Overview

overview

10

Static

static

10

619bcc1654...18.exe

windows7-x64

10

619bcc1654...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    619bcc16546e3d7ddea8045fa88f65fc_JaffaCakes118

  • Size

    157KB

  • Sample

    240521-bv4v3adg67

  • MD5

    619bcc16546e3d7ddea8045fa88f65fc

  • SHA1

    bab813d5a45552978bba9a413089222c3f225a6c

  • SHA256

    5fe8e804cc0e7d211019bf37dbb18e4a00af24be11cc9407fac6d648c01716fb

  • SHA512

    22997dc1a27b3ee620ab248336dd7a373d7a5217c30135a36943555e605ae7ea81fe55b5c0b596bc14748831144ae91b4272dd6a319cc3d69bea2fa7caccdded

  • SSDEEP

    3072:Fi8Iy8EytSLbi4eTMlwDCnuZ3jmOaqGpeT3:U8IUykbnWJZ3jmOaqFT3

Score
10/10
sodinokibi810defense_evasionexecutionimpactransomwarespywarestealer

Malware Config

Extracted

Family

sodinokibi

Botnet

8

Campaign

10

Decoy

fbmagazine.ru

palmenhaus-erfurt.de

jacquesgarcianoto.com

vapiano.fr

pureelements.nl

efficiencyconsulting.es

schroederschoembs.com

wallflowersandrakes.com

irizar.com

kiraribeaute-nani.com

ketomealprep.academy

imaginekithomes.co.nz

andermattswisswatches.ch

imagine-entertainment.com

rhino-turf.com

the-beauty-guides.com

adedesign.com

phukienbepthanhdat.com

smartworkplaza.com

chatterchatterchatter.com
Attributes
  • net

    true

  • pid

    8

  • prc

    mysql.exe

  • ransom_oneliner

    Your computer have been infected! Read the {EXT}-readme.txt file for more information.

  • ransom_template

    Hello dear friend! Your files are encrypted, and, as result you can't use it. You must visit our page to get instructions about decryption process. All encrypted files have got {EXT} extension. Instructions into the TOR network ----------------------------- Install TOR browser from https://torproject.org/ Visit the following link: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} Instructions into WWW (The following link can not be in work state, if true, use TOR above): ----------------------------- Visit the following link: http://decryptor.top/{UID} Page will ask you for the key and extension name: {EXT}. Your key code: {KEY}

  • sub

    10

Extracted

Path

C:\Users\Default\zg1l099-readme.txt

Family

sodinokibi

Ransom Note
Hello dear friend! Your files are encrypted, and, as result you can't use it. You must visit our page to get instructions about decryption process. All encrypted files have got zg1l099 extension. Instructions into the TOR network ----------------------------- Install TOR browser from https://torproject.org/ Visit the following link: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/2F15BDB62D29967B Instructions into WWW (The following link can not be in work state, if true, use TOR above): ----------------------------- Visit the following link: http://decryptor.top/2F15BDB62D29967B Page will ask you for the key and extension name: zg1l099. Your key code: Q8+TJ4w35bz7ikW/EwuVHBPfHiWkzej1groA+WJia2FEnbCWk3+30gS2vaq/jBa3 HuXWVKPQA4M918uabvpLPOAIB6+lWHBi+HmM9R4PQpqPO107bD1pIk1PCopSOZbY m5R9+UNzvHiWX+ia8nycNhRax8mh0bVKuJCN7oIvKndrZI/JrmHtHYaHx+3WhbMb YoaVTkSttGFp/A+MW4gnBIWnEu1HeH6Tdrj3JbJDfa1KknsugquyjJpKGVSszms8 oI9hptbOSirDb+DCDRiB5f6QZywISuG7tWzVi5izZp8+Mj2ogP2qIrgLuj7iSxTV pLw6xfPc63Dmf+WhAstnhC3te35ntLJlWtNKoG/xuRxjS7S0lbqOUFmRYeBr2HhX aSdwWOrhpvszNhqeRPwx4MryBSbd0YDH/13ZWyGv0fcjCdaJ/VRSGs2QrOBhK7oZ /1jX2J8fpLg6Ptu3RR2dz4/hyu+XAgccZ5HGi6n1OhUN0ZGkepfESGFPe26/0n4+ scFYLvH7mWm04yau/ly3nb8JZlEmSy0oB+5tXJIN3YDb4T8UHMbzXMB68tbge3Vg ntkNR6Z2bbqzfdrbA1AB/ebnNr1XKy91tYUhPIYU5qfux9Es2kYkF/NJJVwtDOUr PrfPSRbDyN2TLMWiRZ/xBQTjZ4TALEdGq614ABeTf7ix4urMblegkZQz4hYnJnt+ OYAj4IFrrQTFytXgs6MaAuD2o+j14zMcZtTi0ardAF+84PSbj/FNFx5xiakTIzDQ DWJx54C55eWXzUevnhKFAWqNPoqq8vH/m8j/6KZCI22SFTdlfWA+8CNI7t6JAqm8 QJUPKDc3uGKYq7QnyYs+PGjnoo0HrgV6r8UTWbeiXo4WcYT58FTJn9wGOt9y6B0Q 7/VPTHYW8ROWkakpXJ7iZFD5lyhJC4CYSnPQpXOCv7iZYN04t1/7HewAmmmyncjZ MUdC2huy0QLAcrxwTAhr7rY0+tS6DvS/X5B4Y4mufFr9qkBRUesJQHMXG2eWxrel 1ngMrXQAiimaVj9N5hWV0vcgyiXHkeHVf7G6eDe2UGvNw6fqJI+OgHbA84yIiQyf oB4saA3kTeL37XOmTLtcIglhKV19XB8un+HOsYWWKXRVlJJCPqoXFUWOMZa3ow5p XJTGKMR0qbrOAPwnW15j854cytyFWMF/
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/2F15BDB62D29967B

http://decryptor.top/2F15BDB62D29967B

Extracted

Path

C:\Users\Default\121q42l-readme.txt

Family

sodinokibi

Ransom Note
Hello dear friend! Your files are encrypted, and, as result you can't use it. You must visit our page to get instructions about decryption process. All encrypted files have got 121q42l extension. Instructions into the TOR network ----------------------------- Install TOR browser from https://torproject.org/ Visit the following link: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/578D93FF9A00C149 Instructions into WWW (The following link can not be in work state, if true, use TOR above): ----------------------------- Visit the following link: http://decryptor.top/578D93FF9A00C149 Page will ask you for the key and extension name: 121q42l. Your key code: dedGPfkRndvBohy3Z7W8sAVFkoLX/io+FrVlI+AKOkPRzq2mSTDhCWtqNcVYHeaN 3k8kgf9U6a1ABlRqwltPkxF35GJCPAv6HkkGA4xeJKtQoBfcQKkC4FNzUIwJ0AO0 /PhjkpraqMpyvnG53mp3XsAsqiX8Wf4/iyCMPnHw2OomdCEvIfknd24b2fOWsHjN gmyphIyPDXp7hc6kdVcxJ0fVmZVlAK20tGXx9wdVqBGMgml8XP+wSvqVTTNkX2D1 g4+v7ypwCVPEvK1357Ug8YqlKp89yuZjjRJRPrlPJnybacuvzBS+Xf0ECkDVn/9d YZVWODvaC2BRrf2VFyZ9q+nQz19Nra54oaai9wV6wQxsclgmMi/CkI8Mde+5NajP zifH7PSP84P6Gwwsch0OXPkzq/uyXvagRmaQsOt6BiNBnjwOxXnOS7ARvxSkl420 Khi0ox8AFuprux769a+pzQILP5OOBuR1Ftdf+DCL1VQE6AKs68uT00Z2ao1A2l3d ZNeYOdsRlPMZ5Z/hkM3SRIfAmTK1drnv7D1Ma3zb9lrMafN140Y1ttEFXHAYud+p ffiiHF8EDdRRtMnaBnEMpeSnOvpkUOEKREBB3KksD+vm1PmlIeeRfYFQyOdFqM5b VsVdzwKLy3PsbqMVT2v9zYMrTSXQgtqRmhd2f65bKSLuDGvf7noEdNBq6aVTqvuI lXxUlN/4eRkUXMcAPm10RZbsLpc3OPcQQ2vVEbuCxoynlMHBN7r9fOMvjKcchlzf gu/VD2X6M4x3GFud/MknYAE/lxWohWLwL4p8M+1rmkaTrCTtMub0S3ouwrhPUEgt oEM6jJ6jLTxWUw8rRYNsce+OJcW6VpMPxnacmm2Ra+4O5zi45QM6wea5xP2FoIEg Nc4lSFjrU7rnYrfdcb8ky9y63XBfWJQzv1dArTcUHl+xgmmmHDAA9g8k7ZheggGz csmv926iMSm97+I7nMePq4HxDXm75mKrNRbw3rzDEBo3PY72mh5gqfRzl86W7nS9 ae9dTydbZjE3n1uYoqq0zD/C7l8cymL9gn7cb5TAV9SGC8WY67r6alrUtdsakVIL NQZCYG34lrz9alLbkE7Nn84MKRD/fwsR7MVBjJ8Szt1sKTfX3+wTLfy5G4Q8iGRx e/Gp1XocbCphaqZGe7GvvG/GAJSPz8ZCFNbQjnWq
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/578D93FF9A00C149

http://decryptor.top/578D93FF9A00C149

Targets

    • Target

      619bcc16546e3d7ddea8045fa88f65fc_JaffaCakes118

    • Size

      157KB

    • MD5

      619bcc16546e3d7ddea8045fa88f65fc

    • SHA1

      bab813d5a45552978bba9a413089222c3f225a6c

    • SHA256

      5fe8e804cc0e7d211019bf37dbb18e4a00af24be11cc9407fac6d648c01716fb

    • SHA512

      22997dc1a27b3ee620ab248336dd7a373d7a5217c30135a36943555e605ae7ea81fe55b5c0b596bc14748831144ae91b4272dd6a319cc3d69bea2fa7caccdded

    • SSDEEP

      3072:Fi8Iy8EytSLbi4eTMlwDCnuZ3jmOaqGpeT3:U8IUykbnWJZ3jmOaqFT3

    Score
    10/10
    sodinokibidefense_evasionexecutionimpactransomwarespywarestealer

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

      ransomwaresodinokibi

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Renames multiple (184) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Windows Management Instrumentation

1
T1047

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

2
T1070

File Deletion

2
T1070.004

Modify Registry

2
T1112

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2
T1490

Defacement

1
T1491

Resource Development

Reconnaissance

Tasks