Resubmissions

03-08-2024 03:16

240803-dse52awejb 10

03-08-2024 03:15

240803-dr286swdrd 10

03-08-2024 03:15

240803-drxcxs1fnj 10

03-08-2024 03:14

240803-drpcba1fmq 10

03-08-2024 03:14

240803-drh6aswdqd 10

03-08-2024 03:12

240803-dqhs5swdmc 3

03-08-2024 03:08

240803-dm7m4awcpe 10

03-08-2024 03:07

240803-dmj7sswcne 10

Analysis

  • max time kernel
    1561s
  • max time network
    1530s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    03-08-2024 03:15

General

  • Target

    rBlbqI2.exe

  • Size

    291KB

  • MD5

    2fec9bf50de5395f799b23a1099b10d6

  • SHA1

    6000969e75d7d7a3fa1b908bdb9d5daeb5f2534e

  • SHA256

    df049efbfa7ac0b76c8daff5d792c550c7a7a24f6e9e887d01a01013c9caa763

  • SHA512

    5f6885fb1940ee4f84507e2b7929f637d8f264a5c77329aeae31803b772608ea93370177017f90f6f8d8bc9e0b30eb8607ed120d4ead68104fd70feec71a9ab8

  • SSDEEP

    6144:pdSK04ETTZ+4TBpvjLCnVlBpevKBauJirVuD05VSKJ:poL4EnU4T/vjLeVlayRihuA5D

Malware Config

Signatures

  • Jigsaw Ransomware

    Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.

  • Renames multiple (1524) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops desktop.ini file(s) 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\rBlbqI2.exe
    "C:\Users\Admin\AppData\Local\Temp\rBlbqI2.exe"
    1⤵
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4784
    • C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe
      "C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe" C:\Users\Admin\AppData\Local\Temp\rBlbqI2.exe
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:4676

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt.zemblax

    Filesize

    32KB

    MD5

    aec7bd7c96948d97d13c7df53988e89c

    SHA1

    7b906b88009e7509324ae92dc8a32ae4fb38626c

    SHA256

    15fcb7c77cf60f287e9c81ec8053a9cdd1aa8bc0413734e8a1499a9de635c6d0

    SHA512

    27d12f825c16d1d5349f53a23d57f71eb8d4534a1ae4af2c4eead9cda09a4440dadc518a8887a3ea818494cb6319fc82ab8147cdb85958e9b344400b7d6b2803

  • C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\invalid32x32.gif.zemblax

    Filesize

    160B

    MD5

    000e8c41d4a15fb34d0be0dbb56e3778

    SHA1

    00c4eae64ee6239d7c65d819c6ce1ac329224f8c

    SHA256

    8bdfa6a5b7de345cf0d4fe0e9c17d8b0e9db26d58b05b1b2ebbb3a05a068ff28

    SHA512

    775d832eb8ab73e4a93789917dca69edb6c91fbb426e02acf7c6e213ffb4575776187209d1c471fbf57c4621ea3c23d9850f6dfc2770d62c17de9d66710800af

  • C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe

    Filesize

    291KB

    MD5

    2fec9bf50de5395f799b23a1099b10d6

    SHA1

    6000969e75d7d7a3fa1b908bdb9d5daeb5f2534e

    SHA256

    df049efbfa7ac0b76c8daff5d792c550c7a7a24f6e9e887d01a01013c9caa763

    SHA512

    5f6885fb1940ee4f84507e2b7929f637d8f264a5c77329aeae31803b772608ea93370177017f90f6f8d8bc9e0b30eb8607ed120d4ead68104fd70feec71a9ab8

  • C:\Users\Admin\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\Settings\settings.dat.zemblax

    Filesize

    8KB

    MD5

    420960c4b17842a24bbf117222c60e47

    SHA1

    4e2f5bc3a3fe7da4ea60dfaae851b1b88e48751d

    SHA256

    e94c37d7dc8dd954bfee8e340abc882bc361baf0d3771ed442ed625a3bcb0174

    SHA512

    b42f16f6fca9b66d49a2ad7c80e56c51e04d023a4ae50e984dbd267e204682ecbb929fefb5c7ee67775597773b08b6bd39416f13b87f1782cf8c5d553ecd7ce5

  • C:\Users\Admin\AppData\Local\Temp\BroadcastMsg_1722611965.txt.zemblax

    Filesize

    16B

    MD5

    cfdae8214d34112dbee6587664059558

    SHA1

    f649f45d08c46572a9a50476478ddaef7e964353

    SHA256

    33088cb514406f31e3d96a92c03294121ee9f24e176f7062625c2b36bee7a325

    SHA512

    c260f2c223ecbf233051ac1d6a1548ad188a2777085e9d43b02da41b291ff258e4c506f99636150847aa24918c7bbb703652fef2fe55b3f50f85b5bd8dd5f6e3

  • memory/4676-581-0x0000000074840000-0x0000000074DF1000-memory.dmp

    Filesize

    5.7MB

  • memory/4676-579-0x0000000074840000-0x0000000074DF1000-memory.dmp

    Filesize

    5.7MB

  • memory/4676-805-0x0000000074840000-0x0000000074DF1000-memory.dmp

    Filesize

    5.7MB

  • memory/4676-737-0x0000000074840000-0x0000000074DF1000-memory.dmp

    Filesize

    5.7MB

  • memory/4676-736-0x0000000074840000-0x0000000074DF1000-memory.dmp

    Filesize

    5.7MB

  • memory/4676-1878-0x0000000074840000-0x0000000074DF1000-memory.dmp

    Filesize

    5.7MB

  • memory/4676-580-0x0000000074840000-0x0000000074DF1000-memory.dmp

    Filesize

    5.7MB

  • memory/4676-1877-0x0000000074840000-0x0000000074DF1000-memory.dmp

    Filesize

    5.7MB

  • memory/4676-578-0x0000000074840000-0x0000000074DF1000-memory.dmp

    Filesize

    5.7MB

  • memory/4676-345-0x0000000074840000-0x0000000074DF1000-memory.dmp

    Filesize

    5.7MB

  • memory/4676-344-0x0000000074840000-0x0000000074DF1000-memory.dmp

    Filesize

    5.7MB

  • memory/4676-343-0x0000000074840000-0x0000000074DF1000-memory.dmp

    Filesize

    5.7MB

  • memory/4676-342-0x0000000074840000-0x0000000074DF1000-memory.dmp

    Filesize

    5.7MB

  • memory/4676-341-0x0000000074840000-0x0000000074DF1000-memory.dmp

    Filesize

    5.7MB

  • memory/4676-340-0x0000000074840000-0x0000000074DF1000-memory.dmp

    Filesize

    5.7MB

  • memory/4676-216-0x0000000074840000-0x0000000074DF1000-memory.dmp

    Filesize

    5.7MB

  • memory/4784-48-0x0000000005230000-0x0000000005264000-memory.dmp

    Filesize

    208KB

  • memory/4784-215-0x0000000074840000-0x0000000074DF1000-memory.dmp

    Filesize

    5.7MB

  • memory/4784-30-0x0000000005230000-0x0000000005264000-memory.dmp

    Filesize

    208KB

  • memory/4784-28-0x0000000005230000-0x0000000005264000-memory.dmp

    Filesize

    208KB

  • memory/4784-26-0x0000000005230000-0x0000000005264000-memory.dmp

    Filesize

    208KB

  • memory/4784-24-0x0000000005230000-0x0000000005264000-memory.dmp

    Filesize

    208KB

  • memory/4784-22-0x0000000005230000-0x0000000005264000-memory.dmp

    Filesize

    208KB

  • memory/4784-20-0x0000000005230000-0x0000000005264000-memory.dmp

    Filesize

    208KB

  • memory/4784-18-0x0000000005230000-0x0000000005264000-memory.dmp

    Filesize

    208KB

  • memory/4784-14-0x0000000005230000-0x0000000005264000-memory.dmp

    Filesize

    208KB

  • memory/4784-12-0x0000000005230000-0x0000000005264000-memory.dmp

    Filesize

    208KB

  • memory/4784-8-0x0000000005230000-0x0000000005264000-memory.dmp

    Filesize

    208KB

  • memory/4784-7-0x0000000005230000-0x0000000005264000-memory.dmp

    Filesize

    208KB

  • memory/4784-54-0x0000000005230000-0x0000000005264000-memory.dmp

    Filesize

    208KB

  • memory/4784-34-0x0000000005230000-0x0000000005264000-memory.dmp

    Filesize

    208KB

  • memory/4784-16-0x0000000005230000-0x0000000005264000-memory.dmp

    Filesize

    208KB

  • memory/4784-10-0x0000000005230000-0x0000000005264000-memory.dmp

    Filesize

    208KB

  • memory/4784-6-0x0000000074840000-0x0000000074DF1000-memory.dmp

    Filesize

    5.7MB

  • memory/4784-166-0x0000000074840000-0x0000000074DF1000-memory.dmp

    Filesize

    5.7MB

  • memory/4784-36-0x0000000005230000-0x0000000005264000-memory.dmp

    Filesize

    208KB

  • memory/4784-38-0x0000000005230000-0x0000000005264000-memory.dmp

    Filesize

    208KB

  • memory/4784-32-0x0000000005230000-0x0000000005264000-memory.dmp

    Filesize

    208KB

  • memory/4784-40-0x0000000005230000-0x0000000005264000-memory.dmp

    Filesize

    208KB

  • memory/4784-42-0x0000000005230000-0x0000000005264000-memory.dmp

    Filesize

    208KB

  • memory/4784-44-0x0000000005230000-0x0000000005264000-memory.dmp

    Filesize

    208KB

  • memory/4784-46-0x0000000005230000-0x0000000005264000-memory.dmp

    Filesize

    208KB

  • memory/4784-0-0x0000000074841000-0x0000000074842000-memory.dmp

    Filesize

    4KB

  • memory/4784-50-0x0000000005230000-0x0000000005264000-memory.dmp

    Filesize

    208KB

  • memory/4784-52-0x0000000005230000-0x0000000005264000-memory.dmp

    Filesize

    208KB

  • memory/4784-56-0x0000000005230000-0x0000000005264000-memory.dmp

    Filesize

    208KB

  • memory/4784-58-0x0000000005230000-0x0000000005264000-memory.dmp

    Filesize

    208KB

  • memory/4784-59-0x0000000074840000-0x0000000074DF1000-memory.dmp

    Filesize

    5.7MB

  • memory/4784-61-0x0000000005230000-0x0000000005264000-memory.dmp

    Filesize

    208KB

  • memory/4784-63-0x0000000005230000-0x0000000005264000-memory.dmp

    Filesize

    208KB

  • memory/4784-65-0x0000000005230000-0x0000000005264000-memory.dmp

    Filesize

    208KB

  • memory/4784-69-0x0000000005230000-0x0000000005264000-memory.dmp

    Filesize

    208KB

  • memory/4784-71-0x0000000005230000-0x0000000005264000-memory.dmp

    Filesize

    208KB

  • memory/4784-67-0x0000000005230000-0x0000000005264000-memory.dmp

    Filesize

    208KB

  • memory/4784-5-0x0000000074840000-0x0000000074DF1000-memory.dmp

    Filesize

    5.7MB

  • memory/4784-2-0x0000000074840000-0x0000000074DF1000-memory.dmp

    Filesize

    5.7MB

  • memory/4784-1-0x0000000074840000-0x0000000074DF1000-memory.dmp

    Filesize

    5.7MB