jigsaw | 86a391fe7a237f4f17846c53d71e45820411d1a9a6e0c16f22a11ebc491ff9ff

Analysis

max time kernel
21s
max time network
17s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
17/08/2024, 21:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

jigsaw.exe
Size

283KB
MD5

2773e3dc59472296cb0024ba7715a64e
SHA1

27d99fbca067f478bb91cdbcb92f13a828b00859
SHA256

3ae96f73d805e1d3995253db4d910300d8442ea603737a1428b613061e7f61e7
SHA512

6ef530b209f8ec459cca66dbf2c31ec96c5f7d609f17fa3b877d276968032fbc6132ea4a45ed1450fb6c5d730a7c9349bf4481e28befaea6b119ec0ded842262
SSDEEP

6144:7fukPLPvucHiQQQ4uuy9ApZbZWxcZt+kTfMLJTOAZiYSXjjeqXus:7fu5cCT7yYlWi8kTfMLJTOAZiYSXjyqX

Score

10^/10

jigsaw persistence ransomware

Malware Config

Signatures

Jigsaw Ransomware
Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.
ransomware jigsaw

Executes dropped EXE 1 IoCs

pid	Process
3832	drpbx.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Windows\CurrentVersion\Run\firefox.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Frfx\\firefox.exe"	jigsaw.exe

Drops file in Program Files directory 38 IoCs

description	ioc	Process
File created	C:\Program Files\CompressNew.mp4.fun	drpbx.exe
File opened for modification	C:\Program Files\FindOptimize.pptx	drpbx.exe
File opened for modification	C:\Program Files\FormatRevoke.png	drpbx.exe
File created	C:\Program Files\Microsoft Office\ThinAppXManifest.xml.fun	drpbx.exe
File opened for modification	C:\Program Files\ResetEnable.dotx	drpbx.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	drpbx.exe
File created	C:\Program Files\FindOptimize.pptx.fun	drpbx.exe
File created	C:\Program Files\SendEdit.ppsm.fun	drpbx.exe
File opened for modification	C:\Program Files\ShowRemove.mp4	drpbx.exe
File created	C:\Program Files\StepUnregister.mid.fun	drpbx.exe
File created	C:\Program Files\7-Zip\readme.txt.fun	drpbx.exe
File opened for modification	C:\Program Files\Microsoft Office\AppXManifest.xml	drpbx.exe
File created	C:\Program Files\Microsoft Office\FileSystemMetadata.xml.fun	drpbx.exe
File opened for modification	C:\Program Files\Microsoft Office\ThinAppXManifest.xml	drpbx.exe
File created	C:\Program Files\Mozilla Firefox\private_browsing.VisualElementsManifest.xml.fun	drpbx.exe
File created	C:\Program Files\AssertBackup.jpg.fun	drpbx.exe
File created	C:\Program Files\ResetEnable.dotx.fun	drpbx.exe
File created	C:\Program Files\SuspendSave.rar.fun	drpbx.exe
File opened for modification	C:\Program Files\Windows Defender\Defendericon.png	drpbx.exe
File opened for modification	C:\Program Files\SendEdit.ppsm	drpbx.exe
File opened for modification	C:\Program Files\SuspendSave.rar	drpbx.exe
File created	C:\Program Files\TestSuspend.dxf.fun	drpbx.exe
File opened for modification	C:\Program Files\AssertBackup.jpg	drpbx.exe
File created	C:\Program Files\FormatRevoke.png.fun	drpbx.exe
File opened for modification	C:\Program Files\StepUnregister.mid	drpbx.exe
File created	C:\Program Files\7-Zip\History.txt.fun	drpbx.exe
File created	C:\Program Files\7-Zip\License.txt.fun	drpbx.exe
File opened for modification	C:\Program Files\Microsoft Office\FileSystemMetadata.xml	drpbx.exe
File created	C:\Program Files\ShowRemove.mp4.fun	drpbx.exe
File opened for modification	C:\Program Files\TestSuspend.dxf	drpbx.exe
File opened for modification	C:\Program Files\Windows Defender\ThirdPartyNotices.txt	drpbx.exe
File opened for modification	C:\Program Files\CompressNew.mp4	drpbx.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	drpbx.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	drpbx.exe
File created	C:\Program Files\Microsoft Office\AppXManifest.xml.fun	drpbx.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.VisualElementsManifest.xml	drpbx.exe
File created	C:\Program Files\Mozilla Firefox\firefox.VisualElementsManifest.xml.fun	drpbx.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.VisualElementsManifest.xml	drpbx.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1268 wrote to memory of 3832	1268	jigsaw.exe	73
PID 1268 wrote to memory of 3832	1268	jigsaw.exe	73

C:\Users\Admin\AppData\Local\Temp\jigsaw.exe
"C:\Users\Admin\AppData\Local\Temp\jigsaw.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe
  "C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe" C:\Users\Admin\AppData\Local\Temp\jigsaw.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:3832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe

Filesize
283KB

MD5
2773e3dc59472296cb0024ba7715a64e

SHA1
27d99fbca067f478bb91cdbcb92f13a828b00859

SHA256
3ae96f73d805e1d3995253db4d910300d8442ea603737a1428b613061e7f61e7

SHA512
6ef530b209f8ec459cca66dbf2c31ec96c5f7d609f17fa3b877d276968032fbc6132ea4a45ed1450fb6c5d730a7c9349bf4481e28befaea6b119ec0ded842262

Download Submit
memory/1268-3-0x000000001B8F0000-0x000000001BDBE000-memory.dmp

Filesize
4.8MB

Download
memory/1268-2-0x0000000000C60000-0x0000000000C98000-memory.dmp

Filesize
224KB

Download
memory/1268-0-0x00007FFEB9215000-0x00007FFEB9216000-memory.dmp

Filesize
4KB

Download
memory/1268-4-0x000000001B2F0000-0x000000001B38C000-memory.dmp

Filesize
624KB

Download
memory/1268-7-0x00007FFEB8F60000-0x00007FFEB9900000-memory.dmp

Filesize
9.6MB

Download
memory/1268-1-0x00007FFEB8F60000-0x00007FFEB9900000-memory.dmp

Filesize
9.6MB

Download
memory/1268-13-0x00007FFEB8F60000-0x00007FFEB9900000-memory.dmp

Filesize
9.6MB

Download
memory/3832-14-0x00007FFEB8F60000-0x00007FFEB9900000-memory.dmp

Filesize
9.6MB

Download
memory/3832-15-0x00007FFEB8F60000-0x00007FFEB9900000-memory.dmp

Filesize
9.6MB

Download
memory/3832-16-0x00007FFEB8F60000-0x00007FFEB9900000-memory.dmp

Filesize
9.6MB

Download
memory/3832-17-0x00007FFEB8F60000-0x00007FFEB9900000-memory.dmp

Filesize
9.6MB

Download
memory/3832-18-0x000000001C020000-0x000000001C028000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads