sodinokibi | 42996516b6604ba136ff909d9b59d2a676a72eaafa30c729cdfaddd96b20fc83

General

Target

4903f3effb98da65c49bb9591c16615d_JaffaCakes118.dll
Size

164KB
MD5

4903f3effb98da65c49bb9591c16615d
SHA1

d53e85991420c1475385babd72d31ee77faefc6d
SHA256

42996516b6604ba136ff909d9b59d2a676a72eaafa30c729cdfaddd96b20fc83
SHA512

454b8a5f3528ce77d993b84ccd0df7b8f0843a6a47516b1aa13fe6cbb79d1853646e03c7c9663266df154fd464f594d41be1e392d0c8c3dd676e4348e5149880
SSDEEP

3072:BrX1t2U05pbJ5xhxY9doh7O79siUs/NaDn3Ka9:BrltH05f5v2i7O93Nenaa9

Score

10^/10

sodinokibi ransomware

Malware Config

Extracted

Path

C:\Users\4x52109-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension 4x52109. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/45B962B73A1D45A7 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/45B962B73A1D45A7 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: QbADCAwHc2AFaTsjnnC1FEzKU5/3McdMRpXKCqM622c/rAJOEZt3/tvbK4ha9gOs tLAIUoxzy2nmBK2/sMJg995Xr+phJjwkJAevZSsnQClrh16N9I2JUqtDgUMZkPmc Fbrz1TKqXZJXVnSm4V+8HLyp+ijt9lwISpxvpJgMVVDIBBrNhvrsBxjIhD6TrcUp yR5TCkRp0mmyeUEEu6yN/TRP2FkZOUSZ9cBMPVDquDaBNjyXcz//va3Szwga/qEP 8jW/1utgExFnyrktRpUsJpSbw38Y/o7FPGqb8I7qwAwYNcM6QxKEnni9T9SE2Y96 jZ/9veaMem8FakIKxiv3fYZD64sKIxGHcFIHeH4QK+Out0kHKL9chAWEw4ST2kNN 4B6gZiCH5oXQv83eTye+yZO1ZISDEj6WFsAv6Qmm88GOOrKUQxDopLUJ5wl/7x7z GgH8bdWHhSjG4KirV7d9Djm3J8T4VHXUcICttLeBZKVQQYva0pkg0ptYCoVGtGft 5ljZB/xoDb2GoAj86PuxSDD0pvsS2nLvJG23JKOz6vnqu12ycdXwlZaVNeFt3jiR 1Bof4cmT0lEEqNDN5PPI1K1vJrCETWxWZHi7q3TUrC7N7HGTMj8EsrI/JHFm4Sqx fw9UnBuUQwjk2jLY26N6wYr72308VHvh/PUjj/9/95oDKA6sxHViJ6qlpAyaj3Kb IUUPE0UXWcHFZTUQGVlXxPDhQsa9YEwAPnNPbF7/48wCfDGBlyAUP5WUIMj4lGDm 6RSSOae3AXdI+C8n98HTvSWh5xR/Ia7M3hyOnyInf0pYfo1jyUDoA5LGbWdT+ZV4 /NhnQcf7udps2RY5Bs48xYS3OS/Z5M2Y3xRgCY+1dUucHj5XbZVL1H9IMFQPiVQR OknI8H4w5O2cr7y8p4vuczYSsds31LFRqpC/VG4Jdnlmtg6N63YXVvwGHnyi4sBw oF22+72+KKaGKqNphmVsc1Nbc05lXIJx60SpLYE9kZBznXAuq3GJ484IpHfJMW9t bgoVEIFQ6HKt+UZ/GcdQH0hiO3VwJ6NsxORPySaHIlMdCJjqONv8NBeMpo7TsFW7 AXMfDIyY7OUELiOk6Vls6/C9cyFQwtkbmYPqyFeARwmVzsHc0lLEXIqKkI/Ljn5j mtHq1s+T2TAo12RJ1lJUs9lFhvoWm3f2I4LBmpcorsKRFX81J4z+e75d9mPAIv1y yYplp7yTROxPXr7Xf6Nd0wmi3PY= Extension name: 4x52109 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/45B962B73A1D45A7

http://decryptor.top/45B962B73A1D45A7

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	rundll32.exe
File opened (read-only)	\??\V:	rundll32.exe
File opened (read-only)	\??\T:	rundll32.exe
File opened (read-only)	\??\G:	rundll32.exe
File opened (read-only)	\??\K:	rundll32.exe
File opened (read-only)	\??\A:	rundll32.exe
File opened (read-only)	\??\B:	rundll32.exe
File opened (read-only)	\??\P:	rundll32.exe
File opened (read-only)	\??\S:	rundll32.exe
File opened (read-only)	\??\Y:	rundll32.exe
File opened (read-only)	\??\F:	rundll32.exe
File opened (read-only)	\??\E:	rundll32.exe
File opened (read-only)	\??\J:	rundll32.exe
File opened (read-only)	\??\W:	rundll32.exe
File opened (read-only)	\??\H:	rundll32.exe
File opened (read-only)	\??\X:	rundll32.exe
File opened (read-only)	\??\Z:	rundll32.exe
File opened (read-only)	\??\I:	rundll32.exe
File opened (read-only)	\??\M:	rundll32.exe
File opened (read-only)	\??\N:	rundll32.exe
File opened (read-only)	\??\O:	rundll32.exe
File opened (read-only)	\??\D:	rundll32.exe
File opened (read-only)	\??\L:	rundll32.exe
File opened (read-only)	\??\R:	rundll32.exe
File opened (read-only)	\??\U:	rundll32.exe

Drops file in Program Files directory 22 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files\EditMove.docx	rundll32.exe
File opened for modification	\??\c:\program files\PopUse.avi	rundll32.exe
File opened for modification	\??\c:\program files\WaitClose.mp4	rundll32.exe
File opened for modification	\??\c:\program files\WriteInstall.m4a	rundll32.exe
File created	\??\c:\program files\4x52109-readme.txt	rundll32.exe
File opened for modification	\??\c:\program files\BlockExpand.pcx	rundll32.exe
File opened for modification	\??\c:\program files\EditWrite.vsw	rundll32.exe
File opened for modification	\??\c:\program files\PublishAssert.wmv	rundll32.exe
File opened for modification	\??\c:\program files\RestartConfirm.rmi	rundll32.exe
File opened for modification	\??\c:\program files\RestoreExit.mov	rundll32.exe
File created	\??\c:\program files (x86)\4x52109-readme.txt	rundll32.exe
File opened for modification	\??\c:\program files\AssertStart.reg	rundll32.exe
File opened for modification	\??\c:\program files\ClearApprove.avi	rundll32.exe
File opened for modification	\??\c:\program files\CompressMerge.vsdx	rundll32.exe
File opened for modification	\??\c:\program files\OptimizeAdd.dot	rundll32.exe
File opened for modification	\??\c:\program files\TestExport.au3	rundll32.exe
File opened for modification	\??\c:\program files\InitializeCopy.vbs	rundll32.exe
File opened for modification	\??\c:\program files\ProtectSwitch.jpeg	rundll32.exe
File opened for modification	\??\c:\program files\ResizeShow.mp4	rundll32.exe
File opened for modification	\??\c:\program files\SubmitSend.vdw	rundll32.exe
File opened for modification	\??\c:\program files\TestConvert.dxf	rundll32.exe
File opened for modification	\??\c:\program files\UndoShow.DVR	rundll32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3000	rundll32.exe
3000	rundll32.exe
864	powershell.exe
864	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	864	powershell.exe
Token: SeBackupPrivilege	1716	vssvc.exe
Token: SeRestorePrivilege	1716	vssvc.exe
Token: SeAuditPrivilege	1716	vssvc.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1552 wrote to memory of 3000	1552	rundll32.exe	83
PID 1552 wrote to memory of 3000	1552	rundll32.exe	83
PID 1552 wrote to memory of 3000	1552	rundll32.exe	83
PID 3000 wrote to memory of 864	3000	rundll32.exe	91
PID 3000 wrote to memory of 864	3000	rundll32.exe	91

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4903f3effb98da65c49bb9591c16615d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1552
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4903f3effb98da65c49bb9591c16615d_JaffaCakes118.dll,#1
  2⤵
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3000
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:864

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:4548

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\4x52109-readme.txt

Filesize
6KB

MD5
54d93ec67aab0e6a5f5c3017f485abd2

SHA1
70103a198cde5e25fb6690f2cbaf757632dba01c

SHA256
a4895b87fe7d53804c6e4aa515d2dbc48b721134c1e69fbf03e10edc55f9cc67

SHA512
82d31b59aeb86aaeec8064186c2382dba3f572e41ca7cc3c9542c1922dba976092833b13d1ad5768a44a9e2b540248b4496f6469240d6f37fd85741ce0bdda96

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_f3yh1vpf.0zw.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/864-0-0x00007FFD81B83000-0x00007FFD81B85000-memory.dmp

Filesize
8KB

Download
memory/864-6-0x000002AFCE430000-0x000002AFCE452000-memory.dmp

Filesize
136KB

Download
memory/864-11-0x00007FFD81B80000-0x00007FFD82641000-memory.dmp

Filesize
10.8MB

Download
memory/864-12-0x00007FFD81B80000-0x00007FFD82641000-memory.dmp

Filesize
10.8MB

Download
memory/864-15-0x00007FFD81B80000-0x00007FFD82641000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing