General
- Target uninstall.exe
- Size 77KB
- Sample260710-fk3bpsev6y
- SHA256 87b6249fbae56b7247812e9dbfcce9ef28331da218b2af26900ab4890a1f285a
Score
10/10
Malware Config
Targets
-
- Target uninstall.exe
- Size 77KB
- SHA256 87b6249fbae56b7247812e9dbfcce9ef28331da218b2af26900ab4890a1f285a
Score10/10Family: Jigsaw Ransomware
Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
Renames multiple (1679) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
Deletes itself
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Adds Run key to start application
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
ConfuserEx .NET packer
Detects ConfuserEx .NET packer.
-
- Target $PLUGINSDIR/LangDLL.dll
- Size 5KB
- SHA256 4cf25411f28f639f72156c24b0f66ea42f5aee5973f6c137d901da6ae42d5b7e
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
Score3/10 -
- Target $PLUGINSDIR/nsis_tauri_utils.dll
- Size 33KB
- SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
Score3/10
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1