Overview

overview

10

Static

static

10

2c448be318...18.exe

windows7-x64

10

2c448be318...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    131s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-05-2024 23:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2c448be318e53757eeb78e1a1ec2245a_JaffaCakes118.exe

  • Size

    161KB

  • MD5

    2c448be318e53757eeb78e1a1ec2245a

  • SHA1

    072d3c8b6bb946acfe17656071faec4bac7c8b46

  • SHA256

    c5b521000c1d318921b58f7b5db3a067d28e6badd304ea9085831af8985b9fec

  • SHA512

    bf6614f3ac3556b3d049bc4192e49680025758174bb2c0873fe5967f8bc3e29f82ae2046876f1502c3db7adf51775ff7b2c34ad9c9cdea4e7a16d23f6f4e7f91

  • SSDEEP

    3072:oRud7cQgLbDkQjKiNLDIFjKbnSEg//b5Y7H:o0qQe52GIFGH8bK

Score
10/10
sodinokibiransomware

Malware Config

Extracted

Path

C:\Recovery\9qty9v83-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 9qty9v83. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/ECB50901C5843CA4 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/ECB50901C5843CA4 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: hp0fk23os6mv2vgGbahkpWF33NvHnLz+Nw4izuaUyA5ixJyWShJ32A9KnLkHbMLY L/gfYxhM5P1cwJ1zmFSiLORZYoS3rDQxccFbmo63+9SDofsK4JBtCVEpM2x6Nczf 2lzowhe55mW/VbqBXTFLmoc2GDJOeip32Ud6eMP9x18YAkRLEhPZ6HlfFJ9IEdOM oSfS0nxFaQTu05XSZNqi+gtAQOOLkxqUGwVzbqtBp12OZj5qvokl00WD3HV5TBFp t6KxZHzZ59BdpRB7Yil2ccMHQD6JZiyp6CUv0mC5O239gXaEvtFx23XCcdQ3xBy+ MVBhmIJx3ylImhah9GdPF81ESkdwPzsf+9CjjONV+3jMYXTCbAyZIH3dt/9eeJ7S L7xGEHUvqTsXbEkG6HRk7/XNi6fQOLyODM2+Nohgek0Oi66sji0z7HQkyJfkpOm+ JuecOVY58bIMRoz0Ba8//9KtIdB+c0xxbkh/NYG215LojD1aDLe5wPUtSD7RpR/s U4BE/SJoYr/sfH2LeTrY/mWG4B+tPQCOOOUMvDzXkf8DYNZWImsoME1sk1cWV1tw wXrCS31dA+M1JPPz2Y/WuewJDakcKjoFpapwY9oOnCBZWZa/iEO3z8j0nD7vQZJ7 GkjNJEwzwRlIuJdvV7CoJ5QpX2nOacIu3wr+odmAoVqFyyvHuNe/luUndErx8GiL Pbm2MWNgWJ/H70AuQbZisJ0s0d+kYYcLtJL08xJG+yhUAjIr5aFvwansXt0XW4ub FA71EidxTGCnTy4l2y9jWcMogsEfmf6QJnHdx4PNTsXydsXBh72fdQ/hikmrAPG5 Il9M46vEtRU8IwRRA8NKUtPP5iEY/5cUNItmy2dOBPHxzXJ2ORlCI3KQ0wg40Ogb /rbr4qrVoWNiJpOsX4nt/WKSueRzsDN38SwwXpK6HZ0crOXgK3DyHYRVG8Flg1kN fv7MSuzAlxDOTd5nZvtuTuX8Enci/mX7GRUCjZvVYn+hLnhrn7nk25kl9ukPj8bs fdVM5G5B0Bsh0eNaICwQmkYz2limUD5fAtcAljEmI7108BgjQRp++wuSKfNLVQ88 510uqOIps5oXmEHua3EGDMz5BlBrLKvuEsju0DNjeqjeOkGDsRgxicRtFsysx4a5 ctdrX9U+04vusxoPTrENbdGr01YtqoNDgkdqkDX4BWiXUUP8raarHlaWdzBYhdx8 Yle3bCO//NJ2jw7ijQw3nkrbP7M= Extension name: 9qty9v83 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/ECB50901C5843CA4

http://decryptor.top/ECB50901C5843CA4

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 29 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2c448be318e53757eeb78e1a1ec2245a_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\2c448be318e53757eeb78e1a1ec2245a_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:116
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures
      2⤵
        PID:3580
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4148,i,4686244434963378549,11462511444150484980,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:8
      1⤵
        PID:2680

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Recovery\9qty9v83-readme.txt
        Filesize

        6KB

        MD5

        c516985b3a1fa2673a772f032afd8bd5

        SHA1

        fc72ab0cf5263618770844f83c819775ad668ed2

        SHA256

        72f0102f32b4fb68b9336b9062cd06672738f96099a659a2d8aa9a82e8d7c8d2

        SHA512

        d3d00665a948dce73b209bcb8a13b734b5ea6d8d79c0741f8cca9ecad9584112f3ed2c21ba6857031bdc64cc971c916c35960e0072048431386136117b8869f2

        Download Submit