Overview

overview

10

Static

static

3

145ba21333...18.exe

windows10-2004-x64

10

Resubmissions

04-05-2024 21:53

240504-1r3k9sfe77 10

04-05-2024 20:28

240504-y9hmpsdd79 10

Analysis

  • max time kernel
    124s
  • max time network
    123s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-05-2024 21:53

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    145ba213336bbb05c09d2bcf198aa3bd_JaffaCakes118.exe

  • Size

    416KB

  • MD5

    145ba213336bbb05c09d2bcf198aa3bd

  • SHA1

    517dc0d3d853c09fd7cb69aa85fc8f37b9bf3a87

  • SHA256

    6329693e5c61a2f0fa1a53bd177f5a332ef729050b3f109630b759c792f0b986

  • SHA512

    1868d5e625f2fb48f1ca59a34d6b0ebee612d5c657adc349ddc9b5984409e0e9844f5a31f81a1f1e1234e44064f695de07843f1fad3aad54e051e6620127a4b1

  • SSDEEP

    6144:RQNOV3wQRokxB8n7zPUmmTg2OJH80FjTz/XmlH9n7a:qCFRoI8zP38OJ80Fjff49u

Score
10/10
sodinokibi1711ransomwarespywarestealer

Malware Config

Extracted

Family

sodinokibi

Botnet

17

Campaign

11

Decoy

texanscan.org

g2mediainc.com

avis.mantova.it

cac2040.com

zumrutkuyutemel.com

livelai.com

floweringsun.org

jandhpest.com

agora-collectivites.com

mikegoodfellow.co.uk

letterscan.de

voice2biz.com

biodentify.ai

csaballoons.com

angeleyezstripclub.com

innovationgames-brabant.nl

oraweb.net

transifer.fr

alattekniksipil.com

ruggestar.ch
Attributes
  • net

    true

  • pid

    17

  • prc

    mysql.exe

  • ransom_oneliner

    Hello dear friend! Your files are encrypted, and, as result you can't use it. You must visit our page to get instructions about decryption process. For futher steps {EXT}-readme.txt that is located in every encrypted folder

  • ransom_template

    Hello dear friend! Your files are encrypted, and, as result you can't use it. You must visit our page to get instructions about decryption process. All encrypted files have got {EXT} extension. Instructions into the TOR network ----------------------------- Install TOR browser from https://torproject.org/ Visit the following link: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} Instructions into WWW (The following link can not be in work state, if true, use TOR above): ----------------------------- Visit the following link: http://decryptor.top/{UID} Page will ask you for the key, here it is: {KEY}

  • sub

    11

Extracted

Path

C:\Users\Default\3k2fd94-readme.txt

Family

sodinokibi

Ransom Note
Hello dear friend! Your files are encrypted, and, as result you can't use it. You must visit our page to get instructions about decryption process. All encrypted files have got 3k2fd94 extension. Instructions into the TOR network ----------------------------- Install TOR browser from https://torproject.org/ Visit the following link: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/4ACF03FFBC917B86 Instructions into WWW (The following link can not be in work state, if true, use TOR above): ----------------------------- Visit the following link: http://decryptor.top/4ACF03FFBC917B86 Page will ask you for the key, here it is: locVvP7q+hmXasFOOb0tlBRk9+/FLseMFPicq4egDoUQuYi3aJkGWIXI3xBIq2XR 3eY+qhh/5gYzjIrfRKsZ9TepmLEyUEkNp3VThKYrLDW1qIViL2X/f1bFhP+kG8kE 9CEGUvXl0cBCxuIzMih+0V8Q89mpaKWPzlH2V3cwx/oxpWaEiWhRlrMx6O2vqUmS fJhVph7jLd6zWGOq0eMc9noSchKpeVfqfF5MllCaVi6RyRM1P/kiw6hhajl8iLqW EyhL3NG2cWoEKKoIMsBAV1soKsDtjkBOW3uEKLrJewGFq8uNZm9IiT40H1YMzuQS eOpxC5UWyuMIdnMBuVvCuZ5yMEgxQeOKDv0E5V4Dzmkv+t3uVg0r6V+BDabX001K Wo+WvuckSuWBZo7OwCl4bptljn7qr04e4JnkueHn2ePcqGgGRXkLXvkM/5gQOz9u RS9VEP3SBFx4v3KtZgbXJgrpjgaD2QGMXKUy4tjXk6y2HtQ/D1Uy1+NevC1kDRC5 58RIsjKhMRMAeZmpurC9trZD7xzlcano6qC5vqRemzI9NPxsH5M+YuGvxWPZeLcx WeTc6dlj+PicWEq1ebu0qphbCM5yB6ahKD17uSKfQStSSfz72iGDvk+qWzSTatZw TkkQ2yN5affvk0qegvj4SaoM0zamk9KaYhuRMXQMILJtOevikB+4QtwG/4XHcMBl r0vNQiXesrVGfDAUY8SD11IruEBf6k25+vPp8s8bFCXMP6Npnl3L23lZthxzYNUe 9cIkXCMTIDCrA9Ab0+IE3KiangTbn6UvKrokdvfG85BKtutZ7FImxgKd03mJaHsU O3JKAxuLYfN6+qp8ozW1xfQFUSWgB7Tk0pIDWRcb0hi3AA0vLuUeEOBhpAI92YZ7 dQQRAAP6oz80Vq/sZK21bTrXS09U7xfn8PbY9xjAORTHaea7kWM13tvFuhODF1lj /ZMSNb+j33X8wVAPU3JfbqufJXaVe9RuBazUdgm4prRV9MB8YyAZb5JtqXoxpDJ0 E1ETMPq4wkC+HR8FERQpeLUOJHCemktkGTGs/qfn98TbgyIWhFEKWY1zVm2tYgef 9P6XzmSZZ2Ix0VIDICuk66nZTj8RcNaBgK+iWciAfKwPZqafD491wPHjU0hi7Y5j GNqlk7YVDa+15082VRS3HmsgNccaBhDMMUrCYjE2qbs=
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/4ACF03FFBC917B86

http://decryptor.top/4ACF03FFBC917B86

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Renames multiple (142) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\145ba213336bbb05c09d2bcf198aa3bd_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\145ba213336bbb05c09d2bcf198aa3bd_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4260
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures
      2⤵
        PID:2236
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /4
      1⤵
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2396
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:1248
      • C:\Windows\system32\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\3k2fd94-readme.txt
        1⤵
          PID:3796
        • C:\Windows\System32\6fedgwzhcgwmc.exe
          "C:\Windows\System32\6fedgwzhcgwmc.exe"
          1⤵
            PID:804
          • C:\Windows\System32\7bmpgk.exe
            "C:\Windows\System32\7bmpgk.exe"
            1⤵
              PID:4180

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Default\3k2fd94-readme.txt
              Filesize

              3KB

              MD5

              01472d29e3ce83c611784f752f3444af

              SHA1

              b7dc0bbe3dc1042a0a961b079ca1702f4d29cc80

              SHA256

              ee120807898317e9c792ff4a25a8bb3a259485f42ccfb8c4be53b4a94989e38c

              SHA512

              18f70d7c5ac52ea3756e5e53d83beed6b85eb00ad58222165781316fd102faff78d18d2a8b8fb3993b57df63dc9fd9b54be5d96e16d49c5b4d7b7132bab6cea9

              Download Submit

            • memory/2396-8-0x000001DDC9840000-0x000001DDC9841000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2396-1-0x000001DDC9840000-0x000001DDC9841000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2396-3-0x000001DDC9840000-0x000001DDC9841000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2396-7-0x000001DDC9840000-0x000001DDC9841000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2396-2-0x000001DDC9840000-0x000001DDC9841000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2396-13-0x000001DDC9840000-0x000001DDC9841000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2396-12-0x000001DDC9840000-0x000001DDC9841000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2396-11-0x000001DDC9840000-0x000001DDC9841000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2396-10-0x000001DDC9840000-0x000001DDC9841000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2396-9-0x000001DDC9840000-0x000001DDC9841000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4260-0-0x0000000000427000-0x000000000042D000-memory.dmp

              Filesize

              24KB

              Download

            • memory/4260-17-0x0000000002400000-0x000000000242B000-memory.dmp

              Filesize

              172KB

              Download

            • memory/4260-18-0x0000000002400000-0x000000000242B000-memory.dmp

              Filesize

              172KB

              Download

            • memory/4260-19-0x0000000000427000-0x000000000042D000-memory.dmp

              Filesize

              24KB

              Download

            • memory/4260-14-0x0000000002400000-0x000000000242B000-memory.dmp

              Filesize

              172KB

              Download

            • memory/4260-347-0x0000000002400000-0x000000000242B000-memory.dmp

              Filesize

              172KB

              Download

            • memory/4260-348-0x0000000002400000-0x000000000242B000-memory.dmp

              Filesize

              172KB

              Download

            • memory/4260-351-0x0000000002400000-0x000000000242B000-memory.dmp

              Filesize

              172KB

              Download

            • memory/4260-352-0x0000000002400000-0x000000000242B000-memory.dmp

              Filesize

              172KB

              Download

            • memory/4260-354-0x0000000002400000-0x000000000242B000-memory.dmp

              Filesize

              172KB

              Download

            • memory/4260-355-0x0000000002400000-0x000000000242B000-memory.dmp

              Filesize

              172KB

              Download