Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
12-12-2024 08:17
General
-
Target
e57af3c82f33302d9736c178410bce30_JaffaCakes118.exe
-
Size
2.0MB
-
MD5
e57af3c82f33302d9736c178410bce30
-
SHA1
edd2f34ec0ea57edde129253790f70f5c0390bb0
-
SHA256
607f1607762645b684f13cffccfbe4bc326f24707953dc0cfb80aff22def8df0
-
SHA512
ef2f763b1349c23597bf16bcb6d03066b1d1f51eb59e61448d4955ac12d0d1e614428d4040285915021ad71aaadc202dcae97308a45cc20d339bcffd5a2d2c40
-
SSDEEP
49152:3pVsby44mK/P4sFPfYQ1dNhq7LZw9PZOAIYZ4:Znmk9FIeDeZw9MAIe
Malware Config
Signatures
-
Jigsaw Ransomware
Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.
-
Jigsaw family
-
Renames multiple (2021) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e57af3c82f33302d9736c178410bce30_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e57af3c82f33302d9736c178410bce30_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe"C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe" C:\Users\Admin\AppData\Local\Temp\e57af3c82f33302d9736c178410bce30_JaffaCakes118.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
160B
MD5c55a44def54d2d4ad446279e2396fd53
SHA1f77e9719392509d2faadeb953d40a3810c100b83
SHA256257c16c6967bc37b43934987963025ef860d83c198a5a0dc380f72638d6b47f6
SHA512bd8f3b07592b9036ccd6778cf98e1604ee4e93f3273aed09869dd8ecd1a5c084bf2cadca3eb718c09bbc20487f19ad8848f8dc6e613b5b6155df741fd43a0c59
-
Filesize
2.0MB
MD5e57af3c82f33302d9736c178410bce30
SHA1edd2f34ec0ea57edde129253790f70f5c0390bb0
SHA256607f1607762645b684f13cffccfbe4bc326f24707953dc0cfb80aff22def8df0
SHA512ef2f763b1349c23597bf16bcb6d03066b1d1f51eb59e61448d4955ac12d0d1e614428d4040285915021ad71aaadc202dcae97308a45cc20d339bcffd5a2d2c40
-
Filesize
16B
MD5f676080bd90886ac2ecf680ac3162244
SHA130a721d56041472fcf0c255c3c05c89b76093101
SHA2566e658c85e1ac3f1599673a2374ad5e8fb94520fe68b3f6eefdf108c42acc6414
SHA512b654a04f020ca0ccb0e9f7ab964e0d6a998b15b02ec47cbcccfd1274b99fddeccdca688b1d39e3d82de28610624f8765b1f5ac52895072f7c4cdb824f1658960
-
Filesize
190KB
MD53fd1ba89a6718c5b8cacc96408aa33ae
SHA11dc5ccffff32e49a1515a9ab84d41a071fa60f40
SHA256eb5bc035243b59473d7185c0d6916e163ca5934c5651bd0bf515993c454ffdb2
SHA5123659dfe4fde76f62e0e45342b633a532ed792307bbe43d2ae350ab4b76f7d51fef7e5ae8cc3a435d9c0a47d89c5cff1298c6893b18c307c3647ee2b93f8f8d9a
-
Filesize
9KB
MD5fe8741d10633a88804aea9308409ddef
SHA1757ec30304d9804753c2675c1e0b170c2a68d07c
SHA2565a88908f04b960d0fcd18425aff46f465a1318042b2234e55259f31a5eff55ba
SHA512246a6fdd2e0f7c2be23048ca0636e1d1d7fc28942f798ce251b4a9953940f271a2f4c42c592290e6971ad8ac1e6547a9170f464e6cc791fc0e48daf706b25be9
-
Filesize
9.6MB
-
Filesize
4KB
-
Filesize
9.6MB
-
Filesize
1.4MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
456KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
