Overview

overview

10

Static

static

10

9ecca170d0...18.exe

windows7-x64

10

9ecca170d0...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    147s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-06-2024 16:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    9ecca170d0515fb14c8b78302b8053e7_JaffaCakes118.exe

  • Size

    166KB

  • MD5

    9ecca170d0515fb14c8b78302b8053e7

  • SHA1

    2b498759c83f05beda20adc991be476934ea0fa8

  • SHA256

    ec0c653d5e10fec936dae340bf97c88f153cc0cdf7079632a38a19c876f3c4fe

  • SHA512

    fa433c9712a8a247825d85c950f9754ec83dbf82fa5f86a2b637727362f22fcdc68cd59bb3845e1d6020d7ce5133a1916b5af0b1ed716bd6d3a696353d2df8bb

  • SSDEEP

    3072:1LFrb30BRtBZZg+i2ayy2RjLTuVyu7CJDgoMT3Qt6tCIm:ZJ0BXScFy2RsQJ8zgQ

Score
10/10
sodinokibipersistenceransomware

Malware Config

Extracted

Path

C:\Recovery\How to decrypt w92y2gmfr2-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension w92y2gmfr2. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/8B78766B5F9AF0DA 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/8B78766B5F9AF0DA Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: wBi2XBDwbNlXgSnAYMTp3E0fhbmLsckgDkV8PpBsX5Qc27h/rNXZMwFo3Wo0apE1 rjXrqrS+eC8BNfiuwjsQ0I1IMbIuNqiu5mHEtqoiyBmH2L2BWXsiB5mvU8XOU/N5 K+OPL3F/wu5u2/jCDU+geVvRLuQ+/0UAGhDSXJ7X2TsN5UZtCvaeOnTm5xs0sw7G 3LADxortX9Mgj/2zIzh6i45IzudG6+LJ+cPlz5Tdfn6BIIFHRfXBSWZH35kpxDHT 573xp/u1Pa5gi/naX3rEQGVVuD932wSYsc6vMMvke1z1Q0qAcKeeTd80Svozq8/6 fb8/QY4gYZvq6S3BLA9iN1G4vkDdOJLmjbRDpP2WNq7sSt7+a2hE6WGqJZBh6VHy m7Nt8APVgz4O74ASq2FXba17hNsB6c1bvA+1RpxxMV3IFrVXg0Hs5T2EsmToRcQK 1DHMm7+TQEomDYRvfEwBs9IHEJtroFMPf1AnHpi/a9OsEbFRH3hr0gA8V6Vp5IcW 79BElgvD+qHgHdJnp0BZVGd+9jnYNR/k8cDrgEQIyPSZ3193aSMkoNCVlabuyvy3 BGSyX8nMgivXKZwbd96gCgf4u99AoOI6cd8v7aJsejnM3ncICi69whyhTjGmSigO NwPILVmLLbSyX/gWsSytaLQoNoUiu4cA1E/i4t/MpHct2y9NGJetrhPBcWExjsYW KYpCMqRRoh/+mR+koFvH0edqloQqGO2XbcxWarO+H5aVgD1i1bN50GfYG2zgvfU7 MTpAJVUveNXec6/xQmU29BaCkMdUEXzhTbyOsC/t7fUdGdHFmftaqTZh2Oskz8O+ ZOf8kt7j435bSgHMkUdepnpqUhY0V6VaJ6GQtUstBk84biWwLtAUCiPk7KSwqMKL e4TdDC4fvtW0Mswb4afqe8kraBICQlIgLW7O17z/nwWKRJAsVovzvpL6ArjBSCL9 Ep6B1sDPwXydPsqL/Q1akMoxgOeWSKLhJAFvXvzQVUrUc3SfKe41P9y0EdGl3xLo GQ4yp4FjaRq+udHX71kmncqzTUCGA4gBXBhLNGbDyLZVLeMGjiTP7UlRFUuPaz2L K1mvQN1q+cAG0Z5Jf4Mkiwy66bDFTWtJDtvosdlCKfBrLIpz4XAvsJLeg+XtPeix pUiK9Xh80cuUv+Hpr8LoPB+lEB8j/qrnItloSgaZDtc/hbjOthWrAQb1/FOHh+tB L49DlfyiYx1tTDq9INSJfeofNVdnlupHjXWkUr4JcVua4nXubUt8KOwVEe+qzjZ1 uygYr0z2G8GkrMay80qWEeGDUgkT/g7gN/vA6tUd3+me+2gxIoo+/JMr91RrE8s8 4sHqdGojPkqECXiNxcA7XIK1MWcPxnlE0HeNjMwi992X9NTK5W04vf/vKaqd+Q== Extension name: w92y2gmfr2 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/8B78766B5F9AF0DA

http://decryptor.cc/8B78766B5F9AF0DA

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 32 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\9ecca170d0515fb14c8b78302b8053e7_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\9ecca170d0515fb14c8b78302b8053e7_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3920
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:60
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:1580
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2776

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Initial Access

    Execution

    Persistence

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Privilege Escalation

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Defense Evasion

    Modify Registry

    2
    T1112

    Credential Access

    Discovery

    Query Registry

    1
    T1012

    Peripheral Device Discovery

    1
    T1120

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Defacement

    1
    T1491

    Resource Development

    Reconnaissance

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Recovery\How to decrypt w92y2gmfr2-readme.txt
      Filesize

      7KB

      MD5

      9f07dc9075e71c5056bdf082d04cf93f

      SHA1

      8f8c6cd7f4c577d67b6acdfcc6deef1722ac38ad

      SHA256

      f33f6806665fc093847425fd25f8c4ab068bcfb53efe304822bfb122150025ff

      SHA512

      67c21bab123559fa2fed4655f50ffd7a537f1ff2954bf971c952c3d1669aa121764fdf0515d1e2a91f1533647414574a5d608855c04f5043ae34215ba4f52ffd

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ijys0qv4.tjk.ps1
      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      Download Submit
    • memory/60-0-0x00007FFDE5E23000-0x00007FFDE5E25000-memory.dmp
      Filesize

      8KB

      Download
    • memory/60-1-0x00000208F0F30000-0x00000208F0F52000-memory.dmp
      Filesize

      136KB

      Download
    • memory/60-11-0x00007FFDE5E20000-0x00007FFDE68E1000-memory.dmp
      Filesize

      10.8MB

      Download
    • memory/60-12-0x00007FFDE5E20000-0x00007FFDE68E1000-memory.dmp
      Filesize

      10.8MB

      Download
    • memory/60-13-0x00007FFDE5E20000-0x00007FFDE68E1000-memory.dmp
      Filesize

      10.8MB

      Download
    • memory/60-16-0x00007FFDE5E20000-0x00007FFDE68E1000-memory.dmp
      Filesize

      10.8MB

      Download