sage | 62cce749fcfaf6ffc33593f37510701268d21d75f09d15a2d8545f341a4426d8

Analysis

max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/10/2026, 04:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Ransom.Win32.SageCrypt.pf.exe
Size 284KB
Sample261016-exvxqahs3k
SHA256 62cce749fcfaf6ffc33593f37510701268d21d75f09d15a2d8545f341a4426d8
MD5 b6f9526abb8fbbdc3f63654300bcaa85
SHA1 dfcbc26fb819ccc7d78c50f101249e5f9157363f
SHA512 cc86627329053bc5b10ce2945d7a44b104ae1ec52a82a0e7302d4cc3f0faefe6074832203d1d1c219eb3b796973879d5dec13ffc616bfec40a2946ed1cbead18
SSDEEP 6144:yafhocQU4+KIO+8Ui89KfR4LLoz7z1lIY7:B5QUYIO70KZqcXIY
TLSH
T1D6540615BA90FC1EE4271631DCE19AF01629BE26CFA0080B7B547F3A3535D4059EEEE6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution sage persistence ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Documents\!HELP_SOS.hta

Ransom Note

<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>Decryption Instructions</title> <HTA:APPLICATION ID='App' APPLICATIONNAME="Decryption Instructions" SCROLL="yes" SINGLEINSTANCE="yes" WINDOWSTATE="maximize"> <style> a { color: #04a; text-decoration: none; } a:hover { text-decoration: underline; } body { background-color: #e7e7e7; color: #222; font-family: "Lucida Sans Unicode", "Lucida Grande", sans-serif; font-size: 12pt; line-height: 16pt; } body, h1 { margin: 0; padding: 0; } h1 { color: #555; text-align: center; padding-bottom: 1.5em; } h2 { color: #555; text-align: center; } ol li { padding-bottom: 13pt; } .container { background-color: #EEE; border: 2pt solid #C7C7C7; margin: 3%; min-width: 600px; padding: 5% 10%; color: #444; } .filecontainer{ padding: 5% 10%; display: none; } .header { border-bottom: 2pt solid #c7c7c7; padding-bottom: 5%; } .hr { background: #bda; display: block; height: 2pt; margin-top: 1.5%; margin-bottom: 1.5%; overflow: hidden; width: 100%; } .key{ background-color: #A1D490; border: 1px solid #506A48; display: block; text-align: center; margin: 0.5em 0; padding: 1em 1.5em; word-wrap: break-word; } .keys{ margin: 3em 0; } .filename{ border: 3px solid #AAA; display: block; text-align: center; margin: 0.5em 0em; padding: 1em 1.5em; background-color: #DCC; } .us{ text-decoration: strong; color: #333; } .info{ background-color: #E4E4E4; padding: 0.5em 3em; margin: 1em 0; } .text{ text-align: justify; } #file{ background-color: #FCC; } .lsb{ display: none; margin: 3%; text-align: center; } .ls{ border: 1px solid #888; border-radius: 3px; padding: 0 0.5em; margin: 1em 0.1em; } .ls:hover{ background-color: #D0D0D0; } .l{ display:none; } </style> <script language="vbscript"> Function GetCmd GetCmd = App.commandLine End Function </script> <script language="javascript"> function openlink(url){ new ActiveXObject("WScript.Shell").Run(url); return false; } function aIndexOf(arr, v){ for(var i = 0; i < arr.length; i++) if(arr[i] == v) return i; return -1; } function tweakClass(cl, f){ var els; if(document.getElementByClassName != null){ els = document.getElementsByClassName(cl); } else{ els = []; var tmp = document.getElementsByTagName('*'); for (var i = 0; i < tmp.length; i++){ var c = tmp[i].className; if( (c == cl) || ((c != '') && ((' '+c+' ').indexOf(' '+cl+' ') != -1)) ) els.push(tmp[i]); } } for(var i = 0; i < els.length; i++) f(els[i]); } var langs = ["en","de","it","pt","es","fr","kr","nl","ar","fa","zh"]; function setLang(lang){ if(aIndexOf(langs, lang) == -1) lang = langs[0]; for(var i = 0; i < langs.length; i++){ var clang = langs[i]; tweakClass('l-'+clang, function(el){ el.style.display = (clang == lang) ? 'block' : 'none'; }); tweakClass('ls-'+clang, function(el){ el.style.backgroundColor = (clang == lang) ? '#BBB' : ''; }); } } function onPageLoaded(){ try{ tweakClass('lsb', function(el){ el.style.display = 'block'; }); }catch(e){} try{ setLang(en); }catch(e){} try{ var args = GetCmd().match(/"[^"]+"|[^ ]+/g); if(args.length > 1){ var file = args[args.length-1]; if(file.charAt(0) == '"' && file.charAt(file.length-1) == '"') file = file.substr(1, file.length-2); document.getElementById('filename').innerHTML = file; document.getElementById('file').style.display = 'block'; document.title = 'File is encrypted'; } }catch(e){} } </script> </head> <body onload='javascript:onPageLoaded()'> <div class='lsb'> <span class='ls ls-en' onclick="javascript:return setLang('en')">English</span> <span class='ls ls-de' onclick="javascript:return setLang('de')">Deutsch</span> <span class='ls ls-it' onclick="javascript:return setLang('it')">Italiano</span> <span class='ls ls-pt' onclick="javascript:return setLang('pt')">Português</span> <span class='ls ls-es' onclick="javascript:return setLang('es')">Español</span> <span class='ls ls-fr' onclick="javascript:return setLang('fr')">Français</span> <span class='ls ls-kr' onclick="javascript:return setLang('kr')">한국어</span> <span class='ls ls-nl' onclick="javascript:return setLang('nl')">Nederlands</span> <span class='ls ls-ar' onclick="javascript:return setLang('ar')">العربية</span> <span class='ls ls-fa' onclick="javascript:return setLang('fa')">فارسی</span> <span class='ls ls-zh' onclick="javascript:return setLang('zh')">中文</span> </div> <div id='file' class='container filecontainer'> <div class='filename'> <div style='float:left; padding:18px 0'><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAADEAAABACAYAAACz4p94AAAABmJLR0QA/wD/AP+gvaeTAAAACXBIWXMAARCQAAEQkAGJrNK4AAAAB3RJTUUH4QEcFBoaYAOrHQAABThJREFUaN7tmlloXGUUx3/3ziRtTa2xcZ1gtaJFDFjtwSqllaKiiEilKOKDNS2UivXF+qD0QRBRUMQXN/TBBcFifahYFC0urfpghSMqaDSkdQMvojZpIk2zTMaHe776MZ17M6u9ozkwzAwz3/ed/9m+s9yABkhEUFX/+43ATcBy4FxgMdABTAB/Aj8CXwO7VfVdb10AlPy9aqGgTuYDVS3Z56XA48AtdWz1OrBdVQ82AiaoVfJATlWLIrIAeAbYWKciS975LwJ3q+pEJQ03DYRJKVDVGRFZCew0kylnqFaaAULgB+B2Vd1fru3ZKFcDAFS1JCLXA7uBMxs1S29t0fzn5kKhMBBF0WAURYgIURQ1DsIAhKaBVcAbwKk0l0JgGlgIrCkUChpF0U/VAgmrOCBvPrAEeBY4jdZQ3jRyDvCEiJxl2ne+mLowTQs5VZ0yJ95mobMaRx0A3gMGgSPAycCFwHXARQlrfKFeDjwMbG7IsT0zKorIauBtYFGFvxY9s3wZ2Kaqwyn7dgNPpkQ1t9/PwGZV3TNbxErThAOwCOhPADBtexwGNqrqrrR4bxFnBNgkIm8CrwFdCX66BNgA7KlLE2aDeVWdFpHlwPsVfMEBGAXuUtUd1YRGH6CIrLdAESZoYxC4Q1U/r8exQwMQAFdb+CuP7U6LO6oF4MK0d+47ZlpJfJ0HXFsm3OpB2HsPsCZBUtgF9VSZo85KFq7zqnrUTOq3ChYyA3QCq7x1NYFwZnYKsKJCFOqwz59YJKo5VTAmAQ4CuxKiHUCviCyryZzMhIqeOnsSDh8B9qnqTJqU0kKyAT8MfJwiyB5gWa0+ETjGgPOBeQkSGgG+rPdmM99wfjUEHEoA0Q0srRmEaSRv+VFHAogx84lGyO01ChxI+E8XcHq9aUdnhahU8uL471bszJoWVEFHbL8kHhfXCyIE5qesGXX+UW9F5mli0jSbRPMaAdGZ8vtUtSG1ykg1mXIRdzaaxVYjSU7kPmFKaAsq5DW+dBY2WAyV89GV8ntXran4tGfzW4B7K0grAI5WMIF6zAjgD2ATsDXhrPFaGwGZJhE59jrOPMraMIuBK4EzTFqlE8x7YNr6TFUP+dkwQCAiobuhRWQt8DTQl2FlfAtsVdW9DoyviUeA7U1owbSSfL4eU9UHjlVRInI/8FDGATizcvytLhQKQRRFewMRuQJ4y+y/Xcg13IaA/tBCWxftRe5+uwC4NQTWzpabZFgbAFeF1qzKtSEIp40+l+QFtC91hvwHaA7E/xlEKesgZrz6u19VA/eytH64FUGkmSCKtt8XwKWq+opL0GxE8AKwknh6mkkQ03bXRMTT0F9d7m/pfdGy5SHgPtclyRoIZyLfAR95APC6If4A5sOsgfB7UQe88jbJoceI+6+ZdeyOKrWWzxqIwJN+H/F8rlJDzR8XrMiyT1wM3OnX7V797oBeQzxYbF6lJCLTTcpi3fhrBNiiqjsrNCBuIx5Ozs+qT+SJW5vdxHPoS3yHlrjH8nyzAbTCsZ1ZjfPPoMa/DMdpAc0lgHMg2gREqcxPSrSoHdoqx+4Ceu3Sc4x3c/wkNpMgclZT9AIPisjZFl57gUeZZeKThcuuvDhyAppsFfOt9gl/385/w7FLtDmFwF9ebdxO5IQ/HBIPLabaGMT+kLitP9GGAELi4ecHIfAqyc9VZJWc+SvwUi6KorFCofANsA44qQ0AuEfrfgHuUdWB0IqWT4Ebml3At4hywPfAelXd5y47sIfY7XbdQNytuwxYkCHmR4GvgOfcM4fGL38Dzdjo/H/3PFAAAAAASUVORK5CYII=" style='padding:0 7.5px'/></div> <div> <h2 class='l l-en' style='display:block'>The file is encrypted but can be restored</h2> <h2 class='l l-de' >Die Datei ist verschlüsselt, aber kann wiederhergestellt werden</h2> <h2 class='l l-it' >Il file è crittografato, ma può essere ripristinato</h2> <h2 class='l l-pt' >O arquivo está criptografado, mas poderá ser descriptografado</h2> <h2 class='l l-es' >El archivo está encriptado pero puede ser restaurado</h2> <h2 class='l l-fr' >Le fichier est crypté mais peut être restauré</h2> <h2 class='l l-kr' >파일은 암호화되었지만 복원 할 수 있습니다</h2> <h2 class='l l-nl' >Het bestand is versleuteld maar kan worden hersteld</h2> <h2 class='l l-ar' > الملف مشفر لكن من الممكن إسترجاعه </h2> <h2 class='l l-fa' >این فایل رمزگذاری شده است اما می تواند بازیابی شود</h2> <h2 class='l l-zh' >文件已被加密，但是可以解密</h2> <p><span id='filename'></span></p> </div> </div> <h2>The file you tried to open and other important files on your computer were encrypted by "SAGE 2.2 Ransomware".</h2> <h2>Action required to restore your files.</h2> </div> <div class='container'> <div class="text l l-en" style='display:block'> <h1>File recovery instructions</h2> <p>You probably noticed that you can not open your files and that some software stopped working correctly.</p> <p>This is expected. Your files content is still there, but it was encrypted by <span class='us'>"SAGE 2.2 Ransomware"</span>.</p> <p>Your files are not lost, it is possible to revert them back to normal state by decrypting.</p> <p>The only way you can do that is by getting <span class='us'>"SAGE Decrypter"</span> software and your personal decryption key.</p> <div class='info'> <p>Using any other software which claims to be able to restore your files will result in files being damaged or destroyed.</p> </div> <p>You can purchase <span class='us'>"SAGE Decrypter"</span> software and your decryption key at your personal page you can access by following links:</p> <div class='keys'> <div class='key'> <a href="http://7gie6ffnkrjykggd.3io74zx.com/login/ARf-EFwuLjVz660Mjm40Wf3zOBNP4faIpI-7gGfVNSTrKCw92lFN0kvA" onclick='javascript:return openlink(this.href)'>http://7gie6ffnkrjykggd.3io74zx.com/</a> </div> </div> <p>If you are asked for your personal key, copy it to the form on the site. This is your personal key:</p> <div class='keys'> <div class='key'> ARf-EFwuLjVz660Mjm40Wf3zOBNP4faIpI-7gGfVNSTrKCw92lFN0kvA </div> </div> <p>You will also be able to decrypt one file for free to make sure "SAGE Decrypter" software is able to recover your files</p> <div class='info'> <p>If none of those links work for you for a prolonged period of time or you need your files recovered as fast as possible, you can also access your personal page using "Tor Browser".</p> <p>In order to do that you need to:</p> <ol> <li>open Internet Explorer or any other internet browser;</li> <li>copy the address <a href='https://www.torproject.org/download/download-easy.html.en' onclick='javascript:return openlink(this.href)'>https://www.torproject.org/download/download-easy.html.en</a> into address bar and press "Enter";</li> <li>once the page opens, you will be offered to download Tor Browser, download it and run the installator, follow installation instructions;</li> <li>once installation is finished, open the newly installed Tor Browser and press the "Connect" button (button can be named differently if you installed non-English version);</li> <li>Tor Browser will establish connection and open a normal browser window;</li> <li>copy the address <div class='key'>http://7gie6ffnkrjykggd.onion/login/ARf-EFwuLjVz660Mjm40Wf3zOBNP4faIpI-7gGfVNSTrKCw92lFN0kvA</div> into this browser address bar and press "Enter";</li> <li>your personal page should be opened now; if it didn't then wait for a bit and try again.</li> </ol> <p>If you can not perform this steps then check your internet connection and try again. If it still doesn't work, try asking some computer guy for help in performing this steps for you or look for some video guides on <a href='https://www.youtube.com/results?search_query=tor+browser+install' onclick='javascript:return openlink(this.href)'>YouTube</a>.</p> </div> <div class='info'> <p>You can find a copy of this instruction in files named "!HELP_SOS" stored next to your encrypted files.</p> </div> </div> <div class="text l l-de" > <h1>Anleitung zur Dateiwiederherstellung</h2> <p>Sie haben sicherlich gemerkt, dass Sie Ihre Daten nicht öffnen können und dass Programme nicht mehr ordnungsgemäß funktionieren.</p> <p>Dies ist zu erwarten. Die Dateiinhalte existieren noch, aber wurden mit {us_enc}} verschlüsselt.</p> <p>Ihre Daten sind nicht verloren. Es ist möglich, sie mit Hilfe von Entschlüsselung in ihren Originalzustand zurückzuversetzen.</p> <p>Die einzige Möglichkeit das zu tun, ist die Verwendung von <span class='us'>"SAGE Decrypter"</span> Software und Ihr persönlicher Entschlüsselungskey.</p> <div class='info'> <p>Das Verwenden von anderer Software, die angeblich ihre Daten wiederherstellen kann, wird dazu führen, dass Ihre Daten beschädigt oder zerstört werden.</p> </div> <p>Sie können die <span class='us'>"SAGE Decrypter"</span> Software und Ihren Entschlüsselungskey auf Ihrer persönlichen Seite erwerben, indem Sie diesen Links folgen:</p> <div class='keys'> <div class='key'> <a href="http://7gie6ffnkrjykggd.3io74zx.com/login/ARf-EFwuLjVz660Mjm40Wf3zOBNP4faIpI-7gGfVNSTrKCw92lFN0kvA" onclick='javascript:return openlink(this.href)'>http://7gie6ffnkrjykggd.3io74zx.com/</a> </div> </div> <p>Falls Sie nach ihrem persönlichen Key gefragt werden, kopieren Sie ihn in das Formular auf dieser Seite. Dies ist Ihr persönlicher Key:</p> <div class='keys'> <div class='key'> ARf-EFwuLjVz660Mjm40Wf3zOBNP4faIpI-7gGfVNSTrKCw92lFN0kvA </div> </div> <p>Sie können eine Datei gratis entschlüssen, um sicher zu sein, dass die "SAGE Decrypter" Software ihre Daten wiederherstellen kann</p> <div class='info'> <p>Falls keine dieser Links über einen längeren Zeitraum funktionieren sollten oder Sie Ihre Daten so schnell wie möglich wiederherstellen müssen, können Sie Ihre persönliche Seite mit Hilfe des "Tor Browser" aufrufen.</p> <p>Dazu benötigen Sie:</p> <ol> <li>Öffnen Sie den Internet Explorer oder einen anderen Internetbrowser;</li> <li>Kopieren Sie diese Adresse <a href='https://www.torproject.org/download/download-easy.html.en' onclick='javascript:return openlink(this.href)'>https://www.torproject.org/download/download-easy.html.en</a> in die Adressleiste und drücken Sie "Enter";</li> <li>So bald sich die Seite öffnet, wird Ihnen der Download des Tor Browser angeboten. Laden Sie ihn herunter und führen Sie die Installation aus, indem Sie den Installationsanweisungen folgen;</li> <li>Wenn die Installation abgeschlossen ist, öffnen Sie den soeben installierten Tor Browser und drücken Sie den "Connect" Knopf (Der Namen kann abweichen, falls Sie eine nicht-englische Version installiert haben);</li> <li>Tor Browser wird eine Verbindung herstellen und ein normales Browserfenster öffnen;</li> <li>Kopieren Sie die Adresse <div class='key'>http://7gie6ffnkrjykggd.onion/login/ARf-EFwuLjVz660Mjm40Wf3zOBNP4faIpI-7gGfVNSTrKCw92lFN0kvA</div> in die Browseradressleiste und drücken Sie "Enter";</li> <li>Ihre persönliche Seite sollte sich nun geöffnet haben; falls nicht: Warten Sie eine Weile und versuchen Sie es erneut.</li> </ol> <p>Falls Sie nicht in der Lage sind, diese Schritte durchzuführen, überprüfen Sie Ihre Internetverbindung. Wenn es noch immer nicht funktioniert, fragen Sie jemanden, der sich mit Computern auskennt, um diese Schritte durchzuführen oder schauen Sie sich einige Videoanleitungen auf {a_youtube}} an.</p> </div> <div class='info'> <p>Sie finden eine Kopie dieser Anleitung in einer Datei namens "!HELP_SOS" neben Ihren verschlüsselten Daten.</p> </div> </div> <div class="text l l-it" > <h1>Istruzioni per il recupero dei file</h2> <p>Probabilmente hai notato che non puoi più aprire i tuoi file e alcuni software hanno smesso di funzionare correttamente.</p> <p>Questo era previsto. I tuoi file si trovano ancora al loro posto, ma sono stati crittografati da <span class='us'>"SAGE 2.2 Ransomware"</span>.</p> <p>I tuoi file non sono persi, è possibile farli tornare al loro stato normale eseguendo una decrittazione.</p> <p>L'unico modo in cui è possibile farlo è scaricare il software <span class='us'>"SAGE Decrypter"</span> e la tua chiave personale di decrittazione.</p> <div class='info'> <p>Utilizzando un qualsiasi altro software che sostiene di essere in grado di ripristinare i tuoi file, li danneggerà o distruggerà per sempre.</p> </div> <p>È possibile acquistare il software <span class='us'>"SAGE Decrypter"</span> e la tua chiave di decrittazione nella tua pagina personale a cui puoi accedere d

Signatures

Family: Sage
Sage is a ransomware that has been active since 2020.
ransomware sage
Contacts a large (7716) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.pf.exe
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	anzkKiqD.exe

Executes dropped EXE 4 IoCs

pid	Process
928	anzkKiqD.exe
6128	anzkKiqD.exe
5348	anzkKiqD.exe
5228	anzkKiqD.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
4936	WScript.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Bcq.bmp"	anzkKiqD.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\Desktop\Wallpaper	anzkKiqD.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4128	cmd.exe
2948	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.pf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	anzkKiqD.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	anzkKiqD.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.pf.exe

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.pf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	anzkKiqD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	anzkKiqD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.pf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	anzkKiqD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	anzkKiqD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2832	PING.EXE
5224	PING.EXE

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\Desktop	anzkKiqD.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT	anzkKiqD.exe
Key created	\REGISTRY\USER\S-1-5-19	anzkKiqD.exe
Key created	\REGISTRY\USER\S-1-5-20	anzkKiqD.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\sage.notice\DefaultIcon	anzkKiqD.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\sage.notice\FriendlyTypeName	anzkKiqD.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\sage.notice\shell	anzkKiqD.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\.sage	anzkKiqD.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\.sage\ = "sage.notice"	anzkKiqD.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\sage.notice\shell\open\command	anzkKiqD.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\sage.notice\shell\open\command\ = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\f1.hta\" \"%1\""	anzkKiqD.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\sage.notice	anzkKiqD.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\sage.notice\DefaultIcon\ = "%WinDir%\\SysWow64\\shell32.dll,47"	anzkKiqD.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\sage.notice\FriendlyTypeName\ = "encrypted by SAGE"	anzkKiqD.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\sage.notice\shell\open	anzkKiqD.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\htafile	anzkKiqD.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings	anzkKiqD.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\htafile\DefaultIcon	anzkKiqD.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\htafile\DefaultIcon\ = "%WinDir%\\SysWow64\\shell32.dll,44"	anzkKiqD.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
2832	PING.EXE
5224	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5848	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5348	anzkKiqD.exe
5348	anzkKiqD.exe
5348	anzkKiqD.exe
5348	anzkKiqD.exe
5348	anzkKiqD.exe
5348	anzkKiqD.exe
5348	anzkKiqD.exe
5348	anzkKiqD.exe
5348	anzkKiqD.exe
5348	anzkKiqD.exe
5348	anzkKiqD.exe
5348	anzkKiqD.exe
5348	anzkKiqD.exe
5348	anzkKiqD.exe
5348	anzkKiqD.exe
5348	anzkKiqD.exe
5348	anzkKiqD.exe
5348	anzkKiqD.exe
5348	anzkKiqD.exe
5348	anzkKiqD.exe
5348	anzkKiqD.exe
5348	anzkKiqD.exe
5348	anzkKiqD.exe
5348	anzkKiqD.exe
5348	anzkKiqD.exe
5348	anzkKiqD.exe
5348	anzkKiqD.exe
5348	anzkKiqD.exe
5348	anzkKiqD.exe
5348	anzkKiqD.exe
5348	anzkKiqD.exe
5348	anzkKiqD.exe
5348	anzkKiqD.exe
5348	anzkKiqD.exe
5348	anzkKiqD.exe
5348	anzkKiqD.exe
5348	anzkKiqD.exe
5348	anzkKiqD.exe
5348	anzkKiqD.exe
5348	anzkKiqD.exe
5348	anzkKiqD.exe
5348	anzkKiqD.exe
5348	anzkKiqD.exe
5348	anzkKiqD.exe
5348	anzkKiqD.exe
5348	anzkKiqD.exe
5348	anzkKiqD.exe
5348	anzkKiqD.exe
5348	anzkKiqD.exe
5348	anzkKiqD.exe
5348	anzkKiqD.exe
5348	anzkKiqD.exe
5348	anzkKiqD.exe
5348	anzkKiqD.exe
5348	anzkKiqD.exe
5348	anzkKiqD.exe
5348	anzkKiqD.exe
5348	anzkKiqD.exe
5348	anzkKiqD.exe
5348	anzkKiqD.exe
5348	anzkKiqD.exe
5348	anzkKiqD.exe
5348	anzkKiqD.exe
5348	anzkKiqD.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4560 wrote to memory of 5760	4560	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.pf.exe	88
PID 4560 wrote to memory of 5848	4560	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.pf.exe	89
PID 928 wrote to memory of 6128	928	anzkKiqD.exe	97
PID 4560 wrote to memory of 5348	4560	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.pf.exe	99
PID 4560 wrote to memory of 2948	4560	jaffacakes118_Trojan-Ransom.Win32.SageCrypt.pf.exe	100
PID 2948 wrote to memory of 2832	2948	cmd.exe	102
PID 5348 wrote to memory of 5228	5348	anzkKiqD.exe	104
PID 5348 wrote to memory of 6124	5348	anzkKiqD.exe	115
PID 5348 wrote to memory of 4936	5348	anzkKiqD.exe	116
PID 5348 wrote to memory of 4852	5348	anzkKiqD.exe	117
PID 5348 wrote to memory of 4128	5348	anzkKiqD.exe	118
PID 4128 wrote to memory of 5224	4128	cmd.exe	122

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Ransom.Win32.SageCrypt.pf.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Ransom.Win32.SageCrypt.pf.exe"
1⤵
- Checks computer location settings
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Ransom.Win32.SageCrypt.pf.exe
  "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Ransom.Win32.SageCrypt.pf.exe" g
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5760
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /CREATE /TN "DCz61mgY" /TR "C:\Users\Admin\AppData\Roaming\anzkKiqD.exe" /SC ONLOGON /RL HIGHEST /F
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:5848
- C:\Users\Admin\AppData\Roaming\anzkKiqD.exe
  "C:\Users\Admin\AppData\Roaming\anzkKiqD.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Sets desktop wallpaper using registry
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5348
- - C:\Users\Admin\AppData\Roaming\anzkKiqD.exe
    "C:\Users\Admin\AppData\Roaming\anzkKiqD.exe" g
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5228
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\!HELP_SOS.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6124
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f1.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - System Location Discovery: System Language Discovery
    PID:4936
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /DELETE /TN /F "DCz61mgY"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4852
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\__config16184093.bat"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4128
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5224
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\__config252888.bat"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2948
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2832

C:\Users\Admin\AppData\Roaming\anzkKiqD.exe
C:\Users\Admin\AppData\Roaming\anzkKiqD.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:928
- C:\Users\Admin\AppData\Roaming\anzkKiqD.exe
  "C:\Users\Admin\AppData\Roaming\anzkKiqD.exe" g
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6128

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x308 0x40c
1⤵
PID:5976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

__config16184093.bat

Path C:\Users\Admin\AppData\Local\Temp\__config16184093.bat
Size 218B
SHA256 74882629d5ae235b532156bf3e9d93fd008e944e8872800ea2762e742023d337
MD5 0e15168c8aaf7ad9075b044fb0d16b58
SHA1 f9ec411cdd74a3e7091053d3dfc43f6e950c1d4b
SHA512 83630ea5f6c06212ea88399d1b6a172fedca76a6b09d0ccaef5ba7035557d7913a402e411d3e9a9c14966a1d7ea3724c22eacd9dfbc6b7ca5478909d357e2fca
TLSH
T1B7D0A72202C4C2BD594141B347B6704EC0718A513F847059D6104BCE73AA404B257CD0
MD5 SHA1 SHA512 TLSH

Submit Download

__config252888.bat

Path C:\Users\Admin\AppData\Local\Temp\__config252888.bat
Size 227B
SHA256 6df5f858b2fb17d06ecc4936f79b5c6ca4b4dd87372db44b6758795e0f618c5d
MD5 45bdca6bebdb8e723b9eea97e3985268
SHA1 c3b910391ba3676771123abe6b5cd0a5c7867966
SHA512 b3428d24fa2090f558f981b1a8311d467ebef511fb23b0fc8418e1d929818da42c2b52d04c267451e014e9f59e3d7a4d4d91d1f4fc47c8ce41a5920c69cb23ea
TLSH
T143D0A712C2CA826A0944739B05B5D45CC074D82C2F8E3B71C6A4845D736640DF287BC4
MD5 SHA1 SHA512 TLSH

Submit Download

f1.vbs

Path C:\Users\Admin\AppData\Local\Temp\f1.vbs
Size 3KB
SHA256 9a55ac3ff3c115b686c19da0a88a9e7525aa62d49c69b107addf8efd33a16215
MD5 4c999bbfddd5513d08d2d414c92ac2f4
SHA1 23e40ea4b75dc037a5cdfce521826737090dce09
SHA512 7b48cbff08a98f273afb78262167030395fab421718df559625867b91f98fbb0eb0152e8002568428086d1bd3f03f9c9ab26fdabdf9e33ffcea8f5c56529b944
TLSH
T116616B1E3E64F17D099351C5272AC111F71ABDEE62020E87940ED4587B1A2A72FE39FE
MD5 SHA1 SHA512 TLSH

Submit Download

0Aac9bqj.tmp

Path C:\Users\Admin\AppData\Roaming\0Aac9bqj.tmp
Size 65B
SHA256 de71f40d53dc5338545adccad74d0cd729b36be7d236ec7dea5880ba641cae85
MD5 dcf0615f7f413d47e7915316e34f3b11
SHA1 c754860e5333138c322e82b8b280f0fd96c6d874
SHA512 aa9485c2bbd5788b25bf2240150562d2593470bc502f657cb031604ed9c12e5055b64de818dc37107c12f7d166ff2fa4171731fd3df9ee8766fd6d3d26c1a175
TLSH
T1C8A022F00202E000080F30A8020000C0802AC0E302C28E0280CEA2BBC0B822820C30B2
MD5 SHA1 SHA512 TLSH

Submit Download

anzkKiqD.exe

Path C:\Users\Admin\AppData\Roaming\anzkKiqD.exe
Size 284KB
SHA256 62cce749fcfaf6ffc33593f37510701268d21d75f09d15a2d8545f341a4426d8
MD5 b6f9526abb8fbbdc3f63654300bcaa85
SHA1 dfcbc26fb819ccc7d78c50f101249e5f9157363f
SHA512 cc86627329053bc5b10ce2945d7a44b104ae1ec52a82a0e7302d4cc3f0faefe6074832203d1d1c219eb3b796973879d5dec13ffc616bfec40a2946ed1cbead18
SSDEEP 6144:yafhocQU4+KIO+8Ui89KfR4LLoz7z1lIY7:B5QUYIO70KZqcXIY
TLSH
T1D6540615BA90FC1EE4271631DCE19AF01629BE26CFA0080B7B547F3A3535D4059EEEE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

!HELP_SOS.hta

Path C:\Users\Admin\Documents\!HELP_SOS.hta
Size 49KB
SHA256 800c1ee7d267047ddbd5bdeb7ff2f34d0c92cd31e34236897ae4574ec0d24810
MD5 b13aa056f1090ab57a49d02551c072b7
SHA1 a2d902ed85210f10993ef6cc2fece51447728b31
SHA512 63fb40dfef4a4e624f2b2a62315dd59e67e903c5f3d88aa5fe1add6ca706f9947f77ea17280081ae3b5f97d18b9c379f55c9975737b81da595a97d1229c5e955
SSDEEP 1536:wJcj35c34fShMJkRVDiNUfSD8+5opGIL8PJGhKSNncjkjPgdg1:wWcofShMJkRVDiNYSD8+5opbL8PkZlc0
TLSH
T13C331AA16A8DDCB3178347C761B5B219F07F6E75C203D612F6BB472420D2A51BA1E873
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FormatWatch.html...

Path C:\Users\Admin\Downloads\FormatWatch.html...
Size 896KB
SHA256 511fabbbe1c8c0efd521accb8439275f695bd82b32c0c033d52a7aaa26a781d3
MD5 acc93fe7e4da28291b3ff1d5855782a5
SHA1 6ec0951d7c8e80ac67889d872bf1d40ba630de8c
SHA512 12f19858828302e27fbed58817ff6a3862f2f58115d187d80e9fb2ecf11b968d64ea35db3da3ebc0884168c94901036ccb4de647282c4bb39b746f6f3b719e8a
SSDEEP 24576:gsysF3H1mx/iFr0jB0lEFwCVivwBXYf/ZrUkTyr:1FGamjBwaFVkwKfByr
TLSH
T1DC1533D616F5563F8D18204B34B5B1DF092B16A3A7930B3AB437CF2E2876D8ABDC2445
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ResolveReset.xml...

Path C:\Users\Admin\Downloads\ResolveReset.xml...
Size 810KB
SHA256 a464738e61328bdd1463ed0046c37502ae6927d4ace39d4dfb5196dd0af16f41
MD5 e5e4b913bf93f6856ea3569d9617f90e
SHA1 fda03fa48a382b3e6b9044b4ab12bff2d34399be
SHA512 39f34b7efa432ea4211b5b3413e556d73727cf4af9d746af32cff07a6b5eddc5bb6ef5ea058d5634847e1dcdb6dc43d8a2f11203d271990c2d5756945d513518
SSDEEP 24576:s/AB7/Ie7KuotKRgpN0Sfl71WTn9rbzgfzoakhyOesa:s/AVD7Kz1pNDJMVvgfuhyOXa
TLSH
T1A205230A2A4E16BD5EF0E6279347C5AA6070BE82EFFD2D138AE113D644E452323F5477
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/928-11-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/928-13-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/4560-2-0x0000000002310000-0x0000000002311000-memory.dmp

Download

memory/4560-17-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/4560-1-0x0000000002310000-0x0000000002311000-memory.dmp

Download

memory/4560-4-0x0000000002310000-0x0000000002311000-memory.dmp

Download

memory/4560-0-0x00000000021D0000-0x0000000002250000-memory.dmp

Download

memory/4560-3-0x00000000021D0000-0x0000000002250000-memory.dmp

Download

memory/4560-5-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/5228-26-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/5228-24-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/5348-27-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/5348-25-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/5348-21-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/5348-318-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/5348-335-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/5760-19-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/5760-8-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/6128-18-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/6128-16-0x0000000000400000-0x000000000044D000-memory.dmp

Download