General

  • Target

    906c497e67b80e785774b046e9d100bb_JaffaCakes118

  • Size

    164KB

  • Sample

    240603-d782nabc77

  • MD5

    906c497e67b80e785774b046e9d100bb

  • SHA1

    ad42be2129e659139681b423af7558b8ee58c3c5

  • SHA256

    c80ded3fe04fe8fea1439d19c87d4c451683786c5bbdf9ddee4755ccde571be1

  • SHA512

    0aefd2aba8b47215309d6d3c1b90ef947ef39280b5627a32e7d51bdab5c2d9f71f77218bdaadc9475c2f7a8830e5d3116c7e245effe1b16aa1ee958580c88dd8

  • SSDEEP

    3072:v0XoUeZ/DVS8L73ea4MoCLfqQvFfjCGfKRw+Zn7X4:veoUeZR2TRCWQFfjCGfKRw+Zn7o

Malware Config

Extracted

Family

sodinokibi

Botnet

28

Campaign

2792

Decoy

zorgboerderijravensbosch.nl

stitch-n-bitch.com

1deals.com

loparnille.se

onesynergyinternational.com

banksrl.co.za

billscars.net

happycatering.de

christopherhannan.com

specialtyhomeservicesllc.com

wyreforest.net

ilveshistoria.com

cormanmarketing.com

goodherbalhealth.com

cmascd.com

artcase.pl

annenymus.com

entdoctor-durban.com

slotspinner.com

mindsparkescape.com

Attributes
  • net

    true

  • pid

    28

  • prc

    ocssd

    powerpnt

    onenote

    msaccess

    dbeng50

    encsvc

    thebat

    ocomm

    oracle

    visio

    mydesktopservice

    sql$

    dbsnmp

    mspub

    sqbcoreservice

    xfssvccon

    veeam

    ocautoupds

    steam

    isqlplussvc

    mydesktopqos

    synctime

    firefox

    wordpa

    agntsvc

    excel

    thunderbird

    winword

    tbirdconfig

    infopath

  • ransom_oneliner

    Sir, its just a business. Just read and follow all instructions and you get your data back. Find {EXT}-readme.txt and follow instructions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} -------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!! A system of morality which is based on relative emotional values is a mere illusion, a thoroughly vulgar conception which has nothing sound in it and nothing true. Socrates

  • sub

    2792

  • svc

    mepocs

    veeam

    sql

    altaro

    backup

    memtas

    sophos

    vss

    svc$

Extracted

Path

C:\Recovery\vuy4940-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension vuy4940. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5F2694BAFFECE8B6 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/5F2694BAFFECE8B6 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 9m+B2Ne4MoT9utgPpOMc9xXgOeVzzhnA7jWknD3UALk4wWapdvmpdwWrwBcvXO0C LJ0+Y+ID0tvpJK8PJ7Logi5q5MEi5ULbUN17RYPZKsGKcz4X9Hh8xIsNzp5CYfFp A3A2ElZqi8QKf2TvERurADYtKdYE9E05+ny5Rs/Xt2TV54hsMVf5EUboHqg54ZdS AnQzHPifpfZc8fKTB4qtm3QWR2l3mWOjP8uGmh3aAzKpcfaZUBd8zV6WPFcj3d0z vB/850i81lNVcBfANR7KB0pA3vnmYSo535fx1r5k1F9mxLhrDkG588l0AcN/Xe1U 4cwm9B5/uFcY7ktQBkaixlnsmkoM/dPGfVHj4eRvFo/qA+xIoKHR8AwtokrBGbxa QJW2MgV5lL5saKcI9JyAjXl79OIfyJkus0QjGIxjyrOKZ/lUP/DlImSKDD20ERKJ O9KIw3qxII0450EeUrhY29GQKCJ5VCc10ZbjkPE151TMfCMo/ppEsTeHzNHHz3PM f6VOigIR6H1cPyAqM6cCmMCELG//7F7Me3zshsUP1y5U0OI4OmBXNKkQ8IWF3syj R8pkw42QqxDQh/5GRDa6sHI09vIJ6L43UD1x044jUwDQs1VYnX/trCWxwt9/iVbB K4l4XPveh2AUNzslTn6wmtxujjrGDdZfGB2alNkSIeCGm7He1VzwR1gP/MnTi7TS xKb4SgVYMltXdC7ejkrC/LaapntAqaulqYrNoJUEWAuu/ezq9C2hHqu3KG30lOV9 AmW4PdSDjnN2i1CiKbE6VcREcdcq6QA6Vz+pSU+sDBesZKawwcfInAZ4xEOMws4G 4GH1K5Cem7I0JXfoqkBC6Ey9qfyulX18P359gAF51F9QyTB9kXzOyxGqUPE1tIh8 fPI1v9iL+6ykuyq4NWvGqgH57BewqycMafh5AL1yiumFUekQp6PX1WPlZoi1GT2K CtcXCQf8aBgYZ3DTlSN4S2NirumvTscDAHbbzaFrbugmexh0b637RxTVKWIyoqzH wEP32oCUVRannwQaQVShdssXz5jlEjDM0bsv41hriUNF92kLmJYb3ZkQr0t+Sf+V ffqRiCHBDvR6w56NNRGboyurkI6eUkSb3zK9wjo6294ngNiA6s9VPBxXulQh0dag PDEAiMliGKyPJcl0tpEMdtIuCgwClZzvJiRs7Gw3DAo8iVxv7ME246gVTcnR0LaE hwNUXgHNJclKtRwJPOU= Extension name: vuy4940 -------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!! A system of morality which is based on relative emotional values is a mere illusion, a thoroughly vulgar conception which has nothing sound in it and nothing true. Socrates
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5F2694BAFFECE8B6

http://decryptor.cc/5F2694BAFFECE8B6

Extracted

Path

C:\Recovery\c684bat8om-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension c684bat8om. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/E4004981CA98FA26 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/E4004981CA98FA26 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 9xBJnGSpnxUqDmQElG5KfAo6JvALLJ3w/uhJEQ2laNF2sBdIsVWsBxxCh5TrYB8C jV0qOiHLsCNnv7g6MsjehisxKi2hYipbBCF5W2GuIsVhzN2XhN4ykBkDVmV1NxGm 1NUKteeIW2nN/MXaVZu/gr+otwD6bvkmKp/xdYzA27UkfrK39XUqTBrdIyDWHKF8 w4B0xiKu4YjJmPrpN78vNzGmWYASD8+pD6wAzf4PWzXapbVA8Plyq3cCGoFUwtWK lESeNgxf8VlKGQTxE+JTuiQGtIOH7k1DdsIXF++R7qByWd4msMDhMG/cIW7UlB/I kgnkXg6GaSplpbQePJ2RJoDoJ7lHWF8b4RP38A9MywqNqhf8C1OYaYDBwGZ/K6UY KldKbybtPWt+oQLO1p27jFfVbYPWfX4SJD5ULcL0j8fbsrrydBw5UNOf+VBYAHw3 xExjTrsZ0TjeVrsWMhNQ+rUYx8cki1aDbC2deLhzipPj40hWQdWiKm8wAzysuGCg MXzM29aVgae7eNwRbItDAAxNLM6S/ejQanQdLayVi+8ri/NuOQAAMSmBMgtPZyph OzBgakAYeEaYNjCUhk0eLomEbZCIy8+e5qkXOdCbB4sj6szmrucD24LMimRbhEmE kh/Tw/KNsgrrmYVp4cz9SWjpwD2eQSWPkqJRKzZQXn+RwAMJBx6elHfamzQjFOGl xC8GeDSZSv53C6GXmbHcpLO5Ke7sSC4lg7ToubGxmvRHltvsAw+yhsiNDCsiYuU/ rJkypgiGwwdgfxGNz4ljyHUMoQzBHuaNrZ7VuB8Hfufrky/kewXHu5EOyWEDiH3r E17F9fhqHcGzVlBAuFaq1w03IwoqzTfqDMoS+oJaU4PbkG+qmT3rZak2IhvtTHX1 C+oB37c7C03CxZrc7+xWxxObvQ5D5lrXqUWaDyYIlG6K2nRAQSQGIcmPWVwgEub7 N/VpKQtxFYEsYEUn0ySMr3p+x0/vKXEG+en4/Hi29ca9UYQMa9XnEwAkX9RFJUBZ Qw7rqzf7Mfxk8AdeC7cnawwrUfcNbY+8oHBYlwWb31aA9KR5d6JiUExgNOxkWFG7 2Tuc89q/BSsswkVKxD8I4zNTD8oSeBYaP7s0gCkA+tU02DOZBcPWBx902AY14mdK EghKC+1qz3DSNdk+kRZsP7h2I3pxePEg5DA/HeSubYQjmN0jh2Bx2/Id1TML0YZW EFaPckJ0A+lhpCGRhkbsxSuiJTlReoMCYTM= Extension name: c684bat8om -------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!! A system of morality which is based on relative emotional values is a mere illusion, a thoroughly vulgar conception which has nothing sound in it and nothing true. Socrates
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/E4004981CA98FA26

http://decryptor.cc/E4004981CA98FA26

Targets

    • Target

      906c497e67b80e785774b046e9d100bb_JaffaCakes118

    • Size

      164KB

    • MD5

      906c497e67b80e785774b046e9d100bb

    • SHA1

      ad42be2129e659139681b423af7558b8ee58c3c5

    • SHA256

      c80ded3fe04fe8fea1439d19c87d4c451683786c5bbdf9ddee4755ccde571be1

    • SHA512

      0aefd2aba8b47215309d6d3c1b90ef947ef39280b5627a32e7d51bdab5c2d9f71f77218bdaadc9475c2f7a8830e5d3116c7e245effe1b16aa1ee958580c88dd8

    • SSDEEP

      3072:v0XoUeZ/DVS8L73ea4MoCLfqQvFfjCGfKRw+Zn7X4:veoUeZR2TRCWQFfjCGfKRw+Zn7o

    Score
    10/10
    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Enterprise v15

Tasks