General

  • Target

    62cc976b335d33848dbdc344375801b9_JaffaCakes118

  • Size

    166KB

  • Sample

    240521-letp9sgd3t

  • MD5

    62cc976b335d33848dbdc344375801b9

  • SHA1

    6b592e83a1bc9ec234b3548a3f52e0112db306dd

  • SHA256

    34c349ad87efc8600b75c1395106c183e1c5197d38f0ab8dda3456c27f748a2e

  • SHA512

    21cc07df4acee862c22d54445e266ebcf261bd524ca0174899c4325ad6ac67c958b4512cb5414d7bd5c19f3007ad28f3d09bde93445c42bdeb765af2e4e1d252

  • SSDEEP

    3072:1LFrb30BRtBZZg+i2ayy2RjLTuVyu7CJDgoMT3Q24PZICwP:ZJ0BXScFy2RsQJ8zg2QF

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$/4ufsothGtNeVhVjDNL2ROnKsA97bjRmE.w0bFwIYPnZZQYuLjH7K

Campaign

3457

Decoy

coding-machine.com

markelbroch.com

hairstylesnow.site

wurmpower.at

rerekatu.com

gonzalezfornes.es

bundabergeyeclinic.com.au

lefumetdesdombes.com

huehnerauge-entfernen.de

nativeformulas.com

jusibe.com

launchhubl.com

aselbermachen.com

izzi360.com

meusharklinithome.wordpress.com

scenepublique.net

herbayupro.com

transliminaltribe.wordpress.com

myhostcloud.com

eaglemeetstiger.de

Attributes
  • net

    true

  • pid

    $2a$10$/4ufsothGtNeVhVjDNL2ROnKsA97bjRmE.w0bFwIYPnZZQYuLjH7K

  • prc

    firefox

    sql

    powerpnt

    dbeng50

    synctime

    excel

    dbsnmp

    tbirdconfig

    wordpad

    infopath

    outlook

    msaccess

    mspub

    xfssvccon

    winword

    ocomm

    steam

    agntsvc

    thebat

    ocssd

    mydesktopqos

    mydesktopservice

    onenote

    oracle

    encsvc

    visio

    ocautoupds

    sqbcoreservice

    isqlplussvc

    thunderbird

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    3457

  • svc

    svc$

    sophos

    veeam

    mepocs

    backup

    memtas

    sql

    vss

Extracted

Path

C:\Users\17170k-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 17170k. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F4540BBE80F6F252 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/F4540BBE80F6F252 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: c4k+fRmRIM2JT3u1VQrHyKYhCumaDDniPb1H5Kr5o88bmy+9EnoH4iUklA+tj6Y/ BQGnEAcTSK/haf5duE1aF43MRbGlV2M6XXt85db0OqNpHw4e11fMTzzku6MKgIUF hrmmsyn1J5AnxY8ZCKwbzUGfgx/Cej7f/ZbAe9Q2lyPpi2bkkAoTCOMDMYSRkRqy 4xq0XY75TrRYrT4R8V6r4fAmYcYUoYX775CmfWL7pCwtbRY3OicG2ScOdOxLsLXm sjQwE3IqJ/y6cEm6WeELnQ+nLYSQElWPw1SS/ZMMhkCpl6rr8TaWIgnzeYV4XYfx cId/mkc/caotV8p9/kc0jOJJOmC8iHucGqvFcLHjlkmDW3dajAbxNpPQtmN7a/PG 3tHGfysToR4u2tBOQ0JU1T9iaNT8lZxrvc3xGwRa3cT1qad4U2oeAKqe70jPdaRr cHwMqF13I6alPGS5/7JxXMyk38XztAWJxTTLYappGeVbJpYIiZVYZYz2BKYHu8FH XCoWZg83qDPI7Pk5/CGwQCfZ1gq+hc+N+I3ntqHI4t61GQ80DPGJhwgoPYvQFocQ z7arXmzE70YbyXKqZC2D4PqtWNxmxVXoMb4ExB4PaAmTiXdViYDKlH6uOIaUjaIC Gyr/2smm1tLZSlSs8eRma7++CTZHox4RnKGTWdR6N+S2ww83WkWLAfAwvVEyGwAU cI2HoQTOEuhDq7JrKMV3T6Yb/1FCcC+DcEOlhD5gwPkQcTnbyWxsnh9068iNxBPa jgj0AExzACyVysQLQ/0mD9w+HyE5htK9VbFrfwrBfYxDgrsqdU1MzZS/GvS/q/Zb HLT4SdGyZnbSVGw4qM5nFAegovhrsfAAKqLb/lAIyzu1KNe37eHoADJkKsEYgnd2 JH4jVZ2nht3wyhK4Ko4AIMRZVkdYxTBltvDUIwWlVfd79Texz4b/2P2JntmpYno6 ZQHloB9hYSx6Tp2Ckp6E5TwIzc1QO+VYOFR42rbxBh2jYZGvz8l+tWlwhc8A3PtK zhVcXRxsqLeuti6MShfOi67AUxDPLQmW57WRN2PI2ZWNrCezgWM6wFBPJO6R320J sF5rhmS2p0g2XdZ1lH1sVfoFNQZ3K4hICSubRX/yOhtv3HhG6mHWW44O6IpXRaME cIXwhSlUfnn+aN7w+1Vkqi4FGtOZgIEEegpszUpe3zJlgknCtbmGEhm0DN/jV35Z 604YlDJrCvn1qhJAa8O8d9qwN7oq2mWdxMZQbaxyWS8uehajSuOHItd6UcjyZw7P Io1f/MJi8/EU8vPd1LDu8NQTtvfgDSNsFnRNjxGEeXQNnncItYCIWMMfmghEgJy0 epzWh7S+c8uJXMRkZu5BUEw6VuyUA9A16rpQmKMzAe8= Extension name: 17170k ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F4540BBE80F6F252

http://decryptor.cc/F4540BBE80F6F252

Extracted

Path

C:\Users\9cr0jf-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 9cr0jf. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/782A96977C490CFB 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/782A96977C490CFB Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: yYzLeba6fQT6hD/1p5rAldpK5URPcCqDxjHjMyt6g89ipPunIuH4ZGURpkgVUInr tzt7RGQIC+cgp4I+k0hOdO0TFynynC5e9QP+vPC82OZ8vnqOygRNw51EhYaX/PhV 84kVAVjKo2ivzwm5gnomaEi9lOGPozjmHoP+at9zE4or/0VNGORE4BsH55j0tXK/ AoEXyD6PE1ej7ayXwJZwI/nMe3LnTwYyWMCc/h9ibcw+F6iLepUz9g4Rt1i11kh6 ZR5ZBhoWZAadjKzE3+SLcCRbBDKJ0LfJ5kAg/h17sxZubqNj641CvLtAooTV9yLb zqKDhOxQZUxorCRMWbr0+HNFQkcIEHCovS999XsdqbuD4NlOBc+y0tO0m9GijJr8 FVhuc4imBQUOpbDcrUeRQqyShWnf1zHWlI9bnCgkqT13O2OMPZN6VpYsWHTZ0hmf nhHjapyf0H/qBPj8Jzz6j4f7AGpCqs2lUjb4xDc2BwqUR4xv0yfJifY+ZG5VAi3v JEfrI4l7MUY+a5dWaI41FuCka+oBuQeSOYNzw2HmLWL03/JvNPPp/6+fuwFfCVLh W95d9pp4eIjumu3ZbCzPadsmYBXJzn6BTGad/w1ME3cK9khAXvMXj6B7Z9DcOkEb k/XvvAdp+4dzI6GXNkS1mbQ4G5WOqeKWjfyvDTlKcc+rHD2G7hQ937vywsRKgF4I cu3GFHU7DK8F6DUZoYV18dRSIeuayK1mE3mkyvHqA97utezzV5LgOvQEsaf72AT4 mNdEaNAYWCqyfJ5GgcgzcYgdYCWfmG81eDLY77nckJcNBUdIpczv0gU2kKtxBHzR PdZK/r+fxpy9Vca42eLqay7PFgL3Q6Zl04iOgaY8jMBQdm41/0N4gHPjmdaQXyhW 93bPPLKj2waGYflKxZ1IhFwZj2SDafueP22MeoGV/lOfOw7jVvFo7XaLl5I4t0Fg vbAwyBGvDT83nmgnkA2eVsUTLVEfe6/2XAuFjKLbh+Ae+4apTrBwe0K/jvpBloKd z3k9ixdUHuhJT2plXo56hACGVkGJARgqZQoJaL1MGpAQMD53zYXEJl16hy+8vjc7 aD8QBSHZlkRMh/jd1GpOAkjeLc7nTVvrtJ3KB0J/jWfWcfsxS2tXBmtIRQKsNqdA z0SYEY9Vz8lUlO5K3D9u4kTPaQ4i1RwZ3VuyzpZzISzkEhP88uBc/5BD+oFKMrQi 1V23fLiZKnInVFhIZsfjDgzFrC1IWiTrKoa3RBd3phzb1QpoyivQm++AHu5agDHV 6rpF1hr0raK7xOiq3dM0z48lPTPjF0C1NvmqofI+Wyn9p31ejCfFDoVLuhOEdZSR WT3JzCrT7kf2iqtw+lZCqs9rWbrhTp+Inbdpvr0BQu7d/86Y3yU= Extension name: 9cr0jf ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/782A96977C490CFB

http://decryptor.cc/782A96977C490CFB

Targets

    • Target

      62cc976b335d33848dbdc344375801b9_JaffaCakes118

    • Size

      166KB

    • MD5

      62cc976b335d33848dbdc344375801b9

    • SHA1

      6b592e83a1bc9ec234b3548a3f52e0112db306dd

    • SHA256

      34c349ad87efc8600b75c1395106c183e1c5197d38f0ab8dda3456c27f748a2e

    • SHA512

      21cc07df4acee862c22d54445e266ebcf261bd524ca0174899c4325ad6ac67c958b4512cb5414d7bd5c19f3007ad28f3d09bde93445c42bdeb765af2e4e1d252

    • SSDEEP

      3072:1LFrb30BRtBZZg+i2ayy2RjLTuVyu7CJDgoMT3Q24PZICwP:ZJ0BXScFy2RsQJ8zg2QF

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Adds Run key to start application

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

3
T1112

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Impact

Defacement

1
T1491

Tasks