Analysis
-
max time kernel
135s -
max time network
92s -
platform
windows11-21h2_x64 -
resource
win11-20240709-en -
resource tags
arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system -
submitted
16-07-2024 20:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
drpbx.exe
Resource
win11-20240709-en
windows11-21h2-x64
14 signatures
300 seconds
General
-
Target
drpbx.exe
-
Size
283KB
-
MD5
2773e3dc59472296cb0024ba7715a64e
-
SHA1
27d99fbca067f478bb91cdbcb92f13a828b00859
-
SHA256
3ae96f73d805e1d3995253db4d910300d8442ea603737a1428b613061e7f61e7
-
SHA512
6ef530b209f8ec459cca66dbf2c31ec96c5f7d609f17fa3b877d276968032fbc6132ea4a45ed1450fb6c5d730a7c9349bf4481e28befaea6b119ec0ded842262
-
SSDEEP
6144:7fukPLPvucHiQQQ4uuy9ApZbZWxcZt+kTfMLJTOAZiYSXjjeqXus:7fu5cCT7yYlWi8kTfMLJTOAZiYSXjyqX
Score
10/10
Malware Config
Signatures
-
Jigsaw Ransomware
Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.
-
Renames multiple (152) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE 1 IoCs
pid Process 2968 drpbx.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000\Software\Microsoft\Windows\CurrentVersion\Run\firefox.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Frfx\\firefox.exe" drpbx.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Lang\sv.txt drpbx.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.16.en-us.xml.fun drpbx.exe File opened for modification C:\Program Files\VideoLAN\VLC\README.txt drpbx.exe File opened for modification C:\Program Files\Windows NT\TableTextService\TableTextServiceYi.txt drpbx.exe File created C:\Program Files\7-Zip\Lang\hy.txt.fun drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\id.txt drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\ja.txt drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\kk.txt drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_1.0.6.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\pt.txt drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\ta.txt drpbx.exe File created C:\Program Files\VideoLAN\VLC\NEWS.txt.fun drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingNews_1.0.6.0_x64__8wekyb3d8bbwe\AppxManifest.xml drpbx.exe File created C:\Program Files\7-Zip\Lang\ba.txt.fun drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\cs.txt drpbx.exe File created C:\Program Files\7-Zip\Lang\ky.txt.fun drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\mng2.txt drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GamingApp_2105.900.24.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxManifest.xml drpbx.exe File created C:\Program Files\DisconnectGet.mov.fun drpbx.exe File created C:\Program Files\7-Zip\Lang\mng.txt.fun drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\ne.txt drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_x64__8wekyb3d8bbwe\BuildInfo.xml drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\pa-in.txt drpbx.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.fun drpbx.exe File opened for modification C:\Program Files\Windows Media Player\Network Sharing\ConnectionManager.xml drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_2.2106.2807.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml drpbx.exe File created C:\Program Files\7-Zip\Lang\fy.txt.fun drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\gl.txt drpbx.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.fun drpbx.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.fun drpbx.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.fun drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GamingApp_2105.900.24.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxManifest.xml drpbx.exe File opened for modification C:\Program Files\DisconnectGet.mov drpbx.exe File created C:\Program Files\dotnet\LICENSE.txt.fun drpbx.exe File created C:\Program Files\7-Zip\Lang\pt.txt.fun drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spl.txt drpbx.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_2.2106.2807.0_x64__8wekyb3d8bbwe\AppxManifest.xml drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\an.txt drpbx.exe File opened for modification C:\Program Files\Java\jdk-1.8\javafx-src.zip drpbx.exe File opened for modification C:\Program Files\Java\jdk-1.8\jmc.txt drpbx.exe File opened for modification C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt drpbx.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.fun drpbx.exe File created C:\Program Files\7-Zip\Lang\yo.txt.fun drpbx.exe File created C:\Program Files\7-Zip\Lang\zh-tw.txt.fun drpbx.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml drpbx.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml drpbx.exe File created C:\Program Files\VideoLAN\VLC\README.txt.fun drpbx.exe File created C:\Program Files\7-Zip\Lang\ast.txt.fun drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\mng.txt drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\ro.txt drpbx.exe File opened for modification C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt drpbx.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml drpbx.exe File created C:\Program Files\PublishUpdate.tif.fun drpbx.exe File opened for modification C:\Program Files\ResolveUnblock.pdf drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\tr.txt drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\uz-cyrl.txt drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\ru.txt drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\sa.txt drpbx.exe File created C:\Program Files\7-Zip\Lang\tr.txt.fun drpbx.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.common.16.xml.fun drpbx.exe File opened for modification C:\Program Files\SyncCopy.aif drpbx.exe File created C:\Program Files\7-Zip\License.txt.fun drpbx.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3636 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 3636 taskmgr.exe Token: SeSystemProfilePrivilege 3636 taskmgr.exe Token: SeCreateGlobalPrivilege 3636 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe 3636 taskmgr.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 5020 wrote to memory of 2968 5020 drpbx.exe 82 PID 5020 wrote to memory of 2968 5020 drpbx.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\drpbx.exe"C:\Users\Admin\AppData\Local\Temp\drpbx.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe"C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe" C:\Users\Admin\AppData\Local\Temp\drpbx.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2968
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3636
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
283KB
MD52773e3dc59472296cb0024ba7715a64e
SHA127d99fbca067f478bb91cdbcb92f13a828b00859
SHA2563ae96f73d805e1d3995253db4d910300d8442ea603737a1428b613061e7f61e7
SHA5126ef530b209f8ec459cca66dbf2c31ec96c5f7d609f17fa3b877d276968032fbc6132ea4a45ed1450fb6c5d730a7c9349bf4481e28befaea6b119ec0ded842262