jigsaw | 92880fa12ebc08efe411f63e623fe80225b771f493e80d4cc159f100229c5a5d | Triage

Sharing

General

Target

Cats.7z
Size

59KB
Sample

250320-3be65strt2
MD5

aea292b5fe9535eec446e63cc1b44991
SHA1

a7d7aecd3908c7cf7f93de08fe5333ded163509a
SHA256

92880fa12ebc08efe411f63e623fe80225b771f493e80d4cc159f100229c5a5d
SHA512

167a475f7e3ceaf8e28e8ecd7f03bc868358106ee17cfdd54845356d051d602375c5b354d58523ffe6f699e6d698d143c6d066662bdbce830dab826de2c76470
SSDEEP

1536:iKOEQghYEczjLsfh3mWvlfxykl+D0gLYDjutHSoaUyANU/C/9+rusLg54:tmDjL6mC1wh5ZSVACCIrb

Score

10^/10

jigsaw persistence ransomware spyware stealer

Malware Config

Targets

- Target
  
  cats.exe
- Size
  
  126KB
- MD5
  
  e0d108435c58dc9403588e4dcab68275
- SHA1
  
  7a7331423938020550ff3decd2e8b50b3ee5c87a
- SHA256
  
  61cd0131cb4bf090c5ee7761566f6f7a778e78b37d220f0506f98632a2663ee8
- SHA512
  
  2a5648ced91b75d928b4d71a8580c5bee75a5f27623f8c5071cd23b8cd85eaa8129ddb0aaf0a1fcca05fb1b7868a0fcd9306e9ddf2d3eaaf605c41cc7fde4a9e
- SSDEEP
  
  3072:7+gYdgLNp0jPilel4+800N1lknzRxqmhda40U6hrnzRxqmhda40U6hK:6gvunnhdaLlrnnhdaLl
Score

10^/10

jigsaw persistence ransomware spyware stealer
- Jigsaw Ransomware
  Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.
  ransomware jigsaw
- Jigsaw family
  jigsaw
- Renames multiple (2001) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

jigsawpersistenceransomwarespywarestealer

behavioral2

jigsawpersistenceransomwarespywarestealer