Resubmissions
13/02/2026, 04:10
260213-ervd1aaz9f1013/02/2026, 01:39
260213-b25qyafx5a1013/02/2026, 00:59
260213-bb2llae17c10Analysis
- max time kernel
15s - max time network
17s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260130-en - resource tags
- submitted
13/02/2026, 00:59
General
- Target Jigsaw.exe
- Size 283KB
- Sample260213-bb2llae17c
- SHA256 3ae96f73d805e1d3995253db4d910300d8442ea603737a1428b613061e7f61e7
Malware Config
Signatures
- Jigsaw Ransomware
Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.
- Jigsaw family
- Renames multiple (59) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 2 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- ConfuserEx .NET packer 1 IoCs
Detects ConfuserEx .NET packer.
- Drops file in Program Files directory 64 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Jigsaw.exe"C:\Users\Admin\AppData\Local\Temp\Jigsaw.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe"C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe" C:\Users\Admin\AppData\Local\Temp\Jigsaw.exe2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\Frfx\firefox.exeC:\Users\Admin\AppData\Roaming\Frfx\firefox.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
drpbx.exe
memory/1516-9-0x00007FFDE4720000-0x00007FFDE50C1000-memory.dmp
memory/1516-3-0x000000001BE00000-0x000000001C2CE000-memory.dmp
memory/1516-4-0x00007FFDE4720000-0x00007FFDE50C1000-memory.dmp
memory/1516-5-0x000000001C2D0000-0x000000001C36C000-memory.dmp
memory/1516-1-0x00007FFDE4720000-0x00007FFDE50C1000-memory.dmp
memory/1516-2-0x0000000000F60000-0x0000000000F98000-memory.dmp
memory/1516-8-0x0000000002B60000-0x0000000002C0D000-memory.dmp
memory/1516-10-0x00007FFDE4720000-0x00007FFDE50C1000-memory.dmp
memory/1516-0-0x00007FFDE49D5000-0x00007FFDE49D6000-memory.dmp
memory/1688-37-0x0000000001290000-0x000000000133D000-memory.dmp
memory/1688-38-0x000000001C6A0000-0x000000001C6AC000-memory.dmp
memory/1688-14-0x00000000013F0000-0x00000000013F8000-memory.dmp
memory/1688-15-0x00007FFDE4720000-0x00007FFDE50C1000-memory.dmp
memory/3252-11-0x00007FFDE4720000-0x00007FFDE50C1000-memory.dmp
memory/3252-16-0x0000000002E80000-0x0000000002F2D000-memory.dmp
memory/3252-12-0x00007FFDE4720000-0x00007FFDE50C1000-memory.dmp