Analysis
-
max time kernel
28s -
max time network
454s -
platform
windows11-21h2_x64 -
resource
win11-20240419-en -
resource tags
arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system -
submitted
30-06-2024 23:32
Static task
static1
Behavioral task
behavioral1
Sample
5cc851c0bce31e62a7c293c01117e5d80383b97ce97c040f2c08cfaa29380037.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral2
Sample
5cc851c0bce31e62a7c293c01117e5d80383b97ce97c040f2c08cfaa29380037.exe
Resource
win11-20240419-en
General
-
Target
5cc851c0bce31e62a7c293c01117e5d80383b97ce97c040f2c08cfaa29380037.exe
-
Size
676KB
-
MD5
c1ed709a4375516d25889357d0660f00
-
SHA1
3f16cd69f3772b9aa51ff2b528f95227e7caed6f
-
SHA256
5cc851c0bce31e62a7c293c01117e5d80383b97ce97c040f2c08cfaa29380037
-
SHA512
215cc02a53e3d0eff52f511c516fd5d87726926984e84cd18a7b35c3783792a0ee050e736f2c72bc28d42f1975bb6314d9f0f9e28766839db257c7c500c81ac0
-
SSDEEP
12288:CDWaTyXxfuXcaUl32k9ozkqkArFWt86fS9Cx6XK:CDWDfhai32k9631rFHYS9h
Malware Config
Extracted
C:\Users\Admin\AppData\Local\chrme\chrome.exe
Signatures
-
Jigsaw Ransomware
Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.
-
Renames multiple (227) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE 1 IoCs
pid Process 4576 chrome.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Microsoft\Windows\CurrentVersion\Run\windows defender.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Wddf\\windows defender.exe" 5cc851c0bce31e62a7c293c01117e5d80383b97ce97c040f2c08cfaa29380037.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Lang\kk.txt chrome.exe File created C:\Program Files\7-Zip\Lang\ky.txt.WNCRY chrome.exe File opened for modification C:\Program Files\7-Zip\Lang\th.txt chrome.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\BuildInfo.xml chrome.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxManifest.xml chrome.exe File created C:\Program Files\7-Zip\Lang\bn.txt.WNCRY chrome.exe File opened for modification C:\Program Files\7-Zip\Lang\ka.txt chrome.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml chrome.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_1.0.38.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxManifest.xml chrome.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_2021.226.1915.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml chrome.exe File opened for modification C:\Program Files (x86)\Windows NT\TableTextService\TableTextServiceArray.txt chrome.exe File created C:\Program Files\7-Zip\Lang\he.txt.WNCRY chrome.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml chrome.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\AppxManifest.xml chrome.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.50.24002.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxManifest.xml chrome.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\AppxManifest.xml chrome.exe File opened for modification C:\Program Files\7-Zip\Lang\is.txt chrome.exe File created C:\Program Files\7-Zip\Lang\kaa.txt.WNCRY chrome.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.WNCRY chrome.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GamingApp_2105.900.24.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxBlockMap.xml chrome.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\msapp-error.js chrome.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml chrome.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml chrome.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxManifest.xml chrome.exe File opened for modification C:\Program Files\7-Zip\Lang\sq.txt chrome.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_1.0.6.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxManifest.xml chrome.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxBlockMap.xml chrome.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxManifest.xml chrome.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml chrome.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_2021.2101.27.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml chrome.exe File created C:\Program Files\7-Zip\Lang\de.txt.WNCRY chrome.exe File opened for modification C:\Program Files\7-Zip\Lang\hr.txt chrome.exe File opened for modification C:\Program Files\Windows Media Player\Network Sharing\ConnectionManager.xml chrome.exe File opened for modification C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color32.bmp chrome.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_x64__8wekyb3d8bbwe\AppxManifest.xml chrome.exe File created C:\Program Files\7-Zip\Lang\it.txt.WNCRY chrome.exe File created C:\Program Files\VideoLAN\VLC\NEWS.txt.WNCRY chrome.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_4.0.2.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml chrome.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2020.503.58.0_x64__8wekyb3d8bbwe\AppxManifest.xml chrome.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.WNCRY chrome.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\AppxBlockMap.xml chrome.exe File opened for modification C:\Program Files\GroupSync.ppt chrome.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.WNCRY chrome.exe File opened for modification C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color48.bmp chrome.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_4.0.2.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml chrome.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.113.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml chrome.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml chrome.exe File created C:\Program Files\7-Zip\Lang\bg.txt.WNCRY chrome.exe File created C:\Program Files\7-Zip\Lang\is.txt.WNCRY chrome.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.WNCRY chrome.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GamingApp_2105.900.24.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxManifest.xml chrome.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00.UWPDesktop_14.0.29231.0_x64__8wekyb3d8bbwe\AppxManifest.xml chrome.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml chrome.exe File created C:\Program Files\7-Zip\Lang\pt.txt.WNCRY chrome.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.WNCRY chrome.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_2.2106.2807.0_x64__8wekyb3d8bbwe\AppxManifest.xml chrome.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.UI.Xaml.2.4_2.42007.9001.0_x64__8wekyb3d8bbwe\logo.png chrome.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\Third Party Notices.txt chrome.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\AppxManifest.xml chrome.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxBlockMap.xml chrome.exe File opened for modification C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color48.jpg chrome.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxBlockMap.xml chrome.exe File opened for modification C:\Program Files (x86)\Windows Media Player\Media Renderer\DMR_48.jpg chrome.exe File opened for modification C:\Program Files\dotnet\ThirdPartyNotices.txt chrome.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2716 wrote to memory of 4576 2716 5cc851c0bce31e62a7c293c01117e5d80383b97ce97c040f2c08cfaa29380037.exe 78 PID 2716 wrote to memory of 4576 2716 5cc851c0bce31e62a7c293c01117e5d80383b97ce97c040f2c08cfaa29380037.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\5cc851c0bce31e62a7c293c01117e5d80383b97ce97c040f2c08cfaa29380037.exe"C:\Users\Admin\AppData\Local\Temp\5cc851c0bce31e62a7c293c01117e5d80383b97ce97c040f2c08cfaa29380037.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\chrme\chrome.exe"C:\Users\Admin\AppData\Local\chrme\chrome.exe" C:\Users\Admin\AppData\Local\Temp\5cc851c0bce31e62a7c293c01117e5d80383b97ce97c040f2c08cfaa29380037.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4576
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt.WNCRY
Filesize32KB
MD5db0a3045dca4ecb87e6f7c2b590bca91
SHA1b1bc88f975b3e75a4ca533c4bf214a78dc755d81
SHA256efb1393b50d3f7ba7a089315f35341d4ead80f20db39c13a5ca3e9c02e12a401
SHA51295ff7ed3c793910a34a4ab90f7ffeaf5adef23857067a2ec6cd87f1f7cef191d74d9457f54fd5b4da9452997bcf9614a4005f9f69541b53313bb59d15e18a9a2
-
Filesize
160B
MD5b47ee4c07daf661cf1f19a5045d8579c
SHA1951ac0b4f0af6318496de1159aa2c6c017180cf6
SHA256e6b31d9b6c7a0e39892fbe2ba743f6a52c052471d678cdf75ce3333eb9a77b79
SHA512232d25b95d9dbb9e62c2a652ac154609189b231a44d13248250cb6d196823126cf861cf5c3518f496ae1cb8be6f7515d8b16ddaf1dfb101157ad3386435363cd
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\Settings\settings.dat.WNCRY
Filesize8KB
MD527c625987a560e413c6e516d464388b9
SHA1d043db9bbcd8259ffff32f0f6098080aecd72019
SHA2568393b7b37858b2e4eb5ea619abf004f17aa7078b44dc7d425d4a6d95878cc820
SHA5120f092e223efb75b2b8ac050a5182aeeba1908c235bdbde2abee9ff0d6488dad9961795c9a92631d342ca97f0997c7aa9e5c04af9ed2726705e3db85e0af17ad0
-
Filesize
16B
MD5e297ceeff18239b87454cafc2cd585cf
SHA16116549961c1ce433963bb1fa0b0b5c35abe8335
SHA2560849953d2b85255cc8caecac2b3765a720dd2d6b088ac0cd95d2202cfe2df0ea
SHA512f18b40bc7730cd872f600c1b6d5a80606677ad5457f42bee0036bdc6f3662125eedcb79716984e828ea3bf853c05946e866661149248ce97f6db44e3448e1f86
-
Filesize
676KB
MD5c1ed709a4375516d25889357d0660f00
SHA13f16cd69f3772b9aa51ff2b528f95227e7caed6f
SHA2565cc851c0bce31e62a7c293c01117e5d80383b97ce97c040f2c08cfaa29380037
SHA512215cc02a53e3d0eff52f511c516fd5d87726926984e84cd18a7b35c3783792a0ee050e736f2c72bc28d42f1975bb6314d9f0f9e28766839db257c7c500c81ac0