General

  • Target

    ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118

  • Size

    166KB

  • Sample

    240615-afwepssarc

  • MD5

    ac29fb1acaa2600f7db1fe9072f9c913

  • SHA1

    dc3913a99092419b69b510fab27d38796b0b82a3

  • SHA256

    89238961a6ae82ba0a84711a3c5920bf8a3b07f74ab0eb6eaa14f4d957a0ed46

  • SHA512

    bbbcec24875cdfd6a7517cd751735d2eb66aa4dc5e681f48d2ceda08e628b85fd6763b1c05df1bf074af23b3307f488330f88f2c095b1f0d124eb2b23e5d3f5a

  • SSDEEP

    3072:1LFrb30BRtBZZg+i2ayy2RjLTuVyu7CJDgoMT3QFMAp3mxUo:ZJ0BXScFy2RsQJ8zgRdm

Malware Config

Extracted

Family

sodinokibi

Botnet

20

Campaign

2656

Decoy

besttechie.com

deprobatehelp.com

mirjamholleman.nl

corona-handles.com

kedak.de

behavioralmedicinespecialists.com

hrabritelefon.hr

iqbalscientific.com

insp.bi

exenberger.at

themadbotter.com

quemargrasa.net

sobreholanda.com

ncid.bc.ca

love30-chanko.com

apolomarcas.com

itelagen.com

pv-design.de

saka.gr

lescomtesdemean.be

Attributes
  • net

    true

  • pid

    20

  • prc

    onenote

    sqbcoreservice

    thebat

    synctime

    ocomm

    firefox

    infopath

    dbeng50

    xfssvccon

    mydesktopqos

    encsvc

    thunderbird

    excel

    mydesktopservice

    tbirdconfig

    ocautoupds

    dbsnmp

    powerpnt

    agntsvc

    sql

    winword

    steam

    msaccess

    mspub

    isqlplussvc

    wordpad

    oracle

    ocssd

    visio

    outlook

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    2656

  • svc

    sql

    mepocs

    veeam

    backup

    memtas

    sophos

    svc$

    vss

Extracted

Path

C:\Users\d5m7js-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension d5m7js. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/78CDBC149E6939F3 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/78CDBC149E6939F3 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: M7zBUphzsRJL1GmDf8l+LYzFNPO9MimYXG0SKMKN/YClzwgqEPGKhEZPbkAXwWpq /9bo/olE7wR6b+XhHeMN9aDRopHAQnY8ptxe35T1qtBfwQ5F5V9KnPEADZ5bqeFh otRlJJOummnnTNMzok7YL1SSztzoLawvlT5Ijph99u5tZBqqBqaPXnyfVrbnHMIA HMcjnQt9IAkpUpTW5hfXRiXLZ/ufKig3xusrA4HSHi1L26mw7UaOyLxDURAKbhMO RwRs3wcRJnQKyr/GxJXC/0IqgmsGloxzzJjl9CbdCjIrQSoAwIRSk2yHRfg9uqG4 j/3gXVovpnaZvCrTqNLmEUg6fVmIdg4Z3vQynE86DR9FdP4ttjAM1nl7+FD11T4i IInEPsn6Ts5hyLA2Y+K64cZ6Wt14r53JBR5Txw9ZgXpS9ipPdP9clhn65sXaQxpp xy7hNTGBAXdZrBvCotngEiM9UltUXx+LWsyHOmUdua2bfH2mXWJTFoGMij/i7wsj mDO7BTqypk02cz5v8AmEre4OLUN1JQMkfd+bRJYS+VZn++gEToYh0zNmomRgfchE Zj7scXFQYc4tOg4wY+qbUgCoZMo9XUxIqqJhLbCIc3hsjKUz4pyYJCbzzJPMw/MU bwTGcFeerCltFwl92ab5DvOam77uPKGvu7A+t0xnWQ/3vXcMZQ0vCu1Prn3X8QS/ jd5khCh90XRhQrCQbeS9tPjONKZS7oObCnBmTsrVZe8Wj0IcV+vCL+RbbN/ABqWy yKcIVoGtGVnekv7RebZJrtO/XGY7tr78XWBFCo2OJzZuMn6FK3Q13bFb4O5wEuaU By/4J4aI/9K+s69fh0nY8uC2juGIU3PESLk9kHAjlc1Arx+27eHq6RnItitna1Ce vTY9cfpkCkxgQ+YYUVY2GUdDLbJxDoz7DksRlddVdKmtzZPi9WZgftM8iMvdRzpk yrELHTyaBI8bsWxOExScc3qQ8flgy0tsqR0qqA9auWk/9imtyNFKiHdarHAIre1M k/N7WS9n1im1zViUUIdUrHQqw+uVmKoAHoH8peRFpcbeS5gDajz714pxlT4WVQeq wsRDSUuMSrwn6BzIVTBCVhJg/6aeWaaCMq+6LRqJbhRKu2Z/bPFQX6aVLyNg9C05 fcoq0jfY8bkpgfnGnXnXDw2sTP7wd3HU6PM1CJQNAJ2su7/CflR7I6gVEHvzsjZ7 WgNxnRsUkfN2K2hn Extension name: d5m7js ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/78CDBC149E6939F3

http://decryptor.cc/78CDBC149E6939F3

Extracted

Path

C:\Users\568x1dii7-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 568x1dii7. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/E7CE522F9C3C013D 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/E7CE522F9C3C013D Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: iTHmojcDzfCUMSOqcc27D2ljHl+TolROb6oxCyFmgX3F1o7ShgB7/S6amtLINuMM Ky5eRxDkXD0BEHC1QTJIpwEFmyDMDzCREHKcJmdMiSn5Frkc2766VU5cwBiv0wgH /qq+HqgnFmNcrnQM1vR/m/JCfR32/C1XMubI4NPUQh66kRurUHGtxuoyAZk5wNuk aMI5nAxiwqV8dswLa1UG21NcGVKKawd7IiAuCSY1u/T6uiTcCxGlBTdr8gu2+h5Y NzR5sT03LXIYiu0ALsq+5Tq7kVz0jUC8pWi0ULbO+9/4tjSzc5Wff9ghFDpPKPQ4 PrTiPh19RpF1mTj/Jww7SQEPBImr8aQJAvVrNpzevm86WznxwaRn8o0EYQr7f2KY qHemoz4FYFdfLGpNJM/N/eDVLYoRQxmlWCNOzse3O5uN5CCsJpn+quqibuypS5SR g8jpTHnWr/ELQ4oT59YJQGohodS0hWFPIboqw4s7BrsuxUCjKdwcX9QHTeg6D+ID iRRPxbu6K6Dq6cQvUcJMVl/RyKieSSHYsEQsEkC1Ue1J2l0l3lM57SyK8SC9Rqg7 6VDzUFymO/Fx69gmk63IYprR0qFF7bUP7Vf9osyuswAv2l4wQmwal4gb4xQmAEZI Y0RvgsmATFKi8y2eaJOJT2m1Ye8zV7sO4+SWC7Jx2pjesO8hbpBDKY/0w+Hc34LU FH/VKmrHDqaFCzXptjRo7XK94jlrYgLLRKmCPMRUALPVduAcFv1Ut3waMa5BmUfr W4PFR5BcBcfHfwWljSBUPwr1bkhIBhjnv/u+k16DniPypBEQ3gITIIQfJ0o5Woav JQa9BB/kplP1k5eKHEeSfdxnN4gmF3jr+Qb1h1roGhBdlrtc8ixDgPsewUWRIMuH Z5UM/cg5vsKdM0zCfKBXpRGZXCiD0JSWIT6chasYieg3UG6ecj8zj7zmduueAWUX PCLdzSvtz5bfiMH4pWkJSITC8cYODHE8EAoiGb3X3ekgkVfoI2oRTqfSIuBKiR4c 0x9tiL36GmgGb/Khs0i4JDYoO6S3l0Vzm5mwtVxAh69KxEcsqBODIkO7a/XOnGPg 6SYTfMjo4M6Cy2eJp7rYxBKN6Kjln+ZMfL2YVwinkibyJtlxPgSp9OSaK3B41SDI 9wuJ9kf8MlZvb6k00lQyIVWGAbpcz1gYtvtIBhUKy5AN8CvLStCqATXclFGIsrBI iY36RHiPPBzHkrMs9WPKzaA1mjYONMio Extension name: 568x1dii7 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/E7CE522F9C3C013D

http://decryptor.cc/E7CE522F9C3C013D

Targets

    • Target

      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118

    • Size

      166KB

    • MD5

      ac29fb1acaa2600f7db1fe9072f9c913

    • SHA1

      dc3913a99092419b69b510fab27d38796b0b82a3

    • SHA256

      89238961a6ae82ba0a84711a3c5920bf8a3b07f74ab0eb6eaa14f4d957a0ed46

    • SHA512

      bbbcec24875cdfd6a7517cd751735d2eb66aa4dc5e681f48d2ceda08e628b85fd6763b1c05df1bf074af23b3307f488330f88f2c095b1f0d124eb2b23e5d3f5a

    • SSDEEP

      3072:1LFrb30BRtBZZg+i2ayy2RjLTuVyu7CJDgoMT3QFMAp3mxUo:ZJ0BXScFy2RsQJ8zgRdm

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

3
T1112

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Impact

Defacement

1
T1491

Tasks