General

  • Target

    20defcd42cabf5da27a21dd342e58068_JaffaCakes118

  • Size

    324KB

  • Sample

    240507-sb3x4aef35

  • MD5

    20defcd42cabf5da27a21dd342e58068

  • SHA1

    408cfabc99c350ad28def5475cfff5dc2de02543

  • SHA256

    735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c

  • SHA512

    8a6a2f462b9e5ecccae13ecf176c8d2ec93e1c535f3541aa9a39151ea7874e730bdb627b422fbe2ba1c51c98c9c5a2b35da79433fbe9105038836ca33f31814d

  • SSDEEP

    6144:uhHmIZ1A3Lp5r8Xjv0PZNVhmN7r6PNkr1UT:iHdA3Lp5YzIH7mNyFqo

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$3aLOaggUASU5QrJ8Y1pYZeU93mMQzM6yVgD7yb83aT6O21pMW2lCu

Campaign

51

Decoy

woodleyacademy.org

bookspeopleplaces.com

despedidascostablanca.es

lapinvihreat.fi

drfoyle.com

carolinepenn.com

abuelos.com

groupe-frayssinet.fr

tecnojobsnet.com

deoudedorpskernnoordwijk.nl

siluet-decor.ru

smessier.com

calxplus.eu

julis-lsa.de

aminaboutique247.com

pier40forall.org

coding-machine.com

longislandelderlaw.com

expandet.dk

blogdecachorros.com

Attributes
  • net

    true

  • pid

    $2a$10$3aLOaggUASU5QrJ8Y1pYZeU93mMQzM6yVgD7yb83aT6O21pMW2lCu

  • prc

    mysql

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! !!! !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    51

  • svc

    backup

    sql

    svc$

    mepocs

    vss

    memtas

    sophos

    veeam

Extracted

Path

C:\Users\js101gn-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion js101gn. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/19B91ADB6076413C 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/19B91ADB6076413C Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 6WELyEAq+5UGpbolFch3WxN5uXPtxKBNR72iIqQU8XH5qDcB8hG2MQEp9C5SS4ig fBMuZ2IC1iny/xNSRflCPB/JMks+nad3i5ys7ryYnHogbMB5f+qPXxSPVjmw5sQV I+j2Q63fQ0UNR4gOGWbBgWzvTYNTDUD6ZdxhHe95VzcK/xD8ue1whghGPtmvbUlr C6lG8oywpWPCfbQKQg0SoBkgf1DW/YeV2mX26NXcgoFm+M7px0gZbJxcCzQRZ75i RjVSjBei8dxpmrWEeXEGIghmfTmEV/MPQa4cjU/jTaJgEwly17+5cBwPmVlRfsJP FXLsTIYDLPSRZOpE57frutI8PKvX/XzqkQj4MOUZt7CYk8L16Lzz3UyejSsqa2OQ i/upNcIZHf8s0kVjfBdxDJT8VfljatfMe4hJtruXqUkCytgMNgb6Pbi9uzXYUkQJ RvR2T4oO2pcR5OxlhevjoXWYwLTF0rn3js84x0WCRIemlMzj20LF0aRdZayrnxjY yqbArTlQ2P8wWSFeFn7iLntvP6Cj8r1q5Rsyw+aP3oIPJRlqTYQF23Ke4ofONC3v 7jmwMxvOPPAiReOIf+kBG03TUxfv/0AQnepk2cxS71RXRj25T+lklWbNg9gOOZ89 Z3QLzi+0RqMGF50n9k1fRM2qw9btzPeAR3BJXEtCfjDFkQhyFY+wqQ+/Qckd4XRE QgV0p8YofbWlj9wQofLrvu74cUvtHFYyDkSlOrZwinAi/yV0o26RwPZX1Mua6CHz ySF6NGAh3IlbxDGdSaQrVpNRv1m5g35edms/WOgdLWc/dCeRxl5VuhJu/o90K9IG Kr26bdGD73HXuXWHC+VyJy+Nrjs2CqdqV7DA8Pk+OqCx+rvWdjdIDKZd4ltrt/3z JYFrVzIv4ggakcYyjCX2KFYJ9v3oequAxSJ2oWSzCJIxtM8i1Dm2k3WvOfNmayUO 6fH49z7l5DzC7ukekeHg8YHJIGlY3+Op2w6fFWkxiNMbbcW/tnegLaOOzkMdECni La3hiC7s9Qq+RHJlT8ZPMZ9wvQfSq0CM0drWsBLbsKiWgqeq1z7mHtR+hxZD8rBu Aj+c/+lYWgmiJCm5WGBusQM6QhFe13BffHc4OXpV5GlUhlQ7Fl9jv5H8VO3LsRYS vZC1/1+NzF4tIAZDXbrmGcYZf0l2PmLJgHmiCE6UfNxFyb0xnEKdevfDWgSmtfIm Z1MP8J6a88hXlKJUf59WJwzdLnNAlyK53+lOOrx3+DwNpK7ArOnnNMhfGXWURgbc 93DU76b1TMtHxtmd0uxjDgCixB0p6O80K3sv4NLCV35fBHhFXQRMJk3kYW7Pn+DC C2nlOyNUASLxLR3FumU7KMd9OgeAsxDykzjR9jHY Extension name: js101gn ----------------------------------------------------------------------------------------- !!! !!! !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/19B91ADB6076413C

http://decryptor.cc/19B91ADB6076413C

Extracted

Path

C:\Users\3qn82bt-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 3qn82bt. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7C19995C708FFDEB 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/7C19995C708FFDEB Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 74db634SA7QBglOi+PPuLr/rQ1mYgVYPhWmsW7i/BtCS7jiCq0e/zaS260O5luDK qp4/LZgHb+8+mrIl7hT2PNm/2BbG/Fc3gHqw34exnu25u3vmrbRESGRL3oAF7BXY FgAL3jotOroz7CfMQhZFh7d/8MbVt5QNGMeI1VVLprH5HwowFo/PQTHY68939Uyz 1iRO5Xg0xGCP9sci3Nj9CpXjMR6CutysvUEvzxIChH+Rl155ORViKUdtSfaFRivr 5hsBgvqIvUHMJvrzdVB/u4BgfeGa3HhYTXwk0PBpv8xPFXkJNGUtFEkcBFbDVo+F DE6fxHwqYyBbGuUMxw8742ccGsxsPpZDlWQr2KENa2vn0nhy2iP9ptziG4oU+rdz Pu31NZscSrNpv3Bg/P6CIhSYfOdDaZtnTGBFsmpM+CMCmuV8RIVFdefgN1Gm0RAG NghGyplgW/MBNTLlBItoMidF5k3CfSfaJLeWOzrWcyypQzXnZBB3zYxkQlbzEZCz KUJERjFqkGjM44AQjR/RsmhjdJgmGFMjvNjXwJW+btIX0nwniGo6GTb45ayaP9mk PH51acqjIN2LLrdkPDgZU9R1lpLH0jJ3ylVkyY37IMSu3nojC20O3qyurUPn7ZWV PDbhj2YnsJWfufgDwfTxfmFKLniB2w9sKnVXK357WBtlrwN3NWaWuaa5LgDZHojQ 5zpvoq8n/tfm/SWoOkmsKTACu8onjgQAVP3Z8+QTI9sG04zB6Gp1BW7Ebb/l5Elg wzGOGLBMJXyH2lGpGOhYNmSn6NU/B2YRbxQYH0gWZ1a+gauI2pJvjx63NyjpGb3m JOmzSkff3F1afeAtboYjxdW8v93LhN/QnD1O8OzVFxycm9PbD/SwcJO0QcMQtwfN P31MzQtwmc30zh07YxNK+B9SFX1H/yhKKFuatS0FvgkygX/kMKS5IN5GA2mwFb8m YqbHnAsT03FGmHwkMA3usVxwL9XsXUhHvVVRULfbQtTqlLIOwRYrNX7uAnStREOw sMQLxf6jbGFoQQviijlk79zmwF2PuspxCYkFnw2zL+47HrYzEvpD6Y2mYpzpRbF6 DqmRUZiGsH9YCXBmHvbWerpYJtf1j1h0SsFP+GOfSFflegHPC1T/UIT02xxZbDMD f3nIcd01sPkZ8poOpUomLX12nxfAXDBCAe5dL27QR8LN6ng9035KNQJn4BxfhAZS +y0SqvFS2AS5S6zGbSICf9zj8OsydKPKHvvQKEKNFttS2GGwMP/TP4Dun0oeS+ZK 0KQHEDEokQi+EIxdsw+wQqgL8bBSjpsXMWakImrfAInWR5HI5rvk2QMF8XlcclPN mFPL2HauGvUK1FCzmScpN+uQUVQXEgmp4qCSDfJr8l7Q05x/ Extension name: 3qn82bt ----------------------------------------------------------------------------------------- !!! !!! !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7C19995C708FFDEB

http://decryptor.cc/7C19995C708FFDEB

Targets

    • Target

      20defcd42cabf5da27a21dd342e58068_JaffaCakes118

    • Size

      324KB

    • MD5

      20defcd42cabf5da27a21dd342e58068

    • SHA1

      408cfabc99c350ad28def5475cfff5dc2de02543

    • SHA256

      735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c

    • SHA512

      8a6a2f462b9e5ecccae13ecf176c8d2ec93e1c535f3541aa9a39151ea7874e730bdb627b422fbe2ba1c51c98c9c5a2b35da79433fbe9105038836ca33f31814d

    • SSDEEP

      6144:uhHmIZ1A3Lp5r8Xjv0PZNVhmN7r6PNkr1UT:iHdA3Lp5YzIH7mNyFqo

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v15

Tasks