sodinokibi | 158b1e1fd5719cbe6fc125d17020d0d6fd1365ef3b6db69941380e5f4c34a8ce

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
20-05-2024 16:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6000b457610de78f95e1e4f1bdca7752_JaffaCakes118.exe
Size

161KB
MD5

6000b457610de78f95e1e4f1bdca7752
SHA1

1f5c7dc950dc36a3853229256ece8d4f493d0145
SHA256

158b1e1fd5719cbe6fc125d17020d0d6fd1365ef3b6db69941380e5f4c34a8ce
SHA512

8a8b54ba89db8a5a6247ab1ae8cd0e53ea730fbe9c18900023d186250a67f024dc1f7916efebf9c6c33a0f63ebf5ce7f02a52e6abb294eddf39fe19273e75e88
SSDEEP

3072:Hp5SexkWi1Lbi4eTMlwDCnu/q0FvbVl7Kr:JvGWwbnWJ/Z77m

Score

10^/10

sodinokibi ransomware

Malware Config

Extracted

Path

C:\Users\nidil-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion nidil. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/872FCCEF45FDD0F2 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/872FCCEF45FDD0F2 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: QdDZvqyQ+dW2HagTm8bW6mAmusuvVuEUzObSG8Sp938HyXMkds82Ufh0RFv5Vrls BMYy4aWgS14vqUVW+wjvkWlMPV67blGl6HIAWADyxOWDN4oWQChkSNi7RhUcZnEn 39YTcYaaS2AwezfkfzZNpv5O5CRPFgCC48V/zFL+xxCX0GFlJ1PIeNoME/DJ6QZb lcSCSO+onit/pRpAZkLC1hrADYMaRIv/bzt3dIWiYcjmu1Nzn/h5/J61eN7ch1w9 o+WTD8PpSjoA9+/ADHT2s8030NxSfDQak4w3pZ/FPZY2KYIAFWs1+a6Be08uWo0z Ni8kJceOiOXQGOu65uk4tYZjL6qBIvjOwvONvL+hsf8ADRJ8e56zO4iMXLikgbGb I2UY1ZTlsb4X9hsjAveBbP4z72cjuR46A2TFbUWulgYeQ+tMAv1y5wd14vmUqdvF 7CS/tjNASW4ydTVmF6+gnlneyjKEiA1YOijLnOd8PsEnUevqjVbqiNQxDtTtBtFV et2gVfmEtAIPgQsbkzh+AVbylYBzbkYvvkovD/Y95HCRPNEyxZ44qhW4b/1U9yf4 KM7GmRxIUz1HY6mScEN7n6Bmm3kcEMiDQrnNmH715mt5IZP/4p6bre1CwaGucnWX zonnNpw2PlDU5HxD0EcEylbi3VOEUoOmbmyZggmIjy+UcWD7zOog0b4ORLUDGQh0 ZZGr3uR6LrByMlETdtMVpS4L4qWyZbHB4H1wEb894lknQE8XaLUtO4X3pwK/76wt 0d5IKJGl4uQiL8YZoi+S9d83Q7wBOBU2T8IEWVj8bzCwxbiqFw4ndIsoUq+6aPSq 381EuSubSGlshtgRnFHdXxrLPFundujqZw5Ce7E0nvTzf07DSNQYvaaV8u8w20QY ZJ2xwiMUClfAgm5gvRKzlzJ7hdbefd+tnydxdEhDONeVdNpD3i9rqtnrJDm3J8Qv 3w3x2C5YwT1MY2x15McXwvDX///ioqQaRPcS1UBhpttW8IQ4UhpJtGVd5MXRe+xS kemfLMo60uDU6d/umvPJdVo/k/+4q7hkFQoxWCkbtqH0g9eJOhRKNhJ+52qkpDqO t4KWmhA4wjC6ZRIq4fg3S+zTE7rsL7VGvBxhQgyOzchrhv7B+DNfbkxXldbu7xTl O0pNvj4jj9bA1dpsOZyqDOcF/AaPfSEDrSepRgbP9aWBpW2QG/gQZLZqOHFC8KHc CG4iQlOso5DTC+vl0Ww= Extension name: nidil ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/872FCCEF45FDD0F2

http://decryptor.top/872FCCEF45FDD0F2

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	6000b457610de78f95e1e4f1bdca7752_JaffaCakes118.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	6000b457610de78f95e1e4f1bdca7752_JaffaCakes118.exe
File opened (read-only)	\??\W:	6000b457610de78f95e1e4f1bdca7752_JaffaCakes118.exe
File opened (read-only)	\??\E:	6000b457610de78f95e1e4f1bdca7752_JaffaCakes118.exe
File opened (read-only)	\??\O:	6000b457610de78f95e1e4f1bdca7752_JaffaCakes118.exe
File opened (read-only)	\??\P:	6000b457610de78f95e1e4f1bdca7752_JaffaCakes118.exe
File opened (read-only)	\??\Q:	6000b457610de78f95e1e4f1bdca7752_JaffaCakes118.exe
File opened (read-only)	\??\Y:	6000b457610de78f95e1e4f1bdca7752_JaffaCakes118.exe
File opened (read-only)	\??\G:	6000b457610de78f95e1e4f1bdca7752_JaffaCakes118.exe
File opened (read-only)	\??\K:	6000b457610de78f95e1e4f1bdca7752_JaffaCakes118.exe
File opened (read-only)	\??\F:	6000b457610de78f95e1e4f1bdca7752_JaffaCakes118.exe
File opened (read-only)	\??\A:	6000b457610de78f95e1e4f1bdca7752_JaffaCakes118.exe
File opened (read-only)	\??\R:	6000b457610de78f95e1e4f1bdca7752_JaffaCakes118.exe
File opened (read-only)	\??\D:	6000b457610de78f95e1e4f1bdca7752_JaffaCakes118.exe
File opened (read-only)	\??\J:	6000b457610de78f95e1e4f1bdca7752_JaffaCakes118.exe
File opened (read-only)	\??\S:	6000b457610de78f95e1e4f1bdca7752_JaffaCakes118.exe
File opened (read-only)	\??\U:	6000b457610de78f95e1e4f1bdca7752_JaffaCakes118.exe
File opened (read-only)	\??\H:	6000b457610de78f95e1e4f1bdca7752_JaffaCakes118.exe
File opened (read-only)	\??\M:	6000b457610de78f95e1e4f1bdca7752_JaffaCakes118.exe
File opened (read-only)	\??\T:	6000b457610de78f95e1e4f1bdca7752_JaffaCakes118.exe
File opened (read-only)	\??\L:	6000b457610de78f95e1e4f1bdca7752_JaffaCakes118.exe
File opened (read-only)	\??\N:	6000b457610de78f95e1e4f1bdca7752_JaffaCakes118.exe
File opened (read-only)	\??\X:	6000b457610de78f95e1e4f1bdca7752_JaffaCakes118.exe
File opened (read-only)	\??\Z:	6000b457610de78f95e1e4f1bdca7752_JaffaCakes118.exe
File opened (read-only)	\??\I:	6000b457610de78f95e1e4f1bdca7752_JaffaCakes118.exe
File opened (read-only)	\??\V:	6000b457610de78f95e1e4f1bdca7752_JaffaCakes118.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\y3e86.bmp"	6000b457610de78f95e1e4f1bdca7752_JaffaCakes118.exe

Drops file in Program Files directory 40 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files\DisconnectFormat.xlsb	6000b457610de78f95e1e4f1bdca7752_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ResetDeny.mpa	6000b457610de78f95e1e4f1bdca7752_JaffaCakes118.exe
File opened for modification	\??\c:\program files\UninstallRemove.wpl	6000b457610de78f95e1e4f1bdca7752_JaffaCakes118.exe
File opened for modification	\??\c:\program files\UnregisterInstall.jpeg	6000b457610de78f95e1e4f1bdca7752_JaffaCakes118.exe
File created	\??\c:\program files\nidil-readme.txt	6000b457610de78f95e1e4f1bdca7752_JaffaCakes118.exe
File opened for modification	\??\c:\program files\BackupCompare.txt	6000b457610de78f95e1e4f1bdca7752_JaffaCakes118.exe
File opened for modification	\??\c:\program files\CompressSwitch.jpg	6000b457610de78f95e1e4f1bdca7752_JaffaCakes118.exe
File created	\??\c:\program files (x86)\nidil-readme.txt	6000b457610de78f95e1e4f1bdca7752_JaffaCakes118.exe
File opened for modification	\??\c:\program files\CompleteMove.vstx	6000b457610de78f95e1e4f1bdca7752_JaffaCakes118.exe
File opened for modification	\??\c:\program files\RepairRemove.rtf	6000b457610de78f95e1e4f1bdca7752_JaffaCakes118.exe
File opened for modification	\??\c:\program files\AssertUninstall.svgz	6000b457610de78f95e1e4f1bdca7752_JaffaCakes118.exe
File opened for modification	\??\c:\program files\DisconnectUnlock.cab	6000b457610de78f95e1e4f1bdca7752_JaffaCakes118.exe
File opened for modification	\??\c:\program files\InitializeRead.doc	6000b457610de78f95e1e4f1bdca7752_JaffaCakes118.exe
File opened for modification	\??\c:\program files\MeasureUpdate.mpeg	6000b457610de78f95e1e4f1bdca7752_JaffaCakes118.exe
File opened for modification	\??\c:\program files\StepOptimize.aiff	6000b457610de78f95e1e4f1bdca7752_JaffaCakes118.exe
File opened for modification	\??\c:\program files\FindClear.mp3	6000b457610de78f95e1e4f1bdca7752_JaffaCakes118.exe
File opened for modification	\??\c:\program files\InvokeClose.mpe	6000b457610de78f95e1e4f1bdca7752_JaffaCakes118.exe
File opened for modification	\??\c:\program files\StartRename.jtx	6000b457610de78f95e1e4f1bdca7752_JaffaCakes118.exe
File opened for modification	\??\c:\program files\BlockOpen.vdx	6000b457610de78f95e1e4f1bdca7752_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ConnectAdd.rmi	6000b457610de78f95e1e4f1bdca7752_JaffaCakes118.exe
File opened for modification	\??\c:\program files\DisconnectResize.mp4	6000b457610de78f95e1e4f1bdca7752_JaffaCakes118.exe
File opened for modification	\??\c:\program files\NewSync.xsl	6000b457610de78f95e1e4f1bdca7752_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ResetFind.3gp2	6000b457610de78f95e1e4f1bdca7752_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ShowJoin.xml	6000b457610de78f95e1e4f1bdca7752_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ShowStart.M2TS	6000b457610de78f95e1e4f1bdca7752_JaffaCakes118.exe
File opened for modification	\??\c:\program files\UnpublishPublish.php	6000b457610de78f95e1e4f1bdca7752_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ApproveSwitch.zip	6000b457610de78f95e1e4f1bdca7752_JaffaCakes118.exe
File opened for modification	\??\c:\program files\CompressGet.svg	6000b457610de78f95e1e4f1bdca7752_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ExportSearch.xltm	6000b457610de78f95e1e4f1bdca7752_JaffaCakes118.exe
File opened for modification	\??\c:\program files\UpdateStep.M2T	6000b457610de78f95e1e4f1bdca7752_JaffaCakes118.exe
File opened for modification	\??\c:\program files\UseEdit.wvx	6000b457610de78f95e1e4f1bdca7752_JaffaCakes118.exe
File opened for modification	\??\c:\program files\UninstallRestore.clr	6000b457610de78f95e1e4f1bdca7752_JaffaCakes118.exe
File opened for modification	\??\c:\program files\WaitGet.pcx	6000b457610de78f95e1e4f1bdca7752_JaffaCakes118.exe
File created	\??\c:\program files (x86)\62161c73.lock	6000b457610de78f95e1e4f1bdca7752_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ConfirmConvertFrom.temp	6000b457610de78f95e1e4f1bdca7752_JaffaCakes118.exe
File opened for modification	\??\c:\program files\RevokeResolve.vst	6000b457610de78f95e1e4f1bdca7752_JaffaCakes118.exe
File opened for modification	\??\c:\program files\RestoreRepair.gif	6000b457610de78f95e1e4f1bdca7752_JaffaCakes118.exe
File created	\??\c:\program files\62161c73.lock	6000b457610de78f95e1e4f1bdca7752_JaffaCakes118.exe
File opened for modification	\??\c:\program files\DenyDebug.rmi	6000b457610de78f95e1e4f1bdca7752_JaffaCakes118.exe
File opened for modification	\??\c:\program files\RestoreProtect.potx	6000b457610de78f95e1e4f1bdca7752_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4388	6000b457610de78f95e1e4f1bdca7752_JaffaCakes118.exe
4388	6000b457610de78f95e1e4f1bdca7752_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4388 wrote to memory of 4648	4388	6000b457610de78f95e1e4f1bdca7752_JaffaCakes118.exe	89
PID 4388 wrote to memory of 4648	4388	6000b457610de78f95e1e4f1bdca7752_JaffaCakes118.exe	89
PID 4388 wrote to memory of 4648	4388	6000b457610de78f95e1e4f1bdca7752_JaffaCakes118.exe	89

C:\Users\Admin\AppData\Local\Temp\6000b457610de78f95e1e4f1bdca7752_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6000b457610de78f95e1e4f1bdca7752_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4388
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  PID:4648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\nidil-readme.txt

Filesize
6KB

MD5
6cd64c447c39cdbc050cbbf015260d70

SHA1
1cc6801ac4f57e262df5cf8bab4c1b3104265c40

SHA256
b2e578417ffd6d85d9b316705384a631b96bf13908e21fadf3fba000755883a5

SHA512
1c2de3af8e128b0d3dbd5ca683935a663a9fdaebd44e94797cab8a8157fc2e2e132260b24150b26e76fe9a6aed639727563c25c49d5324461d33a1d1476a057d

Download Submit