General

  • Target

    1701c19d9610ee4be543815bff908281_JaffaCakes118

  • Size

    165KB

  • Sample

    240505-lbszkagh98

  • MD5

    1701c19d9610ee4be543815bff908281

  • SHA1

    44821ddb87e0260ee8ba368e08c75b0ad3232923

  • SHA256

    6af766a07ccc641da303ab30936ed32ad32bb4d7c983f3df45c4c52c036e9d20

  • SHA512

    6794cb5b710b5165dfb59a6dcecff7776dce69b452b82e51dd9d35ec951e15febe9d71ceedc7ea91845b0d6e8c4214e7c07935dd2c8dd6f5c372e35971eed5ae

  • SSDEEP

    3072:eCEq0R0nZ5ys5n4Y9doh7O79siUs/NabPos:lw02sJPi7O93N9s

Malware Config

Extracted

Family

sodinokibi

Botnet

20

Campaign

46

Decoy

marcandy.com

tzn.nu

alcye.com

barbaramcfadyenjewelry.com

parentsandkids.com

nieuwsindeklas.be

the-cupboard.co.uk

molinum.pt

alabamaroofingllc.com

hensleymarketing.com

hnkns.com

comoserescritor.com

charlesfrancis.photos

michaelfiegel.com

sveneulberg.de

modamarfil.com

mollymccarthydesign.com

evsynthacademy.org

precisetemp.com

domaine-des-pothiers.com

Attributes
  • net

    true

  • pid

    20

  • prc

    mysql

    sqlservr

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    46

  • svc

    sophos

    backup

    sql

    mepocs

    memtas

    veeam

    vss

    svc$

Extracted

Path

C:\Users\06z3z-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 06z3z. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7936EA53BFDF7C92 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/7936EA53BFDF7C92 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: Vd6U0zj/ez3reA4KxvGRQatacs+x13tebxexjiOdeZjkUbt3q/IVfYax6D6sySvu X3gVtnAmzKXbryXVe4hDQEPY/+DpU3Iyfp7r6UB1MRHwoKa+F58bBzEMho6ET5nj iNc1e1E6XwYg+T9OFbD807fac58cJfOSEXx38iJr6xnRCuOUuSR193SpDRgTJ51b UjIitjqSAIogwqcXIQGgjuFJ/mc4TViVHf7uC8U5iQ1ghvn6aVVUWLgOC9JQFDSO 5Ad4mayLPAsjGzJJNXMH+HtT6FyMAuLe4ztCYT0UV22d2JfqFD4GObSyOzNvoJdg WUxmokTl5Hd1S9Y86iwqy8RrPUaaX8vWAe3jr2BQyrN08kSowHnoDcw7XDNozU8c XVm+GW1l4pRluPhFbggA0xOddSrzRVLPxyphNvdggAN10moOMmbTQ8UZUQQzM++C LtMn0xpjpaxQl+jvE+1IJJhew1/Uy/phbQBvy7PCVfVL7m+hVVMo//kVZDlEeAcO nLLaJiw9qW9XQ5kP32HhlLAGJmPs7LMJENh971p4rnYgJvbhHaH2WoU07iBZzrAV I5l66bV1/ES8DyI/rTGjbiJ43f0ABNi8E0MWTqccfXB010wTCljlfffbl238qWFV Y5jwphgrqmUFxpkLHVGMnoAwT9KDy3LDgRwlf9RVnJnOSmrvOBm7n1xVgsHXcctH WtpQqd06s7Y/PC2lK9gweU8zxbxwb93ovQLrokW2lp3nigOTIJPpvnAoN0/Rvo9z ZUMEA2qxMI/IejPKq4P3WfnsDbd7QnBqR7vnh8ORjhhTh7/LtWYrdlFdngs9ziaU zJQJoyjs3X43V4owzYFxY//aDPVSW6NoeUE2l/yyRxk9wYXIpdRknNdUj+5oFD7W L3vTb6bpWFq6AhluBzFgwcWmI7XUoJJhXDYLztDC6m2vULLCSPpcOsH4BvrmxcVy yoCXnhAf2y6sa5m4W82/aqpQw8EpMPSdb0D4z12m6o91y/YE1MntZ+/2o7/8XPPs /lnI0tbw4Hlz0wztUktvVqr2ODyY/7BjJ3VcA5f2X/+pw1eAhe3LoribfNZjeGqP t+xJ6XIelwdbVDpYMsP9OzX24AZEk+zHNBm52CrAvRD0L5n+45OMYvl2CDKeWCUT DJT37Xk984X0jvdBa5E5gku1S/wWcZbMwFj/QtoebeMSXTTCq8zOqgjGayo/msd5 4CQfr3O4 Extension name: 06z3z ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7936EA53BFDF7C92

http://decryptor.top/7936EA53BFDF7C92

Extracted

Path

C:\Users\vlk6s-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion vlk6s. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/966559B32AFAB1AF 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/966559B32AFAB1AF Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: yiUfm3EhvIJhfm2pEh25r15OFvz8da9K000Mk9bynm684HUjHQQkz1YMceQuIVjl awx/wdliQo5JvekVqZca7/9hMlzqdfbgDbMs+x50kpcvLY5gJ879F5hcmg3zu8b5 7totMSKNzfjXUwBh52UtzWLBMpvA/9FyRhy5Lyfy1k0sdBXvtmZZptQtQYEvQ6LJ bB2sQu2rSYhADKIAgCXROJ9Alz+XOCTZNzooUSEwO1wxHnj/ImDww8kXg4VqvXQm 7OAsyqkr0zYhuSgh3/9Sp9DBAS1u/I4qcDhGJ9ZJjNsWXrOVdprqgBSx/Zniax7M mKjEolzC1YGotz1G/qmrPyaVdGRXjccfh1GH9K3zd/QRr/jYcvhGF80xde0DqvPL HFZ7L4/rkAh+lmbmmwdAKVCsWlzmaiM9b/jPGBMd3/egtJu5Kwav65OWAFGGL+ao 0l2KCJYNcoeK9g7iwZ3vrL6/c60g7+LltibHudqKPugX/vPclvJ3lLXc5r7TnW06 Rny4UEjSPZrrnYNcsoTWKRfovvVD7XUeUGJPLlHsQOdicRgXKiZwlhV8ABm9L67r viyl6eslKsSCALmqpMCylkwj7YluqCnhS38WXzHMHtYztTG0PRpTbLHgs+WVOLgj 0pZAfGwBo76cGzObwBk/fURNh5cuiscwDKhfAYd3CkTD0QqS+68HWYoDcp7AiMkQ YTlPDdacV96LD0h0/nlkiS1Vope57VQgUrVOVaDIA36Q4KAr53Dt4rK7F2IlY2A3 iY+XrH6KxM7ZMDf3kXPFLsBP8UCGWNaW+JYIJFFN29GgEiN5SgLIvVEAWsKcZuMY SaAF8riWvf6eD441bsrtinm2T7XdrrQlXrh1oLjtnO/PzKYxOZmGRCsRudS+nJTW +/KYjNpHt2dTmSfJgOy1Xj/riIeIUpmXo/2ZYRcCOgYREjqZSuRelf1ykbbcg3Jm ELHWHa4ZBWlYp0GyiKhDxRZncAEamQfDfQp7466HoSFhNWKLB1gV57K3qsuL3K57 BqXsm1plEFc0fq7O4q38jKoU/ce4rL2DTPRXA6gPjfC0TLZ+Dd9WzzVlyctDXG6M vYIVM0ir+ZQJsc2pHHWMwzbGyNGzBOXOsowVU2BG6KREVMIuP754SeaZaGnskrY9 j7vEvE2FRaS7F9dPzNBZREUBlaiEb6Jr96Qj9YC76ionB7wiW8u2alde9KaZgyeE rx0Gbeh/wv8FfnjJ Extension name: vlk6s ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/966559B32AFAB1AF

http://decryptor.top/966559B32AFAB1AF

Targets

    • Target

      1701c19d9610ee4be543815bff908281_JaffaCakes118

    • Size

      165KB

    • MD5

      1701c19d9610ee4be543815bff908281

    • SHA1

      44821ddb87e0260ee8ba368e08c75b0ad3232923

    • SHA256

      6af766a07ccc641da303ab30936ed32ad32bb4d7c983f3df45c4c52c036e9d20

    • SHA512

      6794cb5b710b5165dfb59a6dcecff7776dce69b452b82e51dd9d35ec951e15febe9d71ceedc7ea91845b0d6e8c4214e7c07935dd2c8dd6f5c372e35971eed5ae

    • SSDEEP

      3072:eCEq0R0nZ5ys5n4Y9doh7O79siUs/NabPos:lw02sJPi7O93N9s

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v15

Tasks