Overview

overview

10

Static

static

3

3efdc5484d...18.exe

windows7-x64

10

3efdc5484d...18.exe

windows10-2004-x64

7

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3efdc5484d5d58b90bdbc48ba7598446_JaffaCakes118

  • Size

    373KB

  • Sample

    240513-ma3m2shh4t

  • MD5

    3efdc5484d5d58b90bdbc48ba7598446

  • SHA1

    24e23dd6e76f1aa0bd66c92ce2ecfa8c47b831ca

  • SHA256

    4447dee4424f298d64e15a4ba543090afe27afc9b839cb186ce4ddad3ca6e6b7

  • SHA512

    c84ceb205550e473251583aaf7364677a7955daba96183289e4d68a42ad7b41ac176dbb7be37361ec0a0958bd6b5d89dbd726de4b4c23dd4f16ffbb197554fb3

  • SSDEEP

    6144:t7eVKANEgjw8TOnLOZEvsMAcgsphgjxgQQ:RWKAGgjgKOAcixgQQ

Score
10/10
sodinokibi1711defense_evasionexecutionimpactransomwarespywarestealer

Malware Config

Extracted

Family

sodinokibi

Botnet

17

Campaign

11

Decoy

texanscan.org

g2mediainc.com

avis.mantova.it

cac2040.com

zumrutkuyutemel.com

livelai.com

floweringsun.org

jandhpest.com

agora-collectivites.com

mikegoodfellow.co.uk

letterscan.de

voice2biz.com

biodentify.ai

csaballoons.com

angeleyezstripclub.com

innovationgames-brabant.nl

oraweb.net

transifer.fr

alattekniksipil.com

ruggestar.ch
Attributes
  • net

    true

  • pid

    17

  • prc

    mysql.exe

  • ransom_oneliner

    Hello dear friend! Your files are encrypted, and, as result you can't use it. You must visit our page to get instructions about decryption process. For futher steps {EXT}-readme.txt that is located in every encrypted folder

  • ransom_template

    Hello dear friend! Your files are encrypted, and, as result you can't use it. You must visit our page to get instructions about decryption process. All encrypted files have got {EXT} extension. Instructions into the TOR network ----------------------------- Install TOR browser from https://torproject.org/ Visit the following link: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} Instructions into WWW (The following link can not be in work state, if true, use TOR above): ----------------------------- Visit the following link: http://decryptor.top/{UID} Page will ask you for the key, here it is: {KEY}

  • sub

    11

Extracted

Path

C:\Users\Default\4r5882w-readme.txt

Family

sodinokibi

Ransom Note
Hello dear friend! Your files are encrypted, and, as result you can't use it. You must visit our page to get instructions about decryption process. All encrypted files have got 4r5882w extension. Instructions into the TOR network ----------------------------- Install TOR browser from https://torproject.org/ Visit the following link: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7581C0BB6C2082A0 Instructions into WWW (The following link can not be in work state, if true, use TOR above): ----------------------------- Visit the following link: http://decryptor.top/7581C0BB6C2082A0 Page will ask you for the key, here it is: bqhLvf5t3v5q59R0oDFt7UdE+YSdHud5qmrUIbAPZpYJC5Gn1l0gPqgAGw3eX9iv xEJvYOOUcuwA15E3rjTAFLL3/cv4ApkQzlv81gmNWez7coU1xLmZa2hlR6OAifUS 3yIlqj4kcwiD2K+S2c+o0nmLYB+nvwDmUf49GyKqw/uat0qomfUjoJpNEfGf/2PJ G20hJex4eqQtuSI7qqkTBAIb3YEdXV2EHjHJvRpwir91Lc196eQwPmYsYvq31UEn YIiSfy+AgQ2X/9+/X9AyQvXLB31yiv5qEuFQxIrza7fRrdOr/7n7b9VKe918BiTf XGtf9wEh04rbn7D0dq+wYt68qM3vduTNOLUvDYKkv8kCpLskbPnWPsba3xXjhsUl aTr2cXC7adFk7QrI/ekPk2kobACyvCEWaa8HgwubUAywqss8AyjyRfHNUQA5wXKQ NigSPI2wetggcrjTyiS0C7IB5eVfdpHrQhVI2orzS4WEZIJfYd4NRtX+PWQ0eE4u Liip1KnMOWLPee+nTnEmUp901qfsIDqODjs0VS20QtSva0tAZnzuuPKC9jRfmnuZ gc1NRj+xyPpoBLsZO5UTVrUY9oHcyDUVnIBeNWBtnjWnpmLqxzQxiLRs9Fkb6I0e ppRHyM8KBiY7wBfjo2a9+Nib+EfgLgTePrDolC1FnhmG5ry/nmod6YeEDX595qYV DO/HZliNN6I9NkVXYdQX8p7jf+KnSp5Z31WYeq9ZRdMTUr9BxiSifQ8BaQHCa+tB vp7cT2CfHlFfiA56P5mdttAvSTGmtJ3QPqliBSWWkz/PJ6UQ8sJFfQCjgrD3XpHh FpMsD2NV6MOw47MiV8/59eCccE+IuMHdpKYjEqjBysN8ugFSXNLJdJqOIPH581xG vSHsaOw7QTOCU3adZnrcIC8GLfyfnlVpz7x1Z8LaTlZfks+OH/CKcKAQNKYJaWbP Rl/dZ3UFtsO+cevTcx8n78EQz5RZKxhccSDQtos6gA7Hz+7ROWfA7tDhVKGgmR54 mrzhpFHa3LlguUNhR1m5PJNbt8XpwotwqR8+Xsa0BcSrZZFVcFzd6i9wc41gLztJ NsOGKmJcN5GmKFrBBuBlO8ncyOoRGw2rB1CNG1J46BenDj8rycPw3cdcO36Byczh pdb4Mmk6xmHDwFrDfjSuZ06b/UCSdfU3qF8=
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7581C0BB6C2082A0

http://decryptor.top/7581C0BB6C2082A0

Targets

    • Target

      3efdc5484d5d58b90bdbc48ba7598446_JaffaCakes118

    • Size

      373KB

    • MD5

      3efdc5484d5d58b90bdbc48ba7598446

    • SHA1

      24e23dd6e76f1aa0bd66c92ce2ecfa8c47b831ca

    • SHA256

      4447dee4424f298d64e15a4ba543090afe27afc9b839cb186ce4ddad3ca6e6b7

    • SHA512

      c84ceb205550e473251583aaf7364677a7955daba96183289e4d68a42ad7b41ac176dbb7be37361ec0a0958bd6b5d89dbd726de4b4c23dd4f16ffbb197554fb3

    • SSDEEP

      6144:t7eVKANEgjw8TOnLOZEvsMAcgsphgjxgQQ:RWKAGgjgKOAcixgQQ

    Score
    10/10
    sodinokibi1711defense_evasionexecutionimpactransomwarespywarestealer

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

      ransomwaresodinokibi

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Renames multiple (206) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

      ransomware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      fbe295e5a1acfbd0a6271898f885fe6a

    • SHA1

      d6d205922e61635472efb13c2bb92c9ac6cb96da

    • SHA256

      a1390a78533c47e55cc364e97af431117126d04a7faed49390210ea3e89dd0e1

    • SHA512

      2cb596971e504eaf1ce8e3f09719ebfb3f6234cea5ca7b0d33ec7500832ff4b97ec2bbe15a1fbf7e6a5b02c59db824092b9562cd8991f4d027feab6fd3177b06

    • SSDEEP

      192:yPtkiQJr7V9r3Ftr87NfwXQ6whlgi62V7i77blbTc4DI:N7Vxr8IgLgi3sVc4

    Score
    3/10
    behavioral3behavioral4

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Windows Management Instrumentation

1
T1047

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

2
T1070

File Deletion

2
T1070.004

Modify Registry

2
T1112

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2
T1490

Defacement

1
T1491

Resource Development

Reconnaissance

Tasks