General

  • Target

    785ba6895dfb23837bba5ef9c84d5c74_JaffaCakes118

  • Size

    114KB

  • Sample

    240527-jbm27sdc96

  • MD5

    785ba6895dfb23837bba5ef9c84d5c74

  • SHA1

    b78c9d56ffd8775b566daccff497dc2672af8cee

  • SHA256

    e8ef7dc54bd782122e3ce1c1ea14c8325dfcd3f6a255d5526c6e2e7624e0f091

  • SHA512

    7d5969afd121f8e9fdad129addfd84485744d9b013e2f8d16a7d5df95a864cab818810617b9c09733699df5732aca0f65275b1f0d4fea24439275e189b30f799

  • SSDEEP

    1536:6Q2auIslFGhFtuAp75WeNMYLoRGp+K6fHICS4AdfG6NlNmraBXZtT:3sI/hqsMYLoRK7bfxl4rI

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$cf6OQuhPB9y1HgqT5kDFDOhFE.ghswbo2IOXOsYe2NaHK7Leb6okO

Campaign

3567

Decoy

tuuliautio.fi

jbbjw.com

julis-lsa.de

ncs-graphic-studio.com

alfa-stroy72.com

hiddencitysecrets.com.au

latribuessentielle.com

ceid.info.tr

ccpbroadband.com

dubscollective.com

manifestinglab.com

truenyc.co

arteservicefabbro.com

cite4me.org

restaurantesszimmer.de

devlaur.com

sairaku.net

katketytaanet.fi

modelmaking.nl

lucidinvestbank.com

Attributes
  • net

    false

  • pid

    $2a$10$cf6OQuhPB9y1HgqT5kDFDOhFE.ghswbo2IOXOsYe2NaHK7Leb6okO

  • prc

    outlook

    dbeng50

    synctime

    ssms

    srv

    sophos

    ocomm

    svc$

    sage

    dbs

    infopath

    xfssvccon

    ocautoupds

    powerpnt

    core

    onenote

    excel

    oracle

    word

    ax32

    w3wp

    exchange

    sql

    msaccess

    pos

    java

    ocssd

    mydesktopqos

    store

    mspub

    visio

    qb

    crm

    thunderbird

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    3567

  • svc

    mepocs

    oracle

    memtas

    quickbooks

    exchange

    vss

    pos

    sage

    backup

    sql

    veeam

    sophos

    qb

    svc$

    crm

Extracted

Path

C:\Recovery\wyj10-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension wyj10. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/B68B416ED737BF2D 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/B68B416ED737BF2D Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 0MW9k7Vw1GI/5Mk8WL3AXbDuynfPHc8xGc6a1u+VezbwYWv5Nr6lupPD/87PO4ML R163hHG3VzjE34kaDlssJuGGx92WOHkIGJ297mT2rHvbL+2YzhUmcJiV5Uf/eXBV gO+fjaZ2mVG3WR6Ue6+oehIsOqBQEWMrSw3wBjaTaxdtH1dzwRCIFgMTDew/mUfa 0VEQ95q5nESvWIM4XDX1QJUwDlfRkfvQa41YXFN8jNt4Zp3LujvYw5Ikd7zmO7M4 BWS91eHDTuiXMuKmajnoaDo3Cayp/RhjnEaAQl9opmSpKU3hbdjrhEpWm85lZFES AEc6UIOI9hIRu+IwB9l8h+oqCBnFddS2MdYAny48/yGkVbL/WMGr1Q6p3/5K6/nx k3ow+WfmaYyF0EbYyop8Ch4giyjWah15cqCcuhBwWnkKHiGIVTj7x9zMazI3gO6M Siv3wmYrMzeUtPMBAiqoabs4uI/SPPtEo8dZggKpc2N25DEcUQpwyJsVDmnYs2Bs okqa0QOnNk+YEI9DYaUK9QwUqyrAYIXeH8ymIgDSLtC4PgqcG8gudWaV7Y3SUU7i iaWZlV/I0G3z9nCiR1YCfmx8w/KbMW6CboQHq+aOcEX7JXoLRdSDfKtlGwI3TVPX NxDfVwsXGIXFzOFuctkF0GFTKrVLrIzmDE+WS0V1G/mzm3z3E7poZneufLGuy8od KjTSgejsDMyGQHmX8vew8AqpePcMtdLPsEOcTsI6JWNGqkM9H+7Q+tgqrGOG69CU Lb9tJzWCapJC/EjnApBLdh61uc+H05IxV5inoXOknzYAXHk1dEPG2hnatmTDB61W SPK1eN+A47VGMTGcx0zPXgpia4bb19dNSIDormEClldSpD5h9D9M7ydmLgWpgev9 EAmidymwRRI2324+LSmcJUfUlijdVWtMePvlkupK1MlqbiKq5Sdrp88+dcjj/PDI 6QaPnoRa+lYQCdTwBndc0tbwyeX8ppDXie9w43DH1mAbki6PC2vPfcLSSKXaWnVC czN85QrjwCkEHxc4vy00xAlI1/tafQ/+rwQoIVIu8JVPG1RstLUWxHuCx/jA78Qg jBumrK3S2bm1i4OvpqsHQOwRGEwQf6aS+9EfaStDi0A+x0wsR6EJSfdEIFJJpLJc offMocwAtM7D/ynfp5sBv6ugxEZ+7a2cxgRJzjw75q5Ke/SNFr1bzpO2BLRmQQNW gbZrM8UBadUSgXnnW9JwU2R4dlyhVfpvj60cAdYL/jQG/OB4z/O6XgzyKf93uNGZ +EvKRj7sAT8sBsVVlHuK/hCUe+XI4cfiT5Noqzw6cziToSgzArE1xFc3JD7OoQOU d07056zuJwCJVhnbL1bB/qYcf/bajrtCXsJfVwpQ Extension name: wyj10 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/B68B416ED737BF2D

http://decryptor.cc/B68B416ED737BF2D

Extracted

Path

C:\Recovery\59icmdv4a7-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension 59icmdv4a7. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/BD9E1C1061F3D5A6 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/BD9E1C1061F3D5A6 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: RLWXvsOmweZWcJ7J00SnW8W2Dzp3Nd+lKIuW2Na4Nkse3OEqv83LkFI88tsU8UDh mMtH0mHRGEJzJD72B3yuDCc7RKexI3vY5JR/8XT7140f1Zi8gsK+QfNtQfUORjvL MBIUfCwvL5etSPotUbNjQDObKyI9BzMiEGmx6xT8R4qgmEE7p1HO5I4M3O8CX9hp E1rbmCGzXE+rhIJg1TMoVl81/nUjxEqkhzKAWBXEbbOLSSaG3MdSV4GKo0hed7WB r/cv1axXua+KVf+J/qpn/VXSUyqaMXK/ocZcUeyExkEkZaIT2pVg6lMrp/ireWUF LnNRo/yos1MN7K3y2wS96i2755E0DjBzAOYi/axKEorYE7P9zBYgXuM6xu9/hgVv tdDFw9mc+lvTCK1Y24XNTq2Nu3ZFN1sYDA1Jo4i0leVlinIdnGSUA8FFOIIijkRR k1jR25LggZuATkTuQDzerV46kD5x0ms2KsS4GG3iivGJXo5CQ163nR0bsfz1eaCS kJ5p8KnaycxIbeE+VzZOUqRtcK11vwShcU1A7TlMo1EM2mfpTHUGGaxG03Lv51LP RXmgikX7T0fDzAwVFpo26ggNIhf7SBwzD/FxjID916gwk01q2OIvLLgoy++jXR7H wkABfD4W7aiqOMko3xlrPJ6wUGJRUhra9nbvDiPAF7T093QGKgtdR/1ANxxECXjG Ik6665gPmaTpPCbc0YtWdSLOAOomMnlrAsjgkqZNgiA4+5oxNHolANMmjvbfy0TS fkRoFJ3Pji5/mu4u09vpKZ9uvzsbt78rlgVyUtcfU2/R/vk0JIlCAivP87XXOAbz +aCJ7rVWpEH/EgJOxugI+PACqQoeTf4KGr6KJGO1fW7B4bdkGFydCrpEmuR2GH+0 7noDQzsHwr+voJfmZYhkIHO6vsUimjAipec52fALiFS8QR/g/6jHGHPbIfWG/Wl7 3XJhuRp8ijcfYagJBhrWqnmAHLz24sx7bslgkCxhLL99lxSMgOwTncXK+1wlnyvf ry2I9rZpBwDXgNtJoHL0iWJ/M/L+fylyuoO2hPFpGAzVTMOLLopPFb2BYQtMeV0U t48GB2e+HNnb/ZwPJbkEtnUu517hMRXPOg6YNaqZfVTzVUsWnLuiC7MXC2CPTlFR iw3bSdJBtqIdEHBqk/sRZFJBcvj0cXr12osZZlOqdCgiM1N2ayki3m5FmYyLGTf5 ORXAezTnVtUySit4ViUOxVPWLaSqgK2WJxi9zuF5Chpw0ZrIiHRwWFyqkVaYbqV0 iO+BRPezB3Zl0cOOn1H/EOQ5dtuFiTixmUMOuLIO1tHAGgN7K3PYmXsa1yvisCZf 1rc1mZT91PL+a08nquIFMLbGFFB/iOmdug4WGbDBKoJicEvz+xYQ9Tj4cXqhIw== Extension name: 59icmdv4a7 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/BD9E1C1061F3D5A6

http://decryptor.cc/BD9E1C1061F3D5A6

Targets

    • Target

      785ba6895dfb23837bba5ef9c84d5c74_JaffaCakes118

    • Size

      114KB

    • MD5

      785ba6895dfb23837bba5ef9c84d5c74

    • SHA1

      b78c9d56ffd8775b566daccff497dc2672af8cee

    • SHA256

      e8ef7dc54bd782122e3ce1c1ea14c8325dfcd3f6a255d5526c6e2e7624e0f091

    • SHA512

      7d5969afd121f8e9fdad129addfd84485744d9b013e2f8d16a7d5df95a864cab818810617b9c09733699df5732aca0f65275b1f0d4fea24439275e189b30f799

    • SSDEEP

      1536:6Q2auIslFGhFtuAp75WeNMYLoRGp+K6fHICS4AdfG6NlNmraBXZtT:3sI/hqsMYLoRK7bfxl4rI

    Score
    10/10
    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Matrix ATT&CK v13

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Tasks