Analysis
-
max time kernel
144s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
27-11-2024 13:27
General
-
Target
2f41c73046f3b0f5edd79ae089b6b64ec3a0812ea02fe7325b8e5b171a621c95.exe
-
Size
1.5MB
-
MD5
b8f887a092b6bdcb1bd882e35164d1d7
-
SHA1
08152f67bf925a7478312d45a67f33116a6097b3
-
SHA256
2f41c73046f3b0f5edd79ae089b6b64ec3a0812ea02fe7325b8e5b171a621c95
-
SHA512
057b60f71a84c51d3112e553164d4a476f9488bd1369cec4405975b8cece83fe29d58342bd02ad17542ca1e38254f05dadca027ecbeb281d3b94ff198517dff7
-
SSDEEP
24576:7zwwr/TK4y3+HaxwUsgdYNLhzEnmfp499VYn6nTtEpR59qUN0i6OtH:78wra+ksgdYNLhYmfpaVYn6nTMR59VSi
Malware Config
Signatures
-
Jigsaw Ransomware
Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.
-
Jigsaw family
-
Renames multiple (2021) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2f41c73046f3b0f5edd79ae089b6b64ec3a0812ea02fe7325b8e5b171a621c95.exe"C:\Users\Admin\AppData\Local\Temp\2f41c73046f3b0f5edd79ae089b6b64ec3a0812ea02fe7325b8e5b171a621c95.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe"C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe" C:\Users\Admin\AppData\Local\Temp\2f41c73046f3b0f5edd79ae089b6b64ec3a0812ea02fe7325b8e5b171a621c95.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
160B
MD5000e8c41d4a15fb34d0be0dbb56e3778
SHA100c4eae64ee6239d7c65d819c6ce1ac329224f8c
SHA2568bdfa6a5b7de345cf0d4fe0e9c17d8b0e9db26d58b05b1b2ebbb3a05a068ff28
SHA512775d832eb8ab73e4a93789917dca69edb6c91fbb426e02acf7c6e213ffb4575776187209d1c471fbf57c4621ea3c23d9850f6dfc2770d62c17de9d66710800af
-
Filesize
1.5MB
MD5b8f887a092b6bdcb1bd882e35164d1d7
SHA108152f67bf925a7478312d45a67f33116a6097b3
SHA2562f41c73046f3b0f5edd79ae089b6b64ec3a0812ea02fe7325b8e5b171a621c95
SHA512057b60f71a84c51d3112e553164d4a476f9488bd1369cec4405975b8cece83fe29d58342bd02ad17542ca1e38254f05dadca027ecbeb281d3b94ff198517dff7
-
Filesize
16B
MD5cfdae8214d34112dbee6587664059558
SHA1f649f45d08c46572a9a50476478ddaef7e964353
SHA25633088cb514406f31e3d96a92c03294121ee9f24e176f7062625c2b36bee7a325
SHA512c260f2c223ecbf233051ac1d6a1548ad188a2777085e9d43b02da41b291ff258e4c506f99636150847aa24918c7bbb703652fef2fe55b3f50f85b5bd8dd5f6e3
-
Filesize
190KB
MD539488efdf502ed5b3609b3f21a85020d
SHA1e9bac9646bc8a6b286e7510bda3e9557f99b2aab
SHA2567c0047d407614d616ad9c13ac47e5da2001758af23cec607439c5701b20f4422
SHA512289b83bf8981879e619a046439702fd47228a5467eca086ddae82cb16e426094c9e77025f47995ce809d4cadc544fa370141e255022ffc49916300cb0d349793
-
Filesize
9KB
MD530aa572b185d07a2b4a579f812065134
SHA173fbfe228e5fbca6fdc4b18e16c9b5a0ad229abd
SHA256c32575cdd39a09244624f17667fbce4306474a926c2554be43dada0ecd5953ea
SHA512b62147d09e78f311c0d9afbfbe32a3ed3de3a40ffd472d069538246e2fc1ddbab7c38a9c95a1006dd701e7c8c8870df8350b8b287260bf9e11106d2e5e1c7505
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
4KB
-
Filesize
2.4MB
-
Filesize
9.6MB
-
Filesize
9.6MB
