Overview

overview

10

Static

static

10

bc4698c570...18.dll

windows7-x64

9

bc4698c570...18.dll

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bc4698c570801cad5abd33dfd924dbcf_JaffaCakes118

  • Size

    164KB

  • Sample

    240618-q43fxswelb

  • MD5

    bc4698c570801cad5abd33dfd924dbcf

  • SHA1

    dbcb886ee0b18a9b52d86c0c5419974e2252fdd2

  • SHA256

    1339249b5c799cd64f2c6f3695a8b912daac4329630d0d1d1bd77ae41a8be542

  • SHA512

    ff2fa0a4b1670236a5df9812025fbaeda1b1e61811c9d12052f59cba296b786898c969c68090cc756ce1c942df4a234cab87a03bbf02fafe0db3985e67deedf5

  • SSDEEP

    3072:AZPM0OGdUKV10OTed7/kBazzFbULB3VgslIYBj:AZPMnGZVyO6F/M4qRVgsIYB

Score
10/10
sodinokibi16705defense_evasionexecutionimpactransomware

Malware Config

Extracted

Family

sodinokibi

Botnet

16

Campaign

705

Decoy

rhino-turf.com

altitudeboise.com

diakonie-weitramsdorf-sesslach.de

opticahubertruiz.com

cincinnatiphotocompany.org

1deals.com

rizplakatjaya.com

voice2biz.com

campinglaforetdetesse.com

mediabolmong.com

michal-s.co.il

lifeinbreaths.com

ziliak.com

eyedoctordallas.com

husetsanitas.dk

shrinkingplanet.com

amyandzac.com

fitnessblenderstory.com

brunoimmobilier.com

letsstopsmoking.co.uk
Attributes
  • net

    true

  • pid

    16

  • prc

    mydesktopservice

    sqbcoreservice

    sql

    agntsvc

    synctime

    firefox

    thunderbird

    dbsnmp

    steam

    winword

    ocssd

    dbeng50

    isqlplussvc

    mspub

    ocautoupds

    excel

    outlook

    encsvc

    xfssvccon

    ocomm

    tbirdconfig

    wordpa

    visio

    infopath

    powerpnt

    onenote

    oracle

    thebat

    mydesktopqos

    msaccess

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    705

  • svc

    sophos

    backup

    memtas

    svc$

    veeam

    vss

    mepocs

    sql

Targets

    • Target

      bc4698c570801cad5abd33dfd924dbcf_JaffaCakes118

    • Size

      164KB

    • MD5

      bc4698c570801cad5abd33dfd924dbcf

    • SHA1

      dbcb886ee0b18a9b52d86c0c5419974e2252fdd2

    • SHA256

      1339249b5c799cd64f2c6f3695a8b912daac4329630d0d1d1bd77ae41a8be542

    • SHA512

      ff2fa0a4b1670236a5df9812025fbaeda1b1e61811c9d12052f59cba296b786898c969c68090cc756ce1c942df4a234cab87a03bbf02fafe0db3985e67deedf5

    • SSDEEP

      3072:AZPM0OGdUKV10OTed7/kBazzFbULB3VgslIYBj:AZPMnGZVyO6F/M4qRVgsIYB

    Score
    9/10
    defense_evasionexecutionimpactransomware

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Windows Management Instrumentation

1
T1047

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

2
T1070

File Deletion

2
T1070.004

Direct Volume Access

1
T1006

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2
T1490

Resource Development

Reconnaissance

Tasks