sodinokibi | b8dc282b15526821326ae7158f5e4e895a874fc15499d102d59e819aa78d5800

General

Target

906476f7f37236ab87319d477afec56f_JaffaCakes118.dll
Size

116KB
MD5

906476f7f37236ab87319d477afec56f
SHA1

16485c511e413cc33b4fe6ef3c95b65198cdd9f3
SHA256

b8dc282b15526821326ae7158f5e4e895a874fc15499d102d59e819aa78d5800
SHA512

8c893d42f90a4d63b6261c8644bb97807052fa1570693b3cc179566b7a14f28590d7d2e4e5062cbb731617f83c46c0333d46a45a5ad2138576b95867fbf323ce
SSDEEP

1536:CPp8kFF4+utlznGEvCrUmUYwGOmpX2yaICS4Aa7A2Ow/TGXiPt50c0HL:8vnuGqfGOqVB2bSXiVW5

Score

10^/10

sodinokibi ransomware

Malware Config

Extracted

Path

C:\Users\cv4shj9-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension cv4shj9. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/544CFD610482C335 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/544CFD610482C335 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: Jpohjqnx498b60nD1dA9ejcU4ePPsODP9aq4QZE+C6jaQmNaIHHlEZb8lztTokgz MY5Su3QrgylQQaxBESU76stW1Nns2pwdqZgq/fhL4DaSsm++0juvROx2DQC8bKET Lq1RiZYPIfyoh9Gf5Vx56sKzZKunMTF5amgSnZbBh+pRL2SXBGpn+n0JSWQgeAM/ e92RmJKJwq5ndLHf0EqmWzuQK5ho+q4SGGWaXdGqjo/9O6whnSrm15F7RQmff/6A Z6sd0XUVfRyBv6hSOXZ1QqDkR48xzhMXNA1GfxSovrkf9HRjsNI27CmuFezr+5SH PsQj3vVGVwmamSe3iFMzNQupzhmavgEULYMJMzrPNQwx9k6xvJsKl9q/o7mfhoR8 Dj6sbAyoxEtTxRQG+MUB+PzCXuwH/5I2jwtrvwN3wfpSb2XjVy7xkQEiaE2dnawv Rexr5Qlbs/xAp0WyabJ8kfL3i0Hs3hKOQI7Ui46729RHh9txj8iQi7rKpq4lwbnn MTOpJTkYlIlvoMPjc3svUs8EX7/pfVwy4j72UD3JhxoiYvhF6PDNPj93gwwGaveB 9rmueVHIdY5srTRIC4ZxiYpGIeBJYZrVs9RPmb186LRBkGaVcJxnnG5sQvYiOJys 5jh82QFR8/GlFxELhJj5ICe08GOcarXx/x2zyyAJvJpftxBXaG4RJBEWAd/1DcLP dc8QiBD4U0B40D+tQvUGL5C5wxlAlrcghe5SXVcLO8rdULdiibf7t8D5oxHFKFj6 6Y9fNFl6QrLZeB+Gq7rbW6ij4yujauaEhZmFjD194p4qMr/r3uyDjmktKV/T9seB X/dBUJDcbN9WYZTyL1st3hVM+AN0nbjq05bz0dJFDLNANyBlUPWTNOWTUe9SHviy lQeHpTiI609aDKVsxmBTfeso7YpkfhRt+Ho9P5LKglC5uoWOdWV77zN7PcneD8xe EeNh+eKk7j0+wmy/nOVHLlgC8tE6Rlelx6CY7klRWDEJycuucW+qjFSi1XEYEPkg e04OSnNmOvtq2b5akUlYYbncloXMnicbvWUsAcVvj9RKpMTnqBYA6HFGwF/oZae2 ptpEEnQamFkYAjTtWbRrA3j0MR+rnf1rGK9+bThmeQ+qg99j7pXTsa38rMIEhQPn KUwiPTNCP9tX/1bK8NGrGbBRRfNM7+d4NnHLYsyg6x4ii23qskibtte+JoxHRKB3 5oom4fKyhT3S9fwtcCY+ZI6H1/oTbyBhnPE/yO6Z3AkKW3VfKg0pAd7xFKK/OHeI u3rJgQGzAv2yDVAD/GenpiwJlnUwsEMOIM6toce9mh+3JoeC/PnK2p9clcuve2oy 1Qo6mgDfkggBHS1TnRtVzrdrQjPfgGpT2P4DSB4Aqv5nPdZ/Unc7VA== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/544CFD610482C335

http://decryptor.cc/544CFD610482C335

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	rundll32.exe
File opened (read-only)	\??\E:	rundll32.exe
File opened (read-only)	\??\G:	rundll32.exe
File opened (read-only)	\??\I:	rundll32.exe
File opened (read-only)	\??\O:	rundll32.exe
File opened (read-only)	\??\R:	rundll32.exe
File opened (read-only)	\??\V:	rundll32.exe
File opened (read-only)	\??\W:	rundll32.exe
File opened (read-only)	\??\X:	rundll32.exe
File opened (read-only)	\??\Y:	rundll32.exe
File opened (read-only)	\??\J:	rundll32.exe
File opened (read-only)	\??\N:	rundll32.exe
File opened (read-only)	\??\U:	rundll32.exe
File opened (read-only)	\??\H:	rundll32.exe
File opened (read-only)	\??\K:	rundll32.exe
File opened (read-only)	\??\L:	rundll32.exe
File opened (read-only)	\??\S:	rundll32.exe
File opened (read-only)	\??\T:	rundll32.exe
File opened (read-only)	\??\B:	rundll32.exe
File opened (read-only)	\??\M:	rundll32.exe
File opened (read-only)	\??\P:	rundll32.exe
File opened (read-only)	\??\Q:	rundll32.exe
File opened (read-only)	\??\Z:	rundll32.exe

Drops file in Program Files directory 32 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files\ReadNew.m1v	rundll32.exe
File opened for modification	\??\c:\program files\ResolveEnable.mpeg	rundll32.exe
File opened for modification	\??\c:\program files\CopyExport.m4a	rundll32.exe
File opened for modification	\??\c:\program files\OpenClear.odt	rundll32.exe
File created	\??\c:\program files\cv4shj9-readme.txt	rundll32.exe
File opened for modification	\??\c:\program files\CompleteUnblock.css	rundll32.exe
File opened for modification	\??\c:\program files\OptimizeSubmit.htm	rundll32.exe
File opened for modification	\??\c:\program files\SendTrace.mpeg3	rundll32.exe
File opened for modification	\??\c:\program files\StartUse.avi	rundll32.exe
File opened for modification	\??\c:\program files\SubmitEdit.tif	rundll32.exe
File opened for modification	\??\c:\program files\SyncInstall.odt	rundll32.exe
File opened for modification	\??\c:\program files\DisconnectTest.avi	rundll32.exe
File opened for modification	\??\c:\program files\EnterInstall.temp	rundll32.exe
File opened for modification	\??\c:\program files\CompleteWait.mpv2	rundll32.exe
File opened for modification	\??\c:\program files\FormatConvert.DVR	rundll32.exe
File opened for modification	\??\c:\program files\UnblockSync.3gpp	rundll32.exe
File created	\??\c:\program files (x86)\cv4shj9-readme.txt	rundll32.exe
File opened for modification	\??\c:\program files\CompleteRestart.dib	rundll32.exe
File opened for modification	\??\c:\program files\RegisterMount.ini	rundll32.exe
File opened for modification	\??\c:\program files\StepClose.ppt	rundll32.exe
File opened for modification	\??\c:\program files\SuspendRepair.mpeg3	rundll32.exe
File opened for modification	\??\c:\program files\AssertExpand.js	rundll32.exe
File opened for modification	\??\c:\program files\PopMerge.avi	rundll32.exe
File opened for modification	\??\c:\program files\ExpandApprove.potm	rundll32.exe
File opened for modification	\??\c:\program files\SendSave.tiff	rundll32.exe
File opened for modification	\??\c:\program files\StopBackup.jfif	rundll32.exe
File opened for modification	\??\c:\program files\UnblockTrace.vdx	rundll32.exe
File opened for modification	\??\c:\program files\BlockSend.xhtml	rundll32.exe
File opened for modification	\??\c:\program files\CheckpointOptimize.vdw	rundll32.exe
File opened for modification	\??\c:\program files\ExportSplit.emf	rundll32.exe
File opened for modification	\??\c:\program files\AddExit.MTS	rundll32.exe
File opened for modification	\??\c:\program files\ClearOptimize.vdw	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4776	rundll32.exe
4776	rundll32.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4776	rundll32.exe
Token: SeTakeOwnershipPrivilege	4776	rundll32.exe
Token: SeBackupPrivilege	5100	vssvc.exe
Token: SeRestorePrivilege	5100	vssvc.exe
Token: SeAuditPrivilege	5100	vssvc.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4004 wrote to memory of 4776	4004	rundll32.exe	85
PID 4004 wrote to memory of 4776	4004	rundll32.exe	85
PID 4004 wrote to memory of 4776	4004	rundll32.exe	85

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\906476f7f37236ab87319d477afec56f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4004
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\906476f7f37236ab87319d477afec56f_JaffaCakes118.dll,#1
  2⤵
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4776

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:4884

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\cv4shj9-readme.txt

Filesize
6KB

MD5
fe6e06f65ee4bcb2bdd34354b1d0b2ae

SHA1
ea0f7561d9cf052326ec59486de550e76205fc24

SHA256
9c65aeb7a726c8641812ec91af342e5782dce6f72d268e5040f1ce6591d6bbd5

SHA512
58d044555643047aed942e77fd20eaa94209dc3a04aea9404e61775ba2dd61dc8e9c1431d0a653b66c93306a579ace7b479f3d6f613f0ea4ae4056265262e5cc

Download Submit

Analysis

Sharing