Overview

overview

10

Static

static

10

6723ff7149...18.exe

windows7-x64

10

6723ff7149...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/05/2024, 11:42

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    6723ff71492b60139a98a6497a87cf3b_JaffaCakes118.exe
  • Size 115KB
  • Sample240522-nt3yladd93
  • SHA256 c86d0f1e2ba023322a6d580286a0eae480a3bdd3012c444207907ef0c16eca64
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
sodinokibipersistenceransomware

Malware Config

Extracted

Path

  • C:\Users\mx813nrt2-readme.txt

  • sodinokibi

Ransom Note
  • ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion mx813nrt2. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/BBB456361FD4EE79 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/BBB456361FD4EE79 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: +gthiD2xbC/wQvlyFevpGux9rf+d7C8QcmeAqZFctEkiAk8v9pFHc1ov0qD3a79S fABxb1k0xXGiZ3XVoqPdv3aYSGUSSVaA70OZE6fkN9Cv6DAV2JO3vDagePRM1dC2 R6g55yHjgeBUV3UaNHEZ6ud9Sp+3z/2URop9yqN+Z4x+jXUdQkotxyCquHUkr3+Q N8ORfXLrhhYln1ojhI1e0hkJ3Qmfw+vdUOMUyeFI+vH6eXsuRv+DsaalYaGxlCLq h43RuArsFVzjJsztKxxNiHIGdX+jnW1AUmGHdVvNbh5t+IpEx5CgzfDtmOApfBaE LhUsBe7wyej5Oy7D5T363uus7WhRP2yGumyqm9H51IvV2Bi1v+zVDGfz8G+1uptt v4EMWCsrnbDUuixFRRJLGvQ26Lqoet1pDxs1J3FhIyh0/Orx/rOVLmKYGotYdCB0 PwSwPfMgTeGCWI52aX0X+Wj/Q/VP4//k/nzDVNPWASOZ2qaMetOGCejIExgn/1hc prTm7EMAjlntwkSlOUSbJgsEy+bpA3+SJC4FXvcBlPLhDjTLZTfVtzc84SB8Obis 5JMyNk9eFaaydiv6Ba9AshkSebBRVMmAsl1lYrWU/bTOB4bgf+RPFDWu8uVnbeTM BHS68YRs/01eiWAbpHsZYGK1X0+OadKjhaG8jvYKWf/EIGZaynYxiC5fYbIkOz77 ybnR3heh7OYiYXaDOI+FOUBH/WKVoyI5rpl5HWjnQv3dQyW0RFsfMZlIR41nJ8kD wFG/lMcB1cs9m/Pck2y1sMYIGj4qTgU1q7daYvZJ8LXEgAHAl0cYP2uw+s82Omp2 mSmHrrdlrQGisxSsbJMSC+A0t2ZUO/5boDaSrHnhzuE/4U/Wwdwfeiv4t77Lrfr8 6hpQVAwSN/fdOAwtKcsrb9gRrOfBN+w6BH+asfPdRl8sc8HBq8/ccCGyO+XyIHhw SjM1iFK7NHh7qo0N0u44Mv7EGQtMK3bbC3A041uugt+FtDRtJzu/KHDtpMP1eINZ DuTphfqlrGMaoKAYE0kEOlc2GXKBv4yY2olGAD/GUVCLug4ZYzgDFeIfeAa1ycSZ nuNTGqGpHaCLD4SZ8Qz+Y9gI6y38KG5ELjsdlm/2A5Up2YVX5TIRk4q8pLSgb9lI LhkeTnp6txG0bCuDHtL0GzmXjOm/8CB0T95Wd2x96fUZV47sY4ItKfxsGkPzChBt SGgaFCg69IKX6+ajOUZzgbbEemAQF9uPAr7WNXCr5JtaxUjdSG8KU4e28m4OJ/Kp kBq/o5QTznoHKEdHg+qgwFQECVarLYu126cn5OnUR3TghEso4ne3r91UB5688hB6 fNy8gUdYcU9Ev2yCPHwufXJ78o2caE0abH/BnllR0SblYhBeMhKWj3iuH9Q= Extension name: mx813nrt2 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

  • http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/BBB456361FD4EE79

  • http://decryptor.cc/BBB456361FD4EE79

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 33 IoCs
  • Modifies system certificate store 2 TTPs 14 IoCs
    evasionspywaretrojan
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6723ff71492b60139a98a6497a87cf3b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\6723ff71492b60139a98a6497a87cf3b_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    PID:2508

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        mx813nrt2-readme.txt
        • Path C:\Users\mx813nrt2-readme.txt
        • Size 7KB
        • SHA256 261865f52553f23c820f2a7af76cd8dd81e7ca90d5e304d06c5fa847ebbfabd1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download