sodinokibi | 3a6a69d72b533a2e5051973c85a7be5d25f661df01111e17e439126241c9ea39

General

Target

13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
Size

166KB
MD5

13577e7b34a4c62a7a0944121ff84c70
SHA1

06f3daf23dd391ad7e8b8aef613f58cb9baadc11
SHA256

3a6a69d72b533a2e5051973c85a7be5d25f661df01111e17e439126241c9ea39
SHA512

2fcf381f1424336701de4fe631f015eccf8b65ac58909401efb1986f80672571713b0b818b26f2cadb44de8d4e5918ce3865346c42546b8e94286be595879bd1
SSDEEP

3072:1LFrb30BRtBZZg+i2ayy2RjLTuVyu7CJDgoMT3Qfexg3759um6C6lg:ZJ0BXScFy2RsQJ8zgWxI759fbSg

Score

10^/10

sodinokibi persistence ransomware

Malware Config

Extracted

Path

C:\Users\8ueb7mez-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 8ueb7mez. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/EB9BC747A366F9C6 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/EB9BC747A366F9C6 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 8wMk5E6/vp4/R048IhaXftqAUvLFpusku+bM/9kowSa6rFwO7WJojOJvMnyiplfW SpDRHSAeHQrXtEqEVnn7bKFgEjeJ9mfQ0tfvnbwBnPuIk6yb8t2Za8m7qcilo35j ZCokfnqFfJEDaaepipNAvUjoqs8UtXiLSEwnbBErTVI6l7frEYQeCCe8dURzTdLP NyUXFLsZJRjhFd1JXLAU+Q3rlQlJpQyZSlVbM1p3RogBbLXibjYkGmrP3pn6FXhQ BaoWQ0tIC3H1YIXRF7QanbQ4+30eu31LkuWBhFRK4hb9IXTKeaB8MCc9ycu1gI8s 8lE/1uyZHjcGDKpPPwUmsvdFDqf4j1nRMIjn4Fk7++T16X1GRUPktH3tOTe0tik2 mWqNt7HkYsax584tiwKeMRK9RX4tlwlN86h5BEKQR7fZX4HtJ4PKgEOgg73UJ6gU yMUr8MCq9yavKvRjx+VXGfeq184AL7kSsRrzFHc5+lpHrZjGwIwxi1RO1SuGM0nZ g+2vaT4PycwI7fp4UKlBrS/be9M9WQkFHQg83+sOQBNiLiaJoW7AZgrGHgkfKw5L 9R2clW7SiBE6cJu9LHvnBgLXip5KrbmcrAXKaFqpPrI4+NO3NEMcmVMe4PpkPIe/ C0RCdlLCcOOlJCemaXDaReS12QzbsMOg7StFF49IwR8HCu4BbkQ/1+/Vi8wYjB4w 0fGQDY7iIMpdkrWDSIpuRRs1traabJK9QvGsCxdcbNin3IVCVCinqLhG1cUQuISW QfgnBpNaUfS8z1aoake5KT9YqVbmWsC5pjNEYtOX9sYfpdwIoPPmYnz5tTcb2xWq 2yQglJGZm5vN4HF/6RlEHMF2T0LSWPV6YxdcnVc1YDLPQlsDJn+d2LrTQj1oTsIs K8GeyOrsbUN/kacperAMxmzOOK9YmxbG0+HV7iLqIPNavrc5s1BK83k6nDnsi0sj JgjH3i8kd8fOKtZQ1UnOtChoXT6NyG16AUIOfR4XQVyYqntVXQnOE/pxA5MLi7BY oF4GE5cCb13DdssPwL6C5dWy5KgihktpVdZ7LAUQJ2z0eVkdAg8anQZXgOVWM03m 11UmPV6OI879AieM6GxWuTMkRLpbt7mr87fmlz1lB7AHQ+dhAsJ0qjst8zz0faKP 5ZNjqmS2kdI2k1OHnd4VhFy73Ib1ILGqG0yDmG3+NX5+VnM8mIN8zaDucI5mXce4 xZlO0EOj/yETRDasII8ZGmwThNNxZQRNhcYxlnlL3gMOor0SCC+nQix9ssalKAQe d1afgabhEVbZjTwBxzgCpFeZgO50uSSOelrbx8csuPz8qCt2+nU3i429+AtzBJjN t4K1iIKdF+KrTuzhuBN58oGfJboIFV6FXtCwyZCqvvrstb1Zk1J4NsIJ Extension name: 8ueb7mez ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/EB9BC747A366F9C6

http://decryptor.cc/EB9BC747A366F9C6

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\k51299BQXH = "C:\\Users\\Admin\\AppData\\Local\\Temp\\13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe"	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe

Drops desktop.ini file(s) 27 IoCs

description	ioc	Process
File opened for modification	\??\c:\users\public\desktop\desktop.ini	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
File opened for modification	\??\c:\users\public\documents\desktop.ini	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
File opened for modification	\??\c:\users\public\videos\desktop.ini	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
File opened for modification	\??\c:\program files (x86)\desktop.ini	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
File opened for modification	\??\c:\users\public\desktop.ini	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
File opened for modification	\??\c:\users\admin\favorites\desktop.ini	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
File opened for modification	\??\c:\users\admin\onedrive\desktop.ini	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
File opened for modification	\??\c:\users\public\accountpictures\desktop.ini	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
File opened for modification	\??\c:\users\admin\documents\desktop.ini	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
File opened for modification	\??\c:\users\admin\links\desktop.ini	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
File opened for modification	\??\c:\users\admin\videos\desktop.ini	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
File opened for modification	\??\c:\users\public\pictures\desktop.ini	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
File opened for modification	\??\c:\users\admin\music\desktop.ini	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
File opened for modification	\??\c:\users\admin\favorites\links\desktop.ini	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
File opened for modification	\??\c:\users\admin\contacts\desktop.ini	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
File opened for modification	\??\c:\users\admin\downloads\desktop.ini	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
File opened for modification	\??\c:\users\admin\pictures\desktop.ini	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
File opened for modification	\??\c:\users\admin\saved games\desktop.ini	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
File opened for modification	\??\c:\users\admin\searches\desktop.ini	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
File opened for modification	\??\c:\users\admin\3d objects\desktop.ini	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
File opened for modification	\??\c:\users\public\downloads\desktop.ini	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
File opened for modification	\??\c:\users\admin\pictures\camera roll\desktop.ini	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
File opened for modification	\??\c:\users\admin\desktop\desktop.ini	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
File opened for modification	\??\c:\users\public\music\desktop.ini	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
File opened for modification	\??\c:\users\admin\pictures\saved pictures\desktop.ini	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
File opened for modification	\??\c:\program files\desktop.ini	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
File opened for modification	\??\c:\users\public\libraries\desktop.ini	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
File opened (read-only)	\??\N:	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
File opened (read-only)	\??\B:	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
File opened (read-only)	\??\L:	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
File opened (read-only)	\??\X:	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
File opened (read-only)	\??\R:	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
File opened (read-only)	\??\U:	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
File opened (read-only)	\??\F:	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
File opened (read-only)	\??\H:	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
File opened (read-only)	\??\J:	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
File opened (read-only)	\??\Q:	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
File opened (read-only)	\??\Z:	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
File opened (read-only)	\??\D:	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
File opened (read-only)	\??\I:	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
File opened (read-only)	\??\K:	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
File opened (read-only)	\??\W:	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
File opened (read-only)	\??\Y:	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
File opened (read-only)	\??\V:	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
File opened (read-only)	\??\O:	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
File opened (read-only)	\??\T:	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
File opened (read-only)	\??\A:	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
File opened (read-only)	\??\E:	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
File opened (read-only)	\??\S:	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
File opened (read-only)	\??\G:	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
File opened (read-only)	\??\P:	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a24.bmp"	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe

Drops file in Program Files directory 21 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files\NewRename.docx	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
File opened for modification	\??\c:\program files (x86)\desktop.ini	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
File opened for modification	\??\c:\program files\desktop.ini	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ExpandSkip.eps	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ConvertPing.vbe	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
File opened for modification	\??\c:\program files\DenyEnter.mhtml	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ImportStart.pot	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
File opened for modification	\??\c:\program files\MergeUnblock.potm	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
File opened for modification	\??\c:\program files\RevokeResume.vssm	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
File opened for modification	\??\c:\program files\SubmitRestore.dot	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
File created	\??\c:\program files (x86)\8ueb7mez-readme.txt	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
File opened for modification	\??\c:\program files\CompressEdit.dib	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
File opened for modification	\??\c:\program files\PingBlock.ex_	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
File opened for modification	\??\c:\program files\DisconnectSet.css	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
File opened for modification	\??\c:\program files\InitializeInvoke.ods	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
File opened for modification	\??\c:\program files\GroupResume.rar	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
File opened for modification	\??\c:\program files\RepairSet.js	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ShowRepair.odp	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
File opened for modification	\??\c:\program files\TraceSearch.dxf	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
File created	\??\c:\program files\8ueb7mez-readme.txt	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
File opened for modification	\??\c:\program files\GroupDeny.mhtml	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d0030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa20f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000040000000100000010000000497904b0eb8719ac47b0bc11519b74d0030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d578112861900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
876	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
876	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
548	powershell.exe
548	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	876	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
Token: SeDebugPrivilege	548	powershell.exe
Token: SeBackupPrivilege	3160	vssvc.exe
Token: SeRestorePrivilege	3160	vssvc.exe
Token: SeAuditPrivilege	3160	vssvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 876 wrote to memory of 548	876	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe	93
PID 876 wrote to memory of 548	876	13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe	93

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\13577e7b34a4c62a7a0944121ff84c70_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:876
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:548

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:4472

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

3

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\8ueb7mez-readme.txt

Filesize
7KB

MD5
4fc86f9052c7e25c47ec39fe0532eed7

SHA1
3a79fd507051ca8e2250e5f737de495a320fe4a2

SHA256
b9d6ce276ab468326f15b21f1f5bf720894fda687f75a747b5be925ca522c938

SHA512
107a55d278666a07c670a0cd77ae335c6241e319fd08cb05f6a55d8462864ca5ab7da71133f3e282c0eac5a4555b41a89ef5d947b7157fae34ca873aeddc98a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rptjjsrv.zgb.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/548-0-0x00007FFEC8943000-0x00007FFEC8945000-memory.dmp

Filesize
8KB

Download
memory/548-1-0x0000023BFA720000-0x0000023BFA742000-memory.dmp

Filesize
136KB

Download
memory/548-11-0x00007FFEC8940000-0x00007FFEC9401000-memory.dmp

Filesize
10.8MB

Download
memory/548-12-0x00007FFEC8940000-0x00007FFEC9401000-memory.dmp

Filesize
10.8MB

Download
memory/548-15-0x00007FFEC8940000-0x00007FFEC9401000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads