sodinokibi | 12096093901347150ac72d6c9c1cbacf4de7d6a51ef1ab4cddc06f85311dd8ab

Analysis

max time kernel
125s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15-05-2024 06:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

44e5f6b16ab566006f4d970662afc38e_JaffaCakes118.dll
Size

158KB
MD5

44e5f6b16ab566006f4d970662afc38e
SHA1

67f15baf34ecf32839c441adb55c309bbda173ac
SHA256

12096093901347150ac72d6c9c1cbacf4de7d6a51ef1ab4cddc06f85311dd8ab
SHA512

f5596ecf863ee98b550b86da3d5e560994dd23827170fec6aaa4dd515ee147d140a24671b35b814303bce4164729ea9d929a4345798997132a7e91aff4c1cf8f
SSDEEP

1536:/gAJlgaPladwnfzDcep9O3F7Pbi4eTMluxtXDCntTnICS4AEuzF8gM5iZQ1+mexx:3PwdkzDcC2Lbi4eTMlwDCnuzO/gQw1n

Score

10^/10

sodinokibi ransomware

Malware Config

Extracted

Path

C:\Users\aitp3l-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion aitp3l. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7384B9686CE87DC7 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/7384B9686CE87DC7 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: Ug8O5Q5gxtsTm65doPAj3zkqSEQIYqQYEOOdRZMYs5oqhYgeOcgE4qiJ6dFiof9j 3oXKlMGfgJi+htk55KEg7mIELyNDRC22CnO1l9GVwqnxz2dkHzJbcXJa/24KYDHp qHPWJFcACSrlh2Q5DknSg9hKaCVxl/9jjoUwP3L5PA8Kyj4SbUdOwxaNgeWdX9sS IW4wR62KcGyZtH3PE8X4tE5P9zezEOYg94NKNN/ckqw5BQrax4Vd/823Pee17NFC W4+LzefxM74TnBv6eodyQ/Xs+tUp5Nr46nH/YqeHBPihIHnyAL4RGEerJlDL9MyA u/L9jfW7HoQPEmlZpOfIaGkZDPN9jvQ9ZPIrHOQt4XEPyxNi5v9Oe1nMdcQjM27B 8Tvczvqk5VjyJ2yBQHCiZ9o3FrCuzx7M3SieZdsvgvjIIW6hRqynSBqrdkU3Ye+i qK/vfTDdup8b+9OvMQaOWF43+AXvaczbm61X86x/YCvwFKlUEj8bPU37L1dY1jvm OoNxMA0u2ZeB4gfpEmMJzaNNXfEy71nRPTfK3iuFkPOIRMU4T1TJUflw3h4Szz4X 7Em+1yi2nbLEW2yAdO6bhIYzPcZa1sOvNrSsr7M9w/pb4cOP27v6DHmpzgzJv7SE nF78feCSkFW8OW3YJqErQD7xSoBCUZpq5PUmZ8PUiM3/gyavNRLpCUceEOVCjayW 01vzKG7DM0HLd1+PvD4eLNiS1sDbq595kcZZwR864Q06CiQnU/0Nau02JrzvUr/E RB+Wm4M/XMn0SsLNkO4nF8NVe174+4sDFuSKL3Qa/XLAKa+Kg4vATXT6mIj1LqwO MK8FJyOzUnY9SaqigoXgQY7FXHi4mzLOea46hz26Jr6FHQWFfKEF6DlQd68ukPmJ /uwg0YhcvdOyG4f7Y/YRpbaTg4+mqzXaffjkn9qNWpzAQR0MGiBG0Oe70BTEENJw vHnng5/s/59RA+bOL/NfPUy8t1kmq0RZGIGBtXAADj4qqaY4n7pA9QGadQa70+US PTW1pzfTJMyiyxJyoflhStc4OFyD7X7b6rywrSRW6TNXvTfBQjIOBFHb8xndGM6w WHMxZLEPlJPZF55VjpyGbFcy5TqVETiOGG8NHMM86BLpxSsBE4sGOhW9+QESqOyn 2LrZYLzYt8FWF3lBmGil7DX8wOxJzo0ziwPQuj4enqqjDA== Extension name: aitp3l ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7384B9686CE87DC7

http://decryptor.top/7384B9686CE87DC7

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi
Renames multiple (1673) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	rundll32.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	rundll32.exe
File opened (read-only)	\??\P:	rundll32.exe
File opened (read-only)	\??\T:	rundll32.exe
File opened (read-only)	\??\V:	rundll32.exe
File opened (read-only)	\??\A:	rundll32.exe
File opened (read-only)	\??\J:	rundll32.exe
File opened (read-only)	\??\N:	rundll32.exe
File opened (read-only)	\??\U:	rundll32.exe
File opened (read-only)	\??\W:	rundll32.exe
File opened (read-only)	\??\Z:	rundll32.exe
File opened (read-only)	\??\B:	rundll32.exe
File opened (read-only)	\??\K:	rundll32.exe
File opened (read-only)	\??\L:	rundll32.exe
File opened (read-only)	\??\O:	rundll32.exe
File opened (read-only)	\??\R:	rundll32.exe
File opened (read-only)	\??\X:	rundll32.exe
File opened (read-only)	\??\Y:	rundll32.exe
File opened (read-only)	\??\E:	rundll32.exe
File opened (read-only)	\??\G:	rundll32.exe
File opened (read-only)	\??\H:	rundll32.exe
File opened (read-only)	\??\M:	rundll32.exe
File opened (read-only)	\??\Q:	rundll32.exe
File opened (read-only)	\??\S:	rundll32.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\aitp3l-readme.txt	rundll32.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\el-GR\57d8acaf.lock	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ppd.xrm-ms	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial-ppd.xrm-ms	rundll32.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml	rundll32.exe
File created	C:\Program Files (x86)\Windows Media Player\57d8acaf.lock	rundll32.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\aitp3l-readme.txt	rundll32.exe
File opened for modification	C:\Program Files\Windows Media Player\uk-UA\wmpnssui.dll.mui	rundll32.exe
File opened for modification	C:\Program Files\Windows NT\TableTextService\TableTextServiceYi.txt	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ul-phn.xrm-ms	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-pl.xrm-ms	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-pl.xrm-ms	rundll32.exe
File created	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\x64\aitp3l-readme.txt	rundll32.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_2019.1111.2029.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\aitp3l-readme.txt	rundll32.exe
File created	C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\Fonts\57d8acaf.lock	rundll32.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\fontconfig.properties.src	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-ppd.xrm-ms	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Grace-ul-oob.xrm-ms	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-ul-phn.xrm-ms	rundll32.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-200_8wekyb3d8bbwe\aitp3l-readme.txt	rundll32.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\57d8acaf.lock	rundll32.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\aitp3l-readme.txt	rundll32.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\de-DE\wmplayer.exe.mui	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-ppd.xrm-ms	rundll32.exe
File created	C:\Program Files\Windows Photo Viewer\ja-JP\aitp3l-readme.txt	rundll32.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-100_8wekyb3d8bbwe\57d8acaf.lock	rundll32.exe
File created	C:\Program Files (x86)\Windows Defender\es-ES\aitp3l-readme.txt	rundll32.exe
File created	C:\Program Files (x86)\Common Files\System\es-ES\57d8acaf.lock	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-ppd.xrm-ms	rundll32.exe
File created	C:\Program Files\Java\jre-1.8\lib\57d8acaf.lock	rundll32.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\EppManifest.dll.mui	rundll32.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\AppxMetadata\aitp3l-readme.txt	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.UI.Xaml.2.0_2.1810.18004.0_x64__8wekyb3d8bbwe\AppxSignature.p7x	rundll32.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\ja-JP\wmlaunch.exe.mui	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.officemui.msi.16.en-us.xml	rundll32.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_neutral_~_kzf8qxf38zg5c\57d8acaf.lock	rundll32.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\en-US\57d8acaf.lock	rundll32.exe
File created	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\AppxMetadata\57d8acaf.lock	rundll32.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\AppxMetadata\aitp3l-readme.txt	rundll32.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\aitp3l-readme.txt	rundll32.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SAMPLES\57d8acaf.lock	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-ppd.xrm-ms	rundll32.exe
File created	C:\Program Files\Windows NT\Accessories\aitp3l-readme.txt	rundll32.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\MpEvMsg.dll.mui	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_neutral_~_8wekyb3d8bbwe\AppxSignature.p7x	rundll32.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\aitp3l-readme.txt	rundll32.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\aitp3l-readme.txt	rundll32.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\aitp3l-readme.txt	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_Grace-ppd.xrm-ms	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ppd.xrm-ms	rundll32.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000008\57d8acaf.lock	rundll32.exe
File created	C:\Program Files\Windows Defender\ja-JP\aitp3l-readme.txt	rundll32.exe
File created	C:\Program Files\WindowsApps\Microsoft.People_2019.305.632.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\aitp3l-readme.txt	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-pl.xrm-ms	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ppd.xrm-ms	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-ul-oob.xrm-ms	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\EXCEL.VisualElementsManifest.xml	rundll32.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-125_8wekyb3d8bbwe\Win10\aitp3l-readme.txt	rundll32.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\sr-latn-cs\aitp3l-readme.txt	rundll32.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\deploy.jar	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-pl.xrm-ms	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ul-oob.xrm-ms	rundll32.exe
File created	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\57d8acaf.lock	rundll32.exe
File created	C:\Program Files\WindowsApps\Microsoft.YourPhone_2019.430.2026.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\57d8acaf.lock	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2796	rundll32.exe
2796	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4856 wrote to memory of 2796	4856	rundll32.exe	89
PID 4856 wrote to memory of 2796	4856	rundll32.exe	89
PID 4856 wrote to memory of 2796	4856	rundll32.exe	89
PID 2796 wrote to memory of 992	2796	rundll32.exe	97
PID 2796 wrote to memory of 992	2796	rundll32.exe	97
PID 2796 wrote to memory of 992	2796	rundll32.exe	97

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\44e5f6b16ab566006f4d970662afc38e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\44e5f6b16ab566006f4d970662afc38e_JaffaCakes118.dll,#1
  2⤵
  - Checks computer location settings
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2796
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    PID:992

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3768,i,14486271492189381216,15799931579469722648,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:8
1⤵
PID:5608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\aitp3l-readme.txt

Filesize
6KB

MD5
e31b9ce1ad6077225eb520a93de313c8

SHA1
246ae1f0f28d3f947162cef694be155e35ffa381

SHA256
b6e64695a0175ad74c76ba04a0894903ce46fe1bb891cab3e1ba2a68af66a585

SHA512
84c4e604eae1511414df9efc03be8fd9d472bac3e0ff5a758bb9f06e9000597047ef6def207d24bab6b62e20054ed3d1180b87d070b1b7b31c985407d52a3cd4

Download Submit