Resubmissions
19-07-2024 15:21
240719-srpqea1dkd 1009-10-2023 22:49
231009-2rxkpagh8y 1030-03-2021 09:40
210330-ae6xfbdjpn 1030-03-2021 09:36
210330-23qa4tgj4n 1029-03-2021 16:32
210329-8v5z5a82en 10Analysis
-
max time kernel
66s -
max time network
57s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
19-07-2024 15:21
General
-
Target
cats.exe
-
Size
126KB
-
MD5
e0d108435c58dc9403588e4dcab68275
-
SHA1
7a7331423938020550ff3decd2e8b50b3ee5c87a
-
SHA256
61cd0131cb4bf090c5ee7761566f6f7a778e78b37d220f0506f98632a2663ee8
-
SHA512
2a5648ced91b75d928b4d71a8580c5bee75a5f27623f8c5071cd23b8cd85eaa8129ddb0aaf0a1fcca05fb1b7868a0fcd9306e9ddf2d3eaaf605c41cc7fde4a9e
-
SSDEEP
3072:7+gYdgLNp0jPilel4+800N1lknzRxqmhda40U6hrnzRxqmhda40U6hK:6gvunnhdaLlrnnhdaLl
Malware Config
Signatures
-
Jigsaw Ransomware
Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.
-
Renames multiple (2027) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cats.exe"C:\Users\Admin\AppData\Local\Temp\cats.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Google (x86)\Chrome32.exe"C:\Users\Admin\AppData\Local\Google (x86)\Chrome32.exe" C:\Users\Admin\AppData\Local\Temp\cats.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
160B
MD5a8258060e35cd08265a3f658e6aa2963
SHA1a67c6aeb6db7a488c84810feea22a2d6f7be9bc8
SHA256e847f277e6adf5f94573c0f1b10ac15efd6ca48f34f9be52e9baec6e1f1de04b
SHA51270ecf38aa25d92ffff7a24ea35c467c95b9a22dfdc99e0705d56527923cda574add21987ab98ae2b8c589e334141d6957a660a3e34a546c764c3e42069f50d45
-
Filesize
126KB
MD5e0d108435c58dc9403588e4dcab68275
SHA17a7331423938020550ff3decd2e8b50b3ee5c87a
SHA25661cd0131cb4bf090c5ee7761566f6f7a778e78b37d220f0506f98632a2663ee8
SHA5122a5648ced91b75d928b4d71a8580c5bee75a5f27623f8c5071cd23b8cd85eaa8129ddb0aaf0a1fcca05fb1b7868a0fcd9306e9ddf2d3eaaf605c41cc7fde4a9e
-
Filesize
16B
MD5a2ec71f236b0da26c756b086bd502f09
SHA1e9dc21e143a2aba3ca9eb634ed291ddf93b32e4b
SHA256b4805a7f3e187212efacd5c2475bc8a30ce7274f8dae65858537a7f08b866717
SHA512a1d0f50c760c9bc3ab50053633e2fd3bdca6d0de8f256b48b5c45c8bc20a93a7e2123b09c8ce5de3c9ef013d0f2c3de165d68f7748c89d629122ae6d498e9af3
-
Filesize
190KB
MD5469021c9a36263fdab8875291bc9ecbf
SHA13e1e3ee99b86f31d611866def9a8d3ac791b53d2
SHA256fe73711ec90ab032c10f4ff5bd796534f5ada15a20c3bd35e83cd0cfb81ac3d4
SHA5120dd7c09b7189a42240e3bf13f1b1218eabedc9892bc77f0da1d2f22a8eeb4407f6155686cd6bb946d295dd2af0568b7ec7e628e4df85cccded8495b97a3fbad5
-
Filesize
10KB
MD56a9cbce075203c9065775d83343ce699
SHA1bd1003dcefaf79e47b51d3f37ffd1fb850b20808
SHA2567a9b7129ac74789a3f1ae90eb3664767739b7b20d1df882ce55fa8d269ee9b38
SHA5126b169a60bf850bf7d1e50642c8458b30714eba8c3e6ee84aef5ff8e0dfc1b8a2af64f8ca56384c48b797e52ae418c41623ade1e2f5a3e8cb4e52bbe126975bb6
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
4KB
-
Filesize
9.6MB
-
Filesize
9.6MB
