Analysis
-
max time kernel
70s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
04-08-2024 04:56
Static task
static1
Behavioral task
behavioral1
Sample
Ransomware.Jigsaw.exe
Resource
win7-20240704-en
General
-
Target
Ransomware.Jigsaw.exe
-
Size
283KB
-
MD5
2773e3dc59472296cb0024ba7715a64e
-
SHA1
27d99fbca067f478bb91cdbcb92f13a828b00859
-
SHA256
3ae96f73d805e1d3995253db4d910300d8442ea603737a1428b613061e7f61e7
-
SHA512
6ef530b209f8ec459cca66dbf2c31ec96c5f7d609f17fa3b877d276968032fbc6132ea4a45ed1450fb6c5d730a7c9349bf4481e28befaea6b119ec0ded842262
-
SSDEEP
6144:7fukPLPvucHiQQQ4uuy9ApZbZWxcZt+kTfMLJTOAZiYSXjjeqXus:7fu5cCT7yYlWi8kTfMLJTOAZiYSXjyqX
Malware Config
Signatures
-
Jigsaw Ransomware
Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.
-
Renames multiple (218) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE 1 IoCs
pid Process 2704 drpbx.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\firefox.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Frfx\\firefox.exe" Ransomware.Jigsaw.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\Lang\mng2.txt.fun drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\tr.txt drpbx.exe File created C:\Program Files\7-Zip\Lang\hu.txt.fun drpbx.exe File created C:\Program Files\7-Zip\Lang\va.txt.fun drpbx.exe File opened for modification C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color32.bmp drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\ru.txt drpbx.exe File created C:\Program Files\7-Zip\Lang\cs.txt.fun drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\lv.txt drpbx.exe File created C:\Program Files\7-Zip\Lang\ro.txt.fun drpbx.exe File created C:\Program Files\7-Zip\Lang\sr-spc.txt.fun drpbx.exe File opened for modification C:\Program Files\VideoLAN\VLC\README.txt drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\bg.txt drpbx.exe File created C:\Program Files\7-Zip\Lang\ru.txt.fun drpbx.exe File opened for modification C:\Program Files\DVD Maker\Shared\DissolveAnother.png drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\hr.txt drpbx.exe File created C:\Program Files\7-Zip\Lang\de.txt.fun drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\el.txt drpbx.exe File created C:\Program Files\7-Zip\Lang\tt.txt.fun drpbx.exe File created C:\Program Files\7-Zip\Lang\zh-tw.txt.fun drpbx.exe File created C:\Program Files\7-Zip\Lang\bn.txt.fun drpbx.exe File created C:\Program Files\7-Zip\Lang\fi.txt.fun drpbx.exe File created C:\Program Files\7-Zip\Lang\gl.txt.fun drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\mn.txt drpbx.exe File created C:\Program Files\7-Zip\Lang\pl.txt.fun drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-tw.txt drpbx.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\PurblePlaceMCE.png drpbx.exe File opened for modification C:\Program Files\Windows Media Player\Media Renderer\RenderingControl.xml drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\br.txt drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\it.txt drpbx.exe File created C:\Program Files\7-Zip\Lang\ms.txt.fun drpbx.exe File created C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt.fun drpbx.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Microsoft.Office.BusinessData.xml drpbx.exe File created C:\Program Files\7-Zip\Lang\fy.txt.fun drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\ga.txt drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\th.txt drpbx.exe File opened for modification C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw32.bmp drpbx.exe File opened for modification C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw48.bmp drpbx.exe File opened for modification C:\Program Files\Windows NT\TableTextService\TableTextServiceSimplifiedShuangPin.txt drpbx.exe File created C:\Program Files\InvokeResume.m3u.fun drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\id.txt drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\io.txt drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\mr.txt drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\sv.txt drpbx.exe File created C:\Program Files\7-Zip\Lang\sv.txt.fun drpbx.exe File opened for modification C:\Program Files\VideoLAN\VLC\AUTHORS.txt drpbx.exe File opened for modification C:\Program Files\Windows Media Player\Media Renderer\DMR_120.png drpbx.exe File opened for modification C:\Program Files\7-Zip\readme.txt drpbx.exe File opened for modification C:\Program Files (x86)\Microsoft.NET\RedistList\AssemblyList_4_client.xml drpbx.exe File opened for modification C:\Program Files\Windows Media Player\Network Sharing\MediaReceiverRegistrar.xml drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\ast.txt drpbx.exe File created C:\Program Files\7-Zip\Lang\af.txt.fun drpbx.exe File opened for modification C:\Program Files\FindRestart.jpeg drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\tt.txt drpbx.exe File created C:\Program Files\VideoLAN\VLC\AUTHORS.txt.fun drpbx.exe File opened for modification C:\Program Files\Windows NT\TableTextService\TableTextServiceSimplifiedQuanPin.txt drpbx.exe File created C:\Program Files (x86)\Microsoft.NET\RedistList\AssemblyList_4_extended.xml.fun drpbx.exe File created C:\Program Files\7-Zip\Lang\hy.txt.fun drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\fy.txt drpbx.exe File created C:\Program Files\7-Zip\Lang\hi.txt.fun drpbx.exe File created C:\Program Files\7-Zip\Lang\nn.txt.fun drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\ta.txt drpbx.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Microsoft.Office.BusinessApplications.Runtime.xml.fun drpbx.exe File opened for modification C:\Program Files (x86)\Windows NT\TableTextService\TableTextServiceSimplifiedQuanPin.txt drpbx.exe File created C:\Program Files\7-Zip\Lang\ast.txt.fun drpbx.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1028 vlc.exe -
Suspicious behavior: EnumeratesProcesses 46 IoCs
pid Process 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2756 taskmgr.exe 1028 vlc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2756 taskmgr.exe -
Suspicious use of FindShellTrayWindow 62 IoCs
pid Process 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 1028 vlc.exe 1028 vlc.exe 1028 vlc.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe -
Suspicious use of SendNotifyMessage 60 IoCs
pid Process 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 1028 vlc.exe 1028 vlc.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1028 vlc.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2308 wrote to memory of 2704 2308 Ransomware.Jigsaw.exe 30 PID 2308 wrote to memory of 2704 2308 Ransomware.Jigsaw.exe 30 PID 2308 wrote to memory of 2704 2308 Ransomware.Jigsaw.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\Ransomware.Jigsaw.exe"C:\Users\Admin\AppData\Local\Temp\Ransomware.Jigsaw.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe"C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe" C:\Users\Admin\AppData\Local\Temp\Ransomware.Jigsaw.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2704
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2756
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1028
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
283KB
MD52773e3dc59472296cb0024ba7715a64e
SHA127d99fbca067f478bb91cdbcb92f13a828b00859
SHA2563ae96f73d805e1d3995253db4d910300d8442ea603737a1428b613061e7f61e7
SHA5126ef530b209f8ec459cca66dbf2c31ec96c5f7d609f17fa3b877d276968032fbc6132ea4a45ed1450fb6c5d730a7c9349bf4481e28befaea6b119ec0ded842262