sodinokibi | 337fe8b50b6db4e741246ca76f27a8dd4e505cceebf9a9577be2d03dd5c5810a

General

Target

1a578c9055a1451622017cd253d238f2_JaffaCakes118.dll
Size

161KB
MD5

1a578c9055a1451622017cd253d238f2
SHA1

a1b72de550c0012a1c556697ce1d371440fcbc2b
SHA256

337fe8b50b6db4e741246ca76f27a8dd4e505cceebf9a9577be2d03dd5c5810a
SHA512

f095c5d8e2ec70ce38de23be00c9dc364b24d85506d205832d225c33fb1cae2b8555cc1b52f055d7b69df7ee42c96d9d80699033cecbc06e4fe65334af720d29
SSDEEP

1536:7mseS0rh3UharM4WHMnEA0tepkq8e7Pbi4eTMluxtXDCntTnICS4ADEq5tsMzYqV:tsM4oA0tCHLbi4eTMlwDCnuSq7OR

Score

10^/10

sodinokibi ransomware

Malware Config

Extracted

Path

C:\Users\sdyp4c4f-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion sdyp4c4f. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/EA0AA6A76DB1E7CC 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/EA0AA6A76DB1E7CC Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: HQa419ozY+85LZcPmEAIkT5Y60vilgYYV3ghNmA504+FpSuS9WJW8vOz57JLnWIU pg+earXKHrJoBQIeUIzxdTmSKubYKeTxhsKDiP4yADqT4Okqch7Evj9J963h5ayj brCamuG5Y98caIMpY8V/gZfKYiZBfiDMw7iDcxyl1bFSSJXLpyDnQyH2zaYX9m/Q SnczV84Qk8QqNt3cQViSawFU6KKkgeBFViDFmZcd70sPp/ppd7RXyym31nntRgVT aNebQGk7jTLaeVf2gq5nJ6c6m3H3esh67DdxX4074nPOMOgYBgktPxRoWbvJY7T/ lgcjO3vqSzJJEdkJkL4RupcMgNvaZwALi3icymS1SVw5rGiO4GmqedFvlkpBNvBB NJKAotnME2qdEaaSv/kia1IPMuzAP9dPEXYJOcB89BOwt58RQS8NVdSHtIY/710j 3iEVtAvQb6VKW7LHvNP8eoKj7Po4YeM3Ry5I0F6pEfcOW3vcCyREwZvUauebqxZK pKGF8pa5nq0FoJ2bNYapMmy+SyrCTCxQIPMh9XxDyWtezVyVQvee1EIhIyHQ/iKI 10BydTE1Q2ZN8I6SmZUIKKxLjOw5EOpctRo63WzBThJ34q9wnGltA2vzTzqoqbce +q+19GqHLLOp0V9HvEeLk+V1YceiZan1Fvx7slKHQ7oyyDTctrYRJkIccSdUJYqF W1iC0XmNcYEXuxkryoUsQNCHw7uKeW3pd9zmQetHRsqUlpNpS8OTeL+b2Y1cHSSS E27f/IHY+RziJ1mxDi0EHqg6WIfaGksEOXxFihm1cPs+t0kUcjh4ooiPtJbxP3nD 4r/qMx/9Y09494ytp9h5j50gpdP7pmOc9Vdydyj3NX/jKcud1VWwix+P7x58PiZT tcZahoz7RQwkTzTAdYR7KGO70Yl4rEbZ/Wc6WOkcbfU7W6fXLLL1dzlUAgY4hjJS +zxletVkJYVMTPol4GOM6nfxaKD4wXjbmrqI7zkruZClgN1ljFOIsMoVbp/Yn7Bc qdZQJX7ic5FNb9clrkDY99UsfzWZMM7CuHij604E9TTCIZQBiCdG/u65UR5ZmXAW CE9eeULxSP1/TP/KQDg2ficGPgzitM399oPWJZmrB+qLCAiv38VoOAu2/M+PFJvi kFBav9vcPeDP89a69a2F7dBB8lRiXpOIe/WWtcpIztO4PTlury/Ind38vmKPGYE6 pIDg3cgDwevILsYEXPFBqWXl2FQ= Extension name: sdyp4c4f ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/EA0AA6A76DB1E7CC

http://decryptor.top/EA0AA6A76DB1E7CC

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

rundll32.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	rundll32.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

rundll32.exe

description	ioc	process
File opened (read-only)	\??\I:	rundll32.exe
File opened (read-only)	\??\P:	rundll32.exe
File opened (read-only)	\??\S:	rundll32.exe
File opened (read-only)	\??\Z:	rundll32.exe
File opened (read-only)	\??\L:	rundll32.exe
File opened (read-only)	\??\V:	rundll32.exe
File opened (read-only)	\??\X:	rundll32.exe
File opened (read-only)	\??\D:	rundll32.exe
File opened (read-only)	\??\E:	rundll32.exe
File opened (read-only)	\??\B:	rundll32.exe
File opened (read-only)	\??\H:	rundll32.exe
File opened (read-only)	\??\G:	rundll32.exe
File opened (read-only)	\??\K:	rundll32.exe
File opened (read-only)	\??\T:	rundll32.exe
File opened (read-only)	\??\Q:	rundll32.exe
File opened (read-only)	\??\R:	rundll32.exe
File opened (read-only)	\??\U:	rundll32.exe
File opened (read-only)	\??\Y:	rundll32.exe
File opened (read-only)	\??\A:	rundll32.exe
File opened (read-only)	\??\J:	rundll32.exe
File opened (read-only)	\??\M:	rundll32.exe
File opened (read-only)	\??\O:	rundll32.exe
File opened (read-only)	\??\N:	rundll32.exe
File opened (read-only)	\??\W:	rundll32.exe
File opened (read-only)	\??\F:	rundll32.exe

Drops file in Program Files directory 31 IoCs

Processes:

rundll32.exe

description	ioc	process
File created	\??\c:\program files (x86)\dcecd7ac.lock	rundll32.exe
File opened for modification	\??\c:\program files\EnableCompress.mpp	rundll32.exe
File opened for modification	\??\c:\program files\OptimizeBlock.emz	rundll32.exe
File opened for modification	\??\c:\program files\StartSuspend.tmp	rundll32.exe
File opened for modification	\??\c:\program files\TraceUnblock.wm	rundll32.exe
File opened for modification	\??\c:\program files\ClearHide.ini	rundll32.exe
File opened for modification	\??\c:\program files\SplitTest.docx	rundll32.exe
File opened for modification	\??\c:\program files\ClearBlock.edrwx	rundll32.exe
File opened for modification	\??\c:\program files\ConnectPop.zip	rundll32.exe
File opened for modification	\??\c:\program files\DisconnectRename.xlsm	rundll32.exe
File opened for modification	\??\c:\program files\OpenPing.jpeg	rundll32.exe
File opened for modification	\??\c:\program files\StopEnter.ttc	rundll32.exe
File opened for modification	\??\c:\program files\LimitBlock.pub	rundll32.exe
File opened for modification	\??\c:\program files\MoveResize.ini	rundll32.exe
File opened for modification	\??\c:\program files\StopHide.jfif	rundll32.exe
File created	\??\c:\program files\dcecd7ac.lock	rundll32.exe
File created	\??\c:\program files (x86)\sdyp4c4f-readme.txt	rundll32.exe
File opened for modification	\??\c:\program files\DenyEdit.png	rundll32.exe
File opened for modification	\??\c:\program files\DisconnectLimit.mp3	rundll32.exe
File opened for modification	\??\c:\program files\ExpandStart.easmx	rundll32.exe
File opened for modification	\??\c:\program files\SuspendSelect.svg	rundll32.exe
File opened for modification	\??\c:\program files\EditAdd.vsx	rundll32.exe
File opened for modification	\??\c:\program files\SearchSend.shtml	rundll32.exe
File created	\??\c:\program files\sdyp4c4f-readme.txt	rundll32.exe
File opened for modification	\??\c:\program files\CheckpointUpdate.contact	rundll32.exe
File opened for modification	\??\c:\program files\FindCompare.dwg	rundll32.exe
File opened for modification	\??\c:\program files\WaitSwitch.au3	rundll32.exe
File opened for modification	\??\c:\program files\ExitRestart.potm	rundll32.exe
File opened for modification	\??\c:\program files\OutTrace.xps	rundll32.exe
File opened for modification	\??\c:\program files\ResolveFind.WTV	rundll32.exe
File opened for modification	\??\c:\program files\SearchConfirm.pot	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

2656 rundll32.exe
2656 rundll32.exe

pid	process
2656	rundll32.exe
2656	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1456 wrote to memory of 2656	1456	rundll32.exe	rundll32.exe
PID 1456 wrote to memory of 2656	1456	rundll32.exe	rundll32.exe
PID 1456 wrote to memory of 2656	1456	rundll32.exe	rundll32.exe
PID 2656 wrote to memory of 1312	2656	rundll32.exe	cmd.exe
PID 2656 wrote to memory of 1312	2656	rundll32.exe	cmd.exe
PID 2656 wrote to memory of 1312	2656	rundll32.exe	cmd.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1a578c9055a1451622017cd253d238f2_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1456

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1a578c9055a1451622017cd253d238f2_JaffaCakes118.dll,#1
2⤵
- Checks computer location settings
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2656

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures
3⤵
PID:1312

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Peripheral Device Discovery

1

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\sdyp4c4f-readme.txt
Filesize
6KB

MD5
05106ad4aac0b68e795b1bf9cd746fb7

SHA1
4cc33c99001882043f47fd16654a426da47173d6

SHA256
1691e8605eccfcb13cb7e4a9918ad2938ce2e8775dd9dbd486073f0a1e383b06

SHA512
b08ec46d7825119ac11b77a39ab014d87643f2fba80d7f5fb6799cff29abe8a5d935542d3a16b2c9cb3e42d21da1ea997c65326ec84ade6bf46c8e7946ceda7f

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads