Overview

overview

10

Static

static

3

b441362b42...18.exe

windows7-x64

10

b441362b42...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    121s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    16-06-2024 15:34

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b441362b424e8370b25607641aaee053_JaffaCakes118.exe

  • Size

    290KB

  • MD5

    b441362b424e8370b25607641aaee053

  • SHA1

    aee5638fcf95b8994863dc265d728a3af995a2ee

  • SHA256

    fa96876c45a2db66ae1265951e104b5c015c983724feb6ce3e0b92618f49bed4

  • SHA512

    0e19e057853cbdc60884de04b9ccf9e042d5354da1dccbf5ac45a19064582ce6407d0c9788612a209a44c11495b0774da2ce0cd23e65b5af5b5e1c0301a969fd

  • SSDEEP

    3072:yCc99moUMXv84IHesgkSx+oN/7KzTKDyOX6wKamrJPlM8dj09br:yCc9wHRtg9xkNq6wK7dq40

Score
10/10
sodinokibi$2a$10$d/hor8pzftxyevodyrecsebolxf2dclmqmqjta4y2usfgkhezxq624430ransomware

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$D/hOr8pZfTXyeVodyREcseBOlXf2dcLmqmQJTa4y2uSfGkhEZXq62

Campaign

4430

Decoy

ravensnesthomegoods.com

lionware.de

nhadatcanho247.com

senson.fi

walkingdeadnj.com

smessier.com

crosspointefellowship.church

extraordinaryoutdoors.com

kisplanning.com.au

4youbeautysalon.com

abogadosadomicilio.es

toponlinecasinosuk.co.uk

crowd-patch.co.uk

teresianmedia.org

kariokids.com

autodemontagenijmegen.nl

321play.com.hk

ceid.info.tr

bowengroup.com.au

antenanavi.com
Attributes
  • net

    false

  • pid

    $2a$10$D/hOr8pZfTXyeVodyREcseBOlXf2dcLmqmQJTa4y2uSfGkhEZXq62

  • prc

    vxmon

    mspub

    wordpad

    beserver

    vsnapvss

    sqbcoreservice

    ocautoupds

    dbsnmp

    CagService

    mydesktopservice

    benetns

    infopath

    tbirdconfig

    DellSystemDetect

    thebat

    isqlplussvc

    ocssd

    mydesktopqos

    steam

    bengien

    raw_agent_svc

    winword

    sql

    onenote

    firefox

    VeeamNFSSvc

    encsvc

    powerpnt

    EnterpriseClient

    outlook

    bedbh

    dbeng50

    synctime

    visio

    xfssvccon

    agntsvc

    excel

    pvlsvr

    VeeamTransportSvc

    VeeamDeploymentSvc

    msaccess

    thunderbird

    ocomm

    oracle

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    4430

  • svc

    ARSM

    vss

    MSExchange

    veeam

    VSNAPVSS

    BackupExecJobEngine

    MVarmor64

    svc$

    PDVFSService

    VeeamNFSSvc

    AcronisAgent

    sql

    CASAD2DWebSvc

    BackupExecAgentAccelerator

    AcrSch2Svc

    MSSQL

    backup

    BackupExecRPCService

    VeeamTransportSvc

    MSSQL$

    BackupExecDiveciMediaService

    MSExchange$

    MVArmor

    BackupExecVSSProvider

    sophos

    BackupExecAgentBrowser

    CAARCUpdateSvc

    VeeamDeploymentService

    mepocs

    WSBExchange

    memtas

    stc_raw_agent

    BackupExecManagementService

    bedbg

Extracted

Path

C:\Users\12av897-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 12av897. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/DF7698E81DC9D4FE 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/DF7698E81DC9D4FE Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: ImCXAewEgWUNIegKLCE5RUfeKqGzW2otPW/+6GGFDl2wvA6S9VnWWWu0r3mJaPSq 3xzBPI8MObTTaoWvK5lm2bEfHZj9Xq3Ci0GLcjcDTbm8ynxlYGMzPT4mkWcCGlUO XjR7c1SGh/qp6TpoFhugL3qG+eAgMkZipVfWqByFn1Z7Rf9p+1dwTk7inN/z6qEa mgEMSwuvXBzPdMa3C+E14Prhh+f1oBYmEo8+n7K6LWmAOWgJNPH8tIjWU2t5A2CS XZ01CVEgW+eWaguyoCqZYJgAiZXBDI4K/gqniHcvvsKA2XzYNrQut/aAqXUBu+ik VtNb4hf0ZiqGWswS/lQTSaeNMYl/27C5hQ/QnSXiQv3v7r6J8xPPbC3ThGZqoeor WXnkwkj+H2qd4KHO7p74lICnOLpQVTQ1zlZjUFdt2JEImAK66/exzgvSBNguPM5c S5MoC03PTQTIe3iGJ6TdOAD5e3Jo1gO/vxdxPNJdQ9K3cODR28CAS6GPqJ/ujSgX bV6TdiGoYkHm7ADgrb/7m4aIVTOO9VoPB9KMjv16Qi+CtIlYayLApLgctwwWDC1K hS7pqxDBOKLU400/z9d2/dWEXeXcCSgHQsfPBxI+uu8CIvVDyQwjiJbHd9Zn//Ua b9euSZ+HTVL7Dqyhdry4RjlYmohguKQ300Aq9nLHmmHWNwI+UnSIZNGyoLKW+djV KIB0AsjVyLf5v0cmWLO33du77adWhtCC+JZtdqMh1YD4vbHSuRPh65lUWKqtmAfR ZacPUna+8NYZE/yjlRJ0KjYllPEMyfWCMAhpXKwY3wXyHWn4Rgc+riVmnfY8X2+z LyZFjQCybl4lAUiakOUtCIAaSc4wcc0u8PIU/S+WfjM4d/Uz/yx2DH3thbZfoUon i+zEveQw80cwbqgRKsrPZu9MiDo1ADCOmif8BYbAtCCpe7fNzOm4v2pkcgebJt4s KdK/I7ai1Hif94xnF7sN5Kjhf8oYMonndtn+9650qhI55ljnZkmO2YnzN5Z7FHt5 Xuc0vqsvZAg7Dj8Y+m88qtjo39iGG6T+De+89QsXyOcMr1vhzcQp29MieoSoVizj /LhrRHDzDc90D+QsywbboTQ6eX/UO+0ctRaT+cNSpV1tzNRulKfOYmuHfJGSYsH/ 2zrJTewKTbXpJgogGcRo0DlGRQkkslgsRGoZza1EaahjtX6xVdjeIXCUmyGq7kRO Wa6UJKsAPqd/+QJqkiqULSPB6umglShgfvS6eVCieeqYxIDz6JPJffLQ40G+4VYb gTZLReZnlZWjAaRwU2emah34dTAaJVxIpvNXA7Sn+y2jxITtuXVciRCl4Spob6tn zVpmZ6ETP4JptBpn8wlPnCzYrw1L+pFniATt4j9QZKhEXQ== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/DF7698E81DC9D4FE

http://decryptor.cc/DF7698E81DC9D4FE

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 43 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\b441362b424e8370b25607641aaee053_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\b441362b424e8370b25607641aaee053_JaffaCakes118.exe"
    1⤵
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2064
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2928
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:2960
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2564

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Modify Registry

    1
    T1112

    Credential Access

    Discovery

    Query Registry

    1
    T1012

    Peripheral Device Discovery

    1
    T1120

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Defacement

    1
    T1491

    Resource Development

    Reconnaissance

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\12av897-readme.txt
      Filesize

      6KB

      MD5

      eb1e572f300a683a3f19d42cc8a32078

      SHA1

      b6f013a60fb52ec0fa2133d19290d07af60dac34

      SHA256

      e0aa20f49f3487f78d60485bb8ae65b958b51ea0470a094ff57b2d5e29938c43

      SHA512

      1f6c8c25af1e2a39b9a4d08e675fdb0d0596b6db7792d1f8e49741fa9b2b71395ba5bb6c4b070f1faa90b7ddec6d89f60f51e3c6d0bbce80f981e511652bfd11

      Download Submit
    • memory/2064-15-0x00000000005A0000-0x00000000006A0000-memory.dmp
      Filesize

      1024KB

      Download
    • memory/2064-2-0x0000000000020000-0x000000000003E000-memory.dmp
      Filesize

      120KB

      Download
    • memory/2064-3-0x0000000000400000-0x0000000000420000-memory.dmp
      Filesize

      128KB

      Download
    • memory/2064-560-0x0000000000400000-0x0000000000420000-memory.dmp
      Filesize

      128KB

      Download
    • memory/2064-1-0x00000000005A0000-0x00000000006A0000-memory.dmp
      Filesize

      1024KB

      Download
    • memory/2064-559-0x0000000000400000-0x0000000000485000-memory.dmp
      Filesize

      532KB

      Download
    • memory/2064-556-0x0000000000400000-0x0000000000485000-memory.dmp
      Filesize

      532KB

      Download
    • memory/2064-150-0x0000000000400000-0x0000000000485000-memory.dmp
      Filesize

      532KB

      Download
    • memory/2064-149-0x0000000000400000-0x0000000000420000-memory.dmp
      Filesize

      128KB

      Download
    • memory/2928-9-0x000000001B5D0000-0x000000001B8B2000-memory.dmp
      Filesize

      2.9MB

      Download
    • memory/2928-16-0x000007FEF56E0000-0x000007FEF607D000-memory.dmp
      Filesize

      9.6MB

      Download
    • memory/2928-14-0x000007FEF56E0000-0x000007FEF607D000-memory.dmp
      Filesize

      9.6MB

      Download
    • memory/2928-13-0x000007FEF56E0000-0x000007FEF607D000-memory.dmp
      Filesize

      9.6MB

      Download
    • memory/2928-12-0x000007FEF56E0000-0x000007FEF607D000-memory.dmp
      Filesize

      9.6MB

      Download
    • memory/2928-11-0x000007FEF56E0000-0x000007FEF607D000-memory.dmp
      Filesize

      9.6MB

      Download
    • memory/2928-10-0x00000000028E0000-0x00000000028E8000-memory.dmp
      Filesize

      32KB

      Download
    • memory/2928-8-0x000007FEF599E000-0x000007FEF599F000-memory.dmp
      Filesize

      4KB

      Download