Analysis
- max time kernel
17s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
06/10/2026, 14:02
Static task
static1
Behavioral task
behavioral1
Sample
jaffacakes118_Trojan-Downloader.Win32.Upatre.ggxj.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral2
Sample
jaffacakes118_Trojan-Downloader.Win32.Upatre.ggxj.exe
Resource
win11ltsc2024-20260911-en
General
- Target jaffacakes118_Trojan-Downloader.Win32.Upatre.ggxj.exe
- Size 258KB
- Sample261006-rb3rnafb83
- SHA256 67eb08b8b95741ff5b1b6223e49b322766e6e77055d6f4ce1409a3c78c1c3037
- MD5 a879e2ba6b3af15ce04e055c986cb5ec
- SHA1 c9c676c9f551da6662643ae61cb5a0da3a5a7917
- SHA512 6ae63b620c10968b92ceafc9f453cfc75f03e8e6784119d93bf09332de1236cc695b4687c25849fae7877196ae3ae2c839ccd2b2d8a941dca63367dd47e0364d
- SSDEEP 3072:rZO3z0e6pnMtRHRLet5Y4tpo7snUlCCrkyke6xtMcrlA0ZyN5cRWDwwuae:rZc6yHRK4CpPUMLxtVrlA3OW/E
- TLSH T167448C00B253CCEFD659913B89D09AB02F545F38BE6481072654BF3BAFF9690C2972D6
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
-
C:\Users\Admin\Desktop\!HELP_SOS.hta
- <!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>Decryption Instructions</title> <HTA:APPLICATION ID='App' APPLICATIONNAME="Decryption Instructions" SCROLL="yes" SINGLEINSTANCE="yes" WINDOWSTATE="maximize"> <style> a { color: #04a; text-decoration: none; } a:hover { text-decoration: underline; } body { background-color: #e7e7e7; color: #222; font-family: "Lucida Sans Unicode", "Lucida Grande", sans-serif; font-size: 12pt; line-height: 16pt; } body, h1 { margin: 0; padding: 0; } h1 { color: #555; text-align: center; padding-bottom: 1.5em; } h2 { color: #555; text-align: center; } ol li { padding-bottom: 13pt; } .container { background-color: #EEE; border: 2pt solid #C7C7C7; margin: 3%; min-width: 600px; padding: 5% 10%; color: #444; } .filecontainer{ padding: 5% 10%; display: none; } .header { border-bottom: 2pt solid #c7c7c7; padding-bottom: 5%; } .hr { background: #bda; display: block; height: 2pt; margin-top: 1.5%; margin-bottom: 1.5%; overflow: hidden; width: 100%; } .key{ background-color: #A1D490; border: 1px solid #506A48; display: block; text-align: center; margin: 0.5em 0; padding: 1em 1.5em; word-wrap: break-word; } .keys{ margin: 3em 0; } .filename{ border: 3px solid #AAA; display: block; text-align: center; margin: 0.5em 0em; padding: 1em 1.5em; background-color: #DCC; } .us{ text-decoration: strong; color: #333; } .info{ background-color: #E4E4E4; padding: 0.5em 3em; margin: 1em 0; } .text{ text-align: justify; } #file{ background-color: #FCC; } .lsb{ display: none; margin: 3%; text-align: center; } .ls{ border: 1px solid #888; border-radius: 3px; padding: 0 0.5em; margin: 1em 0.1em; } .ls:hover{ background-color: #D0D0D0; } .l{ display:none; } </style> <script language="vbscript"> Function GetCmd GetCmd = App.commandLine End Function </script> <script language="javascript"> function openlink(url){ new ActiveXObject("WScript.Shell").Run(url); return false; } function aIndexOf(arr, v){ for(var i = 0; i < arr.length; i++) if(arr[i] == v) return i; return -1; } function tweakClass(cl, f){ var els; if(document.getElementByClassName != null){ els = document.getElementsByClassName(cl); } else{ els = []; var tmp = document.getElementsByTagName('*'); for (var i = 0; i < tmp.length; i++){ var c = tmp[i].className; if( (c == cl) || ((c != '') && ((' '+c+' ').indexOf(' '+cl+' ') != -1)) ) els.push(tmp[i]); } } for(var i = 0; i < els.length; i++) f(els[i]); } var langs = ["en","de","it","pt","es","fr","kr","nl","ar","fa","zh"]; function setLang(lang){ if(aIndexOf(langs, lang) == -1) lang = langs[0]; for(var i = 0; i < langs.length; i++){ var clang = langs[i]; tweakClass('l-'+clang, function(el){ el.style.display = (clang == lang) ? 'block' : 'none'; }); tweakClass('ls-'+clang, function(el){ el.style.backgroundColor = (clang == lang) ? '#BBB' : ''; }); } } function onPageLoaded(){ try{ tweakClass('lsb', function(el){ el.style.display = 'block'; }); }catch(e){} try{ setLang(en); }catch(e){} try{ var args = GetCmd().match(/"[^"]+"|[^ ]+/g); if(args.length > 1){ var file = args[args.length-1]; if(file.charAt(0) == '"' && file.charAt(file.length-1) == '"') file = file.substr(1, file.length-2); document.getElementById('filename').innerHTML = file; document.getElementById('file').style.display = 'block'; document.title = 'File is encrypted'; } }catch(e){} } </script> </head> <body onload='javascript:onPageLoaded()'> <div class='lsb'> <span class='ls ls-en' onclick="javascript:return setLang('en')">English</span> <span class='ls ls-de' onclick="javascript:return setLang('de')">Deutsch</span> <span class='ls ls-it' onclick="javascript:return setLang('it')">Italiano</span> <span class='ls ls-pt' onclick="javascript:return setLang('pt')">Português</span> <span class='ls ls-es' onclick="javascript:return setLang('es')">Español</span> <span class='ls ls-fr' onclick="javascript:return setLang('fr')">Français</span> <span class='ls ls-kr' onclick="javascript:return setLang('kr')">한국어</span> <span class='ls ls-nl' onclick="javascript:return setLang('nl')">Nederlands</span> <span class='ls ls-ar' onclick="javascript:return setLang('ar')">العربية</span> <span class='ls ls-fa' onclick="javascript:return setLang('fa')">فارسی</span> <span class='ls ls-zh' onclick="javascript:return setLang('zh')">中文</span> </div> <div id='file' class='container filecontainer'> <div class='filename'> <div style='float:left; padding:18px 0'><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAADEAAABACAYAAACz4p94AAAABmJLR0QA/wD/AP+gvaeTAAAACXBIWXMAARCQAAEQkAGJrNK4AAAAB3RJTUUH4QEcFBoaYAOrHQAABThJREFUaN7tmlloXGUUx3/3ziRtTa2xcZ1gtaJFDFjtwSqllaKiiEilKOKDNS2UivXF+qD0QRBRUMQXN/TBBcFifahYFC0urfpghSMqaDSkdQMvojZpIk2zTMaHe776MZ17M6u9ozkwzAwz3/ed/9m+s9yABkhEUFX/+43ATcBy4FxgMdABTAB/Aj8CXwO7VfVdb10AlPy9aqGgTuYDVS3Z56XA48AtdWz1OrBdVQ82AiaoVfJATlWLIrIAeAbYWKciS975LwJ3q+pEJQ03DYRJKVDVGRFZCew0kylnqFaaAULgB+B2Vd1fru3ZKFcDAFS1JCLXA7uBMxs1S29t0fzn5kKhMBBF0WAURYgIURQ1DsIAhKaBVcAbwKk0l0JgGlgIrCkUChpF0U/VAgmrOCBvPrAEeBY4jdZQ3jRyDvCEiJxl2ne+mLowTQs5VZ0yJ95mobMaRx0A3gMGgSPAycCFwHXARQlrfKFeDjwMbG7IsT0zKorIauBtYFGFvxY9s3wZ2Kaqwyn7dgNPpkQ1t9/PwGZV3TNbxErThAOwCOhPADBtexwGNqrqrrR4bxFnBNgkIm8CrwFdCX66BNgA7KlLE2aDeVWdFpHlwPsVfMEBGAXuUtUd1YRGH6CIrLdAESZoYxC4Q1U/r8exQwMQAFdb+CuP7U6LO6oF4MK0d+47ZlpJfJ0HXFsm3OpB2HsPsCZBUtgF9VSZo85KFq7zqnrUTOq3ChYyA3QCq7x1NYFwZnYKsKJCFOqwz59YJKo5VTAmAQ4CuxKiHUCviCyryZzMhIqeOnsSDh8B9qnqTJqU0kKyAT8MfJwiyB5gWa0+ETjGgPOBeQkSGgG+rPdmM99wfjUEHEoA0Q0srRmEaSRv+VFHAogx84lGyO01ChxI+E8XcHq9aUdnhahU8uL471bszJoWVEFHbL8kHhfXCyIE5qesGXX+UW9F5mli0jSbRPMaAdGZ8vtUtSG1ykg1mXIRdzaaxVYjSU7kPmFKaAsq5DW+dBY2WAyV89GV8ntXran4tGfzW4B7K0grAI5WMIF6zAjgD2ATsDXhrPFaGwGZJhE59jrOPMraMIuBK4EzTFqlE8x7YNr6TFUP+dkwQCAiobuhRWQt8DTQl2FlfAtsVdW9DoyviUeA7U1owbSSfL4eU9UHjlVRInI/8FDGATizcvytLhQKQRRFewMRuQJ4y+y/Xcg13IaA/tBCWxftRe5+uwC4NQTWzpabZFgbAFeF1qzKtSEIp40+l+QFtC91hvwHaA7E/xlEKesgZrz6u19VA/eytH64FUGkmSCKtt8XwKWq+opL0GxE8AKwknh6mkkQ03bXRMTT0F9d7m/pfdGy5SHgPtclyRoIZyLfAR95APC6If4A5sOsgfB7UQe88jbJoceI+6+ZdeyOKrWWzxqIwJN+H/F8rlJDzR8XrMiyT1wM3OnX7V797oBeQzxYbF6lJCLTTcpi3fhrBNiiqjsrNCBuIx5Ozs+qT+SJW5vdxHPoS3yHlrjH8nyzAbTCsZ1ZjfPPoMa/DMdpAc0lgHMg2gREqcxPSrSoHdoqx+4Ceu3Sc4x3c/wkNpMgclZT9AIPisjZFl57gUeZZeKThcuuvDhyAppsFfOt9gl/385/w7FLtDmFwF9ebdxO5IQ/HBIPLabaGMT+kLitP9GGAELi4ecHIfAqyc9VZJWc+SvwUi6KorFCofANsA44qQ0AuEfrfgHuUdWB0IqWT4Ebml3At4hywPfAelXd5y47sIfY7XbdQNytuwxYkCHmR4GvgOfcM4fGL38Dzdjo/H/3PFAAAAAASUVORK5CYII=" style='padding:0 7.5px'/></div> <div> <h2 class='l l-en' style='display:block'>The file is encrypted but can be restored</h2> <h2 class='l l-de' >Die Datei ist verschlüsselt, aber kann wiederhergestellt werden</h2> <h2 class='l l-it' >Il file è crittografato, ma può essere ripristinato</h2> <h2 class='l l-pt' >O arquivo está criptografado, mas poderá ser descriptografado</h2> <h2 class='l l-es' >El archivo está encriptado pero puede ser restaurado</h2> <h2 class='l l-fr' >Le fichier est crypté mais peut être restauré</h2> <h2 class='l l-kr' >파일은 암호화되었지만 복원 할 수 있습니다</h2> <h2 class='l l-nl' >Het bestand is versleuteld maar kan worden hersteld</h2> <h2 class='l l-ar' > الملف مشفر لكن من الممكن إسترجاعه </h2> <h2 class='l l-fa' >این فایل رمزگذاری شده است اما می تواند بازیابی شود</h2> <h2 class='l l-zh' >文件已被加密,但是可以解密</h2> <p><span id='filename'></span></p> </div> </div> <h2>The file you tried to open and other important files on your computer were encrypted by "SAGE 2.2 Ransomware".</h2> <h2>Action required to restore your files.</h2> </div> <div class='container'> <div class="text l l-en" style='display:block'> <h1>File recovery instructions</h2> <p>You probably noticed that you can not open your files and that some software stopped working correctly.</p> <p>This is expected. Your files content is still there, but it was encrypted by <span class='us'>"SAGE 2.2 Ransomware"</span>.</p> <p>Your files are not lost, it is possible to revert them back to normal state by decrypting.</p> <p>The only way you can do that is by getting <span class='us'>"SAGE Decrypter"</span> software and your personal decryption key.</p> <div class='info'> <p>Using any other software which claims to be able to restore your files will result in files being damaged or destroyed.</p> </div> <p>You can purchase <span class='us'>"SAGE Decrypter"</span> software and your decryption key at your personal page you can access by following links:</p> <div class='keys'> </div> <p>If you are asked for your personal key, copy it to the form on the site. This is your personal key:</p> <div class='keys'> <div class='key'> AQAAAAAAAAAAhUKuECDAbfHv5xu660OM2XQEsdKg6sGfOH0HMtqV23TA </div> </div> <p>You will also be able to decrypt one file for free to make sure "SAGE Decrypter" software is able to recover your files</p> <div class='info'> <p>If none of those links work for you for a prolonged period of time or you need your files recovered as fast as possible, you can also access your personal page using "Tor Browser".</p> <p>In order to do that you need to:</p> <ol> <li>open Internet Explorer or any other internet browser;</li> <li>copy the address <a href='https://www.torproject.org/download/download-easy.html.en' onclick='javascript:return openlink(this.href)'>https://www.torproject.org/download/download-easy.html.en</a> into address bar and press "Enter";</li> <li>once the page opens, you will be offered to download Tor Browser, download it and run the installator, follow installation instructions;</li> <li>once installation is finished, open the newly installed Tor Browser and press the "Connect" button (button can be named differently if you installed non-English version);</li> <li>Tor Browser will establish connection and open a normal browser window;</li> <li>copy the address <div class='key'>http://7gie6ffnkrjykggd.onion/login/AQAAAAAAAAAAhUKuECDAbfHv5xu660OM2XQEsdKg6sGfOH0HMtqV23TA</div> into this browser address bar and press "Enter";</li> <li>your personal page should be opened now; if it didn't then wait for a bit and try again.</li> </ol> <p>If you can not perform this steps then check your internet connection and try again. If it still doesn't work, try asking some computer guy for help in performing this steps for you or look for some video guides on <a href='https://www.youtube.com/results?search_query=tor+browser+install' onclick='javascript:return openlink(this.href)'>YouTube</a>.</p> </div> <div class='info'> <p>You can find a copy of this instruction in files named "!HELP_SOS" stored next to your encrypted files.</p> </div> </div> <div class="text l l-de" > <h1>Anleitung zur Dateiwiederherstellung</h2> <p>Sie haben sicherlich gemerkt, dass Sie Ihre Daten nicht öffnen können und dass Programme nicht mehr ordnungsgemäß funktionieren.</p> <p>Dies ist zu erwarten. Die Dateiinhalte existieren noch, aber wurden mit {us_enc}} verschlüsselt.</p> <p>Ihre Daten sind nicht verloren. Es ist möglich, sie mit Hilfe von Entschlüsselung in ihren Originalzustand zurückzuversetzen.</p> <p>Die einzige Möglichkeit das zu tun, ist die Verwendung von <span class='us'>"SAGE Decrypter"</span> Software und Ihr persönlicher Entschlüsselungskey.</p> <div class='info'> <p>Das Verwenden von anderer Software, die angeblich ihre Daten wiederherstellen kann, wird dazu führen, dass Ihre Daten beschädigt oder zerstört werden.</p> </div> <p>Sie können die <span class='us'>"SAGE Decrypter"</span> Software und Ihren Entschlüsselungskey auf Ihrer persönlichen Seite erwerben, indem Sie diesen Links folgen:</p> <div class='keys'> </div> <p>Falls Sie nach ihrem persönlichen Key gefragt werden, kopieren Sie ihn in das Formular auf dieser Seite. Dies ist Ihr persönlicher Key:</p> <div class='keys'> <div class='key'> AQAAAAAAAAAAhUKuECDAbfHv5xu660OM2XQEsdKg6sGfOH0HMtqV23TA </div> </div> <p>Sie können eine Datei gratis entschlüssen, um sicher zu sein, dass die "SAGE Decrypter" Software ihre Daten wiederherstellen kann</p> <div class='info'> <p>Falls keine dieser Links über einen längeren Zeitraum funktionieren sollten oder Sie Ihre Daten so schnell wie möglich wiederherstellen müssen, können Sie Ihre persönliche Seite mit Hilfe des "Tor Browser" aufrufen.</p> <p>Dazu benötigen Sie:</p> <ol> <li>Öffnen Sie den Internet Explorer oder einen anderen Internetbrowser;</li> <li>Kopieren Sie diese Adresse <a href='https://www.torproject.org/download/download-easy.html.en' onclick='javascript:return openlink(this.href)'>https://www.torproject.org/download/download-easy.html.en</a> in die Adressleiste und drücken Sie "Enter";</li> <li>So bald sich die Seite öffnet, wird Ihnen der Download des Tor Browser angeboten. Laden Sie ihn herunter und führen Sie die Installation aus, indem Sie den Installationsanweisungen folgen;</li> <li>Wenn die Installation abgeschlossen ist, öffnen Sie den soeben installierten Tor Browser und drücken Sie den "Connect" Knopf (Der Namen kann abweichen, falls Sie eine nicht-englische Version installiert haben);</li> <li>Tor Browser wird eine Verbindung herstellen und ein normales Browserfenster öffnen;</li> <li>Kopieren Sie die Adresse <div class='key'>http://7gie6ffnkrjykggd.onion/login/AQAAAAAAAAAAhUKuECDAbfHv5xu660OM2XQEsdKg6sGfOH0HMtqV23TA</div> in die Browseradressleiste und drücken Sie "Enter";</li> <li>Ihre persönliche Seite sollte sich nun geöffnet haben; falls nicht: Warten Sie eine Weile und versuchen Sie es erneut.</li> </ol> <p>Falls Sie nicht in der Lage sind, diese Schritte durchzuführen, überprüfen Sie Ihre Internetverbindung. Wenn es noch immer nicht funktioniert, fragen Sie jemanden, der sich mit Computern auskennt, um diese Schritte durchzuführen oder schauen Sie sich einige Videoanleitungen auf {a_youtube}} an.</p> </div> <div class='info'> <p>Sie finden eine Kopie dieser Anleitung in einer Datei namens "!HELP_SOS" neben Ihren verschlüsselten Daten.</p> </div> </div> <div class="text l l-it" > <h1>Istruzioni per il recupero dei file</h2> <p>Probabilmente hai notato che non puoi più aprire i tuoi file e alcuni software hanno smesso di funzionare correttamente.</p> <p>Questo era previsto. I tuoi file si trovano ancora al loro posto, ma sono stati crittografati da <span class='us'>"SAGE 2.2 Ransomware"</span>.</p> <p>I tuoi file non sono persi, è possibile farli tornare al loro stato normale eseguendo una decrittazione.</p> <p>L'unico modo in cui è possibile farlo è scaricare il software <span class='us'>"SAGE Decrypter"</span> e la tua chiave personale di decrittazione.</p> <div class='info'> <p>Utilizzando un qualsiasi altro software che sostiene di essere in grado di ripristinare i tuoi file, li danneggerà o distruggerà per sempre.</p> </div> <p>È possibile acquistare il software <span class='us'>"SAGE Decrypter"</span> e la tua chiave di decrittazione nella tua pagina personale a cui puoi accedere dai seguenti collegamenti:</p> <div class='keys'> </div> <p>Se viene richiesta la chiave personale, è possibile copiarla dal modulo del sito. Questa è la chiave personale:</p> <div class='keys'> <div class='key'> AQAAAAAAAAAAhUKuECDAbfHv5xu660OM2XQEsdKg6sGfOH0HMtqV23TA </div> </div> <p>Sarà anche possibile decriptare un file gratuitamente per assicurarsi che il software "SAGE Decrypter" sia in grado di recuperare i file</p>
Signatures
- Contacts a large (7705) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Executes dropped EXE 4 IoCs
pid Process 4928 laICpGh2.exe 3532 laICpGh2.exe 1548 laICpGh2.exe 480 laICpGh2.exe - Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
pid Process 720 WScript.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\|‚ÉwÀö laICpGh2.exe File opened for modification C:\Windows\|‚ÉwÀö laICpGh2.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 8 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 6092 cmd.exe 2504 cmd.exe 2116 cmd.exe 4280 cmd.exe 1544 cmd.exe 2508 cmd.exe 5444 cmd.exe 5192 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language laICpGh2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_Trojan-Downloader.Win32.Upatre.ggxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_Trojan-Downloader.Win32.Upatre.ggxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language laICpGh2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language laICpGh2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language laICpGh2.exe - System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 5536 PING.EXE 4108 PING.EXE - Runs ping.exe 1 TTPs 2 IoCs
pid Process 5536 PING.EXE 4108 PING.EXE - Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4904 schtasks.exe - Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 5932 jaffacakes118_Trojan-Downloader.Win32.Upatre.ggxj.exe 2952 jaffacakes118_Trojan-Downloader.Win32.Upatre.ggxj.exe 4928 laICpGh2.exe 3532 laICpGh2.exe 1548 laICpGh2.exe 480 laICpGh2.exe - Suspicious use of SendNotifyMessage 6 IoCs
pid Process 5932 jaffacakes118_Trojan-Downloader.Win32.Upatre.ggxj.exe 2952 jaffacakes118_Trojan-Downloader.Win32.Upatre.ggxj.exe 4928 laICpGh2.exe 3532 laICpGh2.exe 1548 laICpGh2.exe 480 laICpGh2.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 5932 wrote to memory of 5444 5932 jaffacakes118_Trojan-Downloader.Win32.Upatre.ggxj.exe 90 PID 5932 wrote to memory of 2952 5932 jaffacakes118_Trojan-Downloader.Win32.Upatre.ggxj.exe 92 PID 5932 wrote to memory of 4904 5932 jaffacakes118_Trojan-Downloader.Win32.Upatre.ggxj.exe 93 PID 2952 wrote to memory of 5192 2952 jaffacakes118_Trojan-Downloader.Win32.Upatre.ggxj.exe 97 PID 4928 wrote to memory of 6092 4928 laICpGh2.exe 99 PID 5932 wrote to memory of 3532 5932 jaffacakes118_Trojan-Downloader.Win32.Upatre.ggxj.exe 101 PID 5932 wrote to memory of 2504 5932 jaffacakes118_Trojan-Downloader.Win32.Upatre.ggxj.exe 102 PID 4928 wrote to memory of 1548 4928 laICpGh2.exe 104 PID 2504 wrote to memory of 5536 2504 cmd.exe 105 PID 1548 wrote to memory of 2116 1548 laICpGh2.exe 106 PID 3532 wrote to memory of 4280 3532 laICpGh2.exe 108 PID 3532 wrote to memory of 480 3532 laICpGh2.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Downloader.Win32.Upatre.ggxj.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Downloader.Win32.Upatre.ggxj.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c memcpy2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5444
-
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Downloader.Win32.Upatre.ggxj.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Downloader.Win32.Upatre.ggxj.exe" g2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c memcpy3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5192
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /CREATE /TN "jQ6hgZGe" /TR "C:\Users\Admin\AppData\Roaming\laICpGh2.exe" /SC ONLOGON /RL HIGHEST /F2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4904
-
-
C:\Users\Admin\AppData\Roaming\laICpGh2.exe"C:\Users\Admin\AppData\Roaming\laICpGh2.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c memcpy3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4280
-
-
C:\Users\Admin\AppData\Roaming\laICpGh2.exe"C:\Users\Admin\AppData\Roaming\laICpGh2.exe" g3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c memcpy4⤵
- Executes a command shell one-liner
PID:1544
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\__config252888.bat"2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 23⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:5536
-
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:4088
-
C:\Users\Admin\AppData\Roaming\laICpGh2.exeC:\Users\Admin\AppData\Roaming\laICpGh2.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c memcpy2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:6092
-
-
C:\Users\Admin\AppData\Roaming\laICpGh2.exe"C:\Users\Admin\AppData\Roaming\laICpGh2.exe" g2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c memcpy3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2116
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\!HELP_SOS.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵PID:1812
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f1.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
PID:720
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /DELETE /TN /F "jQ6hgZGe"2⤵PID:1716
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\__config16184093.bat"2⤵
- Executes a command shell one-liner
PID:2508 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 23⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4108
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x00000000000004D01⤵PID:2568
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2Visual Basic
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\__config16184093.bat
- Size 218B
- SHA256 ee76b4c70ec769f5b37eaf4b017f0ba2d084f48d1c758469ce77678079fee800
- MD5 592a020da1569c3506d8c059a225b048
- SHA1 5e569541914f3cc7a9cd51c14c66f0ec3c1403d1
- SHA512 e6d2b7398ab245fbcefa45e20bd55404a66c8ad502f3da8c44b1c34df855f44bf7926866f521287e31aca6e234f3860f7de431282cf2bcb1ab17604b1c9d264e
- TLSH T1A1D0C9E222C8866D6C0385A70B76A05D8071C6E03F8CB949EE60458EF399838B5D76C2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__config252888.bat
- Size 227B
- SHA256 6df5f858b2fb17d06ecc4936f79b5c6ca4b4dd87372db44b6758795e0f618c5d
- MD5 45bdca6bebdb8e723b9eea97e3985268
- SHA1 c3b910391ba3676771123abe6b5cd0a5c7867966
- SHA512 b3428d24fa2090f558f981b1a8311d467ebef511fb23b0fc8418e1d929818da42c2b52d04c267451e014e9f59e3d7a4d4d91d1f4fc47c8ce41a5920c69cb23ea
- TLSH T143D0A712C2CA826A0944739B05B5D45CC074D82C2F8E3B71C6A4845D736640DF287BC4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\f1.vbs
- Size 3KB
- SHA256 9a55ac3ff3c115b686c19da0a88a9e7525aa62d49c69b107addf8efd33a16215
- MD5 4c999bbfddd5513d08d2d414c92ac2f4
- SHA1 23e40ea4b75dc037a5cdfce521826737090dce09
- SHA512 7b48cbff08a98f273afb78262167030395fab421718df559625867b91f98fbb0eb0152e8002568428086d1bd3f03f9c9ab26fdabdf9e33ffcea8f5c56529b944
- TLSH T116616B1E3E64F17D099351C5272AC111F71ABDEE62020E87940ED4587B1A2A72FE39FE
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\3w7OSfSP.tmp
- Size 65B
- SHA256 70dd3478fbd0385f92370e6842a60e5b24fb255da8dd3c54f99de6cc771e8de3
- MD5 6723d95ba25777d0348a74a0c8b8984e
- SHA1 4ddfc12bb170e7973e9bf89e5d4bdd6a79862ce4
- SHA512 96a7f2faa0fbe6dff79b62cb841f52fadc4ff515cdcbad7105f761a6856db2a5ab225da5940e55bf0f66b0b12e93db97899483893c06d757f4c3760beda35eef
- TLSH T130A022C38002A3A8A3E8B2CCC00020FE083008800A2C808030BC00C2C3008EC2000A33
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\laICpGh2.exe
- Size 258KB
- SHA256 67eb08b8b95741ff5b1b6223e49b322766e6e77055d6f4ce1409a3c78c1c3037
- MD5 a879e2ba6b3af15ce04e055c986cb5ec
- SHA1 c9c676c9f551da6662643ae61cb5a0da3a5a7917
- SHA512 6ae63b620c10968b92ceafc9f453cfc75f03e8e6784119d93bf09332de1236cc695b4687c25849fae7877196ae3ae2c839ccd2b2d8a941dca63367dd47e0364d
- SSDEEP 3072:rZO3z0e6pnMtRHRLet5Y4tpo7snUlCCrkyke6xtMcrlA0ZyN5cRWDwwuae:rZc6yHRK4CpPUMLxtVrlA3OW/E
- TLSH T167448C00B253CCEFD659913B89D09AB02F545F38BE6481072654BF3BAFF9690C2972D6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\!HELP_SOS.hta
- Size 46KB
- SHA256 f0e8f110e179c46c441d08b06072d41e98a8aadfbc412217ff94954acee19058
- MD5 9dcb4386fbeffc408e3364563de8e4b4
- SHA1 20fab44e37a057818c9c7dab3cab44dd66d4ad03
- SHA512 82162020ec181bedbf6b259514d6dc770d95d75a2b45734cd1861f9f70ab5dd41b9cf012379ce9ad7ce05855b3a1a3184460ae5c76b6e94e628999292d363edb
- SSDEEP 768:wJcjBRvX3GE2uBg7DVP2cTU5Zoei5iDqtxkoKWRGhK5e8cdkfo6dg1:wJcj3f3GRxvVP1TU5Bi5iDqtjPGhK51c
- TLSH T16A2319B2AA8D9C67234303C761B1B256F57F6D32C706D612F5BB432430E2952BA1E877
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\BlockExit.html...
- Size 303KB
- SHA256 1a988bdec767a3efb2120c5d671f323e5d7317139f3d92f0974b1fda94d8b395
- MD5 0d09b160fd101a316c016db959d972cc
- SHA1 5426cc300c16032c269c0e20d2e49680825ff5c3
- SHA512 c50b1dd7a05cf098c2e44da6a51b92d85739e127fd2950f5a6f8f87624238fbe35fca1a15ed3aed3b65aca989e417425bc75bf19c89ff751db42dc16dc517ff7
- SSDEEP 6144:yFmL10BjpipyQ/CTEPJcjmGnHpoqub+AvN5uu2r+aVywIzNj+BNtFB:+FBjACTEPSjm0A5/2KkywIzBuNPB
- TLSH T1C96423D939DD163BEC887053E93E2B77529C3DADA59C5E8324C6EB36404D689D036DC0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\OutPing.gif...
- Size 314KB
- SHA256 1c26aa55138a355fe0ab2b759e4cb41a0a980587fb603ca688cf88ca9fcc0532
- MD5 8f4e4b7c06712c055c023ddacf1d5676
- SHA1 904a734b55fc5c25fdbf43e033ce3cbbd555ee92
- SHA512 49359184b4836f16e5a8f88caf19f809d4c562e9287ce4bbfb102bad2d373b7b34386c4beccee9e790e69a0d65c97b827f1a2beac9cb88a3f4714ddb6bfff01e
- SSDEEP 6144:Tg8F8LYtzD+49mmDPTwqQ5iZpLv+SOWTEs0VRObn/LxSouZpiV21H:7FpxB9mCbwqQ5SvDmVo7LxSoubBH
- TLSH T12F6423F3F7266803C46D6D26D87E9CB1E0CA03F789E6A805D9C1F94F4A1445F2A50BD6
- MD5 SHA1 SHA512 SSDEEP TLSH