Jigsaw

Overview

Ransomware:Win32/Jigsaw is a highly infamous and uniquely psychological ransomware family, immediately recognizable by its use of the 'Billy the Puppet' image from the *Saw* movie franchise. First appearing in 2016, Jigsaw differentiates itself from standard ransomware through intense temporal extortion: it actively and permanently deletes the victim's encrypted files at set intervals (usually every hour) until the ransom is paid.

Understanding Jigsaw Ransomware
To a victim, a Jigsaw infection is a high-stress, terrifying event. The desktop background is changed to a menacing image, and a countdown timer appears on the screen. The ransom note explicitly states that every hour, a batch of files will be permanently deleted, and if the computer is restarted or the ransomware process is terminated, it will 'punish' the user by deleting 1,000 files immediately. For incident responders, Jigsaw is a destructive wiper masquerading as ransomware, utilizing the .NET framework for rapid file enumeration and AES encryption.

Execution and Psychological Extortion
Jigsaw is typically distributed via spam emails or adware bundlers (`T1189`). Upon execution, it establishes persistence via the Registry Run keys or the Startup folder (`T1547.001`). It then rapidly enumerates the file system and encrypts user documents (appending extensions like `.fun`, `.btc`, or `.kkk`) using AES encryption (`T1486`). Once the initial encryption phase is complete, it drops the ransom note GUI (`T1491`). Crucially, a background thread monitors the system time; every hour, it selects a batch of encrypted files and physically deletes them from the disk (`T1485`). It also hooks system events; attempting to close the GUI or reboot the machine triggers a massive, punitive file deletion routine (`T1490`).

Indicators of Compromise & Impact
The impact is extreme psychological stress and permanent data loss if not handled correctly. EDR platforms will alert on rapid, massive file encryption followed by deliberate file deletion commands. The presence of the *Saw* puppet GUI and encrypted files with `.fun` or `.gws` extensions are definitive IoCs. Network logs will show connections to Bitcoin payment addresses.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_JIGSAW {
    meta:
        description = "Detects Jigsaw (ransomware)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "jigsaw" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Jigsaw Activity
id: 80b47ff94aedbafbbf1316deb3c29e83
status: experimental
description: Detects generic indicators of the jigsaw malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*jigsaw*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. CRITICAL: Do NOT turn off, restart, or attempt to terminate the ransomware process using Task Manager. This will trigger the punitive deletion of 1,000 files.
2. Use a specialized tool (like Process Explorer run from a USB drive) to specifically suspend the active Jigsaw threads in memory before attempting termination.
3. Once the process is safely suspended/terminated, locate and remove the autostart entries in the Registry and Startup folder.
4. Do NOT pay the ransom. Decryption tools for older Jigsaw variants are freely available from projects like No More Ransom.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not panic and abruptly restart the computer; this is exactly what the malware is waiting for to delete bulk data.
2. Avoid paying the ransom; due to flaws in Jigsaw's early implementations, the decryption keys are often hardcoded or extractable from memory.

References & External Analysis

• Search "jigsaw" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: ransomware)

Explore other malware families in the same category:

• Tartober
• Prex
• Excrevie
• Killproc
• Xiazai

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/jigsaw.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.