Extracted

Extracted

• • Target
    jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.4b6c86ca42e1d86926d82ebaba927a84
  • Size 254KB
  • SHA256 943bf3b02289d5ac524bd1b6116d1235ba27f4b6398426212166bb9cf151b213
  • MD5 4b6c86ca42e1d86926d82ebaba927a84
  • SHA1 143fe213b97617cda329e8e2164ecf125811922b
  • SHA512 26bdcd157d8fee7b0a7c1e44ab016d2ee53f01abbcc30ca63b2d28d748fb778e603070093c58e42c820240d1e75489a39318c20d1f0cbe8f25616b16972d3df1
  • SSDEEP 3072:ShJIfTTtKvMm7+yjaiiJmVXZUoGgGN0kaPreqJT2L4un4OFw6uVNq+aPG:ShJioZjaiiJm1LGgeOne48AVcRO
  • TLSH
    T1D34414A8EB8426F4D89740B77608692507C21CFA7E8EF30622C57E5E357A51D30D2EB7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionsageimpactpersistenceprivilege_escalationransomware

  • Family: Sage

    Sage is a ransomware that has been active since 2020.

    ransomwaresage

  • Contacts a large (7714) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

    defense_evasion

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2