Overview

overview

10

Static

static

3

pp.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    pp.exe

  • Size

    7.4MB

  • Sample

    240805-cb7chstdnp

  • MD5

    67e4ed31a1f93cfe8e39fa71c36712aa

  • SHA1

    0b9aaf8d7fc079d5c92999c9e83f78d4cc599e89

  • SHA256

    4e49278775abf88be3be8aa7851cf854b901f1293b6055345d2a6c4ba6bdbf5d

  • SHA512

    b93d86c0c39e9668c1db50035cb7127e8e560e51cf5a925d78769d126dfdcb9df771ed2b1ab8ef68c80860a93a7ec912d105b0569af287a80f683a5cc18589e0

  • SSDEEP

    196608:VU7W4FMIZETKwjPePdrQJiWrBd1WutYPjo:wWQETKwvJiWT1WWao

Score
10/10
jigsawlockybootkitdefense_evasiondiscoveryevasionexecutionimpactpersistencepyinstallerransomwarespywarestealertrojanupx

Malware Config

Targets

    • Target

      pp.exe

    • Size

      7.4MB

    • MD5

      67e4ed31a1f93cfe8e39fa71c36712aa

    • SHA1

      0b9aaf8d7fc079d5c92999c9e83f78d4cc599e89

    • SHA256

      4e49278775abf88be3be8aa7851cf854b901f1293b6055345d2a6c4ba6bdbf5d

    • SHA512

      b93d86c0c39e9668c1db50035cb7127e8e560e51cf5a925d78769d126dfdcb9df771ed2b1ab8ef68c80860a93a7ec912d105b0569af287a80f683a5cc18589e0

    • SSDEEP

      196608:VU7W4FMIZETKwjPePdrQJiWrBd1WutYPjo:wWQETKwvJiWT1WWao

    Score
    10/10
    jigsawlockybootkitdefense_evasiondiscoveryevasionexecutionimpactpersistenceransomwarespywarestealertrojanupx

    • Contains code to disable Windows Defender

      A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

    • Disables service(s)

      evasionexecution

    • Jigsaw Ransomware

      Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.

      ransomwarejigsaw

    • Locky

      Ransomware strain released in 2016, with advanced features like anti-analysis.

      ransomwarelocky

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Renames multiple (190) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion

    • Legitimate hosting services abused for malware hosting/C2

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

System Services

1
T1569

Service Execution

1
T1569.002

Windows Management Instrumentation

1
T1047

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Defense Evasion

Direct Volume Access

1
T1006

Impair Defenses

1
T1562

Disable or Modify Tools

1
T1562.001

Indicator Removal

3
T1070

File Deletion

3
T1070.004

Modify Registry

2
T1112

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Browser Information Discovery

1
T1217

Query Registry

1
T1012

Remote System Discovery

1
T1018

System Information Discovery

1
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Inhibit System Recovery

2
T1490

Service Stop

1
T1489

Tasks