023057ffdf33b43d05ed1a36e76ec1accaa3a84145b914867eca9a0fa773f578acfdcbc5b327b812e98eece0fb4db57a4bab9633deb6ec
-
Filesize
448B
MD5ce3c3fcd1b6e5b2b5a232e0dc54481e2
SHA1516bcd881b43af22276c2434df876781e6f5b2ab
SHA2567b909b99e65750fead9082c88b96a47f549f6069ffe9b504fe5de4f780ae96db
SHA5122bbdbf6bd9f8979115c841f54c21a885d9493f0d559da83103af37d460e65eca015e7393a3cd74e051091d8446631d61ec6d77b59bb91d4d9f819285f473b6ad
-
Filesize
624B
MD502ae5e4ff5e6b03d9a80eb59ee809b71
SHA15c051db3f0d3ade84d734dd7801c62e21e37675a
SHA256a8f8862233a8fcf75a959e98fdb94f88d3240f44aafb3bff128078243cead012
SHA5128e9f53075ffc0f57e85d5ee2d0adb2197117ca95dfbdcf9cbb267968ce373bed98f7642135dd83c59e27456d3ee7126ba339caf9cf6559708ab7d5ed058e680a
-
Filesize
400B
MD50f91902056860423a57179f4b0b2de88
SHA17068dda4aedc111503cb4904b304fbd5255e55db
SHA256f4b53909d47ebf968166f8b8e952506d9207fbb11e23c7ddb80dfe347dee145f
SHA512b5fdf6c672bf63e9e7a30e4eeaa0e830104c0e8a58ae785431cdf225ce09ba1489b3d93337886f9c15824ca4b83d5d0d997c8a3f39143fc967a2a2c666470da3
-
Filesize
560B
MD5f056b50930cd41153d3262d5aaaf8649
SHA14e535f397cc1f05d29a59b6dd221e4602bf1b801
SHA256dc61d8c7cd557ce8101d129fa13b6af01ed24fdbf8b0683eb7cbec9610b781a4
SHA512bf9969f52baba022f2e6438759bf68a25e4b34e82cd60bf915f795db643e31e85f7e5f2ae404010da090cd7f673e038a4e6bc153498c3f0f4aa2864c9cf5aeaf
-
Filesize
400B
MD507dfd980ab32a8e99eb8235be35988a7
SHA12f294fdb28d55b7a9ea07c9af1b3c74515feb743
SHA2561e5ffecb0af2626fab3753aaf10d078bc713a1e649736b396785452321c8f9b8
SHA51289d031b7f066ce1409df9cc3ddddb779d2d6b00bc5c1707aa02b565aa971cea41242a36c4e5c54606dc1f4ce06fdfec6ecd462c4d8174b8e8a4751fdae3a146e
-
Filesize
560B
MD5553fdf2733d3727ca294b8cebe4aa3cd
SHA1c2da40a42990472a20fe462c68c6fcb6b02300a5
SHA25665d41b1abc6c4293ad0224600985259de967a27886d316e496f92eef98b321c0
SHA5124ee7f631a24bf3e3f37b67a536ae418d10bbd8276ff1cbb294ea29772deba6f870c55ed5001dd2f40399f1726f865e836b861750a31acb577e600ea63a2fafea
-
Filesize
400B
MD558197d4ca83316602fcd779338c61169
SHA15a7797fc8ddd14e460eca118b5f856ee66586ec4
SHA2568fea5658a2d0d1c2d50be98a45f04244c284988a732ba5ee9071bfe10b999c8b
SHA512823dc1401a139a79c717ee63c1df993f615105c93abc1c857869a3435d851e13bd74db2454c219defb94809194bddbaaadea69ac0719aa97f36858d5e76ab17f
-
Filesize
560B
MD5a2ed565ce2528828055be8fe24995252
SHA194d175ea415d5b24d3a18b73a11f474cbf42d8af
SHA256bd1dcfdea516600079dcb6d33dbd3e62dc9a5a9e8186662346b8676dd9b01043
SHA5121a537b894f1bc5ce6fd49637cb3f8b59a2596ebab67851a4c21507782a7abb26c1445eaca901f6772d6b7cf991550597341774109e541cd266d9ded85e497339
-
Filesize
688B
MD581a4dabd6a90e21ee4fc73f5d60efc18
SHA1b1e2c93ef01a1bccced7533569875d3341d3b964
SHA25610c8fddc627559947566443ee297e6eeeaf4707613b105a3a6e8edef64adb9a4
SHA5123e8afdfd36f88ecce8c2050836310a0f4b4df11d04c9ce034287cd79a0af03df93aac8965bcab5f0a23e3bb97864306fafd7966a538c4f2c1715854a1ffa9ab4
-
Filesize
1KB
MD5a7cefeeb8d29f03c5d6564cfe7562497
SHA18971340ab9fe23a819cc6153ccb193afd7a2b5df
SHA256c8a652b2e78c61aebd4caca556906b59f713b7d8bb841d8dc6ce69d182b01b26
SHA512b2a0ee3b728882f468105a9ec3e05fcb8c6e027cb584a6e95f782fe1c55147ef1260f443cedbd1e3328eddb5f5e277f13299ef03922c7dd1db4d1b57b6b1a43a
-
Filesize
192B
MD59b682a160d93639c61bdc046f5b0dc30
SHA18aecc1f2269df93a38188aac6f5e2882a73b68a3
SHA256f938c9c5fdbeeee16c35f43733e52646b3685143804457f3ae6cb19ea8d197ab
SHA512e31efc902d28b1b4772c80513e4f3ab89961cb2e7e0c3bd9d1031fdafb2065a9a1b0538ff77f3879f0a5bec2ffb2c9a31e6c8ce3c635548b9165f3cf997689eb
-
Filesize
704B
MD5cfa87d6b32b722102e6c32177153a125
SHA19999a98f19457bd701095d90bac1ed1630ea9496
SHA2565e25b15b3f0f845e5072fee751fadbffc49d6fa4ffe05d0f40c338741aa22dcc
SHA5121a671f87ffa32c527b6b578ce3eed80170bce94f8a69d1be74522daa72f4d2959f35df91a5ca3adbc2c40e1e8414054e316f6b7a0695d59a5c3b10288d493a75
-
Filesize
8KB
MD5e36b78b55205e4ea06faa9bd4a22f026
SHA112ad757081e795a875a09c89382aae6c35688328
SHA2563e82bcd85ba57cbc781caef9ea710da550ac0dce89a2a8886d4a24d291400457
SHA512fae7771dc947fb07ba523869ce129cb1ffa1b0cb1402f68f70a925891fbb079c744445e435e5aa1f2ef719918d4419565ee40812bf628a95961dc87daa695aa0
-
Filesize
19KB
MD57c8ef562bbdbe3ebaff24c1c6ea565d1
SHA1a22b1d45e04da54624af339d10044359e35b55bc
SHA256e85ba08aac39523041999b4a17727e98d1c9ff4ecf09fe7c94d0879fa8cb69a9
SHA5126e4acf12006dcd8b3e82196535f2c3c50b402a2358e10178378a34e3142b168e8a365077920bdba8c4f6034a8f4dfb92d2c2a7e407464cc576facf1d0c84d4ef
-
Filesize
832B
MD5c147efab49dd5a88feadeab96e8827ee
SHA1b28b2ac17536db0447a9ef371895cf73dca34181
SHA25607e7f14ac78252e7450cc26deabec24cdf75c52d89758b46cbd3a546bf005d18
SHA5128ae8d29778f236fddc5281af629a267c799269eee23033e7289b8cb3fef77c07c0177979e5bff410064dbc111ad2667a4b22c6fe6f738a0478c2eb65e8edad5e
-
Filesize
1KB
MD57a342d57b975f1a8f92c424c8636a532
SHA1cbd12d2d7f0b75bc11e7b9742d99b30b3f591a99
SHA256608a663dfa8d453647be4261b0d10f64bf9b59b46ec00aed6d37447b8fb21dc5
SHA512a794ef6f8e14a73d93072b2a1744a77c7fe9c55273a61ba7a1bc2ef870de680a71909f04297d2dcf78bcfd79aaf528514e12fb9c06e490c8f127ea06f938593a
-
Filesize
1KB
MD53485bdbdbea11d6ca7d6d872ee4e6659
SHA1ad9d39e6e54c3756f7ceb65723cdc023189d3fe5
SHA256d509a8a2c1ed47754b8527a84326b069802b00c9d1082cf229b3ebbdae4e5f76
SHA51210279cce4c4384e94fbbaa458225d446242fc2094590e060b5548027f3d3b3f2718bc697ae1d87f34d86d91a57e7d6aedfa005b2dfcb26524f3b9b709befa267
-
Filesize
2KB
MD53ebd863531cbbf18454a629ee091b218
SHA1e0738cf22253704283bf1ab05485afb4f6a7a4d1
SHA2569cd4bd1cacaca8d6d06d5cebc7d26bec0f31213b79397f4b865550f4ea64268e
SHA512bdc475993e720eae46756115569d2dddd7ff78b207e9a4b8d1c3552166ca4c57ff5817ba7c675191c56122a93f342efb921238bf488c657eccd04cd493e3880c
-
Filesize
2KB
MD53c657b8608990f18130329a447306149
SHA1410ac7816a6bcb430f4e0a47be32643b938425b8
SHA2562a7747c3d54e3836dd17fdd54691cb0db7453ab5a77f141fe9a245c10919c9ff
SHA512b8ef7cbbb78db9a9701aa63b9b7f1699e8d8bfc587c03c381c843bd29da637363bff0ed97630263224e1ca52425154236d6d68b4d07d224b7c42ae3fdc0a8541
-
Filesize
4KB
MD5b4000b24696f0499f6caf20075286b26
SHA1090f958b802963ef025da503d79bef48a258dae7
SHA256c778acace7c582c823e895af83272e1154de0eddf497b55cf4d62de547261b25
SHA5127d3f9f16342bb2a59b1f2771293200c81c787cd311c00e116c95db5f6d882ee74810aef58518a204e3f393abf891d03043908058ad380fbc96821b187efbcac3
-
Filesize
304B
MD5e3d8af4afaddb0c259b78c22a01e83e2
SHA19f55f935e502c49feba4b661a02c96b6fb0ca1cf
SHA2569d2cdb65f008630809af945b1f2a2938a27d1a764003b9e1f559be461280f5ec
SHA51213670abdec774c924981385a7d1e5d6b91a8882b1d134ddaa1ed47e1e6d942c1283d2acc805dcbaf3682ba726ef6f491bf2e65bf0dfd034ae9c950890b9ae4a1
-
Filesize
400B
MD5b9f0e212f51bd7a3b4ad4581f47ac193
SHA14ee1fdf75724dc9999ca660d4f067bb24696f623
SHA256f4c917b9ed2a5bb141f77372e5afcdee27c18c35b722104588a872ad0a83c62d
SHA51219710b3803856f2ada527e01753e0e65d77ddca6d0735545650be8bb3abd670b2f6f7e88d298435748435e587d5992e3406c38b272601ae5352e3b8a2b9a1b7d
-
Filesize
1008B
MD5ae7364620d56536a71270dbbfc2acde4
SHA1ba340d4c7de5e0ffd9839ab6f2e749f1295d0d58
SHA25622578a783778394b63628c4eb7ab66d15ce7ed23e682b545cbc5dbf8b2184955
SHA512e6ea1985d986e7fbfa6e021efe51a9b1f4c8a53718755e2828ff9d7246d550697d622605f984a55cd2a9330c72ee6e94b4442029e3d80c180e26849cdfa0ff13
-
Filesize
1KB
MD55dc3f8b9f12a7d917b68ff3dad8d4af0
SHA16791cf4cf36ff84e1d7be01eafbcb7a9f8722305
SHA2561cf78cd61983d985fd05a97e653da4a1b1d40f8834d33340929a109eebd10605
SHA512156e9d6c2c0905e20c90c61ad49868253484667924814ee38f40b21623931ff1de9aea24f00b781631f854f227ff5908265353f8fe949a6a648420e1c4393b69
-
Filesize
2KB
MD5a6c9283864ddf94dde2f06e17afcf02b
SHA1c8a2e693df492d0e94828430b2f2092724aa0fb9
SHA256e1e4c9586b0a10195b7ca71c2c980530be2199fb5c34eebdffee8f659120c963
SHA512760a091d75e1f8fde76ba7624064405fd32708362592cc7c8881f96c5112f098ebe3ad18fe324e8ea0dfade8063bc1be9e76674e9b435d0951b3054c53a31ba8
-
Filesize
848B
MD5bfc84bc3af349034687a783184c17b89
SHA19d4dfc20801ebfce77b72a622cf65c1bde5a709e
SHA2562829de7744c53baa383babe95d6fac83ebad11b22c250b9390aef3c9b33f34a1
SHA512eff0e618788a682d9270277708c9446378133e1322290f518ec413f44482986d8eff077fce287803d065512f1c5067495a8bc15866ff49c18efbc2269dd73b3c
-
Filesize
32KB
MD5db0a3045dca4ecb87e6f7c2b590bca91
SHA1b1bc88f975b3e75a4ca533c4bf214a78dc755d81
SHA256efb1393b50d3f7ba7a089315f35341d4ead80f20db39c13a5ca3e9c02e12a401
SHA51295ff7ed3c793910a34a4ab90f7ffeaf5adef23857067a2ec6cd87f1f7cef191d74d9457f54fd5b4da9452997bcf9614a4005f9f69541b53313bb59d15e18a9a2
-
Filesize
160B
MD5b47ee4c07daf661cf1f19a5045d8579c
SHA1951ac0b4f0af6318496de1159aa2c6c017180cf6
SHA256e6b31d9b6c7a0e39892fbe2ba743f6a52c052471d678cdf75ce3333eb9a77b79
SHA512232d25b95d9dbb9e62c2a652ac154609189b231a44d13248250cb6d196823126cf861cf5c3518f496ae1cb8be6f7515d8b16ddaf1dfb101157ad3386435363cd
-
Filesize
8KB
MD527c625987a560e413c6e516d464388b9
SHA1d043db9bbcd8259ffff32f0f6098080aecd72019
SHA2568393b7b37858b2e4eb5ea619abf004f17aa7078b44dc7d425d4a6d95878cc820
SHA5120f092e223efb75b2b8ac050a5182aeeba1908c235bdbde2abee9ff0d6488dad9961795c9a92631d342ca97f0997c7aa9e5c04af9ed2726705e3db85e0af17ad0
-
Filesize
16B
MD59bde5046970454e99650833c972802e8
SHA1a85a4368a91eabafa1b5cbc4d1d9f77ed4a76532
SHA2567853602c4b85eb3d10b09f3b3c20431ea346b4a8aca1a793d5d4018b179fcddb
SHA512f93e720f5ab3b1415430c3d90a71316de413b2022ca1dee462a4dbbd092dafbf253846258b744d556fb864eb9008abd45263d0f54ac168f8021f75721e2097fd
-
Filesize
16B
MD5362d18015ab1a036d179c7919e79a332
SHA14ea24964d070820d282366c33280df939249cb0b
SHA256a9a623c9301d5ade950a03251e2424b4f8144df8d56dd312e3aa3f76e9570a80
SHA51294836b6925205e98f2415e664b81756d620065a43eb25962ef9e492cdcfea08780ea80b89c047382c75d0a34d4cc6cb57bb581e1cad79e1073d4957e485bd631
-
Filesize
77KB
MD5c28dee4f6db14a8f089fd3394bc5352d
SHA1ab6c88d149c4ef10f48ff644dfd7bba42ba5df38
SHA2560892ecc63143b927d6cfddc1c25e50d9a110b8d5ccf598531ec84d4160f701aa
SHA51235defc44e37879c0d5d22e26c789fb408c1cb48794565b5d264575bba01d2d786e14980a375e1fe3484a0d09ee0d01b4d38bfa8e4057cde0b58fb7c55fd22317
-
Filesize
47KB
MD5b0d00dbe35a71f7be01c7a91100e262b
SHA182468e2fccecec052e89c6b0eea2a23e1bdac3b6
SHA2562d73eb06dfc3ff9e5e418dc8bbd6c2f8ad3d3f50f0b7a76a445a650582a16c44
SHA5124d3486fcc1e8a58ad388a0c20326fabb81d2b35fd357a249700489ed747f6c5340b76f2b04959bcb77ed0e0ad8bc416df5e6885f744265152f1329b64d6923ce
-
Filesize
66KB
MD5b679e13e213fd84871ac942ed205be86
SHA1dafe8ada8961c62efb4532cfba9a6f943a0882b1
SHA25641365a4758f6c56ab35c0c49bbfa1718a6cb38a506ca9a4534286ae4dfde3dba
SHA512fbbff5f7c2da3525717f664f8cf83ff94a331804968e19712616cc550af2fda783de7ce7e6e6f19e763753203ccfb0ab4eb01a1660a87965d6154cbe35de40a2
-
Filesize
16B
MD5e297ceeff18239b87454cafc2cd585cf
SHA16116549961c1ce433963bb1fa0b0b5c35abe8335
SHA2560849953d2b85255cc8caecac2b3765a720dd2d6b088ac0cd95d2202cfe2df0ea
SHA512f18b40bc7730cd872f600c1b6d5a80606677ad5457f42bee0036bdc6f3662125eedcb79716984e828ea3bf853c05946e866661149248ce97f6db44e3448e1f86
-
Filesize
676KB
MD5c1ed709a4375516d25889357d0660f00
SHA13f16cd69f3772b9aa51ff2b528f95227e7caed6f
SHA2565cc851c0bce31e62a7c293c01117e5d80383b97ce97c040f2c08cfaa29380037
SHA512215cc02a53e3d0eff52f511c516fd5d87726926984e84cd18a7b35c3783792a0ee050e736f2c72bc28d42f1975bb6314d9f0f9e28766839db257c7c500c81ac0
-
Filesize
9.6MB
-
Filesize
4.8MB
-
Filesize
624KB
-
Filesize
9.6MB
-
Filesize
4KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
32KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
