Overview
overview
10Static
static
6D02D012970...94.exe
windows7-x64
1DBm0yQwt.exe.ViR.exe
windows7-x64
10ca6ec46ee9...52.apk
windows7-x64
3calc.exe
windows7-x64
7ccc71c83c8...B3.exe
windows7-x64
7ccc71c83c8...68.exe
windows7-x64
7cd2d085998...-0.dll
windows7-x64
8cdffb7e75b...ss.exe
windows7-x64
3cf7382c25a...c9.exe
windows7-x64
6cgi19-alpt...e_.exe
windows7-x64
7chrst.exe
windows7-x64
3ci05l2a.exe
windows7-x64
cl.exe
windows7-x64
7clean.exe
windows7-x64
3coinvault.exe
windows7-x64
9com_loader.exe
windows7-x64
3csrss.ex_.exe
windows7-x64
6d.exe
windows7-x64
3d0a5cfec8e...B3.exe
windows7-x64
7d0a5cfec8e...A6.exe
windows7-x64
7d2164cdbc9...FB.exe
windows7-x64
3d2164cdbc9...08.exe
windows7-x64
7d4439055d2..._1.dll
windows7-x64
3d54d2a216e...96.exe
windows7-x64
7d5f29750a8...c5.apk
windows7-x64
3d6c32b0146...4d.zip
windows7-x64
9d889734783...48.exe
windows7-x64
daaa72f48b...2d.exe
windows7-x64
9ddbf1840bf...e2.exe
windows7-x64
10de882c049b..._3.dll
windows7-x64
3decrypt.exe
windows7-x64
3decrypted.ex_.exe
windows7-x64
6Analysis
- max time kernel
215s - max time network
122s - platform
windows7_x64 - resource
win7-20240903-en - resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system - submitted
22/11/2024, 03:21
Behavioral task
behavioral1
Sample
D02D012970AA164CAD15C757D7E52994.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
DBm0yQwt.exe.ViR.exe
Resource
win7-20240903-en
Behavioral task
behavioral3
Sample
ca6ec46ee9435a4745fd3a03267f051dc64540dd348f127bb33e9675dadd3d52.apk
Resource
win7-20240729-en
Behavioral task
behavioral4
Sample
calc.exe
Resource
win7-20241010-en
Behavioral task
behavioral5
Sample
ccc71c83c8d9895ef0b375273f9f185dfac63ecd01775e2dc705afe4d48c95e2_Dumped_TDS=4F9911B3.exe
Resource
win7-20241023-en
Behavioral task
behavioral6
Sample
ccc71c83c8d9895ef0b375273f9f185dfac63ecd01775e2dc705afe4d48c95e2_TDS=4FAD9768.exe
Resource
win7-20240903-en
Behavioral task
behavioral7
Sample
cd2d085998a289134ffaf27fbdcbc8cb_api-ms-win-system-dispex-l1-1-0.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
cdffb7e75b20eeae4db75c9962c17b3be980a719f7597e8b11a747d72c975a36_not_packed_maybe_useless.exe
Resource
win7-20240903-en
Behavioral task
behavioral9
Sample
cf7382c25a8bf0d904d51063ceb29fb70f630bc9.exe
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
cgi19-alptsevs-h555.exe_.exe
Resource
win7-20240903-en
Behavioral task
behavioral11
Sample
chrst.exe
Resource
win7-20241010-en
Behavioral task
behavioral12
Sample
ci05l2a.exe
Resource
win7-20240903-en
Behavioral task
behavioral13
Sample
cl.exe
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
clean.exe
Resource
win7-20240903-en
Behavioral task
behavioral15
Sample
coinvault.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
com_loader.exe
Resource
win7-20240903-en
Behavioral task
behavioral17
Sample
csrss.ex_.exe
Resource
win7-20240708-en
Behavioral task
behavioral18
Sample
d.exe
Resource
win7-20240729-en
Behavioral task
behavioral19
Sample
d0a5cfec8e80622b3e194b5ee03e93d78c7ef3478bead6a039d213caaaa58523_Dumped_TDS=4F9911B3.exe
Resource
win7-20241010-en
Behavioral task
behavioral20
Sample
d0a5cfec8e80622b3e194b5ee03e93d78c7ef3478bead6a039d213caaaa58523_TDS=4FA478A6.exe
Resource
win7-20240903-en
Behavioral task
behavioral21
Sample
d2164cdbc9c78db0115f382a139ccd758f8a25ebfc5ab3e0034e7aef0fe0b6b4_Dumped_TDS=4FB252FB.exe
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
d2164cdbc9c78db0115f382a139ccd758f8a25ebfc5ab3e0034e7aef0fe0b6b4_TDS=4FB30D08.exe
Resource
win7-20241023-en
Behavioral task
behavioral23
Sample
d4439055d2d63e52ffc23c6d24d89194_86e510605f1ee068bdc1ae306312652a__1.dll
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
d54d2a216e637bcd36e5217cfba98896.exe
Resource
win7-20240903-en
Behavioral task
behavioral25
Sample
d5f29750a8cb158d9b89a1e02e8addc5e410d1ddc48e660589144ade47f794c5.apk
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
d6c32b0146f219bdcb5cf524ea9e0047d9b9bd0fd7c395d5b11cbc4c3298824d.zip
Resource
win7-20240903-en
Behavioral task
behavioral27
Sample
d889734783273b7158deeae6cf804a6be99c3a5353d94225a4dbe92caf3a3d48.exe
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
daaa72f48bea498c5ac7ce9bc315e585ff11dad04d1eeb0d1b0ce33a28bedf2d.exe
Resource
win7-20240729-en
Behavioral task
behavioral29
Sample
ddbf1840bf626da19d8f3467fe9e20e2.exe
Resource
win7-20241010-en
Behavioral task
behavioral30
Sample
de882c049be133a950b6917562bb2313_583a76e23c1998307d702709dadbe103__3.dll
Resource
win7-20240708-en
Behavioral task
behavioral31
Sample
decrypt.exe
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
decrypted.ex_.exe
Resource
win7-20240903-en
General
- Target DBm0yQwt.exe.ViR.exe
- Size 216KB
- Sample241122-dwswastmds
- SHA256 ac3f6f87217e1d4fbcd56289b4c77b1adea3dbbaf4131a84b7b2508d6fadcfaf
- MD5 3cb2c3ce48ac870ab0be9afb7233295f
- SHA1 b87ac51e95b85e64bb3fecbbb8f9d2acb5b53895
- SHA512 e41c6ad1f5522dda96e19fdf4b79ebd8b7bc13507c5ed5afc1155e37b1dabf16f11f66b1101124035d3d92a942bcd60122e3751069ebd7da1a36e498845b6900
- SSDEEP 3072:UPPdPl/PuW/Yqoeog665R6OKEjzG6hgckhmnl/5aUWTo+Kuv+nAo:UHTnVHv82ZJFgJ+/Hxn
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
-
C:\Users\Admin\Music\!HELP_SOS.hta
- <!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>Decryption Instructions</title> <HTA:APPLICATION ID='App' APPLICATIONNAME="Decryption Instructions" SCROLL="yes" SINGLEINSTANCE="yes" WINDOWSTATE="maximize"> <style> a { color: #04a; text-decoration: none; } a:hover { text-decoration: underline; } body { background-color: #e7e7e7; color: #222; font-family: "Lucida Sans Unicode", "Lucida Grande", sans-serif; font-size: 12pt; line-height: 16pt; } body, h1 { margin: 0; padding: 0; } h1 { color: #555; text-align: center; padding-bottom: 1.5em; } h2 { color: #555; text-align: center; } ol li { padding-bottom: 13pt; } .container { background-color: #EEE; border: 2pt solid #C7C7C7; margin: 3%; min-width: 600px; padding: 5% 10%; color: #444; } .filecontainer{ padding: 5% 10%; display: none; } .header { border-bottom: 2pt solid #c7c7c7; padding-bottom: 5%; } .hr { background: #bda; display: block; height: 2pt; margin-top: 1.5%; margin-bottom: 1.5%; overflow: hidden; width: 100%; } .key{ background-color: #A1D490; border: 1px solid #506A48; display: block; text-align: center; margin: 0.5em 0; padding: 1em 1.5em; word-wrap: break-word; } .keys{ margin: 3em 0; } .filename{ border: 3px solid #AAA; display: block; text-align: center; margin: 0.5em 0em; padding: 1em 1.5em; background-color: #DCC; } .us{ text-decoration: strong; color: #333; } .info{ background-color: #E4E4E4; padding: 0.5em 3em; margin: 1em 0; } .text{ text-align: justify; } #file{ background-color: #FCC; } .lsb{ display: none; margin: 3%; text-align: center; } .ls{ border: 1px solid #888; border-radius: 3px; padding: 0 0.5em; margin: 1em 0.1em; } .ls:hover{ background-color: #D0D0D0; } .l{ display:none; } </style> <script language="vbscript"> Function GetCmd GetCmd = App.commandLine End Function </script> <script language="javascript"> function openlink(url){ new ActiveXObject("WScript.Shell").Run(url); return false; } function aIndexOf(arr, v){ for(var i = 0; i < arr.length; i++) if(arr[i] == v) return i; return -1; } function tweakClass(cl, f){ var els; if(document.getElementByClassName != null){ els = document.getElementsByClassName(cl); } else{ els = []; var tmp = document.getElementsByTagName('*'); for (var i = 0; i < tmp.length; i++){ var c = tmp[i].className; if( (c == cl) || ((c != '') && ((' '+c+' ').indexOf(' '+cl+' ') != -1)) ) els.push(tmp[i]); } } for(var i = 0; i < els.length; i++) f(els[i]); } var langs = ["en","de","it","pt","es","fr","kr","nl","ar","fa","zh"]; function setLang(lang){ if(aIndexOf(langs, lang) == -1) lang = langs[0]; for(var i = 0; i < langs.length; i++){ var clang = langs[i]; tweakClass('l-'+clang, function(el){ el.style.display = (clang == lang) ? 'block' : 'none'; }); tweakClass('ls-'+clang, function(el){ el.style.backgroundColor = (clang == lang) ? '#BBB' : ''; }); } } function onPageLoaded(){ try{ tweakClass('lsb', function(el){ el.style.display = 'block'; }); }catch(e){} try{ setLang(en); }catch(e){} try{ var args = GetCmd().match(/"[^"]+"|[^ ]+/g); if(args.length > 1){ var file = args[args.length-1]; if(file.charAt(0) == '"' && file.charAt(file.length-1) == '"') file = file.substr(1, file.length-2); document.getElementById('filename').innerHTML = file; document.getElementById('file').style.display = 'block'; document.title = 'File is encrypted'; } }catch(e){} } </script> </head> <body onload='javascript:onPageLoaded()'> <div class='lsb'> <span class='ls ls-en' onclick="javascript:return setLang('en')">English</span> <span class='ls ls-de' onclick="javascript:return setLang('de')">Deutsch</span> <span class='ls ls-it' onclick="javascript:return setLang('it')">Italiano</span> <span class='ls ls-pt' onclick="javascript:return setLang('pt')">Português</span> <span class='ls ls-es' onclick="javascript:return setLang('es')">Español</span> <span class='ls ls-fr' onclick="javascript:return setLang('fr')">Français</span> <span class='ls ls-kr' onclick="javascript:return setLang('kr')">한국어</span> <span class='ls ls-nl' onclick="javascript:return setLang('nl')">Nederlands</span> <span class='ls ls-ar' onclick="javascript:return setLang('ar')">العربية</span> <span class='ls ls-fa' onclick="javascript:return setLang('fa')">فارسی</span> <span class='ls ls-zh' onclick="javascript:return setLang('zh')">中文</span> </div> <div id='file' class='container filecontainer'> <div class='filename'> <div style='float:left; padding:18px 0'><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAADEAAABACAYAAACz4p94AAAABmJLR0QA/wD/AP+gvaeTAAAACXBIWXMAARCQAAEQkAGJrNK4AAAAB3RJTUUH4QEcFBoaYAOrHQAABThJREFUaN7tmlloXGUUx3/3ziRtTa2xcZ1gtaJFDFjtwSqllaKiiEilKOKDNS2UivXF+qD0QRBRUMQXN/TBBcFifahYFC0urfpghSMqaDSkdQMvojZpIk2zTMaHe776MZ17M6u9ozkwzAwz3/ed/9m+s9yABkhEUFX/+43ATcBy4FxgMdABTAB/Aj8CXwO7VfVdb10AlPy9aqGgTuYDVS3Z56XA48AtdWz1OrBdVQ82AiaoVfJATlWLIrIAeAbYWKciS975LwJ3q+pEJQ03DYRJKVDVGRFZCew0kylnqFaaAULgB+B2Vd1fru3ZKFcDAFS1JCLXA7uBMxs1S29t0fzn5kKhMBBF0WAURYgIURQ1DsIAhKaBVcAbwKk0l0JgGlgIrCkUChpF0U/VAgmrOCBvPrAEeBY4jdZQ3jRyDvCEiJxl2ne+mLowTQs5VZ0yJ95mobMaRx0A3gMGgSPAycCFwHXARQlrfKFeDjwMbG7IsT0zKorIauBtYFGFvxY9s3wZ2Kaqwyn7dgNPpkQ1t9/PwGZV3TNbxErThAOwCOhPADBtexwGNqrqrrR4bxFnBNgkIm8CrwFdCX66BNgA7KlLE2aDeVWdFpHlwPsVfMEBGAXuUtUd1YRGH6CIrLdAESZoYxC4Q1U/r8exQwMQAFdb+CuP7U6LO6oF4MK0d+47ZlpJfJ0HXFsm3OpB2HsPsCZBUtgF9VSZo85KFq7zqnrUTOq3ChYyA3QCq7x1NYFwZnYKsKJCFOqwz59YJKo5VTAmAQ4CuxKiHUCviCyryZzMhIqeOnsSDh8B9qnqTJqU0kKyAT8MfJwiyB5gWa0+ETjGgPOBeQkSGgG+rPdmM99wfjUEHEoA0Q0srRmEaSRv+VFHAogx84lGyO01ChxI+E8XcHq9aUdnhahU8uL471bszJoWVEFHbL8kHhfXCyIE5qesGXX+UW9F5mli0jSbRPMaAdGZ8vtUtSG1ykg1mXIRdzaaxVYjSU7kPmFKaAsq5DW+dBY2WAyV89GV8ntXran4tGfzW4B7K0grAI5WMIF6zAjgD2ATsDXhrPFaGwGZJhE59jrOPMraMIuBK4EzTFqlE8x7YNr6TFUP+dkwQCAiobuhRWQt8DTQl2FlfAtsVdW9DoyviUeA7U1owbSSfL4eU9UHjlVRInI/8FDGATizcvytLhQKQRRFewMRuQJ4y+y/Xcg13IaA/tBCWxftRe5+uwC4NQTWzpabZFgbAFeF1qzKtSEIp40+l+QFtC91hvwHaA7E/xlEKesgZrz6u19VA/eytH64FUGkmSCKtt8XwKWq+opL0GxE8AKwknh6mkkQ03bXRMTT0F9d7m/pfdGy5SHgPtclyRoIZyLfAR95APC6If4A5sOsgfB7UQe88jbJoceI+6+ZdeyOKrWWzxqIwJN+H/F8rlJDzR8XrMiyT1wM3OnX7V797oBeQzxYbF6lJCLTTcpi3fhrBNiiqjsrNCBuIx5Ozs+qT+SJW5vdxHPoS3yHlrjH8nyzAbTCsZ1ZjfPPoMa/DMdpAc0lgHMg2gREqcxPSrSoHdoqx+4Ceu3Sc4x3c/wkNpMgclZT9AIPisjZFl57gUeZZeKThcuuvDhyAppsFfOt9gl/385/w7FLtDmFwF9ebdxO5IQ/HBIPLabaGMT+kLitP9GGAELi4ecHIfAqyc9VZJWc+SvwUi6KorFCofANsA44qQ0AuEfrfgHuUdWB0IqWT4Ebml3At4hywPfAelXd5y47sIfY7XbdQNytuwxYkCHmR4GvgOfcM4fGL38Dzdjo/H/3PFAAAAAASUVORK5CYII=" style='padding:0 7.5px'/></div> <div> <h2 class='l l-en' style='display:block'>The file is encrypted but can be restored</h2> <h2 class='l l-de' >Die Datei ist verschlüsselt, aber kann wiederhergestellt werden</h2> <h2 class='l l-it' >Il file è crittografato, ma può essere ripristinato</h2> <h2 class='l l-pt' >O arquivo está criptografado, mas poderá ser descriptografado</h2> <h2 class='l l-es' >El archivo está encriptado pero puede ser restaurado</h2> <h2 class='l l-fr' >Le fichier est crypté mais peut être restauré</h2> <h2 class='l l-kr' >파일은 암호화되었지만 복원 할 수 있습니다</h2> <h2 class='l l-nl' >Het bestand is versleuteld maar kan worden hersteld</h2> <h2 class='l l-ar' > الملف مشفر لكن من الممكن إسترجاعه </h2> <h2 class='l l-fa' >این فایل رمزگذاری شده است اما می تواند بازیابی شود</h2> <h2 class='l l-zh' >文件已被加密,但是可以解密</h2> <p><span id='filename'></span></p> </div> </div> <h2>The file you tried to open and other important files on your computer were encrypted by "SAGE 2.0 Ransomware".</h2> <h2>Action required to restore your files.</h2> </div> <div class='container'> <div class="text l l-en" style='display:block'> <h1>File recovery instructions</h2> <p>You probably noticed that you can not open your files and that some software stopped working correctly.</p> <p>This is expected. Your files content is still there, but it was encrypted by <span class='us'>"SAGE 2.0 Ransomware"</span>.</p> <p>Your files are not lost, it is possible to revert them back to normal state by decrypting.</p> <p>The only way you can do that is by getting <span class='us'>"SAGE Decrypter"</span> software and your personal decryption key.</p> <div class='info'> <p>Using any other software which claims to be able to restore your files will result in files being damaged or destroyed.</p> </div> <p>You can purchase <span class='us'>"SAGE Decrypter"</span> software and your decryption key at your personal page you can access by following links:</p> <div class='keys'> <div class='key'> <a href="http://7gie6ffnkrjykggd.op7su2.com/login/AelT-PiV3tFi59XTJjDTrctVPZfMa4LFFsh1nm4yOcrGMDCZU__-DAfA" onclick='javascript:return openlink(this.href)'>http://7gie6ffnkrjykggd.op7su2.com/</a> </div> <div class='key'> <a href="http://7gie6ffnkrjykggd.pe6zawc.com/login/AelT-PiV3tFi59XTJjDTrctVPZfMa4LFFsh1nm4yOcrGMDCZU__-DAfA" onclick='javascript:return openlink(this.href)'>http://7gie6ffnkrjykggd.pe6zawc.com/</a> </div> </div> <p>If you are asked for your personal key, copy it to the form on the site. This is your personal key:</p> <div class='keys'> <div class='key'> AelT-PiV3tFi59XTJjDTrctVPZfMa4LFFsh1nm4yOcrGMDCZU__-DAfA </div> </div> <p>You will also be able to decrypt one file for free to make sure "SAGE Decrypter" software is able to recover your files</p> <div class='info'> <p>If none of those links work for you for a prolonged period of time or you need your files recovered as fast as possible, you can also access your personal page using "Tor Browser".</p> <p>In order to do that you need to:</p> <ol> <li>open Internet Explorer or any other internet browser;</li> <li>copy the address <a href='https://www.torproject.org/download/download-easy.html.en' onclick='javascript:return openlink(this.href)'>https://www.torproject.org/download/download-easy.html.en</a> into address bar and press "Enter";</li> <li>once the page opens, you will be offered to download Tor Browser, download it and run the installator, follow installation instructions;</li> <li>once installation is finished, open the newly installed Tor Browser and press the "Connect" button (button can be named differently if you installed non-English version);</li> <li>Tor Browser will establish connection and open a normal browser window;</li> <li>copy the address <div class='key'>http://7gie6ffnkrjykggd.onion/login/AelT-PiV3tFi59XTJjDTrctVPZfMa4LFFsh1nm4yOcrGMDCZU__-DAfA</div> into this browser address bar and press "Enter";</li> <li>your personal page should be opened now; if it didn't then wait for a bit and try again.</li> </ol> <p>If you can not perform this steps then check your internet connection and try again. If it still doesn't work, try asking some computer guy for help in performing this steps for you or look for some video guides on <a href='https://www.youtube.com/results?search_query=tor+browser+install' onclick='javascript:return openlink(this.href)'>YouTube</a>.</p> </div> <div class='info'> <p>You can find a copy of this instruction in files named "!HELP_SOS" stored next to your encrypted files.</p> </div> </div> <div class="text l l-de" > <h1>Anleitung zur Dateiwiederherstellung</h2> <p>Sie haben sicherlich gemerkt, dass Sie Ihre Daten nicht öffnen können und dass Programme nicht mehr ordnungsgemäß funktionieren.</p> <p>Dies ist zu erwarten. Die Dateiinhalte existieren noch, aber wurden mit {us_enc}} verschlüsselt.</p> <p>Ihre Daten sind nicht verloren. Es ist möglich, sie mit Hilfe von Entschlüsselung in ihren Originalzustand zurückzuversetzen.</p> <p>Die einzige Möglichkeit das zu tun, ist die Verwendung von <span class='us'>"SAGE Decrypter"</span> Software und Ihr persönlicher Entschlüsselungskey.</p> <div class='info'> <p>Das Verwenden von anderer Software, die angeblich ihre Daten wiederherstellen kann, wird dazu führen, dass Ihre Daten beschädigt oder zerstört werden.</p> </div> <p>Sie können die <span class='us'>"SAGE Decrypter"</span> Software und Ihren Entschlüsselungskey auf Ihrer persönlichen Seite erwerben, indem Sie diesen Links folgen:</p> <div class='keys'> <div class='key'> <a href="http://7gie6ffnkrjykggd.op7su2.com/login/AelT-PiV3tFi59XTJjDTrctVPZfMa4LFFsh1nm4yOcrGMDCZU__-DAfA" onclick='javascript:return openlink(this.href)'>http://7gie6ffnkrjykggd.op7su2.com/</a> </div> <div class='key'> <a href="http://7gie6ffnkrjykggd.pe6zawc.com/login/AelT-PiV3tFi59XTJjDTrctVPZfMa4LFFsh1nm4yOcrGMDCZU__-DAfA" onclick='javascript:return openlink(this.href)'>http://7gie6ffnkrjykggd.pe6zawc.com/</a> </div> </div> <p>Falls Sie nach ihrem persönlichen Key gefragt werden, kopieren Sie ihn in das Formular auf dieser Seite. Dies ist Ihr persönlicher Key:</p> <div class='keys'> <div class='key'> AelT-PiV3tFi59XTJjDTrctVPZfMa4LFFsh1nm4yOcrGMDCZU__-DAfA </div> </div> <p>Sie können eine Datei gratis entschlüssen, um sicher zu sein, dass die "SAGE Decrypter" Software ihre Daten wiederherstellen kann</p> <div class='info'> <p>Falls keine dieser Links über einen längeren Zeitraum funktionieren sollten oder Sie Ihre Daten so schnell wie möglich wiederherstellen müssen, können Sie Ihre persönliche Seite mit Hilfe des "Tor Browser" aufrufen.</p> <p>Dazu benötigen Sie:</p> <ol> <li>Öffnen Sie den Internet Explorer oder einen anderen Internetbrowser;</li> <li>Kopieren Sie diese Adresse <a href='https://www.torproject.org/download/download-easy.html.en' onclick='javascript:return openlink(this.href)'>https://www.torproject.org/download/download-easy.html.en</a> in die Adressleiste und drücken Sie "Enter";</li> <li>So bald sich die Seite öffnet, wird Ihnen der Download des Tor Browser angeboten. Laden Sie ihn herunter und führen Sie die Installation aus, indem Sie den Installationsanweisungen folgen;</li> <li>Wenn die Installation abgeschlossen ist, öffnen Sie den soeben installierten Tor Browser und drücken Sie den "Connect" Knopf (Der Namen kann abweichen, falls Sie eine nicht-englische Version installiert haben);</li> <li>Tor Browser wird eine Verbindung herstellen und ein normales Browserfenster öffnen;</li> <li>Kopieren Sie die Adresse <div class='key'>http://7gie6ffnkrjykggd.onion/login/AelT-PiV3tFi59XTJjDTrctVPZfMa4LFFsh1nm4yOcrGMDCZU__-DAfA</div> in die Browseradressleiste und drücken Sie "Enter";</li> <li>Ihre persönliche Seite sollte sich nun geöffnet haben; falls nicht: Warten Sie eine Weile und versuchen Sie es erneut.</li> </ol> <p>Falls Sie nicht in der Lage sind, diese Schritte durchzuführen, überprüfen Sie Ihre Internetverbindung. Wenn es noch immer nicht funktioniert, fragen Sie jemanden, der sich mit Computern auskennt, um diese Schritte durchzuführen oder schauen Sie sich einige Videoanleitungen auf {a_youtube}} an.</p> </div> <div class='info'> <p>Sie finden eine Kopie dieser Anleitung in einer Datei namens "!HELP_SOS" neben Ihren verschlüsselten Daten.</p> </div> </div> <div class="text l l-it" > <h1>Istruzioni per il recupero dei file</h2> <p>Probabilmente hai notato che non puoi più aprire i tuoi file e alcuni software hanno smesso di funzionare correttamente.</p> <p>Questo era previsto. I tuoi file si trovano ancora al loro posto, ma sono stati crittografati da <span class='us'>"SAGE 2.0 Ransomware"</span>.</p> <p>I tuoi file non sono persi, è possibile farli tornare al loro stato normale eseguendo una decrittazione.</p> <p>L'unico modo in cui è possibile f
Signatures
- Contacts a large (7699) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Deletes itself 1 IoCs
pid Process 2148 cmd.exe - Executes dropped EXE 2 IoCs
pid Process 2444 mneTg22G.exe 2776 mneTg22G.exe - Loads dropped DLL 2 IoCs
pid Process 2644 DBm0yQwt.exe.ViR.exe 2444 mneTg22G.exe - Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Control Panel\Desktop\Wallpaper mneTg22G.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Yhe.bmp" mneTg22G.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 15 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBm0yQwt.exe.ViR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBm0yQwt.exe.ViR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DllHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssadmin.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mshta.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mneTg22G.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mneTg22G.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssadmin.exe - System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2828 PING.EXE 2548 PING.EXE - Interacts with shadow copies 3 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2600 vssadmin.exe 2852 vssadmin.exe - Modifies Control Panel 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Control Panel\Desktop mneTg22G.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main mshta.exe - Modifies data under HKEY_USERS 4 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT mneTg22G.exe Key created \REGISTRY\USER\S-1-5-19 mneTg22G.exe Key created \REGISTRY\USER\S-1-5-20 mneTg22G.exe Key created \REGISTRY\USER\S-1-5-18 mneTg22G.exe - Modifies registry class 14 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\.sage\ = "sage.notice" mneTg22G.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\htafile\DefaultIcon mneTg22G.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\htafile\DefaultIcon\ = "%WinDir%\\SysWow64\\shell32.dll,44" mneTg22G.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\sage.notice\shell\open\command mneTg22G.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\sage.notice\shell mneTg22G.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\sage.notice\shell\open mneTg22G.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\sage.notice mneTg22G.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\sage.notice\DefaultIcon\ = "%WinDir%\\SysWow64\\shell32.dll,47" mneTg22G.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\sage.notice\FriendlyTypeName\ = "encrypted by SAGE" mneTg22G.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\sage.notice\shell\open\command\ = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\f1.hta\" \"%1\"" mneTg22G.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\htafile mneTg22G.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\.sage mneTg22G.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\sage.notice\DefaultIcon mneTg22G.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\sage.notice\FriendlyTypeName mneTg22G.exe - Runs ping.exe 1 TTPs 2 IoCs
pid Process 2828 PING.EXE 2548 PING.EXE - Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2352 schtasks.exe - Suspicious behavior: EnumeratesProcesses 39 IoCs
pid Process 2444 mneTg22G.exe 2444 mneTg22G.exe 2444 mneTg22G.exe 2444 mneTg22G.exe 2444 mneTg22G.exe 2444 mneTg22G.exe 2444 mneTg22G.exe 2444 mneTg22G.exe 2444 mneTg22G.exe 2444 mneTg22G.exe 2444 mneTg22G.exe 2444 mneTg22G.exe 2444 mneTg22G.exe 2444 mneTg22G.exe 2444 mneTg22G.exe 2444 mneTg22G.exe 2444 mneTg22G.exe 2444 mneTg22G.exe 2444 mneTg22G.exe 2444 mneTg22G.exe 2444 mneTg22G.exe 2444 mneTg22G.exe 2444 mneTg22G.exe 2444 mneTg22G.exe 2444 mneTg22G.exe 2444 mneTg22G.exe 2444 mneTg22G.exe 2444 mneTg22G.exe 2444 mneTg22G.exe 2444 mneTg22G.exe 2444 mneTg22G.exe 2444 mneTg22G.exe 2444 mneTg22G.exe 2444 mneTg22G.exe 2444 mneTg22G.exe 2444 mneTg22G.exe 2444 mneTg22G.exe 2444 mneTg22G.exe 2444 mneTg22G.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2644 DBm0yQwt.exe.ViR.exe Token: SeShutdownPrivilege 2644 DBm0yQwt.exe.ViR.exe Token: SeShutdownPrivilege 2644 DBm0yQwt.exe.ViR.exe Token: SeShutdownPrivilege 2644 DBm0yQwt.exe.ViR.exe Token: SeShutdownPrivilege 2644 DBm0yQwt.exe.ViR.exe Token: SeShutdownPrivilege 2644 DBm0yQwt.exe.ViR.exe Token: SeShutdownPrivilege 2644 DBm0yQwt.exe.ViR.exe Token: SeShutdownPrivilege 2644 DBm0yQwt.exe.ViR.exe Token: SeShutdownPrivilege 2644 DBm0yQwt.exe.ViR.exe Token: SeShutdownPrivilege 2644 DBm0yQwt.exe.ViR.exe Token: SeShutdownPrivilege 2644 DBm0yQwt.exe.ViR.exe Token: SeShutdownPrivilege 2644 DBm0yQwt.exe.ViR.exe Token: SeShutdownPrivilege 2644 DBm0yQwt.exe.ViR.exe Token: SeShutdownPrivilege 2644 DBm0yQwt.exe.ViR.exe Token: SeShutdownPrivilege 2644 DBm0yQwt.exe.ViR.exe Token: SeShutdownPrivilege 2644 DBm0yQwt.exe.ViR.exe Token: SeShutdownPrivilege 2644 DBm0yQwt.exe.ViR.exe Token: SeShutdownPrivilege 2644 DBm0yQwt.exe.ViR.exe Token: SeShutdownPrivilege 2644 DBm0yQwt.exe.ViR.exe Token: SeShutdownPrivilege 2644 DBm0yQwt.exe.ViR.exe Token: SeShutdownPrivilege 2644 DBm0yQwt.exe.ViR.exe Token: SeShutdownPrivilege 2644 DBm0yQwt.exe.ViR.exe Token: SeShutdownPrivilege 2644 DBm0yQwt.exe.ViR.exe Token: SeShutdownPrivilege 2644 DBm0yQwt.exe.ViR.exe Token: SeShutdownPrivilege 2644 DBm0yQwt.exe.ViR.exe Token: SeShutdownPrivilege 2644 DBm0yQwt.exe.ViR.exe Token: SeShutdownPrivilege 2644 DBm0yQwt.exe.ViR.exe Token: SeShutdownPrivilege 2644 DBm0yQwt.exe.ViR.exe Token: SeShutdownPrivilege 2644 DBm0yQwt.exe.ViR.exe Token: SeShutdownPrivilege 2644 DBm0yQwt.exe.ViR.exe Token: SeShutdownPrivilege 2644 DBm0yQwt.exe.ViR.exe Token: SeShutdownPrivilege 2644 DBm0yQwt.exe.ViR.exe Token: SeShutdownPrivilege 2644 DBm0yQwt.exe.ViR.exe Token: SeShutdownPrivilege 2644 DBm0yQwt.exe.ViR.exe Token: SeShutdownPrivilege 2644 DBm0yQwt.exe.ViR.exe Token: SeShutdownPrivilege 2644 DBm0yQwt.exe.ViR.exe Token: SeShutdownPrivilege 2644 DBm0yQwt.exe.ViR.exe Token: SeShutdownPrivilege 2644 DBm0yQwt.exe.ViR.exe Token: SeShutdownPrivilege 2644 DBm0yQwt.exe.ViR.exe Token: SeShutdownPrivilege 2644 DBm0yQwt.exe.ViR.exe Token: SeShutdownPrivilege 2644 DBm0yQwt.exe.ViR.exe Token: SeShutdownPrivilege 2644 DBm0yQwt.exe.ViR.exe Token: SeShutdownPrivilege 2644 DBm0yQwt.exe.ViR.exe Token: SeShutdownPrivilege 2644 DBm0yQwt.exe.ViR.exe Token: SeShutdownPrivilege 2644 DBm0yQwt.exe.ViR.exe Token: SeShutdownPrivilege 2644 DBm0yQwt.exe.ViR.exe Token: SeShutdownPrivilege 2644 DBm0yQwt.exe.ViR.exe Token: SeShutdownPrivilege 2644 DBm0yQwt.exe.ViR.exe Token: SeShutdownPrivilege 2644 DBm0yQwt.exe.ViR.exe Token: SeShutdownPrivilege 2644 DBm0yQwt.exe.ViR.exe Token: SeShutdownPrivilege 2644 DBm0yQwt.exe.ViR.exe Token: SeShutdownPrivilege 2644 DBm0yQwt.exe.ViR.exe Token: SeShutdownPrivilege 2644 DBm0yQwt.exe.ViR.exe Token: SeShutdownPrivilege 2644 DBm0yQwt.exe.ViR.exe Token: SeShutdownPrivilege 2644 DBm0yQwt.exe.ViR.exe Token: SeShutdownPrivilege 2644 DBm0yQwt.exe.ViR.exe Token: SeShutdownPrivilege 2644 DBm0yQwt.exe.ViR.exe Token: SeShutdownPrivilege 2644 DBm0yQwt.exe.ViR.exe Token: SeShutdownPrivilege 2644 DBm0yQwt.exe.ViR.exe Token: SeShutdownPrivilege 2644 DBm0yQwt.exe.ViR.exe Token: SeShutdownPrivilege 2644 DBm0yQwt.exe.ViR.exe Token: SeShutdownPrivilege 2644 DBm0yQwt.exe.ViR.exe Token: SeShutdownPrivilege 2644 DBm0yQwt.exe.ViR.exe Token: SeShutdownPrivilege 2644 DBm0yQwt.exe.ViR.exe - Suspicious use of WriteProcessMemory 52 IoCs
description pid Process procid_target PID 2644 wrote to memory of 1676 2644 DBm0yQwt.exe.ViR.exe 31 PID 2644 wrote to memory of 1676 2644 DBm0yQwt.exe.ViR.exe 31 PID 2644 wrote to memory of 1676 2644 DBm0yQwt.exe.ViR.exe 31 PID 2644 wrote to memory of 1676 2644 DBm0yQwt.exe.ViR.exe 31 PID 2644 wrote to memory of 2352 2644 DBm0yQwt.exe.ViR.exe 32 PID 2644 wrote to memory of 2352 2644 DBm0yQwt.exe.ViR.exe 32 PID 2644 wrote to memory of 2352 2644 DBm0yQwt.exe.ViR.exe 32 PID 2644 wrote to memory of 2352 2644 DBm0yQwt.exe.ViR.exe 32 PID 2644 wrote to memory of 2444 2644 DBm0yQwt.exe.ViR.exe 34 PID 2644 wrote to memory of 2444 2644 DBm0yQwt.exe.ViR.exe 34 PID 2644 wrote to memory of 2444 2644 DBm0yQwt.exe.ViR.exe 34 PID 2644 wrote to memory of 2444 2644 DBm0yQwt.exe.ViR.exe 34 PID 2644 wrote to memory of 2148 2644 DBm0yQwt.exe.ViR.exe 35 PID 2644 wrote to memory of 2148 2644 DBm0yQwt.exe.ViR.exe 35 PID 2644 wrote to memory of 2148 2644 DBm0yQwt.exe.ViR.exe 35 PID 2644 wrote to memory of 2148 2644 DBm0yQwt.exe.ViR.exe 35 PID 2148 wrote to memory of 2828 2148 cmd.exe 37 PID 2148 wrote to memory of 2828 2148 cmd.exe 37 PID 2148 wrote to memory of 2828 2148 cmd.exe 37 PID 2148 wrote to memory of 2828 2148 cmd.exe 37 PID 2444 wrote to memory of 2776 2444 mneTg22G.exe 38 PID 2444 wrote to memory of 2776 2444 mneTg22G.exe 38 PID 2444 wrote to memory of 2776 2444 mneTg22G.exe 38 PID 2444 wrote to memory of 2776 2444 mneTg22G.exe 38 PID 2444 wrote to memory of 2600 2444 mneTg22G.exe 39 PID 2444 wrote to memory of 2600 2444 mneTg22G.exe 39 PID 2444 wrote to memory of 2600 2444 mneTg22G.exe 39 PID 2444 wrote to memory of 2600 2444 mneTg22G.exe 39 PID 2444 wrote to memory of 2852 2444 mneTg22G.exe 43 PID 2444 wrote to memory of 2852 2444 mneTg22G.exe 43 PID 2444 wrote to memory of 2852 2444 mneTg22G.exe 43 PID 2444 wrote to memory of 2852 2444 mneTg22G.exe 43 PID 2444 wrote to memory of 2700 2444 mneTg22G.exe 45 PID 2444 wrote to memory of 2700 2444 mneTg22G.exe 45 PID 2444 wrote to memory of 2700 2444 mneTg22G.exe 45 PID 2444 wrote to memory of 2700 2444 mneTg22G.exe 45 PID 2444 wrote to memory of 2124 2444 mneTg22G.exe 47 PID 2444 wrote to memory of 2124 2444 mneTg22G.exe 47 PID 2444 wrote to memory of 2124 2444 mneTg22G.exe 47 PID 2444 wrote to memory of 2124 2444 mneTg22G.exe 47 PID 2444 wrote to memory of 2084 2444 mneTg22G.exe 48 PID 2444 wrote to memory of 2084 2444 mneTg22G.exe 48 PID 2444 wrote to memory of 2084 2444 mneTg22G.exe 48 PID 2444 wrote to memory of 2084 2444 mneTg22G.exe 48 PID 2444 wrote to memory of 2392 2444 mneTg22G.exe 49 PID 2444 wrote to memory of 2392 2444 mneTg22G.exe 49 PID 2444 wrote to memory of 2392 2444 mneTg22G.exe 49 PID 2444 wrote to memory of 2392 2444 mneTg22G.exe 49 PID 2392 wrote to memory of 2548 2392 cmd.exe 52 PID 2392 wrote to memory of 2548 2392 cmd.exe 52 PID 2392 wrote to memory of 2548 2392 cmd.exe 52 PID 2392 wrote to memory of 2548 2392 cmd.exe 52 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\DBm0yQwt.exe.ViR.exe"C:\Users\Admin\AppData\Local\Temp\DBm0yQwt.exe.ViR.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\DBm0yQwt.exe.ViR.exe"C:\Users\Admin\AppData\Local\Temp\DBm0yQwt.exe.ViR.exe" g2⤵
- System Location Discovery: System Language Discovery
PID:1676
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /CREATE /TN "b7FMk7bv" /TR "C:\Users\Admin\AppData\Roaming\mneTg22G.exe" /SC ONLOGON /RL HIGHEST /F2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2352
-
-
C:\Users\Admin\AppData\Roaming\mneTg22G.exe"C:\Users\Admin\AppData\Roaming\mneTg22G.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Users\Admin\AppData\Roaming\mneTg22G.exe"C:\Users\Admin\AppData\Roaming\mneTg22G.exe" g3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2776
-
-
C:\Windows\SysWOW64\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet3⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
PID:2600
-
-
C:\Windows\SysWOW64\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet3⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
PID:2852
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\!HELP_SOS.hta"3⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:2700
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f1.vbs"3⤵
- System Location Discovery: System Language Discovery
PID:2124
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /DELETE /TN /F "b7FMk7bv"3⤵
- System Location Discovery: System Language Discovery
PID:2084
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\__config16184093.bat"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 24⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2548
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\__config252888.bat"2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 23⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2828
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:2756
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵
- System Location Discovery: System Language Discovery
PID:2944
Network
MITRE ATT&CK Enterprise v15
Execution
Scheduled Task/Job
1Scheduled Task
1Windows Management Instrumentation
1Defense Evasion
Direct Volume Access
1Indicator Removal
2File Deletion
2Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\__config16184093.bat
- Size 218B
- SHA256 7c487af3d14f3172f86de8aee02be85fa9a534258bcd1aba030eb4d41c021f50
- MD5 86ef2b2d32220a1ca2bdaa6d244770c5
- SHA1 04e7c71008c77728e9b7b01d5de963d2c2b1764d
- SHA512 552208a4efd69f687b883b5f43a12bee3e6dd75e93e921c3bf3115081375fc661822e46d9b2814f2d3fe7af57fdee272e1c4428d285c288c29a6ac0429f8c19c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\__config252888.bat
- Size 227B
- SHA256 52e034a4f657349a1c5e0512e4b19157b56ef93469205a9974f501da319d894a
- MD5 70e42df697ad661221ae5920a25e32cb
- SHA1 f481fff28b5abf6632ba1ab08bc9fb6488b7c52b
- SHA512 e9c5fd70023aec82fc61d8dc5c05800154163b244f995644f27ac5d7c89edd53206abbcc8ffa698fb4b6d2f53c1a28ee5c5a3046864c0b1e1e75c2c199253380
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\f1.vbs
- Size 3KB
- SHA256 9a55ac3ff3c115b686c19da0a88a9e7525aa62d49c69b107addf8efd33a16215
- MD5 4c999bbfddd5513d08d2d414c92ac2f4
- SHA1 23e40ea4b75dc037a5cdfce521826737090dce09
- SHA512 7b48cbff08a98f273afb78262167030395fab421718df559625867b91f98fbb0eb0152e8002568428086d1bd3f03f9c9ab26fdabdf9e33ffcea8f5c56529b944
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\96amWR7q.tmp
- Size 65B
- SHA256 f1d35bf342d9564a44fcc1780dc5f016dd9b140507e89085edeb7ace18d47c32
- MD5 4f8ed5ef82f86bff77a7d412a712837b
- SHA1 2318e66cd25ec6675e41fdeb5e2570ce6d939d85
- SHA512 295256810b98f20f7da24c59d684ebbb34ffbde7b3c9a1259803476efb471288fabef398d82128a8345d4f2db03838b4bb022f88201f7c2c517847b3f52e1e5b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\mneTg22G.exe
- Size 216KB
- SHA256 ac3f6f87217e1d4fbcd56289b4c77b1adea3dbbaf4131a84b7b2508d6fadcfaf
- MD5 3cb2c3ce48ac870ab0be9afb7233295f
- SHA1 b87ac51e95b85e64bb3fecbbb8f9d2acb5b53895
- SHA512 e41c6ad1f5522dda96e19fdf4b79ebd8b7bc13507c5ed5afc1155e37b1dabf16f11f66b1101124035d3d92a942bcd60122e3751069ebd7da1a36e498845b6900
- SSDEEP 3072:UPPdPl/PuW/Yqoeog665R6OKEjzG6hgckhmnl/5aUWTo+Kuv+nAo:UHTnVHv82ZJFgJ+/Hxn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\Music\!HELP_SOS.hta
- Size 52KB
- SHA256 89e12c1465207d3de3b629173de85c3e3f9fd43085a795a036527a902f9e8990
- MD5 777eb96769efb1210ee3491b4d16aa9e
- SHA1 55f9f08b40afaee5598ca81954c66bb247284126
- SHA512 9a3e885175b43912f110d5df56e57e0ff13b7172d548fe09d53103b1baf1650b4211c869ff1fa11f49d340fc202d3c8cac309f9bf30b402ea7013d832df1c69a
- SSDEEP 1536:wJcj3hqy3G/qgtq6rgq7DVqULUBq01EqY5SnqiWtMqFzGhKiq5tcxSLqhKdg1:w8qyW/qgtq6rgq7DVqUL4q01EqY5SnqW
- MD5 SHA1 SHA512 SSDEEP