jigsaw | 9dca05d456e7a2f665bc3d92c883574754718441a6075de6d09a918e67ae1035

Sharing

Copy URL

Twitter E-mail

General

Target

9137481ae47cb028ea325c76a6298798_JaffaCakes118
Size

24.4MB
Sample

241123-27643axrej
MD5

9137481ae47cb028ea325c76a6298798
SHA1

2f9c8d2490566bb08dcb3c6666cf204392d2b317
SHA256

9dca05d456e7a2f665bc3d92c883574754718441a6075de6d09a918e67ae1035
SHA512

4b17225458d0ac9e5b916c15cd6cb89c493af480e77bf001ad8ca6cfe422ed454061c36b2a843277e6711f164070d1baa5b42224f228bc059311889e9285de90
SSDEEP

393216:fqxZWG6E9nJi+AnsobtOKLzz4F0Cb7E+SVCibwjVpVjXrnharBxdsbK+u4XAfrmY:SC/eJi+AsrKCrEBrwzVDrnhalDI/YmR+

Score

10^/10

Malware Config

Targets

- Target
  
  HowToBeatPayPal-preci.pdf
- Size
  
  3.8MB
- MD5
  
  ebf7b19ffb7eac4ed326636374c7fe18
- SHA1
  
  a2b8e6bf659720d1537e416b70fa015ab7abb8ae
- SHA256
  
  d129fb349f777afbff5b9d833c547b809b4e2a37f56efc030cca228f1049b981
- SHA512
  
  7c84cf201d3032c28a9a143fc64537b999e9117ad092e01da2838a17a31dad61e5f4d5970173169c173fd193d13b4afc3e8c29744f5aa8507aa6c472a90c0d3f
- SSDEEP
  
  98304:X0Wz6vrunXB6Q1jXofcaRgxNDBYL/XrZmtYt3jKz:kW+vreRv1rofclDCh4YZKz
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  
  NEW PAYPAL CASHOUT 2014.pdf
- Size
  
  679KB
- MD5
  
  91d968587dcf2a59e28d35cd4ddd18c4
- SHA1
  
  05ec0b7512a0bde9b1dceef4663fff7772c11bcf
- SHA256
  
  b77a664c1dc520e85f4a6b7ddd8049b50eb4052b20a01e2a94b3345777f41ae8
- SHA512
  
  dbc5ed3b1a996e332c3e139982390e79de0c82f5815b4d8e15f7cb11bb4872f6eac313ae298d4b19bf4a3e626d32b9270a00a26fb2d4049eadcd947bd6876652
- SSDEEP
  
  12288:jpSeeG4cKCz94eviwnFIKA0uYqjoTRE5K36GMGDl8IU8vBE0Y6t6t6cIOgv09zOA:j0c4cKCz94ejnGx9jcROo6GMGDfU0B4n
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  
  PolishPaypal.pdf
- Size
  
  40KB
- MD5
  
  8ccd0910daa227a0333e7198aa698a8e
- SHA1
  
  0232b99524d17c26fa09bfa2230f5fb7aadf433a
- SHA256
  
  1913f5048d667984b35b89f695b26e52d398034d222736c1d0d5120a9f8431c6
- SHA512
  
  a9286c7d1211992f81cd88bd5f33142f6beea2e71cd311cdd52878e84900f6476c2254879a56f3da5e69992e63d9cc73b4a74c72657e271e63269efdc69eff71
- SSDEEP
  
  768:TN/EfO0OMYgixR0HsWlLox4Vk4PBO6tRckYl0HPfmd1a4dtkRgmT2nMDzssdvJfd:VE5QgUyxYGr5xRckYl0HP+dQgs2n+Rl
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  
  Profiting from Paypal - TCF Wiki.html
- Size
  
  32KB
- MD5
  
  f69df598aa45d488ec12cc5438030ab6
- SHA1
  
  5ed2d3740dd741b5a1be1d7dd0d1c43f64d9537e
- SHA256
  
  fe8e7883656dcdf0ff4a05c3905397aeeecd0c75cc4b5d06b80e1536e11bc989
- SHA512
  
  97f0d6dc1d0a51576ddbe80424898e2128d20021aea0c79265747727c645a74871178dae01cf8960baee4cb8c2fdaf3c2b18efc43d5dd85b66103420813dc325
- SSDEEP
  
  384:aMPfdUrfTVBFPzDsjvr9ZMFgTvGoDYCvwe4yW165e/hVOl1i3mVCDLNZpc6TU1zx:aMPfEh7LWxZoyC6OgivZpcTaCW4
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  
  ScrewPaypal.pdf
- Size
  
  550KB
- MD5
  
  811bdc8ec33febb0cdf3c4954f3031a4
- SHA1
  
  5a3361b378827661fbdd3f9a02cc4d2c57826e14
- SHA256
  
  77be8e5c9396e4bc657387abf1ddf88b2ec8bdab60dc3477ae74ab7e03fea6c4
- SHA512
  
  a7fe181b945c1a4ad18d0b8ada41f5181c8fa3cd146c982cb1611e1b873426aa4a708c51af8847c6e0ebdc0d32e3f11a75d0f54ddb14d74680181f060e7e8ae0
- SSDEEP
  
  12288:Q4aZSMas5zyPlrc6HxXcBeW8DIa8VmhGQgprWXrM:Q4sorcWIeHD9E5rWI
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  
  StealthPaypal.pdf
- Size
  
  42KB
- MD5
  
  092078d0a61b990d7aadb2371e89bb11
- SHA1
  
  111d35a7df2f1bc11fa3f9a96f732651a6a795af
- SHA256
  
  7f9d7cd4ab9fa79b9f7eb9a0eca83e3d781fd2f5f3ebeee1e9e512cd34516f3a
- SHA512
  
  e1d0d453a48397f1763f833ebf2ded481daec1a247eb3e4afc8b83efef16e537edc44f586b62e292f213f8f9c8c11516dcfee324e1c5ed24e032595da649f756
- SSDEEP
  
  768:KPLQDLTsav4O6Jd4irWtuZbMLCpMfEnOZz2BhGS0k3HN1ZRZdZwxlCFJ9:KzQDLww2BWMZ41s/huUHDZRZ1r
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  
  The Ultimate Privacy Guide.pdf
- Size
  
  991KB
- MD5
  
  89839cc54ab6e3cd85c06cc837631719
- SHA1
  
  a25065d5301c838b714261d2c5e0e0553a93ccd0
- SHA256
  
  49d70057e256b152c80457d63d8e44c08eecf317d3b5f299f799acc13d5a6ed0
- SHA512
  
  54b6ffb3fb348df612a5e02a6c2d0461e7cc0996ea054eaeb118e3b0253032c08b6696ee986cc193cfb11c762b0652064660d33759e6ec62a0a3059172149fb5
- SSDEEP
  
  24576:A0bbH7v9TzRdnipNb0QN+BhPD21/tChaaI+Pizvsov0Q:RbbHpTzLnu0++imiLXv
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  
  Unlimited Stealth PayPal Acts and how to Cash them out.pdf
- Size
  
  51KB
- MD5
  
  8cbcfd4f65421379598628918a5c6048
- SHA1
  
  cff70e9a589452810b997081c7dede8c30163e40
- SHA256
  
  29426b26f770333e3ce92e61ba0e6c6508679655a023ec64185c32e5ec534821
- SHA512
  
  accb1ac7e99c3b65d7d72ec5365271ff01fb04ef02b07806a1da1f52371c141bd46cdaae3920ff01940656fd8d94b0bc1511b976a7059d5f4c43cc1934b931ce
- SSDEEP
  
  768:uN2QunEdL3/uh54q+gideO6Jd4irWtuZbMLCpMfEnOZz2BhGSc0rfpR5j9BktMwc:utL3Ghn40BWMZ41s/hjc0r1xBktMwuSu
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  
  Yasuo.Paypal.v4.5.5.5.lnk
- Size
  
  3KB
- MD5
  
  5d6276cdb3f840dc5c5a6c89a42a8d6d
- SHA1
  
  c4094dd18d14f214392709a7da2b8d47649298bc
- SHA256
  
  2cf631d3527853eaa9d486915707cbe570f82d408c16d84aa530ef38ec594296
- SHA512
  
  98a91248ad60fa91633c29fdf72d379f0b80f24b030d704079f2b9a9689e298d0d064bbcc72d6d37e37cb04802e9c3f31bcf8810440b5fa50dc9845a857ba27f
Score

10^/10

jigsaw persistence ransomware spyware stealer
- Jigsaw Ransomware
  Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.
  ransomware jigsaw
- Jigsaw family
  jigsaw
- Renames multiple (2510) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral17 behavioral18
- Target
  
  files/Yasuo.Paypal.v4.5.5.5.exe
- Size
  
  436KB
- MD5
  
  3bee1d24189d4941f68b96da6e207be4
- SHA1
  
  dce911b1c05da965c8733935723b88bc29d12756
- SHA256
  
  a375201f22b6e71d8ea0f81266242e4638e1754aeee14059e9c5e39026d6c710
- SHA512
  
  a40b01c630ff2c4b90a2e1bbf285c5d558193ee0fba79a3210a56408087ca828292269945e3202f65b8eb038a565b1ea8a18d185864ba9dc4073a3633c86ca29
- SSDEEP
  
  12288:5l9mnmYK1bcy9oNm3/oK14MfZGLBddXLA:cqzONmQrBM
Score

10^/10

jigsaw persistence ransomware spyware stealer
- Jigsaw Ransomware
  Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.
  ransomware jigsaw
- Jigsaw family
  jigsaw
- Renames multiple (2512) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral19 behavioral20
- Target
  
  paypal stealth.pdf
- Size
  
  373KB
- MD5
  
  61406112e7319aa050b000ea0c51bdbe
- SHA1
  
  01719f71f167d7eca75608d2b334d5f581646af0
- SHA256
  
  eeeeb3386414e348a81ad42eb2dcacbe9a2789a25ccc1d6aacd3c6dc0b8ff50f
- SHA512
  
  c62e640f0c49afb06d6ac799280bfa5661477b80c502f71dbb7841f517afb565c5c5c1ccfac6c12d33d3dbb0eb41d25de7618397ec3f78cca0ca5f42577fccb0
- SSDEEP
  
  6144:ges5xtRuyQ55VY2hpW02Yo38ZoFkLAUL3wfsvF3lpgHs6Tzwk/gYfkh:4tRuTS02D3IM2wcF3lz63wqgYfw
Score

3^/10

discovery
behavioral21 behavioral22

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Jigsaw Ransomware

Jigsaw family

Renames multiple (2510) files with added filename extension

Checks computer location settings

Executes dropped EXE

Reads user/profile data of web browsers

Adds Run key to start application

Jigsaw Ransomware

Jigsaw family

Renames multiple (2512) files with added filename extension

Checks computer location settings

Executes dropped EXE

Reads user/profile data of web browsers

Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22