Extracted

Extracted

• • Target
    jaffacakes118_Trojan-Downloader.Win32.Upatre.ggxj.a879e2ba6b3af15ce04e055c986cb5ec
  • Size 258KB
  • SHA256 67eb08b8b95741ff5b1b6223e49b322766e6e77055d6f4ce1409a3c78c1c3037
  • MD5 a879e2ba6b3af15ce04e055c986cb5ec
  • SHA1 c9c676c9f551da6662643ae61cb5a0da3a5a7917
  • SHA512 6ae63b620c10968b92ceafc9f453cfc75f03e8e6784119d93bf09332de1236cc695b4687c25849fae7877196ae3ae2c839ccd2b2d8a941dca63367dd47e0364d
  • SSDEEP 3072:rZO3z0e6pnMtRHRLet5Y4tpo7snUlCCrkyke6xtMcrlA0ZyN5cRWDwwuae:rZc6yHRK4CpPUMLxtVrlA3OW/E
  • TLSH
    T167448C00B253CCEFD659913B89D09AB02F545F38BE6481072654BF3BAFF9690C2972D6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionsagepersistenceransomware

  • Family: Sage

    Sage is a ransomware that has been active since 2020.

    ransomwaresage

  • Contacts a large (7715) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2