Overview

overview

10

Static

static

3

145ba21333...18.exe

windows7-x64

10

145ba21333...18.exe

windows10-2004-x64

10

Resubmissions

04-05-2024 21:53

240504-1r3k9sfe77 10

04-05-2024 20:28

240504-y9hmpsdd79 10

Analysis

  • max time kernel
    140s
  • max time network
    145s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    04-05-2024 20:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    145ba213336bbb05c09d2bcf198aa3bd_JaffaCakes118.exe

  • Size

    416KB

  • MD5

    145ba213336bbb05c09d2bcf198aa3bd

  • SHA1

    517dc0d3d853c09fd7cb69aa85fc8f37b9bf3a87

  • SHA256

    6329693e5c61a2f0fa1a53bd177f5a332ef729050b3f109630b759c792f0b986

  • SHA512

    1868d5e625f2fb48f1ca59a34d6b0ebee612d5c657adc349ddc9b5984409e0e9844f5a31f81a1f1e1234e44064f695de07843f1fad3aad54e051e6620127a4b1

  • SSDEEP

    6144:RQNOV3wQRokxB8n7zPUmmTg2OJH80FjTz/XmlH9n7a:qCFRoI8zP38OJ80Fjff49u

Score
10/10
sodinokibi1711defense_evasionexecutionimpactransomwarespywarestealer

Malware Config

Extracted

Family

sodinokibi

Botnet

17

Campaign

11

Decoy

texanscan.org

g2mediainc.com

avis.mantova.it

cac2040.com

zumrutkuyutemel.com

livelai.com

floweringsun.org

jandhpest.com

agora-collectivites.com

mikegoodfellow.co.uk

letterscan.de

voice2biz.com

biodentify.ai

csaballoons.com

angeleyezstripclub.com

innovationgames-brabant.nl

oraweb.net

transifer.fr

alattekniksipil.com

ruggestar.ch
Attributes
  • net

    true

  • pid

    17

  • prc

    mysql.exe

  • ransom_oneliner

    Hello dear friend! Your files are encrypted, and, as result you can't use it. You must visit our page to get instructions about decryption process. For futher steps {EXT}-readme.txt that is located in every encrypted folder

  • ransom_template

    Hello dear friend! Your files are encrypted, and, as result you can't use it. You must visit our page to get instructions about decryption process. All encrypted files have got {EXT} extension. Instructions into the TOR network ----------------------------- Install TOR browser from https://torproject.org/ Visit the following link: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} Instructions into WWW (The following link can not be in work state, if true, use TOR above): ----------------------------- Visit the following link: http://decryptor.top/{UID} Page will ask you for the key, here it is: {KEY}

  • sub

    11

Extracted

Path

C:\Users\Default\610e21li1-readme.txt

Family

sodinokibi

Ransom Note
Hello dear friend! Your files are encrypted, and, as result you can't use it. You must visit our page to get instructions about decryption process. All encrypted files have got 610e21li1 extension. Instructions into the TOR network ----------------------------- Install TOR browser from https://torproject.org/ Visit the following link: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/58A391D02A3CDDBA Instructions into WWW (The following link can not be in work state, if true, use TOR above): ----------------------------- Visit the following link: http://decryptor.top/58A391D02A3CDDBA Page will ask you for the key, here it is: NtmT7rhyN09AEN4EP+5RjYiEORn/q4IV7rusUSJO1SoZdNfLWaD9Vv33DXEZkWJK RiFvsAmx7pECwdYFY08dJ3N5QJebczAVN2jF5JgljwjBzjgBMgGrrFciIS1MWZi+ EyL4uf5cQd/9P8LHrXt4odqVAaZsOADAjsEkhBv4elrDDpMzJatwYzIjP8z0DO6V s/4ZFUB1o0/BykUtQUTiR2Jsw+1+3ZI35/LslD3C3vzPWk+DHYdX4vc8ZNnoxX1h EjYRN18h1KonPNAzQwvsD27bFRODb20lbTyx6fFGn1b/6lEDyGmB/B2bgcL+i7OL MHyOUJW1JdobBKt7IJgQN/Djygq4dfBwMb9K1WQKIrlChse+J0msd5dr32aPIhy9 A5ph67KPws0Q85h5iiIlEZjHSixFiIp1qqI28uELWWTNytKo/ObfBTgiF0gKBLX2 VedExrEEHe1ZlT8SNZed7rFTHDLGwzh+S0MBthvurXRXsG9NA0tO6Q/VR+bIoLxl Kr1nE4eSyNzvMHsAbC5WTUsfFcXYelJIvcu9c0idHu4SjYCUDFh5ebDJCeWf8MxB MtPExo6as4/ajMewp30A82SBQq6Fo+7sdo1BcM6OE+I9bqiwNCDp79IN/cH/M9RQ oWSwv46ijQB34ffsK+4kirmQL/HRvZu5OJr0xix/+ewIIqt5syq8ccJe4kJhiSMe 0JWdj2Xx4HJiTwf172kOLmCmGSA4C8fuV8CMzmoCQWmEqVacydrOY+kQgUTXJwQG pBjn4TXjikJyFEQ0JL4wJOB+X98NQQccRh4xs8sc5/YYJi8CqvD1tbsvAglQMcSb mVYE5XNtHrD+P+ncVAZ/VuaJz7dKf3rxARkfz02B+o/MywRWpBfrZqVXFa1JxCAY XIsm6baFI/tndBIqXA73EcHlH93qfb4Hzh+Ci8DqFy5cU/IoABD7bx4o5ZtRn183 8Pzr+J4qs3L/84acA9ZBKRaP4wQUT8szlmPkJShAxKv7XVawnzImopM9yYT1BqCg uAy6wRiM0N1UF9gPkHfFmysG+31afIPLzxaRxBelokwSEyDqtJTlVAuIf0xDV458 0eqoBu82fnF9IUfr5JyISpgPPPIa+v+QRFr5uX1FX7zz0u6X/x5BqnVcVeCdgd58 sK9X0ok/yxt5D705ylDcemJROfWt2DMp7ek=
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/58A391D02A3CDDBA

http://decryptor.top/58A391D02A3CDDBA

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Renames multiple (175) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies system certificate store 2 TTPs 6 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\145ba213336bbb05c09d2bcf198aa3bd_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\145ba213336bbb05c09d2bcf198aa3bd_JaffaCakes118.exe"
    1⤵
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Windows directory
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3048
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2144
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin.exe Delete Shadows /All /Quiet
        3⤵
        • Interacts with shadow copies
        PID:2720
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2880

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
    Filesize

    68KB

    MD5

    29f65ba8e88c063813cc50a4ea544e93

    SHA1

    05a7040d5c127e68c25d81cc51271ffb8bef3568

    SHA256

    1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

    SHA512

    e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    fdb8b3f743c1cc065af7523a8d229ca3

    SHA1

    3babd1918d74e45b6ebb89a91418f1eabe7361ac

    SHA256

    88f56918e50da4d8de0983a01d1ad631e1ac56b6ee0bd2f9d543b3cc38a9383b

    SHA512

    84776a2da9b2cfc27bb20f8bf62b5486b8f056846962bd516e501fe93b8b8db17708ff9fe784f1a513e770904cc514498bba09b4bf4e6eac9b08e50244f32886

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    b4782d9b8c855562d50962f78adc6da0

    SHA1

    519dff64fd2d81b532accc81286d2c61b5559374

    SHA256

    d9f247938d8636d82cf3420b414977a120c3b6baa9aa6b4166cb586d7d380e20

    SHA512

    19cd2e5ccea4866dce07acd29cf2e6551e793d179de9d08a681e9587e0db6dea59ff019a37e2237e3229b467bbd0f099ee8534bfa318d7638b7395771343640c

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Tar960F.tmp
    Filesize

    177KB

    MD5

    435a9ac180383f9fa094131b173a2f7b

    SHA1

    76944ea657a9db94f9a4bef38f88c46ed4166983

    SHA256

    67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

    SHA512

    1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

    Download Submit

  • C:\Users\Default\610e21li1-readme.txt
    Filesize

    3KB

    MD5

    fb263c53d652393b3cdf2e5096cf53a2

    SHA1

    a3e778a7399cbc78a738ec29cca58f7e5bda0d17

    SHA256

    0e327f60cf191d345e8915cc4851bc770dd124df09d5a9acde9ddf9626a6ff4c

    SHA512

    ea637d2cd4e38ca7d15ec9e1385639c685005b610ada91971127749c02b780dbf93bc8a64b3ce66fc89012b99b12a27ff9c5ac99fe3b1bd599d7e8c21f048d9d

    Download Submit

  • memory/3048-9-0x0000000000890000-0x00000000008AF000-memory.dmp

    Filesize

    124KB

    Download

  • memory/3048-7-0x00000000024B0000-0x000000000254F000-memory.dmp

    Filesize

    636KB

    Download

  • memory/3048-11-0x0000000000780000-0x0000000000786000-memory.dmp

    Filesize

    24KB

    Download

  • memory/3048-10-0x0000000002920000-0x0000000002A29000-memory.dmp

    Filesize

    1.0MB

    Download

  • memory/3048-8-0x0000000002550000-0x000000000267D000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/3048-12-0x0000000000780000-0x0000000000786000-memory.dmp

    Filesize

    24KB

    Download

  • memory/3048-14-0x0000000000610000-0x000000000063B000-memory.dmp

    Filesize

    172KB

    Download

  • memory/3048-15-0x0000000000427000-0x000000000042D000-memory.dmp

    Filesize

    24KB

    Download

  • memory/3048-16-0x0000000000610000-0x000000000063B000-memory.dmp

    Filesize

    172KB

    Download

  • memory/3048-0-0x0000000000427000-0x000000000042D000-memory.dmp

    Filesize

    24KB

    Download

  • memory/3048-429-0x0000000000610000-0x000000000063B000-memory.dmp

    Filesize

    172KB

    Download

  • memory/3048-6-0x00000000023E0000-0x00000000024A9000-memory.dmp

    Filesize

    804KB

    Download

  • memory/3048-5-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

    Download

  • memory/3048-4-0x00000000003F0000-0x00000000003FA000-memory.dmp

    Filesize

    40KB

    Download

  • memory/3048-1-0x0000000000610000-0x000000000063B000-memory.dmp

    Filesize

    172KB

    Download

  • memory/3048-538-0x0000000000610000-0x000000000063B000-memory.dmp

    Filesize

    172KB

    Download

  • memory/3048-539-0x0000000000610000-0x000000000063B000-memory.dmp

    Filesize

    172KB

    Download

  • memory/3048-540-0x0000000000610000-0x000000000063B000-memory.dmp

    Filesize

    172KB

    Download

  • memory/3048-621-0x0000000000610000-0x000000000063B000-memory.dmp

    Filesize

    172KB

    Download