sage | 99d34dd2baef1fa9de5ababd48556d54e7efb23c08f19a775de399186c518b62

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/10/2026, 04:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Ransom.Win32.SageCrypt.mi.exe
Size 283KB
Sample261016-exs35ahs2q
SHA256 99d34dd2baef1fa9de5ababd48556d54e7efb23c08f19a775de399186c518b62
MD5 a7c8fe9f262079fff0129263e1ac00b6
SHA1 dd0a825ab676094ed1f79d49b8355e9858c3101e
SHA512 4959025b626610dc44c2b2048b45370e7b57adb1c6cb4cc1633e85990223aa45ada5bedcb8c8b9d518d2630633ef7f40ab57f1e6c457320c422704eca545472c
SSDEEP 6144:05CdYtpk7CG4nr1/008LTQFTBDVyVkIyRyRyoaX/fUzCeo0EkggUXFw:05pC54nx/0pLMxpyk1RKwkGe2g
TLSH
T1AE549E23B294E072C4561AB4C46187F1A770BC31CD73426BB7843E1EFD76BC18B6A6A5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution sage persistence ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\!HELP_SOS.hta

Ransom Note

<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>Decryption Instructions</title> <HTA:APPLICATION ID='App' APPLICATIONNAME="Decryption Instructions" SCROLL="yes" SINGLEINSTANCE="yes" WINDOWSTATE="maximize"> <style> a { color: #04a; text-decoration: none; } a:hover { text-decoration: underline; } body { background-color: #e7e7e7; color: #222; font-family: "Lucida Sans Unicode", "Lucida Grande", sans-serif; font-size: 12pt; line-height: 16pt; } body, h1 { margin: 0; padding: 0; } h1 { color: #555; text-align: center; padding-bottom: 1.5em; } h2 { color: #555; text-align: center; } ol li { padding-bottom: 13pt; } .container { background-color: #EEE; border: 2pt solid #C7C7C7; margin: 3%; min-width: 600px; padding: 5% 10%; color: #444; } .filecontainer{ padding: 5% 10%; display: none; } .header { border-bottom: 2pt solid #c7c7c7; padding-bottom: 5%; } .hr { background: #bda; display: block; height: 2pt; margin-top: 1.5%; margin-bottom: 1.5%; overflow: hidden; width: 100%; } .key{ background-color: #A1D490; border: 1px solid #506A48; display: block; text-align: center; margin: 0.5em 0; padding: 1em 1.5em; word-wrap: break-word; } .keys{ margin: 3em 0; } .filename{ border: 3px solid #AAA; display: block; text-align: center; margin: 0.5em 0em; padding: 1em 1.5em; background-color: #DCC; } .us{ text-decoration: strong; color: #333; } .info{ background-color: #E4E4E4; padding: 0.5em 3em; margin: 1em 0; } .text{ text-align: justify; } #file{ background-color: #FCC; } .lsb{ display: none; margin: 3%; text-align: center; } .ls{ border: 1px solid #888; border-radius: 3px; padding: 0 0.5em; margin: 1em 0.1em; } .ls:hover{ background-color: #D0D0D0; } .l{ display:none; } </style> <script language="vbscript"> Function GetCmd GetCmd = App.commandLine End Function </script> <script language="javascript"> function openlink(url){ new ActiveXObject("WScript.Shell").Run(url); return false; } function aIndexOf(arr, v){ for(var i = 0; i < arr.length; i++) if(arr[i] == v) return i; return -1; } function tweakClass(cl, f){ var els; if(document.getElementByClassName != null){ els = document.getElementsByClassName(cl); } else{ els = []; var tmp = document.getElementsByTagName('*'); for (var i = 0; i < tmp.length; i++){ var c = tmp[i].className; if( (c == cl) || ((c != '') && ((' '+c+' ').indexOf(' '+cl+' ') != -1)) ) els.push(tmp[i]); } } for(var i = 0; i < els.length; i++) f(els[i]); } var langs = ["en","de","it","pt","es","fr","kr","nl","ar","fa","zh"]; function setLang(lang){ if(aIndexOf(langs, lang) == -1) lang = langs[0]; for(var i = 0; i < langs.length; i++){ var clang = langs[i]; tweakClass('l-'+clang, function(el){ el.style.display = (clang == lang) ? 'block' : 'none'; }); tweakClass('ls-'+clang, function(el){ el.style.backgroundColor = (clang == lang) ? '#BBB' : ''; }); } } function onPageLoaded(){ try{ tweakClass('lsb', function(el){ el.style.display = 'block'; }); }catch(e){} try{ setLang(en); }catch(e){} try{ var args = GetCmd().match(/"[^"]+"|[^ ]+/g); if(args.length > 1){ var file = args[args.length-1]; if(file.charAt(0) == '"' && file.charAt(file.length-1) == '"') file = file.substr(1, file.length-2); document.getElementById('filename').innerHTML = file; document.getElementById('file').style.display = 'block'; document.title = 'File is encrypted'; } }catch(e){} } </script> </head> <body onload='javascript:onPageLoaded()'> <div class='lsb'> <span class='ls ls-en' onclick="javascript:return setLang('en')">English</span> <span class='ls ls-de' onclick="javascript:return setLang('de')">Deutsch</span> <span class='ls ls-it' onclick="javascript:return setLang('it')">Italiano</span> <span class='ls ls-pt' onclick="javascript:return setLang('pt')">Português</span> <span class='ls ls-es' onclick="javascript:return setLang('es')">Español</span> <span class='ls ls-fr' onclick="javascript:return setLang('fr')">Français</span> <span class='ls ls-kr' onclick="javascript:return setLang('kr')">한국어</span> <span class='ls ls-nl' onclick="javascript:return setLang('nl')">Nederlands</span> <span class='ls ls-ar' onclick="javascript:return setLang('ar')">العربية</span> <span class='ls ls-fa' onclick="javascript:return setLang('fa')">فارسی</span> <span class='ls ls-zh' onclick="javascript:return setLang('zh')">中文</span> </div> <div id='file' class='container filecontainer'> <div class='filename'> <div style='float:left; padding:18px 0'><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAADEAAABACAYAAACz4p94AAAABmJLR0QA/wD/AP+gvaeTAAAACXBIWXMAARCQAAEQkAGJrNK4AAAAB3RJTUUH4QEcFBoaYAOrHQAABThJREFUaN7tmlloXGUUx3/3ziRtTa2xcZ1gtaJFDFjtwSqllaKiiEilKOKDNS2UivXF+qD0QRBRUMQXN/TBBcFifahYFC0urfpghSMqaDSkdQMvojZpIk2zTMaHe776MZ17M6u9ozkwzAwz3/ed/9m+s9yABkhEUFX/+43ATcBy4FxgMdABTAB/Aj8CXwO7VfVdb10AlPy9aqGgTuYDVS3Z56XA48AtdWz1OrBdVQ82AiaoVfJATlWLIrIAeAbYWKciS975LwJ3q+pEJQ03DYRJKVDVGRFZCew0kylnqFaaAULgB+B2Vd1fru3ZKFcDAFS1JCLXA7uBMxs1S29t0fzn5kKhMBBF0WAURYgIURQ1DsIAhKaBVcAbwKk0l0JgGlgIrCkUChpF0U/VAgmrOCBvPrAEeBY4jdZQ3jRyDvCEiJxl2ne+mLowTQs5VZ0yJ95mobMaRx0A3gMGgSPAycCFwHXARQlrfKFeDjwMbG7IsT0zKorIauBtYFGFvxY9s3wZ2Kaqwyn7dgNPpkQ1t9/PwGZV3TNbxErThAOwCOhPADBtexwGNqrqrrR4bxFnBNgkIm8CrwFdCX66BNgA7KlLE2aDeVWdFpHlwPsVfMEBGAXuUtUd1YRGH6CIrLdAESZoYxC4Q1U/r8exQwMQAFdb+CuP7U6LO6oF4MK0d+47ZlpJfJ0HXFsm3OpB2HsPsCZBUtgF9VSZo85KFq7zqnrUTOq3ChYyA3QCq7x1NYFwZnYKsKJCFOqwz59YJKo5VTAmAQ4CuxKiHUCviCyryZzMhIqeOnsSDh8B9qnqTJqU0kKyAT8MfJwiyB5gWa0+ETjGgPOBeQkSGgG+rPdmM99wfjUEHEoA0Q0srRmEaSRv+VFHAogx84lGyO01ChxI+E8XcHq9aUdnhahU8uL471bszJoWVEFHbL8kHhfXCyIE5qesGXX+UW9F5mli0jSbRPMaAdGZ8vtUtSG1ykg1mXIRdzaaxVYjSU7kPmFKaAsq5DW+dBY2WAyV89GV8ntXran4tGfzW4B7K0grAI5WMIF6zAjgD2ATsDXhrPFaGwGZJhE59jrOPMraMIuBK4EzTFqlE8x7YNr6TFUP+dkwQCAiobuhRWQt8DTQl2FlfAtsVdW9DoyviUeA7U1owbSSfL4eU9UHjlVRInI/8FDGATizcvytLhQKQRRFewMRuQJ4y+y/Xcg13IaA/tBCWxftRe5+uwC4NQTWzpabZFgbAFeF1qzKtSEIp40+l+QFtC91hvwHaA7E/xlEKesgZrz6u19VA/eytH64FUGkmSCKtt8XwKWq+opL0GxE8AKwknh6mkkQ03bXRMTT0F9d7m/pfdGy5SHgPtclyRoIZyLfAR95APC6If4A5sOsgfB7UQe88jbJoceI+6+ZdeyOKrWWzxqIwJN+H/F8rlJDzR8XrMiyT1wM3OnX7V797oBeQzxYbF6lJCLTTcpi3fhrBNiiqjsrNCBuIx5Ozs+qT+SJW5vdxHPoS3yHlrjH8nyzAbTCsZ1ZjfPPoMa/DMdpAc0lgHMg2gREqcxPSrSoHdoqx+4Ceu3Sc4x3c/wkNpMgclZT9AIPisjZFl57gUeZZeKThcuuvDhyAppsFfOt9gl/385/w7FLtDmFwF9ebdxO5IQ/HBIPLabaGMT+kLitP9GGAELi4ecHIfAqyc9VZJWc+SvwUi6KorFCofANsA44qQ0AuEfrfgHuUdWB0IqWT4Ebml3At4hywPfAelXd5y47sIfY7XbdQNytuwxYkCHmR4GvgOfcM4fGL38Dzdjo/H/3PFAAAAAASUVORK5CYII=" style='padding:0 7.5px'/></div> <div> <h2 class='l l-en' style='display:block'>The file is encrypted but can be restored</h2> <h2 class='l l-de' >Die Datei ist verschlüsselt, aber kann wiederhergestellt werden</h2> <h2 class='l l-it' >Il file è crittografato, ma può essere ripristinato</h2> <h2 class='l l-pt' >O arquivo está criptografado, mas poderá ser descriptografado</h2> <h2 class='l l-es' >El archivo está encriptado pero puede ser restaurado</h2> <h2 class='l l-fr' >Le fichier est crypté mais peut être restauré</h2> <h2 class='l l-kr' >파일은 암호화되었지만 복원 할 수 있습니다</h2> <h2 class='l l-nl' >Het bestand is versleuteld maar kan worden hersteld</h2> <h2 class='l l-ar' > الملف مشفر لكن من الممكن إسترجاعه </h2> <h2 class='l l-fa' >این فایل رمزگذاری شده است اما می تواند بازیابی شود</h2> <h2 class='l l-zh' >文件已被加密，但是可以解密</h2> <p><span id='filename'></span></p> </div> </div> <h2>The file you tried to open and other important files on your computer were encrypted by "SAGE 2.2 Ransomware".</h2> <h2>Action required to restore your files.</h2> </div> <div class='container'> <div class="text l l-en" style='display:block'> <h1>File recovery instructions</h2> <p>You probably noticed that you can not open your files and that some software stopped working correctly.</p> <p>This is expected. Your files content is still there, but it was encrypted by <span class='us'>"SAGE 2.2 Ransomware"</span>.</p> <p>Your files are not lost, it is possible to revert them back to normal state by decrypting.</p> <p>The only way you can do that is by getting <span class='us'>"SAGE Decrypter"</span> software and your personal decryption key.</p> <div class='info'> <p>Using any other software which claims to be able to restore your files will result in files being damaged or destroyed.</p> </div> <p>You can purchase <span class='us'>"SAGE Decrypter"</span> software and your decryption key at your personal page you can access by following links:</p> <div class='keys'> <div class='key'> <a href="http://7gie6ffnkrjykggd.k5hjej9.com/login/AZQG8TeZ360uoIcPBORyKlHxbC9CiMmgOHLYkeFTqgfm2F0g-1QF3zDA" onclick='javascript:return openlink(this.href)'>http://7gie6ffnkrjykggd.k5hjej9.com/</a> </div> </div> <p>If you are asked for your personal key, copy it to the form on the site. This is your personal key:</p> <div class='keys'> <div class='key'> AZQG8TeZ360uoIcPBORyKlHxbC9CiMmgOHLYkeFTqgfm2F0g-1QF3zDA </div> </div> <p>You will also be able to decrypt one file for free to make sure "SAGE Decrypter" software is able to recover your files</p> <div class='info'> <p>If none of those links work for you for a prolonged period of time or you need your files recovered as fast as possible, you can also access your personal page using "Tor Browser".</p> <p>In order to do that you need to:</p> <ol> <li>open Internet Explorer or any other internet browser;</li> <li>copy the address <a href='https://www.torproject.org/download/download-easy.html.en' onclick='javascript:return openlink(this.href)'>https://www.torproject.org/download/download-easy.html.en</a> into address bar and press "Enter";</li> <li>once the page opens, you will be offered to download Tor Browser, download it and run the installator, follow installation instructions;</li> <li>once installation is finished, open the newly installed Tor Browser and press the "Connect" button (button can be named differently if you installed non-English version);</li> <li>Tor Browser will establish connection and open a normal browser window;</li> <li>copy the address <div class='key'>http://7gie6ffnkrjykggd.onion/login/AZQG8TeZ360uoIcPBORyKlHxbC9CiMmgOHLYkeFTqgfm2F0g-1QF3zDA</div> into this browser address bar and press "Enter";</li> <li>your personal page should be opened now; if it didn't then wait for a bit and try again.</li> </ol> <p>If you can not perform this steps then check your internet connection and try again. If it still doesn't work, try asking some computer guy for help in performing this steps for you or look for some video guides on <a href='https://www.youtube.com/results?search_query=tor+browser+install' onclick='javascript:return openlink(this.href)'>YouTube</a>.</p> </div> <div class='info'> <p>You can find a copy of this instruction in files named "!HELP_SOS" stored next to your encrypted files.</p> </div> </div> <div class="text l l-de" > <h1>Anleitung zur Dateiwiederherstellung</h2> <p>Sie haben sicherlich gemerkt, dass Sie Ihre Daten nicht öffnen können und dass Programme nicht mehr ordnungsgemäß funktionieren.</p> <p>Dies ist zu erwarten. Die Dateiinhalte existieren noch, aber wurden mit {us_enc}} verschlüsselt.</p> <p>Ihre Daten sind nicht verloren. Es ist möglich, sie mit Hilfe von Entschlüsselung in ihren Originalzustand zurückzuversetzen.</p> <p>Die einzige Möglichkeit das zu tun, ist die Verwendung von <span class='us'>"SAGE Decrypter"</span> Software und Ihr persönlicher Entschlüsselungskey.</p> <div class='info'> <p>Das Verwenden von anderer Software, die angeblich ihre Daten wiederherstellen kann, wird dazu führen, dass Ihre Daten beschädigt oder zerstört werden.</p> </div> <p>Sie können die <span class='us'>"SAGE Decrypter"</span> Software und Ihren Entschlüsselungskey auf Ihrer persönlichen Seite erwerben, indem Sie diesen Links folgen:</p> <div class='keys'> <div class='key'> <a href="http://7gie6ffnkrjykggd.k5hjej9.com/login/AZQG8TeZ360uoIcPBORyKlHxbC9CiMmgOHLYkeFTqgfm2F0g-1QF3zDA" onclick='javascript:return openlink(this.href)'>http://7gie6ffnkrjykggd.k5hjej9.com/</a> </div> </div> <p>Falls Sie nach ihrem persönlichen Key gefragt werden, kopieren Sie ihn in das Formular auf dieser Seite. Dies ist Ihr persönlicher Key:</p> <div class='keys'> <div class='key'> AZQG8TeZ360uoIcPBORyKlHxbC9CiMmgOHLYkeFTqgfm2F0g-1QF3zDA </div> </div> <p>Sie können eine Datei gratis entschlüssen, um sicher zu sein, dass die "SAGE Decrypter" Software ihre Daten wiederherstellen kann</p> <div class='info'> <p>Falls keine dieser Links über einen längeren Zeitraum funktionieren sollten oder Sie Ihre Daten so schnell wie möglich wiederherstellen müssen, können Sie Ihre persönliche Seite mit Hilfe des "Tor Browser" aufrufen.</p> <p>Dazu benötigen Sie:</p> <ol> <li>Öffnen Sie den Internet Explorer oder einen anderen Internetbrowser;</li> <li>Kopieren Sie diese Adresse <a href='https://www.torproject.org/download/download-easy.html.en' onclick='javascript:return openlink(this.href)'>https://www.torproject.org/download/download-easy.html.en</a> in die Adressleiste und drücken Sie "Enter";</li> <li>So bald sich die Seite öffnet, wird Ihnen der Download des Tor Browser angeboten. Laden Sie ihn herunter und führen Sie die Installation aus, indem Sie den Installationsanweisungen folgen;</li> <li>Wenn die Installation abgeschlossen ist, öffnen Sie den soeben installierten Tor Browser und drücken Sie den "Connect" Knopf (Der Namen kann abweichen, falls Sie eine nicht-englische Version installiert haben);</li> <li>Tor Browser wird eine Verbindung herstellen und ein normales Browserfenster öffnen;</li> <li>Kopieren Sie die Adresse <div class='key'>http://7gie6ffnkrjykggd.onion/login/AZQG8TeZ360uoIcPBORyKlHxbC9CiMmgOHLYkeFTqgfm2F0g-1QF3zDA</div> in die Browseradressleiste und drücken Sie "Enter";</li> <li>Ihre persönliche Seite sollte sich nun geöffnet haben; falls nicht: Warten Sie eine Weile und versuchen Sie es erneut.</li> </ol> <p>Falls Sie nicht in der Lage sind, diese Schritte durchzuführen, überprüfen Sie Ihre Internetverbindung. Wenn es noch immer nicht funktioniert, fragen Sie jemanden, der sich mit Computern auskennt, um diese Schritte durchzuführen oder schauen Sie sich einige Videoanleitungen auf {a_youtube}} an.</p> </div> <div class='info'> <p>Sie finden eine Kopie dieser Anleitung in einer Datei namens "!HELP_SOS" neben Ihren verschlüsselten Daten.</p> </div> </div> <div class="text l l-it" > <h1>Istruzioni per il recupero dei file</h2> <p>Probabilmente hai notato che non puoi più aprire i tuoi file e alcuni software hanno smesso di funzionare correttamente.</p> <p>Questo era previsto. I tuoi file si trovano ancora al loro posto, ma sono stati crittografati da <span class='us'>"SAGE 2.2 Ransomware"</span>.</p> <p>I tuoi file non sono persi, è possibile farli tornare al loro stato normale eseguendo una decrittazione.</p> <p>L'unico modo in cui è possibile farlo è scaricare il software <span class='us'>"SAGE Decrypter"</span> e la tua chiave personale di decrittazione.</p> <div class='info'> <p>Utilizzando un qualsiasi altro software che sostiene di essere in grado di ripristinare i tuoi file, li danneggerà o distruggerà per sempre.</p> </div> <p>È possibile acquistare il software <span class='us'>"SAGE Decrypter"</span> e la tua chiave di decrittazione nella tua pagina personale a cui puoi accedere d

Signatures

Family: Sage
Sage is a ransomware that has been active since 2020.
ransomware sage
Contacts a large (7714) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.mi.exe
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	5IzaheIy.exe

Executes dropped EXE 4 IoCs

pid	Process
3716	5IzaheIy.exe
928	5IzaheIy.exe
3400	5IzaheIy.exe
3992	5IzaheIy.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\emf	5IzaheIy.exe
File created	C:\Windows\SysWOW64\emf	5IzaheIy.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
1492	WScript.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\Desktop\Wallpaper	5IzaheIy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bkW.bmp"	5IzaheIy.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1828	cmd.exe
3700	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 12 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.mi.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	5IzaheIy.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	5IzaheIy.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	5IzaheIy.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	5IzaheIy.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	5IzaheIy.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.mi.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.mi.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.mi.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	5IzaheIy.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	5IzaheIy.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	5IzaheIy.exe

System Location Discovery: System Language Discovery 1 TTPs 39 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.mi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5IzaheIy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5IzaheIy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.mi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5IzaheIy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5IzaheIy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 27 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4576	PING.EXE
2932	PING.EXE
4256	PING.EXE
5044	PING.EXE
4220	PING.EXE
1636	PING.EXE
4852	PING.EXE
632	PING.EXE
5040	PING.EXE
1928	PING.EXE
1720	PING.EXE
4616	PING.EXE
376	PING.EXE
1220	PING.EXE
1804	PING.EXE
3056	PING.EXE
4884	PING.EXE
3420	PING.EXE
3028	PING.EXE
3756	PING.EXE
1836	PING.EXE
756	PING.EXE
3972	PING.EXE
4272	PING.EXE
1944	PING.EXE
1732	PING.EXE
1704	PING.EXE

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\Desktop	5IzaheIy.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT	5IzaheIy.exe
Key created	\REGISTRY\USER\S-1-5-19	5IzaheIy.exe
Key created	\REGISTRY\USER\S-1-5-20	5IzaheIy.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings	5IzaheIy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\sage.notice\FriendlyTypeName\ = "encrypted by SAGE"	5IzaheIy.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\sage.notice\FriendlyTypeName	5IzaheIy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\sage.notice\shell\open\command\ = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\f1.hta\" \"%1\""	5IzaheIy.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\htafile\DefaultIcon	5IzaheIy.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\htafile	5IzaheIy.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\.sage	5IzaheIy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\.sage\ = "sage.notice"	5IzaheIy.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\sage.notice	5IzaheIy.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\sage.notice\shell	5IzaheIy.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\sage.notice\shell\open	5IzaheIy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\htafile\DefaultIcon\ = "%WinDir%\\SysWow64\\shell32.dll,44"	5IzaheIy.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\sage.notice\DefaultIcon	5IzaheIy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\sage.notice\DefaultIcon\ = "%WinDir%\\SysWow64\\shell32.dll,47"	5IzaheIy.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\sage.notice\shell\open\command	5IzaheIy.exe

Runs ping.exe 1 TTPs 27 IoCs

Remote System Discovery

T1018

pid	Process
1220	PING.EXE
3420	PING.EXE
3756	PING.EXE
4852	PING.EXE
3972	PING.EXE
1928	PING.EXE
4272	PING.EXE
4256	PING.EXE
1944	PING.EXE
1732	PING.EXE
4220	PING.EXE
1704	PING.EXE
632	PING.EXE
756	PING.EXE
5040	PING.EXE
1804	PING.EXE
4884	PING.EXE
1636	PING.EXE
2932	PING.EXE
1720	PING.EXE
3056	PING.EXE
5044	PING.EXE
4616	PING.EXE
3028	PING.EXE
4576	PING.EXE
376	PING.EXE
1836	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4344	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3716	5IzaheIy.exe
3716	5IzaheIy.exe
3716	5IzaheIy.exe
3716	5IzaheIy.exe
3716	5IzaheIy.exe
3716	5IzaheIy.exe
3716	5IzaheIy.exe
3716	5IzaheIy.exe
3716	5IzaheIy.exe
3716	5IzaheIy.exe
3716	5IzaheIy.exe
3716	5IzaheIy.exe
3716	5IzaheIy.exe
3716	5IzaheIy.exe
3716	5IzaheIy.exe
3716	5IzaheIy.exe
3716	5IzaheIy.exe
3716	5IzaheIy.exe
3716	5IzaheIy.exe
3716	5IzaheIy.exe
3716	5IzaheIy.exe
3716	5IzaheIy.exe
3716	5IzaheIy.exe
3716	5IzaheIy.exe
3716	5IzaheIy.exe
3716	5IzaheIy.exe
3716	5IzaheIy.exe
3716	5IzaheIy.exe
3716	5IzaheIy.exe
3716	5IzaheIy.exe
3716	5IzaheIy.exe
3716	5IzaheIy.exe
3716	5IzaheIy.exe
3716	5IzaheIy.exe
3716	5IzaheIy.exe
3716	5IzaheIy.exe
3716	5IzaheIy.exe
3716	5IzaheIy.exe
3716	5IzaheIy.exe
3716	5IzaheIy.exe
3716	5IzaheIy.exe
3716	5IzaheIy.exe
3716	5IzaheIy.exe
3716	5IzaheIy.exe
3716	5IzaheIy.exe
3716	5IzaheIy.exe
3716	5IzaheIy.exe
3716	5IzaheIy.exe
3716	5IzaheIy.exe
3716	5IzaheIy.exe
3716	5IzaheIy.exe
3716	5IzaheIy.exe
3716	5IzaheIy.exe
3716	5IzaheIy.exe
3716	5IzaheIy.exe
3716	5IzaheIy.exe
3716	5IzaheIy.exe
3716	5IzaheIy.exe
3716	5IzaheIy.exe
3716	5IzaheIy.exe
3716	5IzaheIy.exe
3716	5IzaheIy.exe
3716	5IzaheIy.exe
3716	5IzaheIy.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 3524 wrote to memory of 4196	3524	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.mi.exe	94
PID 3524 wrote to memory of 4344	3524	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.mi.exe	95
PID 3524 wrote to memory of 928	3524	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.mi.exe	99
PID 3524 wrote to memory of 1828	3524	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.mi.exe	100
PID 1828 wrote to memory of 5044	1828	cmd.exe	102
PID 1828 wrote to memory of 4616	1828	cmd.exe	103
PID 1828 wrote to memory of 1732	1828	cmd.exe	104
PID 1828 wrote to memory of 3028	1828	cmd.exe	105
PID 1828 wrote to memory of 3756	1828	cmd.exe	106
PID 1828 wrote to memory of 4220	1828	cmd.exe	107
PID 1828 wrote to memory of 1704	1828	cmd.exe	108
PID 1828 wrote to memory of 4576	1828	cmd.exe	109
PID 1828 wrote to memory of 376	1828	cmd.exe	110
PID 1828 wrote to memory of 1836	1828	cmd.exe	111
PID 1828 wrote to memory of 1220	1828	cmd.exe	113
PID 3716 wrote to memory of 3400	3716	5IzaheIy.exe	120
PID 928 wrote to memory of 3992	928	5IzaheIy.exe	121
PID 3716 wrote to memory of 1620	3716	5IzaheIy.exe	125
PID 3716 wrote to memory of 1492	3716	5IzaheIy.exe	126
PID 3716 wrote to memory of 4200	3716	5IzaheIy.exe	127
PID 3716 wrote to memory of 3700	3716	5IzaheIy.exe	129
PID 3700 wrote to memory of 1636	3700	cmd.exe	132
PID 3700 wrote to memory of 4852	3700	cmd.exe	134
PID 3700 wrote to memory of 632	3700	cmd.exe	135
PID 3700 wrote to memory of 756	3700	cmd.exe	136
PID 3700 wrote to memory of 3972	3700	cmd.exe	137
PID 3700 wrote to memory of 2932	3700	cmd.exe	138
PID 3700 wrote to memory of 5040	3700	cmd.exe	139
PID 3700 wrote to memory of 1928	3700	cmd.exe	140
PID 3700 wrote to memory of 4272	3700	cmd.exe	141
PID 3700 wrote to memory of 1804	3700	cmd.exe	143
PID 3700 wrote to memory of 4256	3700	cmd.exe	144
PID 3700 wrote to memory of 1720	3700	cmd.exe	145
PID 3700 wrote to memory of 3056	3700	cmd.exe	146
PID 3700 wrote to memory of 4884	3700	cmd.exe	147
PID 3700 wrote to memory of 3420	3700	cmd.exe	148
PID 3700 wrote to memory of 1944	3700	cmd.exe	149

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Ransom.Win32.SageCrypt.mi.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Ransom.Win32.SageCrypt.mi.exe"
1⤵
- Checks computer location settings
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3524
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Ransom.Win32.SageCrypt.mi.exe
  "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Ransom.Win32.SageCrypt.mi.exe" g
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:4196
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /CREATE /TN "n9DsXVMj" /TR "C:\Users\Admin\AppData\Roaming\5IzaheIy.exe" /SC ONLOGON /RL HIGHEST /F
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:4344
- C:\Users\Admin\AppData\Roaming\5IzaheIy.exe
  "C:\Users\Admin\AppData\Roaming\5IzaheIy.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:928
- - C:\Users\Admin\AppData\Roaming\5IzaheIy.exe
    "C:\Users\Admin\AppData\Roaming\5IzaheIy.exe" g
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    PID:3992
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\__config252888.bat"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1828
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5044
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4616
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1732
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3028
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3756
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4220
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1704
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4576
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:376
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1836
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1220

C:\Users\Admin\AppData\Roaming\5IzaheIy.exe
C:\Users\Admin\AppData\Roaming\5IzaheIy.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3716
- C:\Users\Admin\AppData\Roaming\5IzaheIy.exe
  "C:\Users\Admin\AppData\Roaming\5IzaheIy.exe" g
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:3400
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\!HELP_SOS.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1620
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f1.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:1492
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /DELETE /TN /F "n9DsXVMj"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4200
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\__config16184093.bat"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3700
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1636
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4852
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:632
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:756
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3972
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2932
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5040
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1928
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4272
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1804
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4256
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1720
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3056
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4884
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3420
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1944

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x458 0x4e8
1⤵
PID:3956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

__config16184093.bat

Path C:\Users\Admin\AppData\Local\Temp\__config16184093.bat
Size 218B
SHA256 af656fb826824bc1373536ff746bf9bd8cef9e3bfb5546ba0c52a982731e2dce
MD5 d35136d2eae0f6e9c7b1027b7d758549
SHA1 008c7f8976acc41331575850e81dbf3faf68fa00
SHA512 3a41c91e91cf8ee7f70b04c3bf2af06c6a563ebba2d4128e7fc7b8b77a5de7591cff7d7bc0a356208e1e13d8d9c3dff752aeb75dbb8cdd39bf9ce0cf2f6bfaba
TLSH
T171D0C92E82C8866D5802C5E70BB5E09D90B985A47F883769CA50498F7799C08B5AB6C6
MD5 SHA1 SHA512 TLSH

Submit Download

__config252888.bat

Path C:\Users\Admin\AppData\Local\Temp\__config252888.bat
Size 227B
SHA256 6df5f858b2fb17d06ecc4936f79b5c6ca4b4dd87372db44b6758795e0f618c5d
MD5 45bdca6bebdb8e723b9eea97e3985268
SHA1 c3b910391ba3676771123abe6b5cd0a5c7867966
SHA512 b3428d24fa2090f558f981b1a8311d467ebef511fb23b0fc8418e1d929818da42c2b52d04c267451e014e9f59e3d7a4d4d91d1f4fc47c8ce41a5920c69cb23ea
TLSH
T143D0A712C2CA826A0944739B05B5D45CC074D82C2F8E3B71C6A4845D736640DF287BC4
MD5 SHA1 SHA512 TLSH

Submit Download

emf

Path C:\Users\Admin\AppData\Local\Temp\emf
Size 140B
SHA256 a7da9b08841f47b78469e02d08c007d9fac32c9a2657f5a21f23268a93094a2c
MD5 b4c389b5ae07bd96ee0a9c83a8fab4b0
SHA1 7a9e22d72b38678188d9f3aa6e2a629f2b86a99d
SHA512 42ea157fd144fcf086d2ff49e9b34d1e4ec19bbe64465655fa48562ee5a91bd3589dc1457824f58abcee7e78b3b489af1daf4701689499e53208df9e30abdfc1
TLSH
T1ACC0121936559015D00063355961C2980521BC003F0A018575F5B76C09360800053D13
MD5 SHA1 SHA512 TLSH

Submit Download

f1.vbs

Path C:\Users\Admin\AppData\Local\Temp\f1.vbs
Size 3KB
SHA256 9a55ac3ff3c115b686c19da0a88a9e7525aa62d49c69b107addf8efd33a16215
MD5 4c999bbfddd5513d08d2d414c92ac2f4
SHA1 23e40ea4b75dc037a5cdfce521826737090dce09
SHA512 7b48cbff08a98f273afb78262167030395fab421718df559625867b91f98fbb0eb0152e8002568428086d1bd3f03f9c9ab26fdabdf9e33ffcea8f5c56529b944
TLSH
T116616B1E3E64F17D099351C5272AC111F71ABDEE62020E87940ED4587B1A2A72FE39FE
MD5 SHA1 SHA512 TLSH

Submit Download

5IzaheIy.exe

Path C:\Users\Admin\AppData\Roaming\5IzaheIy.exe
Size 283KB
SHA256 99d34dd2baef1fa9de5ababd48556d54e7efb23c08f19a775de399186c518b62
MD5 a7c8fe9f262079fff0129263e1ac00b6
SHA1 dd0a825ab676094ed1f79d49b8355e9858c3101e
SHA512 4959025b626610dc44c2b2048b45370e7b57adb1c6cb4cc1633e85990223aa45ada5bedcb8c8b9d518d2630633ef7f40ab57f1e6c457320c422704eca545472c
SSDEEP 6144:05CdYtpk7CG4nr1/008LTQFTBDVyVkIyRyRyoaX/fUzCeo0EkggUXFw:05pC54nx/0pLMxpyk1RKwkGe2g
TLSH
T1AE549E23B294E072C4561AB4C46187F1A770BC31CD73426BB7843E1EFD76BC18B6A6A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oiRG2hDM.tmp

Path C:\Users\Admin\AppData\Roaming\oiRG2hDM.tmp
Size 65B
SHA256 5d2b6760d4ad7535f4ccef56165001c8e0a0f4d7c7c53211839ab4358f62f8af
MD5 fc21428588ae33b71da8b4c35f0db81c
SHA1 b2b64be5665397fd03337148eb7e1e1277cbc16e
SHA512 a27dec04f57ac524fa4a21c52bb226385fb5c3e19080ee54a3327cd94edb3e655dec823533968cb91d091d1a083452abbb093c1f1fa5378cc5b1002389433cc6
TLSH
T115A00248D92199574516DF480D15918E4013D9D834845C8BB44176169D277B71918389
MD5 SHA1 SHA512 TLSH

Submit Download

!HELP_SOS.hta

Path C:\Users\Admin\Desktop\!HELP_SOS.hta
Size 49KB
SHA256 e3f7cf4f3352defbeb4154326dbd734ffdd8bf5fbf439ce2a297f46ac3c42878
MD5 6c5f50a5d64a91aa7f5c313cd29a5f85
SHA1 369af9c35174ec8a02afceba3904c0a443c07161
SHA512 a2c5386e7159fb9f2d9fdfede44647b5c757dc43a8fcefac6097528d36db4c5b2bd871cca49015cca190fe4947ae0f36c948560dba8b46bc0b49a43c1bc19fde
SSDEEP 1536:wJcj3/i3CxUlK7KPDNEvUxcFy452v+WZyVDGhKUFxcRktlOdg1:wwiSxUlK7KPDNEv2cFy452v1ZyVyfncc
TLSH
T123331AD1EA8D9CB3279307C761B2B315F07F6D36CA06DA11F2BB472530E2551AA1E863
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConnectEnable.css...

Path C:\Users\Admin\Downloads\ConnectEnable.css...
Size 601KB
SHA256 c4209b9c67fbed0281dc5fb7b8d7bc5a6e8ca9f11a3e368b573955ce83ba0986
MD5 66c8b0bbae55425c1408d16804af0a54
SHA1 e27452308ec399d266cb4a8a99020f5d9af7ea2a
SHA512 9530b0f89a7c46e526124c9a6eaf11c2660b18d631851af303ec79d39ecd13cc3742b05236813f84d185768b68f437445f126b8362568c27068695080b7ae8c2
SSDEEP 12288:Lp8uBcuQGPxayBssX3K16RXw1eXWHrCVkaHirojg+MNsrPahhej5PyB085:LplSrG56eaERXwokCaTE8srPazs5Kj5
TLSH
T12ED423EC8DE5EB9D924A7FE9CD314F4701D18B86ACCE6DB1A89217C863902DC06C5973
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RestoreSkip.mid...

Path C:\Users\Admin\Downloads\RestoreSkip.mid...
Size 575KB
SHA256 75167cf87b2eb76a98d01d9fb7e57d7cea5e7b0666d24ca6d45179a3e1e99933
MD5 5bb3c4363e8135399fb33f35c9f47609
SHA1 434077e59c4dbfef05165e3dbe7c04dfd9bb0ca8
SHA512 8bf63bb514604e06741aa05dfb3b9a513dd186abe2964e71aa994147b33bf91061db82b8de62c7f832fa4ce56c0ef70ec09f938a586450cb76cad0e080db5e55
SSDEEP 12288:jxnPBchaQdvdoHDyhIqFkgDl9zPwO7LXtlG5YXhztSfLXiq1:j/chaQdCy/i41r7G5ytuLyq1
TLSH
T1BFC423C6BD61E003FCCD4D4A1B553230AED9DCB20F8CC2146E13A61BD69957B912E6FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/928-37-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/928-35-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/3400-384-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/3400-385-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/3524-10-0x000000000D2B0000-0x000000000D2B1000-memory.dmp

Download

memory/3524-12-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/3524-11-0x000000000D2B0000-0x000000000D2B1000-memory.dmp

Download

memory/3524-15-0x000000000D2B0000-0x000000000D2B1000-memory.dmp

Download

memory/3524-2-0x0000000002260000-0x00000000022C7000-memory.dmp

Download

memory/3524-20-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/3524-9-0x000000000D2B0000-0x000000000D2B1000-memory.dmp

Download

memory/3524-8-0x0000000002260000-0x00000000022C7000-memory.dmp

Download

memory/3524-7-0x000000000D2B0000-0x000000000D2B1000-memory.dmp

Download

memory/3524-6-0x000000000D2B0000-0x000000000D2B1000-memory.dmp

Download

memory/3524-5-0x000000000D2B0000-0x000000000D2B1000-memory.dmp

Download

memory/3524-4-0x000000000D2B0000-0x000000000D2B1000-memory.dmp

Download

memory/3524-3-0x000000000D2B0000-0x000000000D2B1000-memory.dmp

Download

memory/3716-359-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/3716-360-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/3716-38-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/3716-375-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/3716-32-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/3992-389-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/3992-390-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/4196-26-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/4196-25-0x0000000000400000-0x000000000044C000-memory.dmp

Download