Analysis
-
max time kernel
551s -
max time network
358s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
22-11-2024 03:20
General
-
Target
DBm0yQwt.exe.ViR.exe
-
Size
216KB
-
MD5
3cb2c3ce48ac870ab0be9afb7233295f
-
SHA1
b87ac51e95b85e64bb3fecbbb8f9d2acb5b53895
-
SHA256
ac3f6f87217e1d4fbcd56289b4c77b1adea3dbbaf4131a84b7b2508d6fadcfaf
-
SHA512
e41c6ad1f5522dda96e19fdf4b79ebd8b7bc13507c5ed5afc1155e37b1dabf16f11f66b1101124035d3d92a942bcd60122e3751069ebd7da1a36e498845b6900
-
SSDEEP
3072:UPPdPl/PuW/Yqoeog665R6OKEjzG6hgckhmnl/5aUWTo+Kuv+nAo:UHTnVHv82ZJFgJ+/Hxn
Score
10/10
Malware Config
Extracted
Path
C:\!HELP_SOS.hta
Ransom Note
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<title>Decryption Instructions</title>
<HTA:APPLICATION ID='App' APPLICATIONNAME="Decryption Instructions" SCROLL="yes" SINGLEINSTANCE="yes" WINDOWSTATE="maximize">
<style>
a {
color: #04a;
text-decoration: none;
}
a:hover {
text-decoration: underline;
}
body {
background-color: #e7e7e7;
color: #222;
font-family: "Lucida Sans Unicode", "Lucida Grande", sans-serif;
font-size: 12pt;
line-height: 16pt;
}
body, h1 {
margin: 0;
padding: 0;
}
h1 {
color: #555;
text-align: center;
padding-bottom: 1.5em;
}
h2 {
color: #555;
text-align: center;
}
ol li {
padding-bottom: 13pt;
}
.container {
background-color: #EEE;
border: 2pt solid #C7C7C7;
margin: 3%;
min-width: 600px;
padding: 5% 10%;
color: #444;
}
.filecontainer{
padding: 5% 10%;
display: none;
}
.header {
border-bottom: 2pt solid #c7c7c7;
padding-bottom: 5%;
}
.hr {
background: #bda;
display: block;
height: 2pt;
margin-top: 1.5%;
margin-bottom: 1.5%;
overflow: hidden;
width: 100%;
}
.key{
background-color: #A1D490;
border: 1px solid #506A48;
display: block;
text-align: center;
margin: 0.5em 0;
padding: 1em 1.5em;
word-wrap: break-word;
}
.keys{
margin: 3em 0;
}
.filename{
border: 3px solid #AAA;
display: block;
text-align: center;
margin: 0.5em 0em;
padding: 1em 1.5em;
background-color: #DCC;
}
.us{
text-decoration: strong;
color: #333;
}
.info{
background-color: #E4E4E4;
padding: 0.5em 3em;
margin: 1em 0;
}
.text{
text-align: justify;
}
#file{
background-color: #FCC;
}
.lsb{
display: none;
margin: 3%;
text-align: center;
}
.ls{
border: 1px solid #888;
border-radius: 3px;
padding: 0 0.5em;
margin: 1em 0.1em;
}
.ls:hover{
background-color: #D0D0D0;
}
.l{
display:none;
}
</style>
<script language="vbscript">
Function GetCmd
GetCmd = App.commandLine
End Function
</script>
<script language="javascript">
function openlink(url){
new ActiveXObject("WScript.Shell").Run(url);
return false;
}
function aIndexOf(arr, v){
for(var i = 0; i < arr.length; i++) if(arr[i] == v) return i;
return -1;
}
function tweakClass(cl, f){
var els;
if(document.getElementByClassName != null){
els = document.getElementsByClassName(cl);
}
else{
els = [];
var tmp = document.getElementsByTagName('*');
for (var i = 0; i < tmp.length; i++){
var c = tmp[i].className;
if( (c == cl) || ((c != '') && ((' '+c+' ').indexOf(' '+cl+' ') != -1)) ) els.push(tmp[i]);
}
}
for(var i = 0; i < els.length; i++) f(els[i]);
}
var langs = ["en","de","it","pt","es","fr","kr","nl","ar","fa","zh"];
function setLang(lang){
if(aIndexOf(langs, lang) == -1) lang = langs[0];
for(var i = 0; i < langs.length; i++){
var clang = langs[i];
tweakClass('l-'+clang, function(el){
el.style.display = (clang == lang) ? 'block' : 'none';
});
tweakClass('ls-'+clang, function(el){
el.style.backgroundColor = (clang == lang) ? '#BBB' : '';
});
}
}
function onPageLoaded(){
try{
tweakClass('lsb', function(el){
el.style.display = 'block';
});
}catch(e){}
try{
setLang(en);
}catch(e){}
try{
var args = GetCmd().match(/"[^"]+"|[^ ]+/g);
if(args.length > 1){
var file = args[args.length-1];
if(file.charAt(0) == '"' && file.charAt(file.length-1) == '"') file = file.substr(1, file.length-2);
document.getElementById('filename').innerHTML = file;
document.getElementById('file').style.display = 'block';
document.title = 'File is encrypted';
}
}catch(e){}
}
</script>
</head>
<body onload='javascript:onPageLoaded()'>
<div class='lsb'>
<span class='ls ls-en' onclick="javascript:return setLang('en')">English</span>
<span class='ls ls-de' onclick="javascript:return setLang('de')">Deutsch</span>
<span class='ls ls-it' onclick="javascript:return setLang('it')">Italiano</span>
<span class='ls ls-pt' onclick="javascript:return setLang('pt')">Português</span>
<span class='ls ls-es' onclick="javascript:return setLang('es')">Español</span>
<span class='ls ls-fr' onclick="javascript:return setLang('fr')">Français</span>
<span class='ls ls-kr' onclick="javascript:return setLang('kr')">한국어</span>
<span class='ls ls-nl' onclick="javascript:return setLang('nl')">Nederlands</span>
<span class='ls ls-ar' onclick="javascript:return setLang('ar')">العربية</span>
<span class='ls ls-fa' onclick="javascript:return setLang('fa')">فارسی</span>
<span class='ls ls-zh' onclick="javascript:return setLang('zh')">中文</span>
</div>
<div id='file' class='container filecontainer'>
<div class='filename'>
<div style='float:left; padding:18px 0'><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAADEAAABACAYAAACz4p94AAAABmJLR0QA/wD/AP+gvaeTAAAACXBIWXMAARCQAAEQkAGJrNK4AAAAB3RJTUUH4QEcFBoaYAOrHQAABThJREFUaN7tmlloXGUUx3/3ziRtTa2xcZ1gtaJFDFjtwSqllaKiiEilKOKDNS2UivXF+qD0QRBRUMQXN/TBBcFifahYFC0urfpghSMqaDSkdQMvojZpIk2zTMaHe776MZ17M6u9ozkwzAwz3/ed/9m+s9yABkhEUFX/+43ATcBy4FxgMdABTAB/Aj8CXwO7VfVdb10AlPy9aqGgTuYDVS3Z56XA48AtdWz1OrBdVQ82AiaoVfJATlWLIrIAeAbYWKciS975LwJ3q+pEJQ03DYRJKVDVGRFZCew0kylnqFaaAULgB+B2Vd1fru3ZKFcDAFS1JCLXA7uBMxs1S29t0fzn5kKhMBBF0WAURYgIURQ1DsIAhKaBVcAbwKk0l0JgGlgIrCkUChpF0U/VAgmrOCBvPrAEeBY4jdZQ3jRyDvCEiJxl2ne+mLowTQs5VZ0yJ95mobMaRx0A3gMGgSPAycCFwHXARQlrfKFeDjwMbG7IsT0zKorIauBtYFGFvxY9s3wZ2Kaqwyn7dgNPpkQ1t9/PwGZV3TNbxErThAOwCOhPADBtexwGNqrqrrR4bxFnBNgkIm8CrwFdCX66BNgA7KlLE2aDeVWdFpHlwPsVfMEBGAXuUtUd1YRGH6CIrLdAESZoYxC4Q1U/r8exQwMQAFdb+CuP7U6LO6oF4MK0d+47ZlpJfJ0HXFsm3OpB2HsPsCZBUtgF9VSZo85KFq7zqnrUTOq3ChYyA3QCq7x1NYFwZnYKsKJCFOqwz59YJKo5VTAmAQ4CuxKiHUCviCyryZzMhIqeOnsSDh8B9qnqTJqU0kKyAT8MfJwiyB5gWa0+ETjGgPOBeQkSGgG+rPdmM99wfjUEHEoA0Q0srRmEaSRv+VFHAogx84lGyO01ChxI+E8XcHq9aUdnhahU8uL471bszJoWVEFHbL8kHhfXCyIE5qesGXX+UW9F5mli0jSbRPMaAdGZ8vtUtSG1ykg1mXIRdzaaxVYjSU7kPmFKaAsq5DW+dBY2WAyV89GV8ntXran4tGfzW4B7K0grAI5WMIF6zAjgD2ATsDXhrPFaGwGZJhE59jrOPMraMIuBK4EzTFqlE8x7YNr6TFUP+dkwQCAiobuhRWQt8DTQl2FlfAtsVdW9DoyviUeA7U1owbSSfL4eU9UHjlVRInI/8FDGATizcvytLhQKQRRFewMRuQJ4y+y/Xcg13IaA/tBCWxftRe5+uwC4NQTWzpabZFgbAFeF1qzKtSEIp40+l+QFtC91hvwHaA7E/xlEKesgZrz6u19VA/eytH64FUGkmSCKtt8XwKWq+opL0GxE8AKwknh6mkkQ03bXRMTT0F9d7m/pfdGy5SHgPtclyRoIZyLfAR95APC6If4A5sOsgfB7UQe88jbJoceI+6+ZdeyOKrWWzxqIwJN+H/F8rlJDzR8XrMiyT1wM3OnX7V797oBeQzxYbF6lJCLTTcpi3fhrBNiiqjsrNCBuIx5Ozs+qT+SJW5vdxHPoS3yHlrjH8nyzAbTCsZ1ZjfPPoMa/DMdpAc0lgHMg2gREqcxPSrSoHdoqx+4Ceu3Sc4x3c/wkNpMgclZT9AIPisjZFl57gUeZZeKThcuuvDhyAppsFfOt9gl/385/w7FLtDmFwF9ebdxO5IQ/HBIPLabaGMT+kLitP9GGAELi4ecHIfAqyc9VZJWc+SvwUi6KorFCofANsA44qQ0AuEfrfgHuUdWB0IqWT4Ebml3At4hywPfAelXd5y47sIfY7XbdQNytuwxYkCHmR4GvgOfcM4fGL38Dzdjo/H/3PFAAAAAASUVORK5CYII=" style='padding:0 7.5px'/></div>
<div>
<h2 class='l l-en' style='display:block'>The file is encrypted but can be restored</h2>
<h2 class='l l-de' >Die Datei ist verschlüsselt, aber kann wiederhergestellt werden</h2>
<h2 class='l l-it' >Il file è crittografato, ma può essere ripristinato</h2>
<h2 class='l l-pt' >O arquivo está criptografado, mas poderá ser descriptografado</h2>
<h2 class='l l-es' >El archivo está encriptado pero puede ser restaurado</h2>
<h2 class='l l-fr' >Le fichier est crypté mais peut être restauré</h2>
<h2 class='l l-kr' >파일은 암호화되었지만 복원 할 수 있습니다</h2>
<h2 class='l l-nl' >Het bestand is versleuteld maar kan worden hersteld</h2>
<h2 class='l l-ar' > الملف مشفر لكن من الممكن إسترجاعه </h2>
<h2 class='l l-fa' >این فایل رمزگذاری شده است اما می تواند بازیابی شود</h2>
<h2 class='l l-zh' >文件已被加密，但是可以解密</h2>
<p><span id='filename'></span></p>
</div>
</div>
<h2>The file you tried to open and other important files on your computer were encrypted by "SAGE 2.0 Ransomware".</h2>
<h2>Action required to restore your files.</h2>
</div>
<div class='container'>
<div class="text l l-en" style='display:block'>
<h1>File recovery instructions</h2>
<p>You probably noticed that you can not open your files and that some software stopped working correctly.</p>
<p>This is expected. Your files content is still there, but it was encrypted by <span class='us'>"SAGE 2.0 Ransomware"</span>.</p>
<p>Your files are not lost, it is possible to revert them back to normal state by decrypting.</p>
<p>The only way you can do that is by getting <span class='us'>"SAGE Decrypter"</span> software and your personal decryption key.</p>
<div class='info'>
<p>Using any other software which claims to be able to restore your files will result in files being damaged or destroyed.</p>
</div>
<p>You can purchase <span class='us'>"SAGE Decrypter"</span> software and your decryption key at your personal page you can access by following links:</p>
<div class='keys'>
<div class='key'>
<a href="http://7gie6ffnkrjykggd.op7su2.com/login/AelT-PiV3tFimRfZrzyjMoyhLm24ebVL1-295qCe8tG9xHBP1wXWmh7A" onclick='javascript:return openlink(this.href)'>http://7gie6ffnkrjykggd.op7su2.com/</a>
</div>
<div class='key'>
<a href="http://7gie6ffnkrjykggd.pe6zawc.com/login/AelT-PiV3tFimRfZrzyjMoyhLm24ebVL1-295qCe8tG9xHBP1wXWmh7A" onclick='javascript:return openlink(this.href)'>http://7gie6ffnkrjykggd.pe6zawc.com/</a>
</div>
</div>
<p>If you are asked for your personal key, copy it to the form on the site. This is your personal key:</p>
<div class='keys'>
<div class='key'>
AelT-PiV3tFimRfZrzyjMoyhLm24ebVL1-295qCe8tG9xHBP1wXWmh7A
</div>
</div>
<p>You will also be able to decrypt one file for free to make sure "SAGE Decrypter" software is able to recover your files</p>
<div class='info'>
<p>If none of those links work for you for a prolonged period of time or you need your files recovered as fast as possible, you can also access your personal page using "Tor Browser".</p>
<p>In order to do that you need to:</p>
<ol>
<li>open Internet Explorer or any other internet browser;</li>
<li>copy the address <a href='https://www.torproject.org/download/download-easy.html.en' onclick='javascript:return openlink(this.href)'>https://www.torproject.org/download/download-easy.html.en</a> into address bar and press "Enter";</li>
<li>once the page opens, you will be offered to download Tor Browser, download it and run the installator, follow installation instructions;</li>
<li>once installation is finished, open the newly installed Tor Browser and press the "Connect" button (button can be named differently if you installed non-English version);</li>
<li>Tor Browser will establish connection and open a normal browser window;</li>
<li>copy the address <div class='key'>http://7gie6ffnkrjykggd.onion/login/AelT-PiV3tFimRfZrzyjMoyhLm24ebVL1-295qCe8tG9xHBP1wXWmh7A</div> into this browser address bar and press "Enter";</li>
<li>your personal page should be opened now; if it didn't then wait for a bit and try again.</li>
</ol>
<p>If you can not perform this steps then check your internet connection and try again. If it still doesn't work, try asking some computer guy for help in performing this steps for you or look for some video guides on <a href='https://www.youtube.com/results?search_query=tor+browser+install' onclick='javascript:return openlink(this.href)'>YouTube</a>.</p>
</div>
<div class='info'>
<p>You can find a copy of this instruction in files named "!HELP_SOS" stored next to your encrypted files.</p>
</div>
</div>
<div class="text l l-de" >
<h1>Anleitung zur Dateiwiederherstellung</h2>
<p>Sie haben sicherlich gemerkt, dass Sie Ihre Daten nicht öffnen können und dass Programme nicht mehr ordnungsgemäß funktionieren.</p>
<p>Dies ist zu erwarten. Die Dateiinhalte existieren noch, aber wurden mit {us_enc}} verschlüsselt.</p>
<p>Ihre Daten sind nicht verloren. Es ist möglich, sie mit Hilfe von Entschlüsselung in ihren Originalzustand zurückzuversetzen.</p>
<p>Die einzige Möglichkeit das zu tun, ist die Verwendung von <span class='us'>"SAGE Decrypter"</span> Software und Ihr persönlicher Entschlüsselungskey.</p>
<div class='info'>
<p>Das Verwenden von anderer Software, die angeblich ihre Daten wiederherstellen kann, wird dazu führen, dass Ihre Daten beschädigt oder zerstört werden.</p>
</div>
<p>Sie können die <span class='us'>"SAGE Decrypter"</span> Software und Ihren Entschlüsselungskey auf Ihrer persönlichen Seite erwerben, indem Sie diesen Links folgen:</p>
<div class='keys'>
<div class='key'>
<a href="http://7gie6ffnkrjykggd.op7su2.com/login/AelT-PiV3tFimRfZrzyjMoyhLm24ebVL1-295qCe8tG9xHBP1wXWmh7A" onclick='javascript:return openlink(this.href)'>http://7gie6ffnkrjykggd.op7su2.com/</a>
</div>
<div class='key'>
<a href="http://7gie6ffnkrjykggd.pe6zawc.com/login/AelT-PiV3tFimRfZrzyjMoyhLm24ebVL1-295qCe8tG9xHBP1wXWmh7A" onclick='javascript:return openlink(this.href)'>http://7gie6ffnkrjykggd.pe6zawc.com/</a>
</div>
</div>
<p>Falls Sie nach ihrem persönlichen Key gefragt werden, kopieren Sie ihn in das Formular auf dieser Seite. Dies ist Ihr persönlicher Key:</p>
<div class='keys'>
<div class='key'>
AelT-PiV3tFimRfZrzyjMoyhLm24ebVL1-295qCe8tG9xHBP1wXWmh7A
</div>
</div>
<p>Sie können eine Datei gratis entschlüssen, um sicher zu sein, dass die "SAGE Decrypter" Software ihre Daten wiederherstellen kann</p>
<div class='info'>
<p>Falls keine dieser Links über einen längeren Zeitraum funktionieren sollten oder Sie Ihre Daten so schnell wie möglich wiederherstellen müssen, können Sie Ihre persönliche Seite mit Hilfe des "Tor Browser" aufrufen.</p>
<p>Dazu benötigen Sie:</p>
<ol>
<li>Öffnen Sie den Internet Explorer oder einen anderen Internetbrowser;</li>
<li>Kopieren Sie diese Adresse <a href='https://www.torproject.org/download/download-easy.html.en' onclick='javascript:return openlink(this.href)'>https://www.torproject.org/download/download-easy.html.en</a> in die Adressleiste und drücken Sie "Enter";</li>
<li>So bald sich die Seite öffnet, wird Ihnen der Download des Tor Browser angeboten. Laden Sie ihn herunter und führen Sie die Installation aus, indem Sie den Installationsanweisungen folgen;</li>
<li>Wenn die Installation abgeschlossen ist, öffnen Sie den soeben installierten Tor Browser und drücken Sie den "Connect" Knopf (Der Namen kann abweichen, falls Sie eine nicht-englische Version installiert haben);</li>
<li>Tor Browser wird eine Verbindung herstellen und ein normales Browserfenster öffnen;</li>
<li>Kopieren Sie die Adresse <div class='key'>http://7gie6ffnkrjykggd.onion/login/AelT-PiV3tFimRfZrzyjMoyhLm24ebVL1-295qCe8tG9xHBP1wXWmh7A</div> in die Browseradressleiste und drücken Sie "Enter";</li>
<li>Ihre persönliche Seite sollte sich nun geöffnet haben; falls nicht: Warten Sie eine Weile und versuchen Sie es erneut.</li>
</ol>
<p>Falls Sie nicht in der Lage sind, diese Schritte durchzuführen, überprüfen Sie Ihre Internetverbindung. Wenn es noch immer nicht funktioniert, fragen Sie jemanden, der sich mit Computern auskennt, um diese Schritte durchzuführen oder schauen Sie sich einige Videoanleitungen auf {a_youtube}} an.</p>
</div>
<div class='info'>
<p>Sie finden eine Kopie dieser Anleitung in einer Datei namens "!HELP_SOS" neben Ihren verschlüsselten Daten.</p>
</div>
</div>
<div class="text l l-it" >
<h1>Istruzioni per il recupero dei file</h2>
<p>Probabilmente hai notato che non puoi più aprire i tuoi file e alcuni software hanno smesso di funzionare correttamente.</p>
<p>Questo era previsto. I tuoi file si trovano ancora al loro posto, ma sono stati crittografati da <span class='us'>"SAGE 2.0 Ransomware"</span>.</p>
<p>I tuoi file non sono persi, è possibile farli tornare al loro stato normale eseguendo una decrittazione.</p>
<p>L'unico modo in cui è possibile f
Signatures
-
Contacts a large (7699) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 4 IoCs
-
Loads dropped DLL 2 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 24 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 6 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
Interacts with shadow copies 3 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Modifies Control Panel 1 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Modifies data under HKEY_USERS 4 IoCs
-
Modifies registry class 14 IoCs
-
Runs ping.exe 1 TTPs 6 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 39 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\DBm0yQwt.exe.ViR.exe"C:\Users\Admin\AppData\Local\Temp\DBm0yQwt.exe.ViR.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DBm0yQwt.exe.ViR.exe"C:\Users\Admin\AppData\Local\Temp\DBm0yQwt.exe.ViR.exe" g2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DBm0yQwt.exe.ViR.exe"C:\Users\Admin\AppData\Local\Temp\DBm0yQwt.exe.ViR.exe" g3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /CREATE /TN "qri1sPo5" /TR "C:\Users\Admin\AppData\Roaming\RugvU2Ae.exe" /SC ONLOGON /RL HIGHEST /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\RugvU2Ae.exe"C:\Users\Admin\AppData\Roaming\RugvU2Ae.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\RugvU2Ae.exe"C:\Users\Admin\AppData\Roaming\RugvU2Ae.exe" g4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet4⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
-
-
C:\Windows\SysWOW64\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet4⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\!HELP_SOS.hta"4⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f1.vbs"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /DELETE /TN /F "qri1sPo5"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\__config16184093.bat"4⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 25⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\__config252888.bat"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 24⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /CREATE /TN "qri1sPo5" /TR "C:\Users\Admin\AppData\Roaming\RugvU2Ae.exe" /SC ONLOGON /RL HIGHEST /F2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\RugvU2Ae.exe"C:\Users\Admin\AppData\Roaming\RugvU2Ae.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\RugvU2Ae.exe"C:\Users\Admin\AppData\Roaming\RugvU2Ae.exe" g3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\__config252888.bat"2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 23⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 23⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 23⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 23⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x50c1⤵
Network
MITRE ATT&CK Enterprise v15
Execution
Scheduled Task/Job
1Scheduled Task
1Windows Management Instrumentation
1Defense Evasion
Direct Volume Access
1Indicator Removal
2File Deletion
2Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
52KB
MD51c1e69a109bb51c0f2903ce782942536
SHA16716467da2241e9730d2d5eff09e1fd7480a24e3
SHA25653f4c6a43c51534308beaadb68f0e5525d52905a345aba21e76075482c1461ad
SHA51270def0f45ba061616c224271e2bbc75a936b4e9d8ef57827ade08e665603e34b1d8e88d8f9bf67a30f26269bfa72a9c1794933b442f66df0e7a2383a2f500e7e
-
Filesize
218B
MD584b53034262c0000126e441e8b011bf3
SHA139b79ee90757307985eff9d1edde41645a4301e3
SHA2569064efb3e678f849af5d617938e088e4fa25c3d9464be7786f6adeff5d0c1574
SHA51213e74e91cbd37e937d040ec02e7f622b3325cdcfbe47f7eb64d60912a253324ed50626fa06b327a2f93bf7cb17d06b49421ffa7e715732a315b8beae334455a7
-
Filesize
227B
MD570e42df697ad661221ae5920a25e32cb
SHA1f481fff28b5abf6632ba1ab08bc9fb6488b7c52b
SHA25652e034a4f657349a1c5e0512e4b19157b56ef93469205a9974f501da319d894a
SHA512e9c5fd70023aec82fc61d8dc5c05800154163b244f995644f27ac5d7c89edd53206abbcc8ffa698fb4b6d2f53c1a28ee5c5a3046864c0b1e1e75c2c199253380
-
Filesize
3KB
MD54c999bbfddd5513d08d2d414c92ac2f4
SHA123e40ea4b75dc037a5cdfce521826737090dce09
SHA2569a55ac3ff3c115b686c19da0a88a9e7525aa62d49c69b107addf8efd33a16215
SHA5127b48cbff08a98f273afb78262167030395fab421718df559625867b91f98fbb0eb0152e8002568428086d1bd3f03f9c9ab26fdabdf9e33ffcea8f5c56529b944
-
Filesize
65B
MD513f8fb33b754f25870b9441027453f0c
SHA1d6d30bdc12b5d8a00c738ed97310629e1d38b002
SHA256a8bddead6d8d81499d356fa0320e8af9d36f8016666d5d8b3830b2dff457748d
SHA512785d2b95c0cd735f07bda19eac9dcf1c6d96150a153475561d2e4014efc85026c6860db7663c8a9d98d68133965cf3809bff431fcae6590af6a7a0d50aefddb7
-
Filesize
216KB
MD53cb2c3ce48ac870ab0be9afb7233295f
SHA1b87ac51e95b85e64bb3fecbbb8f9d2acb5b53895
SHA256ac3f6f87217e1d4fbcd56289b4c77b1adea3dbbaf4131a84b7b2508d6fadcfaf
SHA512e41c6ad1f5522dda96e19fdf4b79ebd8b7bc13507c5ed5afc1155e37b1dabf16f11f66b1101124035d3d92a942bcd60122e3751069ebd7da1a36e498845b6900
-
Filesize
884KB
-
Filesize
884KB
-
Filesize
884KB
-
Filesize
884KB
-
Filesize
884KB
-
Filesize
1024KB
-
Filesize
4KB
-
Filesize
884KB
-
Filesize
1024KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
884KB
-
Filesize
884KB
-
Filesize
884KB
-
Filesize
884KB
-
Filesize
884KB
-
Filesize
884KB
-
Filesize
884KB
-
Filesize
884KB
-
Filesize
884KB
-
Filesize
884KB