Overview

overview

10

Static

static

3

jaffacakes...mi.exe

windows10-2004-x64

10

jaffacakes...mi.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    125s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    16/10/2026, 04:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    jaffacakes118_Trojan-Ransom.Win32.SageCrypt.mi.exe
  • Size 283KB
  • Sample261016-exs35ahs2q
  • SHA256 99d34dd2baef1fa9de5ababd48556d54e7efb23c08f19a775de399186c518b62
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionsagepersistenceransomware

Malware Config

Extracted

Path

  • C:\Users\Admin\Downloads\!HELP_SOS.hta

Ransom Note
  • English Deutsch Italiano Português Español Français 한국어 Nederlands العربية فارسی 中文 The file is encrypted but can be restored Die Datei ist verschlüsselt, aber kann wiederhergestellt werden Il file è crittografato, ma può essere ripristinato O arquivo está criptografado, mas poderá ser descriptografado El archivo está encriptado pero puede ser restaurado Le fichier est crypté mais peut être restauré 파일은 암호화되었지만 복원 할 수 있습니다 Het bestand is versleuteld maar kan worden hersteld الملف مشفر لكن من الممكن إسترجاعه این فایل رمزگذاری شده است اما می تواند بازیابی شود 文件已被加密，但是可以解密 The file you tried to open and other important files on your computer were encrypted by "SAGE 2.2 Ransomware". Action required to restore your files. File recovery instructions You probably noticed that you can not open your files and that some software stopped working correctly. This is expected. Your files content is still there, but it was encrypted by "SAGE 2.2 Ransomware" . Your files are not lost, it is possible to revert them back to normal state by decrypting. The only way you can do that is by getting "SAGE Decrypter" software and your personal decryption key. Using any other software which claims to be able to restore your files will result in files being damaged or destroyed. You can purchase "SAGE Decrypter" software and your decryption key at your personal page you can access by following links: http://7gie6ffnkrjykggd.k5hjej9.com/ If you are asked for your personal key, copy it to the form on the site. This is your personal key: AZQG8TeZ360uyH0BH0dkk9QFe2VW6yzFfO29JMDKwl--7l6LKFdG53vA You will also be able to decrypt one file for free to make sure "SAGE Decrypter" software is able to recover your files If none of those links work for you for a prolonged period of time or you need your files recovered as fast as possible, you can also access your personal page using "Tor Browser". In order to do that you need to: open Internet Explorer or any other internet browser; copy the address https://www.torproject.org/download/download-easy.html.en into address bar and press "Enter"; once the page opens, you will be offered to download Tor Browser, download it and run the installator, follow installation instructions; once installation is finished, open the newly installed Tor Browser and press the "Connect" button (button can be named differently if you installed non-English version); Tor Browser will establish connection and open a normal browser window; copy the address http://7gie6ffnkrjykggd.onion/login/AZQG8TeZ360uyH0BH0dkk9QFe2VW6yzFfO29JMDKwl--7l6LKFdG53vA into this browser address bar and press "Enter"; your personal page should be opened now; if it didn't then wait for a bit and try again. If you can not perform this steps then check your internet connection and try again. If it still doesn't work, try asking some computer guy for help in performing this steps for you or look for some video guides on YouTube. You can find a copy of this instruction in files named "!HELP_SOS" stored next to your encrypted files. Anleitung zur Dateiwiederherstellung Sie haben sicherlich gemerkt, dass Sie Ihre Daten nicht öffnen können und dass Programme nicht mehr ordnungsgemäß funktionieren. Dies ist zu erwarten. Die Dateiinhalte existieren noch, aber wurden mit {us_enc}} verschlüsselt. Ihre Daten sind nicht verloren. Es ist möglich, sie mit Hilfe von Entschlüsselung in ihren Originalzustand zurückzuversetzen. Die einzige Möglichkeit das zu tun, ist die Verwendung von "SAGE Decrypter" Software und Ihr persönlicher Entschlüsselungskey. Das Verwenden von anderer Software, die angeblich ihre Daten wiederherstellen kann, wird dazu führen, dass Ihre Daten beschädigt oder zerstört werden. Sie können die "SAGE Decrypter" Software und Ihren Entschlüsselungskey auf Ihrer persönlichen Seite erwerben, indem Sie diesen Links folgen: http://7gie6ffnkrjykggd.k5hjej9.com/ Falls Sie nach ihrem persönlichen Key gefragt werden, kopieren Sie ihn in das Formular auf dieser Seite. Dies ist Ihr persönlicher Key: AZQG8TeZ360uyH0BH0dkk9QFe2VW6yzFfO29JMDKwl--7l6LKFdG53vA Sie können eine Datei gratis entschlüssen, um sicher zu sein, dass die "SAGE Decrypter" Software ihre Daten wiederherstellen kann Falls keine dieser Links über einen längeren Zeitraum funktionieren sollten oder Sie Ihre Daten so schnell wie möglich wiederherstellen müssen, können Sie Ihre persönliche Seite mit Hilfe des "Tor Browser" aufrufen. Dazu benötigen Sie: Öffnen Sie den Internet Explorer oder einen anderen Internetbrowser; Kopieren Sie diese Adresse https://www.torproject.org/download/download-easy.html.en in die Adressleiste und drücken Sie "Enter"; So bald sich die Seite öffnet, wird Ihnen der Download des Tor Browser angeboten. Laden Sie ihn herunter und führen Sie die Installation aus, indem Sie den Installationsanweisungen folgen; Wenn die Installation abgeschlossen ist, öffnen Sie den soeben installierten Tor Browser und drücken Sie den "Connect" Knopf (Der Namen kann abweichen, falls Sie eine nicht-englische Version installiert haben); Tor Browser wird eine Verbindung herstellen und ein normales Browserfenster öffnen; Kopieren Sie die Adresse http://7gie6ffnkrjykggd.onion/login/AZQG8TeZ360uyH0BH0dkk9QFe2VW6yzFfO29JMDKwl--7l6LKFdG53vA in die Browseradressleiste und drücken Sie "Enter"; Ihre persönliche Seite sollte sich nun geöffnet haben; falls nicht: Warten Sie eine Weile und versuchen Sie es erneut. Falls Sie nicht in der Lage sind, diese Schritte durchzuführen, überprüfen Sie Ihre Internetverbindung. Wenn es noch immer nicht funktioniert, fragen Sie jemanden, der sich mit Computern auskennt, um diese Schritte durchzuführen oder schauen Sie sich einige Videoanleitungen auf {a_youtube}} an. Sie finden eine Kopie dieser Anleitung in einer Datei namens "!HELP_SOS" neben Ihren verschlüsselten Daten. Istruzioni per il recupero dei file Probabilmente hai notato che non puoi più aprire i tuoi file e alcuni software hanno smesso di funzionare correttamente. Questo era previsto. I tuoi file si trovano ancora al loro posto, ma sono stati crittografati da "SAGE 2.2 Ransomware" . I tuoi file non sono persi, è possibile farli tornare al loro stato normale eseguendo una decrittazione. L'unico modo in cui è possibile farlo è scaricare il software "SAGE Decrypter" e la tua chiave personale di decrittazione. Utilizzando un qualsiasi altro software che sostiene di essere in grado di ripristinare i tuoi file, li danneggerà o distruggerà per sempre. È possibile acquistare il software "SAGE Decrypter" e la tua chiave di decrittazione nella tua pagina personale a cui puoi accedere dai seguenti collegamenti: http://7gie6ffnkrjykggd.k5hjej9.com/ Se viene richiesta la chiave personale, è possibile copiarla dal modulo del sito. Questa è la chiave personale: AZQG8TeZ360uyH0BH0dkk9QFe2VW6yzFfO29JMDKwl--7l6LKFdG53vA Sarà anche possibile decriptare un file gratuitamente per assicurarsi che il software "SAGE Decrypter" sia in grado di recuperare i file Se nessuno dei collegamenti funziona per un periodo di tempo prolungato o è necessario ripristinare il prima possibile, è possibile accedere alla propria pagina personale anche utilizzando "Tor Browser". Per poterlo fare è necessario: aprire Internet Explorer o qualsiasi altro browser internet; copiare l'indirizzo https://www.torproject.org/download/download-easy.html.en nella barra degli indirizzi e premere "Enter"; una volta aperta la pagina, verrà offerta la possibilità di scaricare Tor Browser, scarica ed esegui il file seguendo le istruzioni di installazione; una volta completata l'installazione, aprire il nuovo Tor Browser e premere il pulsante "Connect" (il pulsante potrebbe avere un nome diverso se non si è installata la versione inglese); Tor Browser stabilirà una connessione e aprirà una normale finestra di navigazione; copiare l'indirizzo http://7gie6ffnkrjykggd.onion/login/AZQG8TeZ360uyH0BH0dkk9QFe2VW6yzFfO29JMDKwl--7l6LKFdG53vA nella barra degli indirizzi del browser e premere "Enter"; ora dovrebbe essere possibile aprire la pagina personale; se così non fosse, attendere qualche istante e riprovare. Se non è possibile eseguire questo passaggio, controllare la connessione internet e riprovare. Se ancora non funziona, prova a chiedere se qualche esperto di computer può farlo al posto tuo oppure dai un'occhiata a qualche video guida su YouTube. Puoi trovare una copia di queste istruzioni nel file di nome "!HELP_SOS" conservato con i tuoi file criptati. Instruções sobre como recuperar os arquivos criptografado: Você já deve ter percebido que todos os seus arquivos não estão mais acessível e alguns dos seus programas não estão funcionando corretamente. Já era de se esperar! Os seus arquivos ainda estão salvos em seu computador, porém não estão acessível porque foram criptografados por "SAGE 2.2 Ransomware" . Os seus arquivos não foram deletados, é possível descriptografá-los. A única maneira de descriptografá-los é usando o programa, "SAGE Decrypter" e a sua chave de descriptografia pessoal. Ao tentar utilizar decodificadores de terceiros para tentar restaurar os seus arquivos, irar corromper todos os seus arquivos, podendo gerar danos irreversíveis. Você pode comprar o "SAGE Decrypter" e sua chave pessoal para decodificação nos seguintes links: http://7gie6ffnkrjykggd.k5hjej9.com/ Caso seja solicitado uma chave pessoal, copie e cole no formulário no site. Essa é a sua chave pessoal: AZQG8TeZ360uyH0BH0dkk9QFe2VW6yzFfO29JMDKwl--7l6LKFdG53vA Você pode descriptografar um arquivo gratuitamente para ter certeza de que o "SAGE Decrypter", seja capaz de descriptografar todos os seus arquivos no seu computador. Se nenhum dos links estiver disponível no momento ou se você precisar com urgência dos seus arquivos, você também pode acessar a sua página pessoal usando o "Tor Browser". Instruções sobre como utilizá-lo: abra o Internet Explorer ou qualquer outro navegador; copie o endereço do https://www.torproject.org/download/download-easy.html.en e cole na barra de endereço em seu navegador e pressione "Enter"; quando a página for aberta em seguida, você verá as informações sobre o Navegador Tor e o link para download, abra o arquivo e siga as instruções de instalação; Quando a instalação estiver concluída, abra o Navegador Tor e pressione o botão "Connect"(o botão pode ter outro nome, se você instalou uma versão do programa que não seja em inglês); O Navegador Tor irá estabelecer uma conexão e, em seguida, abrirá uma janela no navegador; copie o endereço do http://7gie6ffnkrjykggd.onion/login/AZQG8TeZ360uyH0BH0dkk9QFe2VW6yzFfO29JMDKwl--7l6LKFdG53vA e cole na barra de endereço do Navegador Tor, em seguida, pressione "Enter"; a sua página pessoal irá abrir em alguns instantes; caso a página não abra, aguarde um pouco e tente novamente. Se você não conseguir executar todas as etapas, certifique-se de que você está conectado à internet e tente novamente. Se você ainda tiver dificuldade para conectar, peça ajuda a um técnico de informática para auxiliá-lo no processo ou procure vídeos que possam ajudá-lo no YouTube. Você pode encontrar uma cópia do arquivo de instrução chamado "!HELP_SOS" salvo junto ao seus arquivos criptografados. Instrucciones para la recuperación de archivos Probablemente hayas notado que no puedes abrir tus archivos y que algunas aplicaciones dejaron de funcionar correctamente. Era de esperarse. El contenido de tus archivos aún está allí, pero fué encriptado por "SAGE 2.2 Ransomware" . Tus archivos no están perdidos, es posible regresarlos a su estado normal decodificándolos. La única forma de hacerlo es con el software "SAGE Decrypter" y su clave personal de descifrado. Usar cualquier otro software que asegure ser capaz de restaurar tus archivos resultará en un daño o destrucción de los archivos. Puedes comprar el software "SAGE Decrypter" y tu clave de descifrado en tu página personal que puedes accesar a través de los siguientes links: http://7gie6ffnkrjykggd.k5hjej9.com/ Si te es solicitada la clave personal, cópiala en el formulario del sitio. Esta es tu clave personal: AZQG8TeZ360uyH0BH0dkk9QFe2VW6yzFfO29JMDKwl--7l6LKFdG53vA También podrás descifrar un archivo gratis para asegurarte que el software "SAGE Decrypter" es capaz de recuperar tus archivos Si ninguno de esos links te funciona por un tiempo prolongado o si necesitas recuperar tus archivos lo más rápido posible, también puedes accesar a tu página personal usando el "Tor Browser". Con la finalidad de hacerlo necesitas: abrir Internet Explorer o cualquier otro navegador de internet; copia la dirección https://www.torproject.org/download/download-easy.html.en en la barra de direcciones y presiona "Enter"; una vez que abra la página, le será ofrecida la descarga de Tor Browser, descárgalo y ejecuta el instalador, siguiendo las instrucciones de instalación; una vez culminada la instalación, abre el recien instalado Tor Browser y presione el botón "Connect" (el botón puede tener un nombre diferente dependiendo de la versión instalada); copia la dirección http://7gie6ffnkrjykggd.onion/login/AZQG8TeZ360uyH0BH0dkk9QFe2VW6yzFfO29JMDKwl--7l6LKFdG53vA en la barra de direcciones del navegador y presiona "Enter"; tu página personal debería abrir ahora; si no lo hace, espera un momento e intenta de nuevo. Si no puedes hacer el procedimiento, chequea tu conexión a internet e inténtalo de nuevo. Si aún no funciona, intenta pidiéndole ayuda a un técnico de computación para seguir las instrucciones o mira algunos videos de ayuda en YouTube. Puedes encontrar una copia de estas instrucciones en los archivos llamados "!HELP_SOS" almacenados junto a tus archivos encriptados. Les instructions pour restaurer le fichier Vous avez sûrement remarqué que vous ne pouvez pas ouvrir vos fichiers et qu’un logiciel a arrêté de fonctionner correctement. C’est attendu. Le contenu de vos fichiers est encore disponible, mais il a été crypté par "SAGE 2.2 Ransomware" . Vos fichiers ne sont pas perdus, c’est possible de les récupérer et les avoir à l’état normal en les décryptant. La seule façon de le faire et en ayant le logiciel "SAGE Decrypter" et votre clé de décryptage. En utilisant un autre logiciel qui prétend pouvoir restaurer vos fichiers va endommager et détruir vos fichiers. Vous pouvez acheter le logiciel "SAGE Decrypter" et votre clé de décryptage sur votre profile auquel vous pouvez accéder en cliquant sur ce lien: http://7gie6ffnkrjykggd.k5hjej9.com/ Si vous êtes demandé de fournir votre clé, copiez la dans le formulaire du site. Voici votre clé personnelle: AZQG8TeZ360uyH0BH0dkk9QFe2VW6yzFfO29JMDKwl--7l6LKFdG53vA Vous serez en mesure de décrypter un fichier gratuitement pour être sûre que le logiciel "SAGE Decrypter" est capable de restaurer vos fichiers Si aucun des liens ne marche pour vous pour une période prolongée ou si vous avez besoin de restaurer vos fichiers rapidement, vous pouvez accéder à votre profile en utilisant "Navigateut Tor". Pour le faire vous devez: Ouvrez Explorer ou n’importe quel autre navigateut; Copiez cette addresse https://www.torproject.org/download/download-easy.html.en dans la barre d’adresse et cliquez sur "Enterer"; Une fois que la page est ouverte, on va vous proposer de télécharger le navigateur Tor, Téléchargez-le et lancez l’installation, suivez les instructions d’installation ; Une fois l’installation faite, ouvrez votre nouveau navigateur Tor et appuyez sur le bouton "Connect" (Le bouton peut être nommé différemment si vous n’avez pas installé la version en anglais); Le navigateur Tor va établir une connection et ouvrir une fenêtre ordinaire de navigateur ; copiez l’adresse http://7gie6ffnkrjykggd.onion/login/AZQG8TeZ360uyH0BH0dkk9QFe2VW6yzFfO29JMDKwl--7l6LKFdG53vA dans la barre d’adresse et cliquez sur "Entrer"; Votre profile doit être ouvert maintenant; si ça ne marche pas attendez puis essayez encore une fois. Si vous n’arrivez pas à suivre ces étapes verifies alors votre connexion internet et réessayez. Si ça ne march
URLs

  • http://7gie6ffnkrjykggd.k5hjej9.com/

  • http://7gie6ffnkrjykggd.onion/login/AZQG8TeZ360uyH0BH0dkk9QFe2VW6yzFfO29JMDKwl--7l6LKFdG53vA

  • http://7gie6ffnkrjykggd.onion/login/AZQG8TeZ360uyH0BH0dkk9QFe2VW6yzFfO29JMDKwl--7l6LKFdG53vA到浏览器的地址栏，然后按下"回车"键；

Signatures

  • Family: Sage

    Sage is a ransomware that has been active since 2020.

    ransomwaresage
  • Contacts a large (7705) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Executes dropped EXE 4 IoCs
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
    execution
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 12 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 64 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Modifies Control Panel 1 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 16 IoCs
  • Runs ping.exe 1 TTPs 64 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Ransom.Win32.SageCrypt.mi.exe
    "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Ransom.Win32.SageCrypt.mi.exe"
    1⤵
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3304
    • C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Ransom.Win32.SageCrypt.mi.exe
      "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Ransom.Win32.SageCrypt.mi.exe" g
      2⤵
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      PID:2040
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /CREATE /TN "4m1ly9MF" /TR "C:\Users\Admin\AppData\Roaming\jhYUTd9y.exe" /SC ONLOGON /RL HIGHEST /F
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:2820
    • C:\Users\Admin\AppData\Roaming\jhYUTd9y.exe
      "C:\Users\Admin\AppData\Roaming\jhYUTd9y.exe"
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4680
      • C:\Users\Admin\AppData\Roaming\jhYUTd9y.exe
        "C:\Users\Admin\AppData\Roaming\jhYUTd9y.exe" g
        3⤵
        • Executes dropped EXE
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        PID:6012
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\__config252888.bat"
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3004
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:6024
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:2388
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:3680
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:408
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:240
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:4200
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:3252
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:2524
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:3256
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:2692
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:1952
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:5964
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:2184
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:5380
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:1020
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:5700
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:3596
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:1520
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:5840
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:1128
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:5004
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:5044
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:5452
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:4856
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:3428
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:1012
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:4484
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:1100
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:5048
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • System Location Discovery: System Language Discovery
        • Runs ping.exe
        PID:3324
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:5572
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:2616
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:4984
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:2072
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:4396
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:3120
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:2756
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:1484
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:5560
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:4956
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:5908
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:3260
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:2320
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • System Location Discovery: System Language Discovery
        • Runs ping.exe
        PID:5432
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:3472
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:3880
  • C:\Users\Admin\AppData\Roaming\jhYUTd9y.exe
    C:\Users\Admin\AppData\Roaming\jhYUTd9y.exe
    1⤵
    • Executes dropped EXE
    • Sets desktop wallpaper using registry
    • Drops file in Windows directory
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1488
    • C:\Users\Admin\AppData\Roaming\jhYUTd9y.exe
      "C:\Users\Admin\AppData\Roaming\jhYUTd9y.exe" g
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      PID:5904
    • C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\!HELP_SOS.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1360
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f1.vbs"
      2⤵
      • Executes a VBScript file via the Windows Script Host.
      • System Location Discovery: System Language Discovery
      PID:4840
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /DELETE /TN /F "4m1ly9MF"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1728
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\__config16184093.bat"
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:860
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:5432
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:2476
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:3420
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:3880
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:4784
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:1340
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:3096
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:4764
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:4324
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:3088
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:1160
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:5352
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:2456
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:1368
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        PID:4160
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:4268
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:4660
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        PID:3520
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:2500
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:2108
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x00000000000004D4 0x00000000000004D8
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:5724

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        __config16184093.bat
        • Path C:\Users\Admin\AppData\Local\Temp\__config16184093.bat
        • Size 218B
        • SHA256 c2fecd7dfba4af34888d33defa941ddbf125717e4be45cf3d2dc9c22ba193e74
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        __config252888.bat
        • Path C:\Users\Admin\AppData\Local\Temp\__config252888.bat
        • Size 227B
        • SHA256 6df5f858b2fb17d06ecc4936f79b5c6ca4b4dd87372db44b6758795e0f618c5d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        emf
        • Path C:\Users\Admin\AppData\Local\Temp\emf
        • Size 140B
        • SHA256 a7da9b08841f47b78469e02d08c007d9fac32c9a2657f5a21f23268a93094a2c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        f1.vbs
        • Path C:\Users\Admin\AppData\Local\Temp\f1.vbs
        • Size 3KB
        • SHA256 9a55ac3ff3c115b686c19da0a88a9e7525aa62d49c69b107addf8efd33a16215
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        RhO1cnjf.tmp
        • Path C:\Users\Admin\AppData\Roaming\RhO1cnjf.tmp
        • Size 65B
        • SHA256 fa5adfa19a1b409cfc28fdce4b577b65e8a872f7577532e179185e679732c2d2
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        jhYUTd9y.exe
        • Path C:\Users\Admin\AppData\Roaming\jhYUTd9y.exe
        • Size 283KB
        • SHA256 99d34dd2baef1fa9de5ababd48556d54e7efb23c08f19a775de399186c518b62
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        !HELP_SOS.hta
        • Path C:\Users\Admin\Downloads\!HELP_SOS.hta
        • Size 49KB
        • SHA256 3629442526a3afa12259333866cf97c0ec5d70d5bc5a98a9cdd8443ecf485109
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        EnterUse.css...
        • Path C:\Users\Admin\Downloads\EnterUse.css...
        • Size 689KB
        • SHA256 5c82be38cf965c6c976bb6c5894dcd2476eaa1c0cf4eed267e9a9ee8bbb64618
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SplitProtect.ttf...
        • Path C:\Users\Admin\Downloads\SplitProtect.ttf...
        • Size 293KB
        • SHA256 88935383ef926e4bff4e388e580aa0a7dd564e1f061d0bb3a70d4420056ce1ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1488-30-0x0000000000400000-0x000000000044C000-memory.dmp
        Download

        memory/1488-27-0x0000000000400000-0x000000000044C000-memory.dmp
        Download

        memory/1488-279-0x0000000000400000-0x000000000044C000-memory.dmp
        Download

        memory/1488-280-0x0000000000400000-0x000000000044C000-memory.dmp
        Download

        memory/1488-300-0x0000000000400000-0x000000000044C000-memory.dmp
        Download

        memory/2040-24-0x0000000000400000-0x000000000044C000-memory.dmp
        Download

        memory/2040-23-0x0000000000400000-0x000000000044C000-memory.dmp
        Download

        memory/3304-4-0x000000000BAF0000-0x000000000BAF1000-memory.dmp
        Download

        memory/3304-6-0x000000000BAF0000-0x000000000BAF1000-memory.dmp
        Download

        memory/3304-13-0x0000000000400000-0x000000000044C000-memory.dmp
        Download

        memory/3304-3-0x000000000BAF0000-0x000000000BAF1000-memory.dmp
        Download

        memory/3304-2-0x00000000027B0000-0x0000000002817000-memory.dmp
        Download

        memory/3304-12-0x000000000BAF0000-0x000000000BAF1000-memory.dmp
        Download

        memory/3304-9-0x0000000000400000-0x000000000044C000-memory.dmp
        Download

        memory/3304-8-0x000000000BAF0000-0x000000000BAF1000-memory.dmp
        Download

        memory/3304-18-0x0000000000400000-0x000000000044C000-memory.dmp
        Download

        memory/3304-5-0x000000000BAF0000-0x000000000BAF1000-memory.dmp
        Download

        memory/3304-7-0x00000000027B0000-0x0000000002817000-memory.dmp
        Download

        memory/4680-36-0x0000000000400000-0x000000000044C000-memory.dmp
        Download

        memory/4680-34-0x0000000000400000-0x000000000044C000-memory.dmp
        Download

        memory/5904-310-0x0000000000400000-0x000000000044C000-memory.dmp
        Download

        memory/5904-311-0x0000000000400000-0x000000000044C000-memory.dmp
        Download

        memory/6012-315-0x0000000000400000-0x000000000044C000-memory.dmp
        Download

        memory/6012-316-0x0000000000400000-0x000000000044C000-memory.dmp
        Download