General

  • Target

    07dfffd188158429b2d86d28414ad08c_JaffaCakes118

  • Size

    204KB

  • Sample

    240429-rrysmscg35

  • MD5

    07dfffd188158429b2d86d28414ad08c

  • SHA1

    9cabd968c2fcb9a2c03d444c8cd7d8e003a17174

  • SHA256

    39ac4660e5ce9ba6df05d0c4c6459094854421d4604b325fa91a619e0841285c

  • SHA512

    c8590f51654dafc0f3ac9fd4aa6a33c247d58d2bf5d64bd3157dee1287da71280821054937cd556914d5ed72d351cb3d74026eff55185358460f604bb777ac94

  • SSDEEP

    3072:sr85C3oFiWjmfb+HP+rnRfUJcQmK4kIkGCdHwJK3Bc:k934jmfCHWtU+QL4kIpCNwE3G

Malware Config

Extracted

Family

sodinokibi

Botnet

19

Campaign

99

Decoy

luvbec.com

eatyoveges.com

innersurrection.com

campusce.com

anchelor.com

medicalsupportco.com

photonag.com

rsidesigns.com

o2o-academy.com

hoteltantra.com

gaearoyals.com

arthakapitalforvaltning.dk

ntinasfiloxenia.gr

eafx.pro

smartmind.net

delegationhub.com

laylavalentine.com

michal-s.co.il

stathmoulis.gr

mariajosediazdemera.com

Attributes
  • net

    true

  • pid

    19

  • prc

    isqlplussvc

    firefoxconfig

    oracle

    ocssd

    powerpnt

    thebat64

    onenote

    sqlwriter

    outlook

    mysqld_nt

    excel

    sqlbrowser

    dbsnmp

    msaccess

    winword

    dbeng50

    visio

    ocautoupds

    encsvc

    tbirdconfig

    thebat

    sqlservr

    sqbcoreservice

    mysqld

    agntsvc

    xfssvccon

    mysqld_opt

    mydesktopservice

    ocomm

    msftesql

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    99

  • svc

    sql

    veeam

    backup

    memtas

    sophos

    svc$

    vss

    mepocs

Extracted

Path

C:\Users\pzeizd3-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion pzeizd3. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7FC4493865765E17 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/7FC4493865765E17 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: e7OJYktNkK73/sSsm0Y+Lg9v9od/oX/e2/AOa+8txL56/BshUL+1w9mgZx4wmwFQ XjYMRp9Xz/EJzaE3GXM2fsVvgIfLYdA6o9gVYtm7bxBJ/xiYVLelmEjPWS2KBkbB lIlhRvQdiJmQ+Br6CtRdfHkxGgCk3syWPYHcAXcfJokS8JXHC73XjHa4PyBUmbex hY4aI51ix55uqicso5NXC3TRxPgIqNM6oJPJmrr8St0eJns/0pSYSycAePWnleyC 6a80vuRE7vKGqlnCxwJvVDhAfpv4qFpbw/0TOHO8505AFRkWvwQ2ENyBekKX181a RMFk4Bh8TlInMEIeZrpe3dyy9PdwwrrjCXYyNFLHcfUYdEa1FMIkLvCYybN5Sacm xLGPJuwUi6Z2yucITG293F6D6ymKM5Foq3ajNHCTj6AuosQvb9ZDa9/tm4NroN+8 +72wt8+NyiIxC9Xi0TP/7Obu66ewSaWgWcScZHp3g5wBXUPR9CgtBUaUWtSdGL5k 6CS8GUsVp2oZRav/HAoaXd6IwdKJk8PD6xUEldNacMDqDyb0561AsJJ4y7pxNFOD ND9Ant7ACSF7rmL4WGZjPskJqGy6gVN0DDVWCXG9O+ITSlr011FgsvzFN2TNGCD8 5U6vjdQ6wbcKlbS8YFR/v2QPwcytvSjx64PgPaIoQuhC3SEwFQQuC1OLAvxoZthj H8XllG8TZCj+O3x7fo6NYhZzJdHsNhPosrYfZ8EKEQ++YF4dQ0D6fx8m+ArfTY/R 4ugJXXJ7YVLzrOEOyT7b+KTOG+gmYrDp2LEZIxTx2g25EL4iyraxhN7uP7uyfHhv aRxYBZJwKkAh+TLY94IQUC3Zvrkhf/Jb8NwSxoPnFPJ8VWn3e/PPXdPxNCR4wrfX dyRHZ4sZAA5Kj0FObRlVdaB2nOHUjpvOK+lzbqALB/rLv6tD6oUXJW/7FXwT3BtR 8WTsvVo5KflX+bndXRGA7RktrHCBWQlrZZZDkIQORUEvMgmAFRfZla5mmBoLcI/y me5aI8YgIGLa7z6wZ9GDxNqGIFKQMTQAp77bTch3ZkeHUs/HNq8/tkIz1qMeC0Dy rhg8R0zyrm+cPVmXeztHjEUxmKlOQttvF+DHQ7FAktArowaPqVasWeH6Hbf9TuTG zJ92OQXbpMLmPbMUH6HqYWrDVPB4B/iXaujn87og5sOAqiwTDSWLE8InItihE7sX uObu2y4uLOUQ5A== Extension name: pzeizd3 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7FC4493865765E17

http://decryptor.top/7FC4493865765E17

Extracted

Path

C:\Users\05c234-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 05c234. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F6F019AF8B268CEF 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/F6F019AF8B268CEF Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: Dkd3/MEtAdiL9WS8Kvkeg/VmjhhD1pM4cgi0O+9JZ3tyCVuggwFcfOgL6aGNYIPX VgayxPwfN2CY9BdFo7XLmATVz22eOka7KbjrSqgfSvnMpzaP2FpCtX6U2nfDKvMM u6Y0/x9PilxFDeIlsy0AURyrKFLLSZp35GuldrpCe/UashgkrbMwgXtp1IwM5Oix ghs5Csp3uOTF4aYxn4nM+7w5pVBm7Pm8pmme0jUsXl7w9IkpM6V4gTohr3BvWRHy zgrhuquBlXOTUeuWAUallsYrp/K63BDLWeAYTAEvrcxoEK6jFsrp8bL2bvLTl8PA WDouEtEqczl7j+30CLH1QYnabPmc2ab0EbtqSDVg2IEdqlqMNjjZVpVv0NFrXnPP FYHF0t7izOY4CM66sgY+AO0w9tuv0kQnlpeccb48gVp61Ok/3IhsYeoAhdkOx6Nl HsXGnQ/dw6XxZVJpRrSgVZrt+EMfudUUWuKNt+O20fp+SOU94WleRBxkg/G5H2vq a73pTClEgbXeFZ3mOhAjVZUPlhrfru09dtka9yba156Ju1hJAiKsXn/iHIAkJPe8 I0/3jEFYFC6Eg22ywFsSYpMlrEEqM9LSyAN+FNftuY7YAsDmsvv+wtus8wUqYRU4 3T7FMw5v2zcdTdCspaJqf2CC3yNzZ9Onh3h+BT5JnUuV/GHzXQLhZLGR0QbiPYHX EnfwhySNPnhBPMzcYeiSJeyBWfIeZ9vm6fY29sF+BlkvPVabcKO2QlfGUbsRa0Bw YgGo189YIz3uJmpPO7zmmIbASWNuw+4tZn97u9igwP4sDrM8eU4IjzQorowEOxs6 SA8y1pdDQGKlQeS+CPhCemslHAGHESClNFyCB8iL+0ll7XpNEhGpGLo8xxwvncnT wv76CC98f1+T84FODmt6ykVsOqv6bGYu7ztVdPik3RDZV8AFOQBhFAcebLmb+TTk xESt3mVGYW4z/gEKcOE40kZTGy1TZVmbnK0s+ZsuWVrmVRiIFi++tJmiNjYXZsAZ EJiRyN+uI9180o7rbdIT0aaHpJqip+AJ1v1Xfoj9HQzNem1htzdAh3YS8Ikq1dh3 ZZyBGpblN7mVMv62LweOj+CoPIZ34H287FvijBcpyPq0dJnD8OsDNMFDvkoWCJhN 5dPx+AabA1mOPgZ3IPgXKPVf8mzYheU9+tVzeriEg9aSi6aAjP0lij5IjZTgD01o bLN/6D5p5THA2wxgK4Q= Extension name: 05c234 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F6F019AF8B268CEF

http://decryptor.top/F6F019AF8B268CEF

Targets

    • Target

      07dfffd188158429b2d86d28414ad08c_JaffaCakes118

    • Size

      204KB

    • MD5

      07dfffd188158429b2d86d28414ad08c

    • SHA1

      9cabd968c2fcb9a2c03d444c8cd7d8e003a17174

    • SHA256

      39ac4660e5ce9ba6df05d0c4c6459094854421d4604b325fa91a619e0841285c

    • SHA512

      c8590f51654dafc0f3ac9fd4aa6a33c247d58d2bf5d64bd3157dee1287da71280821054937cd556914d5ed72d351cb3d74026eff55185358460f604bb777ac94

    • SSDEEP

      3072:sr85C3oFiWjmfb+HP+rnRfUJcQmK4kIkGCdHwJK3Bc:k934jmfCHWtU+QL4kIpCNwE3G

    • Detect Neshta payload

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Sodinokibi/Revil sample

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Privilege Escalation

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Defense Evasion

Modify Registry

3
T1112

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Collection

Data from Local System

1
T1005

Impact

Defacement

1
T1491

Tasks