sodinokibi | 8ab99ac368b338310cb1e130d9971aedcdd3b79e5c7143e8b4b0a8ce894f9c78

Analysis

max time kernel
134s
max time network
147s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 04:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
Size

160KB
MD5

2d59911040a480a6fbddb59a1d66ad8f
SHA1

b97065e561f6fb69d16932473e5dd039ef2b842d
SHA256

8ab99ac368b338310cb1e130d9971aedcdd3b79e5c7143e8b4b0a8ce894f9c78
SHA512

c85a1b5faf249f186515a222a5e931de6ebbce2f4d3f09460761e2a9a114ca7bfae6dc55c80a3aa0b1688136d5419afbfff909311a23e13b514fbd2ab94859ed
SSDEEP

3072:Kt38mD9P3ILbi4eTMlwDCnumOtbzl9j0G:KdNBPAbnWJmOhb

Score

10^/10

sodinokibi defense_evasion execution impact ransomware

Malware Config

Extracted

Path

C:\Users\i476fd0zte-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion i476fd0zte. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C073BA1BCCAC4BBF 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/C073BA1BCCAC4BBF Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: W3B5HCSnC0IUfePOJLl8OI7zB2N1PIbvV+fxAdgkF4ODDp6x/jdg/XXUTjS0A1wl WP/6Tm5oqkOsGYySLKcsrAGtC577GB6+ZDTYqLisuUTu7H5BJHkXq2kuQmhbL2xI AoQt1oQG7aXeQ0Ty8k0knxeVEis2FqCOvz6cJKudAA/B3jXMlFw9W5kc6jrSU/bV TlUrNDLZjz5hsAP9hK3Vgfd2JZBiahGgt6a6lYzIJFDthp2ckDmbpuC0+tUOTq3g NZyVx2W1Sk9FcZHuCQdPo2oXYjKpT6vl9Oa39I7RH6SgR2wTTmbX8qPXRxeKU8Rb VibC1n7UKNPZ8Uy2xZk9Y9dbNetbhK+EBRbBnfYJNbyn5x6VEDVrWCiC18eLJJpi UheYUpJgbbiUdzj3/f4EVFcAfzEuWBN+6gMFMBDKZyJ2It2Pjili9j9iVUXAUqpS zh+Dj4WT/NTQKWF1GII2uccmhHqWYTSfolEFkLPJMOzyNy7Ypmu+pg3cDEtQyKyY itoDRr4DO2fYPjzuYpdDUHPBNz1kk0hb/4jzqjNVINDUMl9/6V2o3UDSPtJN/vu4 pJupITvZa/oi1ajlkEBmi6WJvetUrPUBu7sy0nID72H5baB6njuqH9jvFnYOvwBX 32+GBP294nL8OMA2qOQrEnLVwYZerIS+6AoEF2hXtVP6ZXcrDwPnYv1ShTQUefd/ elrykF0zBfkdCW2TFsKZy4fTlEw81jbvSHPWk1N411FSVnPQP6FgVgXFh6gRfF1+ FO4o15LaPZvsmV91k897KWeehkwvhZa0WTPzSfJwj4p0Be0nV6bOGHkWS09TZDe9 q/nk6cpuMiCzEvUkPQ95BZRRpya/48M8eFUcWqu9p4hFTRoA7zJHJnoZDRrjnmrD PCFtXe6DmEjl9DgG02CMNAOOAwllXiEvA0zX/4iBUdT0dA68XxbMQnyek7PPSeLN QZz1uPrtorM8vuury1ZwP8zmcM3HqwWhxhQXSQL8SF12My94eCbbjupeDAPtoUbu LZIgiiRVKKnNd4h1FF9mBWpAaKDBhDD7hcmLSfKu4Cy+Bjwf7Iw22mIhqp7c5e69 3FVGmxEEkFpOQlcgf4Nbv8AvEA5Ecl6TZSnU5bonZ2FKyslWvbhF/giJPiISVmJ5 fcV2I2JxBTGNlsMs6686p+r7Vogm/gg0c4WkMinH6UM0KClBaVza3GqmEFEZfLh6 xKz0fB4yPKt3eaIK0r7TcQ== Extension name: i476fd0zte ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C073BA1BCCAC4BBF

http://decryptor.top/C073BA1BCCAC4BBF

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Drops desktop.ini file(s) 28 IoCs

description	ioc	Process
File opened for modification	\??\c:\users\admin\favorites\links for united states\desktop.ini	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File opened for modification	\??\c:\users\admin\desktop\desktop.ini	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File opened for modification	\??\c:\users\admin\favorites\desktop.ini	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File opened for modification	\??\c:\users\admin\searches\desktop.ini	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File opened for modification	\??\c:\users\public\desktop\desktop.ini	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File opened for modification	\??\c:\users\public\videos\desktop.ini	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File opened for modification	\??\c:\users\admin\links\desktop.ini	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File opened for modification	\??\c:\users\admin\pictures\desktop.ini	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File opened for modification	\??\c:\users\public\libraries\desktop.ini	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File opened for modification	\??\c:\users\public\recorded tv\sample media\desktop.ini	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File opened for modification	\??\c:\program files\desktop.ini	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File opened for modification	\??\c:\program files (x86)\desktop.ini	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File opened for modification	\??\c:\users\admin\music\desktop.ini	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File opened for modification	\??\c:\users\public\desktop.ini	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File opened for modification	\??\c:\users\admin\contacts\desktop.ini	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File opened for modification	\??\c:\users\admin\documents\desktop.ini	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File opened for modification	\??\c:\users\public\documents\desktop.ini	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File opened for modification	\??\c:\users\admin\saved games\desktop.ini	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File opened for modification	\??\c:\users\admin\videos\desktop.ini	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File opened for modification	\??\c:\users\public\downloads\desktop.ini	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File opened for modification	\??\c:\users\public\pictures\desktop.ini	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File opened for modification	\??\c:\users\public\music\sample music\desktop.ini	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File opened for modification	\??\c:\users\public\pictures\sample pictures\desktop.ini	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File opened for modification	\??\c:\users\admin\downloads\desktop.ini	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File opened for modification	\??\c:\users\public\music\desktop.ini	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File opened for modification	\??\c:\users\public\recorded tv\desktop.ini	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File opened for modification	\??\c:\users\admin\favorites\links\desktop.ini	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File opened for modification	\??\c:\users\public\videos\sample videos\desktop.ini	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File opened (read-only)	\??\Y:	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File opened (read-only)	\??\H:	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File opened (read-only)	\??\T:	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File opened (read-only)	\??\X:	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File opened (read-only)	\??\V:	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File opened (read-only)	\??\J:	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File opened (read-only)	\??\K:	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File opened (read-only)	\??\M:	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File opened (read-only)	\??\E:	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File opened (read-only)	\??\I:	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File opened (read-only)	\??\F:	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File opened (read-only)	\??\O:	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File opened (read-only)	\??\P:	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File opened (read-only)	\??\R:	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File opened (read-only)	\??\S:	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File opened (read-only)	\??\D:	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File opened (read-only)	\??\B:	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File opened (read-only)	\??\G:	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File opened (read-only)	\??\L:	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File opened (read-only)	\??\A:	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File opened (read-only)	\??\N:	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File opened (read-only)	\??\Z:	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File opened (read-only)	\??\Q:	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File opened (read-only)	\??\U:	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\oxxg0kf789wom.bmp"	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe

Drops file in Program Files directory 32 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files\WatchRead.css	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\c34aa13d.lock	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\v3.5\i476fd0zte-readme.txt	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\v3.5\c34aa13d.lock	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File opened for modification	\??\c:\program files\RegisterSplit.emz	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File opened for modification	\??\c:\program files\UnpublishImport.xhtml	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File opened for modification	\??\c:\program files\UninstallUnlock.ppsm	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ResetPing.csv	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\i476fd0zte-readme.txt	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File opened for modification	\??\c:\program files\EnterConfirm.avi	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File opened for modification	\??\c:\program files\PushSelect.css	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File opened for modification	\??\c:\program files\RestoreEnter.AAC	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File opened for modification	\??\c:\program files\UndoReceive.scf	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File opened for modification	\??\c:\program files (x86)\desktop.ini	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\c34aa13d.lock	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File created	\??\c:\program files (x86)\i476fd0zte-readme.txt	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File opened for modification	\??\c:\program files\RedoDeny.vssx	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File opened for modification	\??\c:\program files\OpenRename.mov	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File opened for modification	\??\c:\program files\SendOpen.m1v	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File created	\??\c:\program files\i476fd0zte-readme.txt	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File opened for modification	\??\c:\program files\GetRemove.vbe	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File opened for modification	\??\c:\program files\UnlockSkip.dib	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File opened for modification	\??\c:\program files\HideOpen.csv	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File opened for modification	\??\c:\program files\RenameHide.bmp	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File opened for modification	\??\c:\program files\desktop.ini	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File opened for modification	\??\c:\program files\SelectDisable.raw	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File created	\??\c:\program files\c34aa13d.lock	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File created	\??\c:\program files (x86)\c34aa13d.lock	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File opened for modification	\??\c:\program files\UseMount.pub	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\i476fd0zte-readme.txt	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File opened for modification	\??\c:\program files\AssertUninstall.pptx	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ShowLock.rm	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
2432	vssadmin.exe

Modifies system certificate store 2 TTPs 6 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000000f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1248	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeBackupPrivilege	1528	vssvc.exe
Token: SeRestorePrivilege	1528	vssvc.exe
Token: SeAuditPrivilege	1528	vssvc.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1248 wrote to memory of 2996	1248	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe	28
PID 1248 wrote to memory of 2996	1248	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe	28
PID 1248 wrote to memory of 2996	1248	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe	28
PID 1248 wrote to memory of 2996	1248	2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe	28
PID 2996 wrote to memory of 2432	2996	cmd.exe	30
PID 2996 wrote to memory of 2432	2996	cmd.exe	30
PID 2996 wrote to memory of 2432	2996	cmd.exe	30
PID 2996 wrote to memory of 2432	2996	cmd.exe	30

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe"
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1248
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2996
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin.exe Delete Shadows /All /Quiet
    3⤵
    - Interacts with shadow copies
    PID:2432

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e33859a99fd0658b6d3833fcc99ffe0c

SHA1
5c49df21fa3b336c6d261937d9b3c40d0de3d726

SHA256
13277c358b837ee0578e5b80d0557c3e2d7074b7b5c06122d750f71da6700066

SHA512
eff375147ca3883c28e2c20bda06d61fddcce809bec5b0a01fafa457a5ba9dde456e40ad8cc505436761a6b030f8197e7b85bafc7278af09f895bf97cdf12cb1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar92E4.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
C:\Users\i476fd0zte-readme.txt

Filesize
6KB

MD5
1a791ab04951f755630628e3b454d966

SHA1
79384adf1f91e046b83f2886dec9fa9b006d8689

SHA256
f5729211dfe56c46ab1ca14f283f16000e42cd1f5951ac28d6ed70e29b7d4d29

SHA512
6a456f2034cd66f94d24ab9a5ad8dc8422132967aa2ea7c85caff70bb45664c75eacc5e6a547634a83b35244aa8f36f39230657431acdce3d680bed670b46c44

Download Submit