Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

619bcc1654...18.exe

windows7-x64

10

619bcc1654...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/05/2024, 01:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    619bcc16546e3d7ddea8045fa88f65fc_JaffaCakes118.exe

  • Size

    157KB

  • MD5

    619bcc16546e3d7ddea8045fa88f65fc

  • SHA1

    bab813d5a45552978bba9a413089222c3f225a6c

  • SHA256

    5fe8e804cc0e7d211019bf37dbb18e4a00af24be11cc9407fac6d648c01716fb

  • SHA512

    22997dc1a27b3ee620ab248336dd7a373d7a5217c30135a36943555e605ae7ea81fe55b5c0b596bc14748831144ae91b4272dd6a319cc3d69bea2fa7caccdded

  • SSDEEP

    3072:Fi8Iy8EytSLbi4eTMlwDCnuZ3jmOaqGpeT3:U8IUykbnWJZ3jmOaqFT3

Score
10/10
sodinokibiransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Default\121q42l-readme.txt

Family

sodinokibi

Ransom Note
Hello dear friend! Your files are encrypted, and, as result you can't use it. You must visit our page to get instructions about decryption process. All encrypted files have got 121q42l extension. Instructions into the TOR network ----------------------------- Install TOR browser from https://torproject.org/ Visit the following link: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/578D93FF9A00C149 Instructions into WWW (The following link can not be in work state, if true, use TOR above): ----------------------------- Visit the following link: http://decryptor.top/578D93FF9A00C149 Page will ask you for the key and extension name: 121q42l. Your key code: dedGPfkRndvBohy3Z7W8sAVFkoLX/io+FrVlI+AKOkPRzq2mSTDhCWtqNcVYHeaN 3k8kgf9U6a1ABlRqwltPkxF35GJCPAv6HkkGA4xeJKtQoBfcQKkC4FNzUIwJ0AO0 /PhjkpraqMpyvnG53mp3XsAsqiX8Wf4/iyCMPnHw2OomdCEvIfknd24b2fOWsHjN gmyphIyPDXp7hc6kdVcxJ0fVmZVlAK20tGXx9wdVqBGMgml8XP+wSvqVTTNkX2D1 g4+v7ypwCVPEvK1357Ug8YqlKp89yuZjjRJRPrlPJnybacuvzBS+Xf0ECkDVn/9d YZVWODvaC2BRrf2VFyZ9q+nQz19Nra54oaai9wV6wQxsclgmMi/CkI8Mde+5NajP zifH7PSP84P6Gwwsch0OXPkzq/uyXvagRmaQsOt6BiNBnjwOxXnOS7ARvxSkl420 Khi0ox8AFuprux769a+pzQILP5OOBuR1Ftdf+DCL1VQE6AKs68uT00Z2ao1A2l3d ZNeYOdsRlPMZ5Z/hkM3SRIfAmTK1drnv7D1Ma3zb9lrMafN140Y1ttEFXHAYud+p ffiiHF8EDdRRtMnaBnEMpeSnOvpkUOEKREBB3KksD+vm1PmlIeeRfYFQyOdFqM5b VsVdzwKLy3PsbqMVT2v9zYMrTSXQgtqRmhd2f65bKSLuDGvf7noEdNBq6aVTqvuI lXxUlN/4eRkUXMcAPm10RZbsLpc3OPcQQ2vVEbuCxoynlMHBN7r9fOMvjKcchlzf gu/VD2X6M4x3GFud/MknYAE/lxWohWLwL4p8M+1rmkaTrCTtMub0S3ouwrhPUEgt oEM6jJ6jLTxWUw8rRYNsce+OJcW6VpMPxnacmm2Ra+4O5zi45QM6wea5xP2FoIEg Nc4lSFjrU7rnYrfdcb8ky9y63XBfWJQzv1dArTcUHl+xgmmmHDAA9g8k7ZheggGz csmv926iMSm97+I7nMePq4HxDXm75mKrNRbw3rzDEBo3PY72mh5gqfRzl86W7nS9 ae9dTydbZjE3n1uYoqq0zD/C7l8cymL9gn7cb5TAV9SGC8WY67r6alrUtdsakVIL NQZCYG34lrz9alLbkE7Nn84MKRD/fwsR7MVBjJ8Szt1sKTfX3+wTLfy5G4Q8iGRx e/Gp1XocbCphaqZGe7GvvG/GAJSPz8ZCFNbQjnWq
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/578D93FF9A00C149

http://decryptor.top/578D93FF9A00C149

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Renames multiple (155) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\619bcc16546e3d7ddea8045fa88f65fc_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\619bcc16546e3d7ddea8045fa88f65fc_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2784
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures
      2⤵
        PID:2228

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Default\121q42l-readme.txt
      Filesize

      3KB

      MD5

      568dead0a841e1e945386680e715af62

      SHA1

      5eb34389e04422d47e0913f4442ba314dba88d9e

      SHA256

      7534be702eb4b531c979e5151a109966abe939f6db7e535af7a0e9031893996f

      SHA512

      9e33bc3468323d14372916f5637cc90f64cc0074d7ad8148e63d7a8668e43014b1d275dd208b62443b849c92baa580a7bcd694039235fbc724031b005ca3b61e

      Download Submit