jigsaw | 60741f2c4ef30ca4dfda69a549cdd20a2edb402b02c4bbe4a8d65e538e52f6b4

Analysis

max time kernel
60s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
29-10-2024 19:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

60741f2c4ef30ca4dfda69a549cdd20a2edb402b02c4bbe4a8d65e538e52f6b4.exe
Size

5.4MB
MD5

4171108985acf10ed305458034045917
SHA1

696e0d48b0395a328655e4149edea73a0bdd3bbd
SHA256

60741f2c4ef30ca4dfda69a549cdd20a2edb402b02c4bbe4a8d65e538e52f6b4
SHA512

4348fcb4b2835d16deca4668f933349c41e0f56f3f5297331b1e9891ba5fbb04a3953411b11cdbaa2975671c6d0ef719f011931efdd3e7b232301d501313e4f0
SSDEEP

12288:7fu5cCT7yYlWi8kTfMLJTOAZiYSXjyqX:725cKlWi

Score

10^/10

jigsaw persistence ransomware

Malware Config

Signatures

Jigsaw Ransomware
Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.
ransomware jigsaw
Jigsaw family
jigsaw
Renames multiple (327) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 1 IoCs

Processes:

drpbx.exe

pid	Process
2772	drpbx.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

60741f2c4ef30ca4dfda69a549cdd20a2edb402b02c4bbe4a8d65e538e52f6b4.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\firefox.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Frfx\\firefox.exe"	60741f2c4ef30ca4dfda69a549cdd20a2edb402b02c4bbe4a8d65e538e52f6b4.exe

Drops file in Program Files directory 64 IoCs

Processes:

drpbx.exe

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Windows Media Player\Media Renderer\DMR_120.png	drpbx.exe
File created	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Hardcover.xml.fun	drpbx.exe
File created	C:\Program Files\CompressSplit.rtf.fun	drpbx.exe
File opened for modification	C:\Program Files\7-Zip\Lang\yo.txt	drpbx.exe
File created	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Slipstream.xml.fun	drpbx.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\sa-jdi.jar.fun	drpbx.exe
File opened for modification	C:\Program Files\Java\jre7\lib\plugin.jar	drpbx.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\javafx-mx.jar.fun	drpbx.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Clarity.xml	drpbx.exe
File created	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Apothecary.xml.fun	drpbx.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt.txt	drpbx.exe
File opened for modification	C:\Program Files\Windows NT\TableTextService\TableTextServiceSimplifiedQuanPin.txt	drpbx.exe
File created	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Adjacency.xml.fun	drpbx.exe
File created	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Composite.xml.fun	drpbx.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	drpbx.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_babypink_Thumbnail.bmp	drpbx.exe
File created	C:\Program Files\7-Zip\Lang\pt-br.txt.fun	drpbx.exe
File opened for modification	C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color32.jpg	drpbx.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\SketchPadTestSchema.xml.fun	drpbx.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipskor.xml	drpbx.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\logo.png	drpbx.exe
File created	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Civic.xml.fun	drpbx.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	drpbx.exe
File created	C:\Program Files\7-Zip\Lang\nl.txt.fun	drpbx.exe
File created	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Executive.xml.fun	drpbx.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Paper.xml	drpbx.exe
File opened for modification	C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw48.png	drpbx.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\Media Renderer\avtransport.xml	drpbx.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsnld.xml	drpbx.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipssrl.xml	drpbx.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Verve.xml	drpbx.exe
File created	C:\Program Files\7-Zip\Lang\fi.txt.fun	drpbx.exe
File opened for modification	C:\Program Files\Windows Media Player\Network Sharing\MediaReceiverRegistrar.xml	drpbx.exe
File opened for modification	C:\Program Files (x86)\Windows NT\TableTextService\TableTextServiceSimplifiedShuangPin.txt	drpbx.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipshrv.xml	drpbx.exe
File created	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Concourse.xml.fun	drpbx.exe
File created	C:\Program Files\7-Zip\Lang\hi.txt.fun	drpbx.exe
File created	C:\Program Files\7-Zip\Lang\pl.txt.fun	drpbx.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	drpbx.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt	drpbx.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uk.txt	drpbx.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsfin.xml	drpbx.exe
File opened for modification	C:\Program Files\Java\jre7\lib\jfr.jar	drpbx.exe
File created	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Equity.xml.fun	drpbx.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt	drpbx.exe
File created	C:\Program Files\7-Zip\Lang\si.txt.fun	drpbx.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Elemental.xml	drpbx.exe
File created	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Essential.xml.fun	drpbx.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Oriel.xml	drpbx.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\1033\Mso Example Intl Setup File B.txt	drpbx.exe
File created	C:\Program Files\7-Zip\Lang\cs.txt.fun	drpbx.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Pretty_Peacock.jpg	drpbx.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Tiki.gif	drpbx.exe
File opened for modification	C:\Program Files\Java\jre7\lib\jsse.jar	drpbx.exe
File created	C:\Program Files\VideoLAN\VLC\AUTHORS.txt.fun	drpbx.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsptb.xml	drpbx.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\include\jvmticmlr.h	drpbx.exe
File created	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Newsprint.xml.fun	drpbx.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Pine_Lumber.jpg	drpbx.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_widescreen_Thumbnail.bmp	drpbx.exe
File opened for modification	C:\Program Files\Mozilla Firefox\defaults\pref\autoconfig.js	drpbx.exe
File opened for modification	C:\Program Files\UndoSync.xltm	drpbx.exe
File opened for modification	C:\Program Files (x86)\Windows NT\TableTextService\TableTextServiceAmharic.txt	drpbx.exe
File created	C:\Program Files\7-Zip\Lang\sr-spc.txt.fun	drpbx.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

60741f2c4ef30ca4dfda69a549cdd20a2edb402b02c4bbe4a8d65e538e52f6b4.exe

description	pid	Process	procid_target
PID 432 wrote to memory of 2772	432	60741f2c4ef30ca4dfda69a549cdd20a2edb402b02c4bbe4a8d65e538e52f6b4.exe	29
PID 432 wrote to memory of 2772	432	60741f2c4ef30ca4dfda69a549cdd20a2edb402b02c4bbe4a8d65e538e52f6b4.exe	29
PID 432 wrote to memory of 2772	432	60741f2c4ef30ca4dfda69a549cdd20a2edb402b02c4bbe4a8d65e538e52f6b4.exe	29

C:\Users\Admin\AppData\Local\Temp\60741f2c4ef30ca4dfda69a549cdd20a2edb402b02c4bbe4a8d65e538e52f6b4.exe
"C:\Users\Admin\AppData\Local\Temp\60741f2c4ef30ca4dfda69a549cdd20a2edb402b02c4bbe4a8d65e538e52f6b4.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:432
- C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe
  "C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe" C:\Users\Admin\AppData\Local\Temp\60741f2c4ef30ca4dfda69a549cdd20a2edb402b02c4bbe4a8d65e538e52f6b4.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:2772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe

Filesize
5.4MB

MD5
4171108985acf10ed305458034045917

SHA1
696e0d48b0395a328655e4149edea73a0bdd3bbd

SHA256
60741f2c4ef30ca4dfda69a549cdd20a2edb402b02c4bbe4a8d65e538e52f6b4

SHA512
4348fcb4b2835d16deca4668f933349c41e0f56f3f5297331b1e9891ba5fbb04a3953411b11cdbaa2975671c6d0ef719f011931efdd3e7b232301d501313e4f0

Download Submit
C:\Users\Admin\Documents\ReceiveRemove.xlsx.fun

Filesize
12KB

MD5
92cb9a3cbba38323e146e38e51a90a35

SHA1
c42c0cb7afa01fde1af54e473ea431f2bf1d41d2

SHA256
f7ede2a856bd1dbae2ec5ac283c8f7dd668cd46acf07ff1d83da8a394fc9dc72

SHA512
35e47552fdbdaad5586a218b9e07443115add5868c1a50270f0e922aa14ae95e9a956763e6e1964ab530d4b53180cd39da167623e9007933572fca0296ae1a57

Download Submit
memory/432-0-0x000007FEF68AE000-0x000007FEF68AF000-memory.dmp

Filesize
4KB

Download
memory/432-1-0x0000000000370000-0x00000000003A8000-memory.dmp

Filesize
224KB

Download
memory/432-4-0x000007FEF65F0000-0x000007FEF6F8D000-memory.dmp

Filesize
9.6MB

Download
memory/432-9-0x000007FEF65F0000-0x000007FEF6F8D000-memory.dmp

Filesize
9.6MB

Download
memory/432-12-0x000007FEF65F0000-0x000007FEF6F8D000-memory.dmp

Filesize
9.6MB

Download
memory/2772-11-0x000007FEF65F0000-0x000007FEF6F8D000-memory.dmp

Filesize
9.6MB

Download
memory/2772-10-0x000007FEF65F0000-0x000007FEF6F8D000-memory.dmp

Filesize
9.6MB

Download
memory/2772-13-0x000007FEF65F0000-0x000007FEF6F8D000-memory.dmp

Filesize
9.6MB

Download