General

  • Target

    b441362b424e8370b25607641aaee053_JaffaCakes118

  • Size

    290KB

  • Sample

    240616-sz5rlasgqq

  • MD5

    b441362b424e8370b25607641aaee053

  • SHA1

    aee5638fcf95b8994863dc265d728a3af995a2ee

  • SHA256

    fa96876c45a2db66ae1265951e104b5c015c983724feb6ce3e0b92618f49bed4

  • SHA512

    0e19e057853cbdc60884de04b9ccf9e042d5354da1dccbf5ac45a19064582ce6407d0c9788612a209a44c11495b0774da2ce0cd23e65b5af5b5e1c0301a969fd

  • SSDEEP

    3072:yCc99moUMXv84IHesgkSx+oN/7KzTKDyOX6wKamrJPlM8dj09br:yCc9wHRtg9xkNq6wK7dq40

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$D/hOr8pZfTXyeVodyREcseBOlXf2dcLmqmQJTa4y2uSfGkhEZXq62

Campaign

4430

Decoy

ravensnesthomegoods.com

lionware.de

nhadatcanho247.com

senson.fi

walkingdeadnj.com

smessier.com

crosspointefellowship.church

extraordinaryoutdoors.com

kisplanning.com.au

4youbeautysalon.com

abogadosadomicilio.es

toponlinecasinosuk.co.uk

crowd-patch.co.uk

teresianmedia.org

kariokids.com

autodemontagenijmegen.nl

321play.com.hk

ceid.info.tr

bowengroup.com.au

antenanavi.com

Attributes
  • net

    false

  • pid

    $2a$10$D/hOr8pZfTXyeVodyREcseBOlXf2dcLmqmQJTa4y2uSfGkhEZXq62

  • prc

    vxmon

    mspub

    wordpad

    beserver

    vsnapvss

    sqbcoreservice

    ocautoupds

    dbsnmp

    CagService

    mydesktopservice

    benetns

    infopath

    tbirdconfig

    DellSystemDetect

    thebat

    isqlplussvc

    ocssd

    mydesktopqos

    steam

    bengien

    raw_agent_svc

    winword

    sql

    onenote

    firefox

    VeeamNFSSvc

    encsvc

    powerpnt

    EnterpriseClient

    outlook

    bedbh

    dbeng50

    synctime

    visio

    xfssvccon

    agntsvc

    excel

    pvlsvr

    VeeamTransportSvc

    VeeamDeploymentSvc

    msaccess

    thunderbird

    ocomm

    oracle

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    4430

  • svc

    ARSM

    vss

    MSExchange

    veeam

    VSNAPVSS

    BackupExecJobEngine

    MVarmor64

    svc$

    PDVFSService

    VeeamNFSSvc

    AcronisAgent

    sql

    CASAD2DWebSvc

    BackupExecAgentAccelerator

    AcrSch2Svc

    MSSQL

    backup

    BackupExecRPCService

    VeeamTransportSvc

    MSSQL$

    BackupExecDiveciMediaService

    MSExchange$

    MVArmor

    BackupExecVSSProvider

    sophos

    BackupExecAgentBrowser

    CAARCUpdateSvc

    VeeamDeploymentService

    mepocs

    WSBExchange

    memtas

    stc_raw_agent

    BackupExecManagementService

    bedbg

Extracted

Path

C:\Users\12av897-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 12av897. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/DF7698E81DC9D4FE 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/DF7698E81DC9D4FE Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: ImCXAewEgWUNIegKLCE5RUfeKqGzW2otPW/+6GGFDl2wvA6S9VnWWWu0r3mJaPSq 3xzBPI8MObTTaoWvK5lm2bEfHZj9Xq3Ci0GLcjcDTbm8ynxlYGMzPT4mkWcCGlUO XjR7c1SGh/qp6TpoFhugL3qG+eAgMkZipVfWqByFn1Z7Rf9p+1dwTk7inN/z6qEa mgEMSwuvXBzPdMa3C+E14Prhh+f1oBYmEo8+n7K6LWmAOWgJNPH8tIjWU2t5A2CS XZ01CVEgW+eWaguyoCqZYJgAiZXBDI4K/gqniHcvvsKA2XzYNrQut/aAqXUBu+ik VtNb4hf0ZiqGWswS/lQTSaeNMYl/27C5hQ/QnSXiQv3v7r6J8xPPbC3ThGZqoeor WXnkwkj+H2qd4KHO7p74lICnOLpQVTQ1zlZjUFdt2JEImAK66/exzgvSBNguPM5c S5MoC03PTQTIe3iGJ6TdOAD5e3Jo1gO/vxdxPNJdQ9K3cODR28CAS6GPqJ/ujSgX bV6TdiGoYkHm7ADgrb/7m4aIVTOO9VoPB9KMjv16Qi+CtIlYayLApLgctwwWDC1K hS7pqxDBOKLU400/z9d2/dWEXeXcCSgHQsfPBxI+uu8CIvVDyQwjiJbHd9Zn//Ua b9euSZ+HTVL7Dqyhdry4RjlYmohguKQ300Aq9nLHmmHWNwI+UnSIZNGyoLKW+djV KIB0AsjVyLf5v0cmWLO33du77adWhtCC+JZtdqMh1YD4vbHSuRPh65lUWKqtmAfR ZacPUna+8NYZE/yjlRJ0KjYllPEMyfWCMAhpXKwY3wXyHWn4Rgc+riVmnfY8X2+z LyZFjQCybl4lAUiakOUtCIAaSc4wcc0u8PIU/S+WfjM4d/Uz/yx2DH3thbZfoUon i+zEveQw80cwbqgRKsrPZu9MiDo1ADCOmif8BYbAtCCpe7fNzOm4v2pkcgebJt4s KdK/I7ai1Hif94xnF7sN5Kjhf8oYMonndtn+9650qhI55ljnZkmO2YnzN5Z7FHt5 Xuc0vqsvZAg7Dj8Y+m88qtjo39iGG6T+De+89QsXyOcMr1vhzcQp29MieoSoVizj /LhrRHDzDc90D+QsywbboTQ6eX/UO+0ctRaT+cNSpV1tzNRulKfOYmuHfJGSYsH/ 2zrJTewKTbXpJgogGcRo0DlGRQkkslgsRGoZza1EaahjtX6xVdjeIXCUmyGq7kRO Wa6UJKsAPqd/+QJqkiqULSPB6umglShgfvS6eVCieeqYxIDz6JPJffLQ40G+4VYb gTZLReZnlZWjAaRwU2emah34dTAaJVxIpvNXA7Sn+y2jxITtuXVciRCl4Spob6tn zVpmZ6ETP4JptBpn8wlPnCzYrw1L+pFniATt4j9QZKhEXQ== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/DF7698E81DC9D4FE

http://decryptor.cc/DF7698E81DC9D4FE

Extracted

Path

C:\Users\480xk-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 480xk. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/52C0A4AE027AABC2 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/52C0A4AE027AABC2 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: rPrCPD+EYGm8NyY56wm4QLLXOaz6yiXDzuizzNG+6haFkJooZJv99NZZnKGq0yho /XVjksmlZtIkQd+MhBTD0/zipVTwwU+qvN/xRSRnE0fSuVsbKUakDhEl1W/rkyiE wi9JSCpCZaxtVSOWM+S5SySU0qRz4tpPAw46sz4ws9Wd7mYr2hIpwVRPuYAaEL8W rCkV6kOjIbJ6PgH1v4DEfASWOrciq0LRipf09KeGjJqZUcyQ/7Fhg5aNB27UX07w sMqQOOJSxCrgzQbSi121KhRsfvJkWKUjsbWHMHhGH1kfpMvGv3e+XUrkxhZ4AJqV SZzIvWHEoQ8Vj6GDl6wF6RnHYJILws67qJy+yJNL0C36oNzAHeh9loSZYuq1lA+L 1edlSfQLDAud2/WKsSCxukjiBQ1LmvxDjfmSH24CL0hRT4BD0Yv6vpXCeWVzizTs FMIT1Qd/rxkDlZBY+QQUtqhHMxkddBZj8w8sK3VtQTUAPKCrSbGvNwLCjJ96i184 2GUDMjtJpD5SVEqL1e2i5chUYMwls24kNr5FImjVw8gEM/JJuwGYh9hBgscc2e7M zJPPZ/wBW19KGwsAN067fS8WmfgxK46kLfleVKsQSnwQ4NhO48yexHhiZJbRAIfo bbIkC8zC89VypNuyPnCt8h8G84ZfYRAEsBfZGcpAsS0rlzcwRj7tsKXs+0LQ7jLN 0OzHMn9CbcQ0bmyveZUcQCXHkOe7YuL2VYm2KsukV6hkKWypSSYC95bt4rj8xiwM A2KmQidp+2PFx9VRYV+aKHvnNCEMxEd/+0Aa6OxvCWgCPnDxSdPaKKhptHGRbLfW u5jKBKadEtA6wZGmf0Iq8oAqFUltoLK/Soar7BvqQZyh+EFeD42+l1jRH6alfvs2 9jiA0RvQ7r2xv5fWj+wUry9aNLNZ2papAFZEqZMnHX1j6C5EBbAMFu0XwPH/x0s1 29EdS5fDojVYVQXdGaZVmEDv9DxKYHREHw9t1CS+okEyE8jjnJ6ke3DOVGLhN5pa VyInMahcNvwCTRg9cw+0VpaAcVGGrs6v4atLIU7G9z333D1EnRUxuohWL62NJKHg sFUHKJDC7fO/tCTP+i+VyjYeFzGepnhhlGEebYqAeZ1Hzt8hhzYq/++Hcbtk86/8 Zuq01xJG2OyGKiCFJJSd1VUj3vXUnuPNYzqK1+vaYbaFZ8E+TqAJXipR/rDply4P ZGRpnzaaJcJCWiJwuaWfdWzdTWteLTSVQWUf42gXTdw6xP0f3QnRGr9afwfyYtCQ BXC6mPi/A0qaBL46i14YIwuwSmgGjUDs8Orf+/6bNlVUdnBIMLSOZ4MP3JYpBVKa /Z6oEC918RNGMVyIKAvuaCwB3kexF0ykCdLjBImWKWYymbwY ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/52C0A4AE027AABC2

http://decryptor.cc/52C0A4AE027AABC2

Targets

    • Target

      b441362b424e8370b25607641aaee053_JaffaCakes118

    • Size

      290KB

    • MD5

      b441362b424e8370b25607641aaee053

    • SHA1

      aee5638fcf95b8994863dc265d728a3af995a2ee

    • SHA256

      fa96876c45a2db66ae1265951e104b5c015c983724feb6ce3e0b92618f49bed4

    • SHA512

      0e19e057853cbdc60884de04b9ccf9e042d5354da1dccbf5ac45a19064582ce6407d0c9788612a209a44c11495b0774da2ce0cd23e65b5af5b5e1c0301a969fd

    • SSDEEP

      3072:yCc99moUMXv84IHesgkSx+oN/7KzTKDyOX6wKamrJPlM8dj09br:yCc9wHRtg9xkNq6wK7dq40

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v13

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Impact

Defacement

1
T1491

Tasks