Analysis

  • max time kernel
    70s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    04-08-2024 04:56

General

  • Target

    Ransomware.Jigsaw.exe

  • Size

    283KB

  • MD5

    2773e3dc59472296cb0024ba7715a64e

  • SHA1

    27d99fbca067f478bb91cdbcb92f13a828b00859

  • SHA256

    3ae96f73d805e1d3995253db4d910300d8442ea603737a1428b613061e7f61e7

  • SHA512

    6ef530b209f8ec459cca66dbf2c31ec96c5f7d609f17fa3b877d276968032fbc6132ea4a45ed1450fb6c5d730a7c9349bf4481e28befaea6b119ec0ded842262

  • SSDEEP

    6144:7fukPLPvucHiQQQ4uuy9ApZbZWxcZt+kTfMLJTOAZiYSXjjeqXus:7fu5cCT7yYlWi8kTfMLJTOAZiYSXjyqX

Malware Config

Signatures

  • Jigsaw Ransomware

    Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.

  • Renames multiple (218) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 46 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 62 IoCs
  • Suspicious use of SendNotifyMessage 60 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Ransomware.Jigsaw.exe
    "C:\Users\Admin\AppData\Local\Temp\Ransomware.Jigsaw.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2308
    • C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe
      "C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe" C:\Users\Admin\AppData\Local\Temp\Ransomware.Jigsaw.exe
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      PID:2704
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2756
  • C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe"
    1⤵
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:1028

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe

    Filesize

    283KB

    MD5

    2773e3dc59472296cb0024ba7715a64e

    SHA1

    27d99fbca067f478bb91cdbcb92f13a828b00859

    SHA256

    3ae96f73d805e1d3995253db4d910300d8442ea603737a1428b613061e7f61e7

    SHA512

    6ef530b209f8ec459cca66dbf2c31ec96c5f7d609f17fa3b877d276968032fbc6132ea4a45ed1450fb6c5d730a7c9349bf4481e28befaea6b119ec0ded842262

  • memory/1028-239-0x000000013F860000-0x000000013F958000-memory.dmp

    Filesize

    992KB

  • memory/1028-248-0x000007FEECD40000-0x000007FEEDDF0000-memory.dmp

    Filesize

    16.7MB

  • memory/1028-249-0x000007FEF6510000-0x000007FEF6577000-memory.dmp

    Filesize

    412KB

  • memory/1028-241-0x000007FEF5FE0000-0x000007FEF6296000-memory.dmp

    Filesize

    2.7MB

  • memory/1028-244-0x000007FEF7640000-0x000007FEF7651000-memory.dmp

    Filesize

    68KB

  • memory/1028-245-0x000007FEF7620000-0x000007FEF7637000-memory.dmp

    Filesize

    92KB

  • memory/1028-247-0x000007FEF75E0000-0x000007FEF75F1000-memory.dmp

    Filesize

    68KB

  • memory/1028-246-0x000007FEF7600000-0x000007FEF761D000-memory.dmp

    Filesize

    116KB

  • memory/1028-243-0x000007FEF7660000-0x000007FEF7677000-memory.dmp

    Filesize

    92KB

  • memory/1028-242-0x000007FEFA8A0000-0x000007FEFA8B8000-memory.dmp

    Filesize

    96KB

  • memory/1028-240-0x000007FEFA8E0000-0x000007FEFA914000-memory.dmp

    Filesize

    208KB

  • memory/2308-10-0x000007FEF4280000-0x000007FEF4C1D000-memory.dmp

    Filesize

    9.6MB

  • memory/2308-0-0x000007FEF453E000-0x000007FEF453F000-memory.dmp

    Filesize

    4KB

  • memory/2308-3-0x000007FEF4280000-0x000007FEF4C1D000-memory.dmp

    Filesize

    9.6MB

  • memory/2308-1-0x00000000005D0000-0x0000000000608000-memory.dmp

    Filesize

    224KB

  • memory/2308-2-0x000007FEF4280000-0x000007FEF4C1D000-memory.dmp

    Filesize

    9.6MB

  • memory/2704-14-0x000007FEF4280000-0x000007FEF4C1D000-memory.dmp

    Filesize

    9.6MB

  • memory/2704-13-0x000007FEF4280000-0x000007FEF4C1D000-memory.dmp

    Filesize

    9.6MB

  • memory/2704-12-0x000007FEF4280000-0x000007FEF4C1D000-memory.dmp

    Filesize

    9.6MB

  • memory/2704-11-0x000007FEF4280000-0x000007FEF4C1D000-memory.dmp

    Filesize

    9.6MB

  • memory/2756-236-0x0000000140000000-0x00000001405E8000-memory.dmp

    Filesize

    5.9MB

  • memory/2756-235-0x0000000140000000-0x00000001405E8000-memory.dmp

    Filesize

    5.9MB

  • memory/2756-16-0x0000000140000000-0x00000001405E8000-memory.dmp

    Filesize

    5.9MB

  • memory/2756-15-0x0000000140000000-0x00000001405E8000-memory.dmp

    Filesize

    5.9MB