sage | 67eb08b8b95741ff5b1b6223e49b322766e6e77055d6f4ce1409a3c78c1c3037

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/10/2026, 14:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Downloader.Win32.Upatre.ggxj.exe
Size 258KB
Sample261006-rb3rnafb83
SHA256 67eb08b8b95741ff5b1b6223e49b322766e6e77055d6f4ce1409a3c78c1c3037
MD5 a879e2ba6b3af15ce04e055c986cb5ec
SHA1 c9c676c9f551da6662643ae61cb5a0da3a5a7917
SHA512 6ae63b620c10968b92ceafc9f453cfc75f03e8e6784119d93bf09332de1236cc695b4687c25849fae7877196ae3ae2c839ccd2b2d8a941dca63367dd47e0364d
SSDEEP 3072:rZO3z0e6pnMtRHRLet5Y4tpo7snUlCCrkyke6xtMcrlA0ZyN5cRWDwwuae:rZc6yHRK4CpPUMLxtVrlA3OW/E
TLSH
T167448C00B253CCEFD659913B89D09AB02F545F38BE6481072654BF3BAFF9690C2972D6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution sage persistence ransomware

Malware Config

Extracted

Path

C:\Recovery\WindowsRE\!HELP_SOS.hta

Ransom Note

<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>Decryption Instructions</title> <HTA:APPLICATION ID='App' APPLICATIONNAME="Decryption Instructions" SCROLL="yes" SINGLEINSTANCE="yes" WINDOWSTATE="maximize"> <style> a { color: #04a; text-decoration: none; } a:hover { text-decoration: underline; } body { background-color: #e7e7e7; color: #222; font-family: "Lucida Sans Unicode", "Lucida Grande", sans-serif; font-size: 12pt; line-height: 16pt; } body, h1 { margin: 0; padding: 0; } h1 { color: #555; text-align: center; padding-bottom: 1.5em; } h2 { color: #555; text-align: center; } ol li { padding-bottom: 13pt; } .container { background-color: #EEE; border: 2pt solid #C7C7C7; margin: 3%; min-width: 600px; padding: 5% 10%; color: #444; } .filecontainer{ padding: 5% 10%; display: none; } .header { border-bottom: 2pt solid #c7c7c7; padding-bottom: 5%; } .hr { background: #bda; display: block; height: 2pt; margin-top: 1.5%; margin-bottom: 1.5%; overflow: hidden; width: 100%; } .key{ background-color: #A1D490; border: 1px solid #506A48; display: block; text-align: center; margin: 0.5em 0; padding: 1em 1.5em; word-wrap: break-word; } .keys{ margin: 3em 0; } .filename{ border: 3px solid #AAA; display: block; text-align: center; margin: 0.5em 0em; padding: 1em 1.5em; background-color: #DCC; } .us{ text-decoration: strong; color: #333; } .info{ background-color: #E4E4E4; padding: 0.5em 3em; margin: 1em 0; } .text{ text-align: justify; } #file{ background-color: #FCC; } .lsb{ display: none; margin: 3%; text-align: center; } .ls{ border: 1px solid #888; border-radius: 3px; padding: 0 0.5em; margin: 1em 0.1em; } .ls:hover{ background-color: #D0D0D0; } .l{ display:none; } </style> <script language="vbscript"> Function GetCmd GetCmd = App.commandLine End Function </script> <script language="javascript"> function openlink(url){ new ActiveXObject("WScript.Shell").Run(url); return false; } function aIndexOf(arr, v){ for(var i = 0; i < arr.length; i++) if(arr[i] == v) return i; return -1; } function tweakClass(cl, f){ var els; if(document.getElementByClassName != null){ els = document.getElementsByClassName(cl); } else{ els = []; var tmp = document.getElementsByTagName('*'); for (var i = 0; i < tmp.length; i++){ var c = tmp[i].className; if( (c == cl) || ((c != '') && ((' '+c+' ').indexOf(' '+cl+' ') != -1)) ) els.push(tmp[i]); } } for(var i = 0; i < els.length; i++) f(els[i]); } var langs = ["en","de","it","pt","es","fr","kr","nl","ar","fa","zh"]; function setLang(lang){ if(aIndexOf(langs, lang) == -1) lang = langs[0]; for(var i = 0; i < langs.length; i++){ var clang = langs[i]; tweakClass('l-'+clang, function(el){ el.style.display = (clang == lang) ? 'block' : 'none'; }); tweakClass('ls-'+clang, function(el){ el.style.backgroundColor = (clang == lang) ? '#BBB' : ''; }); } } function onPageLoaded(){ try{ tweakClass('lsb', function(el){ el.style.display = 'block'; }); }catch(e){} try{ setLang(en); }catch(e){} try{ var args = GetCmd().match(/"[^"]+"|[^ ]+/g); if(args.length > 1){ var file = args[args.length-1]; if(file.charAt(0) == '"' && file.charAt(file.length-1) == '"') file = file.substr(1, file.length-2); document.getElementById('filename').innerHTML = file; document.getElementById('file').style.display = 'block'; document.title = 'File is encrypted'; } }catch(e){} } </script> </head> <body onload='javascript:onPageLoaded()'> <div class='lsb'> <span class='ls ls-en' onclick="javascript:return setLang('en')">English</span> <span class='ls ls-de' onclick="javascript:return setLang('de')">Deutsch</span> <span class='ls ls-it' onclick="javascript:return setLang('it')">Italiano</span> <span class='ls ls-pt' onclick="javascript:return setLang('pt')">Português</span> <span class='ls ls-es' onclick="javascript:return setLang('es')">Español</span> <span class='ls ls-fr' onclick="javascript:return setLang('fr')">Français</span> <span class='ls ls-kr' onclick="javascript:return setLang('kr')">한국어</span> <span class='ls ls-nl' onclick="javascript:return setLang('nl')">Nederlands</span> <span class='ls ls-ar' onclick="javascript:return setLang('ar')">العربية</span> <span class='ls ls-fa' onclick="javascript:return setLang('fa')">فارسی</span> <span class='ls ls-zh' onclick="javascript:return setLang('zh')">中文</span> </div> <div id='file' class='container filecontainer'> <div class='filename'> <div style='float:left; padding:18px 0'><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAADEAAABACAYAAACz4p94AAAABmJLR0QA/wD/AP+gvaeTAAAACXBIWXMAARCQAAEQkAGJrNK4AAAAB3RJTUUH4QEcFBoaYAOrHQAABThJREFUaN7tmlloXGUUx3/3ziRtTa2xcZ1gtaJFDFjtwSqllaKiiEilKOKDNS2UivXF+qD0QRBRUMQXN/TBBcFifahYFC0urfpghSMqaDSkdQMvojZpIk2zTMaHe776MZ17M6u9ozkwzAwz3/ed/9m+s9yABkhEUFX/+43ATcBy4FxgMdABTAB/Aj8CXwO7VfVdb10AlPy9aqGgTuYDVS3Z56XA48AtdWz1OrBdVQ82AiaoVfJATlWLIrIAeAbYWKciS975LwJ3q+pEJQ03DYRJKVDVGRFZCew0kylnqFaaAULgB+B2Vd1fru3ZKFcDAFS1JCLXA7uBMxs1S29t0fzn5kKhMBBF0WAURYgIURQ1DsIAhKaBVcAbwKk0l0JgGlgIrCkUChpF0U/VAgmrOCBvPrAEeBY4jdZQ3jRyDvCEiJxl2ne+mLowTQs5VZ0yJ95mobMaRx0A3gMGgSPAycCFwHXARQlrfKFeDjwMbG7IsT0zKorIauBtYFGFvxY9s3wZ2Kaqwyn7dgNPpkQ1t9/PwGZV3TNbxErThAOwCOhPADBtexwGNqrqrrR4bxFnBNgkIm8CrwFdCX66BNgA7KlLE2aDeVWdFpHlwPsVfMEBGAXuUtUd1YRGH6CIrLdAESZoYxC4Q1U/r8exQwMQAFdb+CuP7U6LO6oF4MK0d+47ZlpJfJ0HXFsm3OpB2HsPsCZBUtgF9VSZo85KFq7zqnrUTOq3ChYyA3QCq7x1NYFwZnYKsKJCFOqwz59YJKo5VTAmAQ4CuxKiHUCviCyryZzMhIqeOnsSDh8B9qnqTJqU0kKyAT8MfJwiyB5gWa0+ETjGgPOBeQkSGgG+rPdmM99wfjUEHEoA0Q0srRmEaSRv+VFHAogx84lGyO01ChxI+E8XcHq9aUdnhahU8uL471bszJoWVEFHbL8kHhfXCyIE5qesGXX+UW9F5mli0jSbRPMaAdGZ8vtUtSG1ykg1mXIRdzaaxVYjSU7kPmFKaAsq5DW+dBY2WAyV89GV8ntXran4tGfzW4B7K0grAI5WMIF6zAjgD2ATsDXhrPFaGwGZJhE59jrOPMraMIuBK4EzTFqlE8x7YNr6TFUP+dkwQCAiobuhRWQt8DTQl2FlfAtsVdW9DoyviUeA7U1owbSSfL4eU9UHjlVRInI/8FDGATizcvytLhQKQRRFewMRuQJ4y+y/Xcg13IaA/tBCWxftRe5+uwC4NQTWzpabZFgbAFeF1qzKtSEIp40+l+QFtC91hvwHaA7E/xlEKesgZrz6u19VA/eytH64FUGkmSCKtt8XwKWq+opL0GxE8AKwknh6mkkQ03bXRMTT0F9d7m/pfdGy5SHgPtclyRoIZyLfAR95APC6If4A5sOsgfB7UQe88jbJoceI+6+ZdeyOKrWWzxqIwJN+H/F8rlJDzR8XrMiyT1wM3OnX7V797oBeQzxYbF6lJCLTTcpi3fhrBNiiqjsrNCBuIx5Ozs+qT+SJW5vdxHPoS3yHlrjH8nyzAbTCsZ1ZjfPPoMa/DMdpAc0lgHMg2gREqcxPSrSoHdoqx+4Ceu3Sc4x3c/wkNpMgclZT9AIPisjZFl57gUeZZeKThcuuvDhyAppsFfOt9gl/385/w7FLtDmFwF9ebdxO5IQ/HBIPLabaGMT+kLitP9GGAELi4ecHIfAqyc9VZJWc+SvwUi6KorFCofANsA44qQ0AuEfrfgHuUdWB0IqWT4Ebml3At4hywPfAelXd5y47sIfY7XbdQNytuwxYkCHmR4GvgOfcM4fGL38Dzdjo/H/3PFAAAAAASUVORK5CYII=" style='padding:0 7.5px'/></div> <div> <h2 class='l l-en' style='display:block'>The file is encrypted but can be restored</h2> <h2 class='l l-de' >Die Datei ist verschlüsselt, aber kann wiederhergestellt werden</h2> <h2 class='l l-it' >Il file è crittografato, ma può essere ripristinato</h2> <h2 class='l l-pt' >O arquivo está criptografado, mas poderá ser descriptografado</h2> <h2 class='l l-es' >El archivo está encriptado pero puede ser restaurado</h2> <h2 class='l l-fr' >Le fichier est crypté mais peut être restauré</h2> <h2 class='l l-kr' >파일은 암호화되었지만 복원 할 수 있습니다</h2> <h2 class='l l-nl' >Het bestand is versleuteld maar kan worden hersteld</h2> <h2 class='l l-ar' > الملف مشفر لكن من الممكن إسترجاعه </h2> <h2 class='l l-fa' >این فایل رمزگذاری شده است اما می تواند بازیابی شود</h2> <h2 class='l l-zh' >文件已被加密，但是可以解密</h2> <p><span id='filename'></span></p> </div> </div> <h2>The file you tried to open and other important files on your computer were encrypted by "SAGE 2.2 Ransomware".</h2> <h2>Action required to restore your files.</h2> </div> <div class='container'> <div class="text l l-en" style='display:block'> <h1>File recovery instructions</h2> <p>You probably noticed that you can not open your files and that some software stopped working correctly.</p> <p>This is expected. Your files content is still there, but it was encrypted by <span class='us'>"SAGE 2.2 Ransomware"</span>.</p> <p>Your files are not lost, it is possible to revert them back to normal state by decrypting.</p> <p>The only way you can do that is by getting <span class='us'>"SAGE Decrypter"</span> software and your personal decryption key.</p> <div class='info'> <p>Using any other software which claims to be able to restore your files will result in files being damaged or destroyed.</p> </div> <p>You can purchase <span class='us'>"SAGE Decrypter"</span> software and your decryption key at your personal page you can access by following links:</p> <div class='keys'> </div> <p>If you are asked for your personal key, copy it to the form on the site. This is your personal key:</p> <div class='keys'> <div class='key'> AQAAAAAAAAAAyyOS4xC9QDiBiEWDfv5y-v7uYROb74dkMPg41s-ZhlvA </div> </div> <p>You will also be able to decrypt one file for free to make sure "SAGE Decrypter" software is able to recover your files</p> <div class='info'> <p>If none of those links work for you for a prolonged period of time or you need your files recovered as fast as possible, you can also access your personal page using "Tor Browser".</p> <p>In order to do that you need to:</p> <ol> <li>open Internet Explorer or any other internet browser;</li> <li>copy the address <a href='https://www.torproject.org/download/download-easy.html.en' onclick='javascript:return openlink(this.href)'>https://www.torproject.org/download/download-easy.html.en</a> into address bar and press "Enter";</li> <li>once the page opens, you will be offered to download Tor Browser, download it and run the installator, follow installation instructions;</li> <li>once installation is finished, open the newly installed Tor Browser and press the "Connect" button (button can be named differently if you installed non-English version);</li> <li>Tor Browser will establish connection and open a normal browser window;</li> <li>copy the address <div class='key'>http://7gie6ffnkrjykggd.onion/login/AQAAAAAAAAAAyyOS4xC9QDiBiEWDfv5y-v7uYROb74dkMPg41s-ZhlvA</div> into this browser address bar and press "Enter";</li> <li>your personal page should be opened now; if it didn't then wait for a bit and try again.</li> </ol> <p>If you can not perform this steps then check your internet connection and try again. If it still doesn't work, try asking some computer guy for help in performing this steps for you or look for some video guides on <a href='https://www.youtube.com/results?search_query=tor+browser+install' onclick='javascript:return openlink(this.href)'>YouTube</a>.</p> </div> <div class='info'> <p>You can find a copy of this instruction in files named "!HELP_SOS" stored next to your encrypted files.</p> </div> </div> <div class="text l l-de" > <h1>Anleitung zur Dateiwiederherstellung</h2> <p>Sie haben sicherlich gemerkt, dass Sie Ihre Daten nicht öffnen können und dass Programme nicht mehr ordnungsgemäß funktionieren.</p> <p>Dies ist zu erwarten. Die Dateiinhalte existieren noch, aber wurden mit {us_enc}} verschlüsselt.</p> <p>Ihre Daten sind nicht verloren. Es ist möglich, sie mit Hilfe von Entschlüsselung in ihren Originalzustand zurückzuversetzen.</p> <p>Die einzige Möglichkeit das zu tun, ist die Verwendung von <span class='us'>"SAGE Decrypter"</span> Software und Ihr persönlicher Entschlüsselungskey.</p> <div class='info'> <p>Das Verwenden von anderer Software, die angeblich ihre Daten wiederherstellen kann, wird dazu führen, dass Ihre Daten beschädigt oder zerstört werden.</p> </div> <p>Sie können die <span class='us'>"SAGE Decrypter"</span> Software und Ihren Entschlüsselungskey auf Ihrer persönlichen Seite erwerben, indem Sie diesen Links folgen:</p> <div class='keys'> </div> <p>Falls Sie nach ihrem persönlichen Key gefragt werden, kopieren Sie ihn in das Formular auf dieser Seite. Dies ist Ihr persönlicher Key:</p> <div class='keys'> <div class='key'> AQAAAAAAAAAAyyOS4xC9QDiBiEWDfv5y-v7uYROb74dkMPg41s-ZhlvA </div> </div> <p>Sie können eine Datei gratis entschlüssen, um sicher zu sein, dass die "SAGE Decrypter" Software ihre Daten wiederherstellen kann</p> <div class='info'> <p>Falls keine dieser Links über einen längeren Zeitraum funktionieren sollten oder Sie Ihre Daten so schnell wie möglich wiederherstellen müssen, können Sie Ihre persönliche Seite mit Hilfe des "Tor Browser" aufrufen.</p> <p>Dazu benötigen Sie:</p> <ol> <li>Öffnen Sie den Internet Explorer oder einen anderen Internetbrowser;</li> <li>Kopieren Sie diese Adresse <a href='https://www.torproject.org/download/download-easy.html.en' onclick='javascript:return openlink(this.href)'>https://www.torproject.org/download/download-easy.html.en</a> in die Adressleiste und drücken Sie "Enter";</li> <li>So bald sich die Seite öffnet, wird Ihnen der Download des Tor Browser angeboten. Laden Sie ihn herunter und führen Sie die Installation aus, indem Sie den Installationsanweisungen folgen;</li> <li>Wenn die Installation abgeschlossen ist, öffnen Sie den soeben installierten Tor Browser und drücken Sie den "Connect" Knopf (Der Namen kann abweichen, falls Sie eine nicht-englische Version installiert haben);</li> <li>Tor Browser wird eine Verbindung herstellen und ein normales Browserfenster öffnen;</li> <li>Kopieren Sie die Adresse <div class='key'>http://7gie6ffnkrjykggd.onion/login/AQAAAAAAAAAAyyOS4xC9QDiBiEWDfv5y-v7uYROb74dkMPg41s-ZhlvA</div> in die Browseradressleiste und drücken Sie "Enter";</li> <li>Ihre persönliche Seite sollte sich nun geöffnet haben; falls nicht: Warten Sie eine Weile und versuchen Sie es erneut.</li> </ol> <p>Falls Sie nicht in der Lage sind, diese Schritte durchzuführen, überprüfen Sie Ihre Internetverbindung. Wenn es noch immer nicht funktioniert, fragen Sie jemanden, der sich mit Computern auskennt, um diese Schritte durchzuführen oder schauen Sie sich einige Videoanleitungen auf {a_youtube}} an.</p> </div> <div class='info'> <p>Sie finden eine Kopie dieser Anleitung in einer Datei namens "!HELP_SOS" neben Ihren verschlüsselten Daten.</p> </div> </div> <div class="text l l-it" > <h1>Istruzioni per il recupero dei file</h2> <p>Probabilmente hai notato che non puoi più aprire i tuoi file e alcuni software hanno smesso di funzionare correttamente.</p> <p>Questo era previsto. I tuoi file si trovano ancora al loro posto, ma sono stati crittografati da <span class='us'>"SAGE 2.2 Ransomware"</span>.</p> <p>I tuoi file non sono persi, è possibile farli tornare al loro stato normale eseguendo una decrittazione.</p> <p>L'unico modo in cui è possibile farlo è scaricare il software <span class='us'>"SAGE Decrypter"</span> e la tua chiave personale di decrittazione.</p> <div class='info'> <p>Utilizzando un qualsiasi altro software che sostiene di essere in grado di ripristinare i tuoi file, li danneggerà o distruggerà per sempre.</p> </div> <p>È possibile acquistare il software <span class='us'>"SAGE Decrypter"</span> e la tua chiave di decrittazione nella tua pagina personale a cui puoi accedere dai seguenti collegamenti:</p> <div class='keys'> </div> <p>Se viene richiesta la chiave personale, è possibile copiarla dal modulo del sito. Questa è la chiave personale:</p> <div class='keys'> <div class='key'> AQAAAAAAAAAAyyOS4xC9QDiBiEWDfv5y-v7uYROb74dkMPg41s-ZhlvA </div> </div> <p>Sarà anche possibile decriptare un file gratuitamente per assicurarsi che il software "SAGE Decrypter" sia in grado di recuperare i file</p>

Signatures

Family: Sage
Sage is a ransomware that has been active since 2020.
ransomware sage
Contacts a large (7715) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	jaffacakes118_Trojan-Downloader.Win32.Upatre.ggxj.exe
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	5IzaheIy.exe

Executes dropped EXE 4 IoCs

pid	Process
1612	5IzaheIy.exe
4448	5IzaheIy.exe
1576	5IzaheIy.exe
4804	5IzaheIy.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:\	5IzaheIy.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\ÌÌ	5IzaheIy.exe
File opened for modification	C:\Windows\SysWOW64\ÌÌ	5IzaheIy.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
936	WScript.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\Desktop\Wallpaper	5IzaheIy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bkW.bmp"	5IzaheIy.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 8 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4612	cmd.exe
4380	cmd.exe
4256	cmd.exe
4364	cmd.exe
732	cmd.exe
4576	cmd.exe
3524	cmd.exe
1872	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Downloader.Win32.Upatre.ggxj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Downloader.Win32.Upatre.ggxj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5IzaheIy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5IzaheIy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5IzaheIy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5IzaheIy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
512	PING.EXE
5028	PING.EXE
4708	PING.EXE
2088	PING.EXE

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\Desktop	5IzaheIy.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT	5IzaheIy.exe
Key created	\REGISTRY\USER\S-1-5-19	5IzaheIy.exe
Key created	\REGISTRY\USER\S-1-5-20	5IzaheIy.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\sage.notice\shell	5IzaheIy.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\htafile	5IzaheIy.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings	5IzaheIy.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\.sage	5IzaheIy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\.sage\ = "sage.notice"	5IzaheIy.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\sage.notice\DefaultIcon	5IzaheIy.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\htafile\DefaultIcon	5IzaheIy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\htafile\DefaultIcon\ = "%WinDir%\\SysWow64\\shell32.dll,44"	5IzaheIy.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\sage.notice\FriendlyTypeName	5IzaheIy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\sage.notice\FriendlyTypeName\ = "encrypted by SAGE"	5IzaheIy.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\sage.notice\shell\open	5IzaheIy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\sage.notice\shell\open\command\ = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\f1.hta\" \"%1\""	5IzaheIy.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\sage.notice	5IzaheIy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\sage.notice\DefaultIcon\ = "%WinDir%\\SysWow64\\shell32.dll,47"	5IzaheIy.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\sage.notice\shell\open\command	5IzaheIy.exe

Runs ping.exe 1 TTPs 4 IoCs

Remote System Discovery

T1018

pid	Process
2088	PING.EXE
512	PING.EXE
5028	PING.EXE
4708	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3968	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1612	5IzaheIy.exe
1612	5IzaheIy.exe
1612	5IzaheIy.exe
1612	5IzaheIy.exe
1612	5IzaheIy.exe
1612	5IzaheIy.exe
1612	5IzaheIy.exe
1612	5IzaheIy.exe
1612	5IzaheIy.exe
1612	5IzaheIy.exe
1612	5IzaheIy.exe
1612	5IzaheIy.exe
1612	5IzaheIy.exe
1612	5IzaheIy.exe
1612	5IzaheIy.exe
1612	5IzaheIy.exe
1612	5IzaheIy.exe
1612	5IzaheIy.exe
1612	5IzaheIy.exe
1612	5IzaheIy.exe
1612	5IzaheIy.exe
1612	5IzaheIy.exe
1612	5IzaheIy.exe
1612	5IzaheIy.exe
1612	5IzaheIy.exe
1612	5IzaheIy.exe
1612	5IzaheIy.exe
1612	5IzaheIy.exe
1612	5IzaheIy.exe
1612	5IzaheIy.exe
1612	5IzaheIy.exe
1612	5IzaheIy.exe
1612	5IzaheIy.exe
1612	5IzaheIy.exe
1612	5IzaheIy.exe
1612	5IzaheIy.exe
1612	5IzaheIy.exe
1612	5IzaheIy.exe
1612	5IzaheIy.exe
1612	5IzaheIy.exe
1612	5IzaheIy.exe
1612	5IzaheIy.exe
1612	5IzaheIy.exe
1612	5IzaheIy.exe
1612	5IzaheIy.exe
1612	5IzaheIy.exe
1612	5IzaheIy.exe
1612	5IzaheIy.exe
1612	5IzaheIy.exe
1612	5IzaheIy.exe
1612	5IzaheIy.exe
1612	5IzaheIy.exe
1612	5IzaheIy.exe
1612	5IzaheIy.exe
1612	5IzaheIy.exe
1612	5IzaheIy.exe
1612	5IzaheIy.exe
1612	5IzaheIy.exe
1612	5IzaheIy.exe
1612	5IzaheIy.exe
1612	5IzaheIy.exe
1612	5IzaheIy.exe
1612	5IzaheIy.exe
1612	5IzaheIy.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
3420	jaffacakes118_Trojan-Downloader.Win32.Upatre.ggxj.exe
116	jaffacakes118_Trojan-Downloader.Win32.Upatre.ggxj.exe
1612	5IzaheIy.exe
4448	5IzaheIy.exe
1576	5IzaheIy.exe
4804	5IzaheIy.exe

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
3420	jaffacakes118_Trojan-Downloader.Win32.Upatre.ggxj.exe
116	jaffacakes118_Trojan-Downloader.Win32.Upatre.ggxj.exe
1612	5IzaheIy.exe
4448	5IzaheIy.exe
1576	5IzaheIy.exe
4804	5IzaheIy.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 3420 wrote to memory of 1872	3420	jaffacakes118_Trojan-Downloader.Win32.Upatre.ggxj.exe	94
PID 3420 wrote to memory of 116	3420	jaffacakes118_Trojan-Downloader.Win32.Upatre.ggxj.exe	96
PID 3420 wrote to memory of 3968	3420	jaffacakes118_Trojan-Downloader.Win32.Upatre.ggxj.exe	97
PID 3420 wrote to memory of 4448	3420	jaffacakes118_Trojan-Downloader.Win32.Upatre.ggxj.exe	104
PID 3420 wrote to memory of 4612	3420	jaffacakes118_Trojan-Downloader.Win32.Upatre.ggxj.exe	105
PID 4612 wrote to memory of 2088	4612	cmd.exe	107
PID 4612 wrote to memory of 512	4612	cmd.exe	108
PID 4612 wrote to memory of 5028	4612	cmd.exe	109
PID 116 wrote to memory of 4380	116	jaffacakes118_Trojan-Downloader.Win32.Upatre.ggxj.exe	110
PID 1612 wrote to memory of 4256	1612	5IzaheIy.exe	112
PID 1612 wrote to memory of 1576	1612	5IzaheIy.exe	114
PID 4448 wrote to memory of 4364	4448	5IzaheIy.exe	115
PID 4448 wrote to memory of 4804	4448	5IzaheIy.exe	117
PID 1576 wrote to memory of 732	1576	5IzaheIy.exe	118
PID 4804 wrote to memory of 4576	4804	5IzaheIy.exe	134
PID 1612 wrote to memory of 3920	1612	5IzaheIy.exe	132
PID 1612 wrote to memory of 936	1612	5IzaheIy.exe	133
PID 1612 wrote to memory of 4576	1612	5IzaheIy.exe	134
PID 1612 wrote to memory of 3524	1612	5IzaheIy.exe	136
PID 3524 wrote to memory of 4708	3524	cmd.exe	138

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Downloader.Win32.Upatre.ggxj.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Downloader.Win32.Upatre.ggxj.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3420
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c memcpy
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1872
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Downloader.Win32.Upatre.ggxj.exe
  "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Downloader.Win32.Upatre.ggxj.exe" g
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:116
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c memcpy
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4380
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /CREATE /TN "n9DsXVMj" /TR "C:\Users\Admin\AppData\Roaming\5IzaheIy.exe" /SC ONLOGON /RL HIGHEST /F
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:3968
- C:\Users\Admin\AppData\Roaming\5IzaheIy.exe
  "C:\Users\Admin\AppData\Roaming\5IzaheIy.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4448
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c memcpy
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4364
- - C:\Users\Admin\AppData\Roaming\5IzaheIy.exe
    "C:\Users\Admin\AppData\Roaming\5IzaheIy.exe" g
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4804
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c memcpy
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:4576
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\__config252888.bat"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4612
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2088
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:512
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5028

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4356

C:\Users\Admin\AppData\Roaming\5IzaheIy.exe
C:\Users\Admin\AppData\Roaming\5IzaheIy.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c memcpy
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4256
- C:\Users\Admin\AppData\Roaming\5IzaheIy.exe
  "C:\Users\Admin\AppData\Roaming\5IzaheIy.exe" g
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1576
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c memcpy
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:732
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\!HELP_SOS.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3920
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f1.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:936
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /DELETE /TN /F "n9DsXVMj"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4576
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\__config16184093.bat"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3524
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4708

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4b8 0x3fc
1⤵
PID:3172

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

!HELP_SOS.hta

Path C:\Recovery\WindowsRE\!HELP_SOS.hta
Size 46KB
SHA256 9831fc81ab13768634c1888b79d21a1ec99a27412569d7ceee0062bf9d34e5a1
MD5 83b8bd0bb4c14e086d2c9773c5daeb4a
SHA1 9776c3ac32c57d7a87f8c3b98afc73ac4bcf9782
SHA512 f78fcc8ca359da96de6340fd8cec6ea71a3fad0855cb844acf2537b376801c3fc69df86f67329f284d2348e6987714b360c42b62f28b75bfe1a2a9e39c673d10
SSDEEP 768:wJcjBR9X3kEkubSBDnZ2CZU7Zieg58DkvxqoKWvGhK5Q8cnkhoUdg1:wJcj313kbFVnZfZU7Hg58Dkvt9GhK572
TLSH
T108231AB2AA8D9862238307C76171B259F57F6D36C706D712F1BB432460E2951EA0ECB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__config16184093.bat

Path C:\Users\Admin\AppData\Local\Temp\__config16184093.bat
Size 218B
SHA256 af656fb826824bc1373536ff746bf9bd8cef9e3bfb5546ba0c52a982731e2dce
MD5 d35136d2eae0f6e9c7b1027b7d758549
SHA1 008c7f8976acc41331575850e81dbf3faf68fa00
SHA512 3a41c91e91cf8ee7f70b04c3bf2af06c6a563ebba2d4128e7fc7b8b77a5de7591cff7d7bc0a356208e1e13d8d9c3dff752aeb75dbb8cdd39bf9ce0cf2f6bfaba
TLSH
T171D0C92E82C8866D5802C5E70BB5E09D90B985A47F883769CA50498F7799C08B5AB6C6
MD5 SHA1 SHA512 TLSH

Submit Download

__config252888.bat

Path C:\Users\Admin\AppData\Local\Temp\__config252888.bat
Size 227B
SHA256 6df5f858b2fb17d06ecc4936f79b5c6ca4b4dd87372db44b6758795e0f618c5d
MD5 45bdca6bebdb8e723b9eea97e3985268
SHA1 c3b910391ba3676771123abe6b5cd0a5c7867966
SHA512 b3428d24fa2090f558f981b1a8311d467ebef511fb23b0fc8418e1d929818da42c2b52d04c267451e014e9f59e3d7a4d4d91d1f4fc47c8ce41a5920c69cb23ea
TLSH
T143D0A712C2CA826A0944739B05B5D45CC074D82C2F8E3B71C6A4845D736640DF287BC4
MD5 SHA1 SHA512 TLSH

Submit Download

f1.vbs

Path C:\Users\Admin\AppData\Local\Temp\f1.vbs
Size 3KB
SHA256 9a55ac3ff3c115b686c19da0a88a9e7525aa62d49c69b107addf8efd33a16215
MD5 4c999bbfddd5513d08d2d414c92ac2f4
SHA1 23e40ea4b75dc037a5cdfce521826737090dce09
SHA512 7b48cbff08a98f273afb78262167030395fab421718df559625867b91f98fbb0eb0152e8002568428086d1bd3f03f9c9ab26fdabdf9e33ffcea8f5c56529b944
TLSH
T116616B1E3E64F17D099351C5272AC111F71ABDEE62020E87940ED4587B1A2A72FE39FE
MD5 SHA1 SHA512 TLSH

Submit Download

5IzaheIy.exe

Path C:\Users\Admin\AppData\Roaming\5IzaheIy.exe
Size 258KB
SHA256 67eb08b8b95741ff5b1b6223e49b322766e6e77055d6f4ce1409a3c78c1c3037
MD5 a879e2ba6b3af15ce04e055c986cb5ec
SHA1 c9c676c9f551da6662643ae61cb5a0da3a5a7917
SHA512 6ae63b620c10968b92ceafc9f453cfc75f03e8e6784119d93bf09332de1236cc695b4687c25849fae7877196ae3ae2c839ccd2b2d8a941dca63367dd47e0364d
SSDEEP 3072:rZO3z0e6pnMtRHRLet5Y4tpo7snUlCCrkyke6xtMcrlA0ZyN5cRWDwwuae:rZc6yHRK4CpPUMLxtVrlA3OW/E
TLSH
T167448C00B253CCEFD659913B89D09AB02F545F38BE6481072654BF3BAFF9690C2972D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oiRG2hDM.tmp

Path C:\Users\Admin\AppData\Roaming\oiRG2hDM.tmp
Size 65B
SHA256 ac52e8b904ab76d9b39010fc18743f6e675467776b4ff6dc358e7a34a3d43aba
MD5 6474b4153468b27c7e16da5c87232280
SHA1 830482f835e9eae76240e9ac18b6f30522013745
SHA512 3bc99896d3cb94e53bcabcc998800ae93de2dd771f2ab146a947dbacaa4a5d70e1254faa184dd239d5c06db7453df813f3ac4962d85225343966d70b183a7967
TLSH
T1C4A02288808A20300030BE822020E028320838383F03080800C3000C2E3B8C830802AB
MD5 SHA1 SHA512 TLSH

Submit Download

InitializeInvoke.html...

Path C:\Users\Admin\Downloads\InitializeInvoke.html...
Size 750KB
SHA256 9c9d7158b0a921e8e1f3489027f78b42b7723257c67355b7c24cbafceb2ad43e
MD5 4b5d5e7e9e16e3c5d9079d84d3a445ee
SHA1 f5dcb5b0353ffff4e87d4d2073c0860aa81e3ab9
SHA512 fc223edc6c5e12394e4845ab0360565a60d2044e43c3aa0a6bbc3352b7adbe55cc6a0090eb6af4a02335338d481bfe00d39a1ce1748c871d360a246cac0e5196
SSDEEP 12288:QAyn7yfNnKB2oiA4L7xviPl5PO8E51cVba4uZFhhGldDNP1EO1NoC2p4Z+ITc:I7KNnKB2ojmwl5POtUVO48FhwnDQOsWY
TLSH
T170F4236C69D7288B977DBBBE512241FE2BCC02599772673E15F047DD3A05EB308A8234
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MountLimit.ico...

Path C:\Users\Admin\Downloads\MountLimit.ico...
Size 1.1MB
SHA256 b6a342322f9dbc6e31869dce377694b99bcc38b209366aee6ea3e40a1437babc
MD5 01acc1072742459847f5d254312a41f7
SHA1 26ae05ac1b87fdc8230a5f9cb879cb9de1fdaeb9
SHA512 9ea0eb145903fa83ed3fe2f1b35526aadf67943579189b1b83da9c56d205c84cf63fd2764b7dcb8257929b93e506910a93065150c37f1da545142df75a5597be
SSDEEP 24576:rLk1L9mOk6AbqJ50Ikh6PiWe8lnsFF34dx38z82:rLaL0Ok6A+70ItflnXdp2
TLSH
T1963533200FD4288554B1CEB1AC30D03E2B73B6DBC6BD9E86679D1FD10E8D22DADE455A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/116-25-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/116-24-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/1576-34-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/1576-33-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/1612-26-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/1612-265-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/1612-37-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/1612-282-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/1612-32-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/3420-10-0x0000000002300000-0x0000000002301000-memory.dmp

Download

memory/3420-12-0x0000000002300000-0x0000000002301000-memory.dmp

Download

memory/3420-11-0x0000000002300000-0x0000000002301000-memory.dmp

Download

memory/3420-7-0x0000000002300000-0x0000000002301000-memory.dmp

Download

memory/3420-0-0x00000000022A0000-0x00000000022F5000-memory.dmp

Download

memory/3420-13-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/3420-8-0x0000000002300000-0x0000000002301000-memory.dmp

Download

memory/3420-22-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/3420-18-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/3420-6-0x0000000002300000-0x0000000002301000-memory.dmp

Download

memory/3420-1-0x0000000002300000-0x0000000002301000-memory.dmp

Download

memory/3420-19-0x0000000002300000-0x0000000002301000-memory.dmp

Download

memory/3420-2-0x0000000002300000-0x0000000002301000-memory.dmp

Download

memory/3420-9-0x0000000002300000-0x0000000002301000-memory.dmp

Download

memory/3420-4-0x0000000002300000-0x0000000002301000-memory.dmp

Download

memory/3420-5-0x0000000002300000-0x0000000002301000-memory.dmp

Download

memory/3420-3-0x00000000022A0000-0x00000000022F5000-memory.dmp

Download

memory/4448-29-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/4448-31-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/4804-36-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/4804-35-0x0000000000400000-0x0000000000444000-memory.dmp

Download