Overview
overview
10Static
static
10Red-Flaged/Jigsaw.exe
windows10-2004-x64
10Red-Flaged/Jigsaw.exe
windows11-21h2-x64
10Red-Flaged/Locky.exe
windows10-2004-x64
10Red-Flaged/Locky.exe
windows11-21h2-x64
10Red-Flaged....1.exe
windows10-2004-x64
10Red-Flaged....1.exe
windows11-21h2-x64
10Red-Flaged....A.exe
windows10-2004-x64
10Red-Flaged....A.exe
windows11-21h2-x64
10Red-Flaged/N-W0rm.exe
windows10-2004-x64
10Red-Flaged/N-W0rm.exe
windows11-21h2-x64
10Red-Flaged....A.exe
windows10-2004-x64
Red-Flaged....A.exe
windows11-21h2-x64
Red-Flaged...df.exe
windows10-2004-x64
10Red-Flaged...df.exe
windows11-21h2-x64
10Red-Flaged/Remcos.exe
windows10-2004-x64
10Red-Flaged/Remcos.exe
windows11-21h2-x64
10Red-Flaged...re.exe
windows10-2004-x64
7Red-Flaged...re.exe
windows11-21h2-x64
7Red-Flaged...66.exe
windows10-2004-x64
10Red-Flaged...66.exe
windows11-21h2-x64
10Red-Flaged...cs.exe
windows10-2004-x64
10Red-Flaged...cs.exe
windows11-21h2-x64
Red-Flaged...an.exe
windows10-2004-x64
10Red-Flaged...an.exe
windows11-21h2-x64
10Red-Flaged...ui.exe
windows10-2004-x64
10Red-Flaged...ui.exe
windows11-21h2-x64
10Red-Flaged...0r.exe
windows10-2004-x64
10Red-Flaged...0r.exe
windows11-21h2-x64
10Red-Flaged...AT.exe
windows10-2004-x64
10Red-Flaged...AT.exe
windows11-21h2-x64
10Red-Flaged/Xeno.exe
windows10-2004-x64
10Red-Flaged/Xeno.exe
windows11-21h2-x64
10Resubmissions
08/09/2026, 15:38
260908-s27nzagd9315/08/2026, 21:05
260815-zw6ytat1ez15/08/2026, 20:50
260815-zmxnsatzgs15/08/2026, 20:46
260815-zkklfatcnf15/08/2026, 20:40
260815-zf5e2stcjb15/08/2026, 20:39
260815-zfqlwstydz14/08/2026, 18:03
260814-wm9fssyyev06/08/2026, 22:09
260806-124lbabl4s06/08/2026, 03:52
260806-efejeaxzax04/08/2026, 06:18
260804-g2rf7ssgqfAnalysis
- max time kernel
598s - max time network
434s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
25/05/2026, 14:51
Static task
static1
Behavioral task
behavioral1
Sample
Red-Flaged/Jigsaw.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
Red-Flaged/Jigsaw.exe
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral3
Sample
Red-Flaged/Locky.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
Red-Flaged/Locky.exe
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral5
Sample
Red-Flaged/MuckModLoaderSetup2.1.1.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
Red-Flaged/MuckModLoaderSetup2.1.1.exe
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral7
Sample
Red-Flaged/MyDoom.A.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
Red-Flaged/MyDoom.A.exe
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral9
Sample
Red-Flaged/N-W0rm.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
Red-Flaged/N-W0rm.exe
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral11
Sample
Red-Flaged/Petya.A.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
Red-Flaged/Petya.A.exe
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral13
Sample
Red-Flaged/Product Sample pdf.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
Red-Flaged/Product Sample pdf.exe
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral15
Sample
Red-Flaged/Remcos.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
Red-Flaged/Remcos.exe
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral17
Sample
Red-Flaged/Rensenware.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
Red-Flaged/Rensenware.exe
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral19
Sample
Red-Flaged/SecuriteInfo.com.Trojan.PackedNET.3443.29781.26666.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
Red-Flaged/SecuriteInfo.com.Trojan.PackedNET.3443.29781.26666.exe
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral21
Sample
Red-Flaged/Synaptics.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
Red-Flaged/Synaptics.exe
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral23
Sample
Red-Flaged/Uniformitarian.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
Red-Flaged/Uniformitarian.exe
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral25
Sample
Red-Flaged/VerifierImGui.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
Red-Flaged/VerifierImGui.exe
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral27
Sample
Red-Flaged/WannaCrypt0r.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
Red-Flaged/WannaCrypt0r.exe
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral29
Sample
Red-Flaged/WarzoneRAT.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
Red-Flaged/WarzoneRAT.exe
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral31
Sample
Red-Flaged/Xeno.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
Red-Flaged/Xeno.exe
Resource
win11-20260513-en
windows11-21h2-x64
General
- Target Red-Flaged/Jigsaw.exe
- Size 283KB
- Sample260525-r7719aex91
- SHA256 3ae96f73d805e1d3995253db4d910300d8442ea603737a1428b613061e7f61e7
- MD5 2773e3dc59472296cb0024ba7715a64e
- SHA1 27d99fbca067f478bb91cdbcb92f13a828b00859
- SHA512 6ef530b209f8ec459cca66dbf2c31ec96c5f7d609f17fa3b877d276968032fbc6132ea4a45ed1450fb6c5d730a7c9349bf4481e28befaea6b119ec0ded842262
- SSDEEP 6144:7fukPLPvucHiQQQ4uuy9ApZbZWxcZt+kTfMLJTOAZiYSXjjeqXus:7fu5cCT7yYlWi8kTfMLJTOAZiYSXjyqX
- TLSH T110549D9C366076EFC867D476DEA81CA4FA6078BB832B8207901715EDA90D997CF141F3
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Family: Jigsaw Ransomware
Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.
- Renames multiple (1719) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Executes dropped EXE 2 IoCs
pid Process 5968 drpbx.exe 5772 firefox.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Run\firefox.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Frfx\\firefox.exe" Jigsaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Run\firefox.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Frfx\\firefox.exe" firefox.exe - ConfuserEx .NET packer 1 IoCs
Detects ConfuserEx .NET packer.
resource yara_rule behavioral2/files/0x001700000002b831-11.dat ConfuserEx - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\GamesXboxHubStoreLogo.scale-100.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PaintSmallTile.scale-200.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Exchange.scale-250.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\OutlookMailBadge.scale-200.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_x64__8wekyb3d8bbwe\Assets\TipsWideTile.scale-100_contrast-black.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SnipSketchAppList.targetsize-36_altform-unplated.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\contrast-black\OrientationControlConeHover.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\Images\Square44x44Logo.scale-150.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\Images\Wide310x150Logo.scale-100_contrast-black.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SnipSketchAppList.targetsize-256_altform-unplated.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.40831.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-16_altform-unplated_contrast-white.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\StoreLargeTile.scale-100.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Todos_0.33.33351.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-16_altform-unplated.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\NotepadStoreLogo.scale-100.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PaintWideTile.scale-200.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarWideTile.scale-125.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\NotepadSmallTile.scale-100.png drpbx.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\server_issue.gif drpbx.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\RedAndBlackLetter.dotx.fun drpbx.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Generic-Dark.scale-250.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SmallLogo.scale-200_contrast-white.png drpbx.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunec.jar.fun drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_1.0.22.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsSmallTile.scale-200_contrast-white.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\Images\PowerAutomateAppIcon.altform-lightunplated_targetsize-32.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.32731.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-16_altform-unplated_contrast-white.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml firefox.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] drpbx.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-tw.txt firefox.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftEdge.Stable_139.0.3405.125_neutral__8wekyb3d8bbwe\AppxManifest.xml drpbx.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Getstarted_10.2.41172.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\TipsMedTile.scale-125_contrast-black.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCalculator_10.2012.21.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\CalculatorSmallTile.scale-125_contrast-white.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_4.0.2.0_x64__8wekyb3d8bbwe\Assets\Icons\StickyNotesAppList.targetsize-16_altform-unplated_contrast-black.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PeopleAppList.targetsize-72.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\Images\contrast-white\PowerAutomateAppIcon.targetsize-24.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Advanced-Light.scale-250.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_x64__8wekyb3d8bbwe\Assets\TipsAppList.targetsize-60_altform-lightunplated.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2012.21.0_x64__8wekyb3d8bbwe\Assets\Graphing.targetsize-64_contrast-white.png drpbx.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\AdjacencyLetter.dotx.fun drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\Images\contrast-black\PowerAutomateWide310x150Logo.scale-125.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailMediumTile.scale-125.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Assets\contrast-white\NotepadAppList.targetsize-16_altform-lightunplated.png drpbx.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\server\Xusage.txt drpbx.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\public_suffix_list.dat.fun drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GamingApp_2105.900.24.0_x64__8wekyb3d8bbwe\Assets\Xbox_SplashScreen.scale-200_contrast-white.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\Theme_Illustration_Seasons_Fall_Center.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.GetHelp_10.2008.32311.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\GetHelpMedTile.scale-125_contrast-white.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\StoreAppList.targetsize-20.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\wwwroot\images\dashboard-logo.svg drpbx.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\CancelGlyph.16.White.png drpbx.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\back-arrow-focus.svg.fun drpbx.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_download_audit_report_18.svg drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2012.21.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-32_altform-lightunplated.png drpbx.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer2019_eula.txt drpbx.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\EmptyShare.scale-125.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ScreenSketch_11.2104.2.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\SnipSketchMedTile.scale-125.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_1.0.38.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderWideTile.scale-100.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\Win10\contrast-white\MicrosoftSolitaireMedTile.scale-100_contrast-white.png drpbx.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.proofing.msi.16.en-us.xml drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\Images\PowerAutomateAppIcon.scale-400.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_x64__8wekyb3d8bbwe\Assets\contrast-black\GetHelpAppList.targetsize-64_altform-unplated_contrast-black.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\EmptyView.scale-400.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2020.503.58.0_x64__8wekyb3d8bbwe\Assets\CameraAppList.targetsize-48.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\Images\LargeTile.scale-150_contrast-white.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-48_altform-unplated_contrast-white.png drpbx.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5928 wrote to memory of 5968 5928 Jigsaw.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\Red-Flaged\Jigsaw.exe"C:\Users\Admin\AppData\Local\Temp\Red-Flaged\Jigsaw.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5928 -
C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe"C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe" C:\Users\Admin\AppData\Local\Temp\Red-Flaged\Jigsaw.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5968
-
-
C:\Users\Admin\AppData\Roaming\Frfx\firefox.exeC:\Users\Admin\AppData\Roaming\Frfx\firefox.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
PID:5772
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt.fun
- Size 32KB
- SHA256 a193ee2673e0ba5ebc5ea6e65665b8a28bd7611f06d2b0174ec2076e22d94356
- MD5 829165ca0fd145de3c2c8051b321734f
- SHA1 f5cc3af85ab27c3ea2c2f7cbb8295b28a76a459e
- SHA512 7d380cda12b342a770def9d4e9c078c97874f3a30cd9f531355e3744a8fef2308f79878ffeb12ce26953325cb6a17bc7e54237dfdc2ee72b140ec295676adbcb
- SSDEEP 768:G0/UcQ5N99TO/VAWPngk6pGemIpytzO2VnXoE6Yiif2U8tzVdiSl:cjTONA4ngknHUUyQXoE5N2U8t5v
- TLSH T131E2F13169EE435456F3C78B5CF49328AB62F7D0F76AA7A30F9A18620DF342150D1A64
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\invalid32x32.gif.fun
- Size 160B
- SHA256 98b6c2ddfefc628d03ceaef9d69688674a6bc32eb707f9ed86bc8c75675c4513
- MD5 580ee0344b7da2786da6a433a1e84893
- SHA1 60f8c4dd5457e9834f5402cb326b1a2d3ca0ba7e
- SHA512 356d2cdea3321e894b5b46ad1ea24c0e3c8be8e3c454b5bd300b7340cbb454e71fc89ca09ea0785b373b483e67c2f6f6bb408e489b0de4ff82d5ed69a75613ba
- TLSH T15FC08C6A014B9E0F0B8A99A600301646A72AD831C151B007E67A1E9BA6AA6666220006
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe
- Size 283KB
- SHA256 3ae96f73d805e1d3995253db4d910300d8442ea603737a1428b613061e7f61e7
- MD5 2773e3dc59472296cb0024ba7715a64e
- SHA1 27d99fbca067f478bb91cdbcb92f13a828b00859
- SHA512 6ef530b209f8ec459cca66dbf2c31ec96c5f7d609f17fa3b877d276968032fbc6132ea4a45ed1450fb6c5d730a7c9349bf4481e28befaea6b119ec0ded842262
- SSDEEP 6144:7fukPLPvucHiQQQ4uuy9ApZbZWxcZt+kTfMLJTOAZiYSXjjeqXus:7fu5cCT7yYlWi8kTfMLJTOAZiYSXjyqX
- TLSH T110549D9C366076EFC867D476DEA81CA4FA6078BB832B8207901715EDA90D997CF141F3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\winword.exe.db.fun
- Size 24KB
- SHA256 bc609f10cc4c74f113d734255d67183435d274f7734a5738234f2b7b18b11603
- MD5 39e8596c7249feb88313e4df93048a7e
- SHA1 6c541e0d4de4c7101f818e2b510d481392ee7f65
- SHA512 596a89ad82487f1084dcd5436b13280b2a5b3826ad3ae7190734347dc63a9d2a4335556007847d02ecab2111d72614f238191857b6426a3def9aa8144fc93bfc
- SSDEEP 768:Zrpirc/XmIbniahgIcMydRsQCGq/l2Rfucw8HU6hs/:v/LbNh5cbfrfCSh+
- TLSH T1C4B2E1D9229C8ED57C061330F92163F5B8A8EE19D69F2EC66715C41B9CF34EEE608C52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\Settings\settings.dat.fun
- Size 8KB
- SHA256 36537e56d60910ab6aa548e64ca4adafdcabde9d60739013993e12ba061dfd65
- MD5 f22599af9343cac74a6c5412104d748c
- SHA1 e2ac4c57fa38f9d99f3d38c2f6582b4334331df5
- SHA512 5c8afc025e1d8342d93b7842dc7ef22eca61085857a80a08ba9b3f156ee3b814606bb32bc244bd525a7913e7915bdf3a86771d39577f4a1176ade04dc381c6d4
- SSDEEP 192:FSgNbwp27vLa0nMdhWNBPh0X4f4ht6VfJHYwiP8bIpu6Ev0KrDj:FnNbwp2/HnMdhWN1h0XG4hix4wmFpu6g
- TLSH T10F029E5D52CA6AB63C3B8FB69378A11E87F234CB332445CE41AA263CA3D5195D4148BA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\BroadcastMsg_1778729716.txt.fun
- Size 16B
- SHA256 619e246fc0ac11320ff9e322a979948d949494b0c18217f4d794e1b398818880
- MD5 8ebcc5ca5ac09a09376801ecdd6f3792
- SHA1 81187142b138e0245d5d0bc511f7c46c30df3e14
- SHA512 cec50bfc6ad2f57f16da99459f40f2d424c6d5691685fa1053284f46c8c8c8a975d7bcb1f3521c4f3fbdc310cf4714e29404aa23be6021e2e267c97b090dc650
- MD5 SHA1 SHA512