General

  • Target

    9efbbace685671cc174a24989e4dda08_JaffaCakes118

  • Size

    166KB

  • Sample

    240611-v2nl7svcrf

  • MD5

    9efbbace685671cc174a24989e4dda08

  • SHA1

    9234b5bd774ca12b0fe46ce74c80f1ea76d85600

  • SHA256

    65980c4eba464e9bdaa06ac6bad34b90405c591769accb078ac352288be9def5

  • SHA512

    a2af96b0e6557c1f4bb4900f5abb0d39594847521156d37c33c7f3c744475bf8e91a8f14e0910e6c4f192da9aa25e40acd691b7efe841adcf95ac8670b140133

  • SSDEEP

    3072:1LFrb30BRtBZZg+i2ayy2RjLTuVyu7CJDgoMT3Qlz:ZJ0BXScFy2RsQJ8zglz

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$bYPwfV5f.unsW7RpjYqD/u290WiTDfoU8OCGlN3G.nU1ZtWwaUIdm

Campaign

3253

Decoy

pier40forall.org

sandd.nl

thaysa.com

completeweddingkansas.com

gaiam.nl

dpo-as-a-service.com

aarvorg.com

personalenhancementcenter.com

cheminpsy.fr

pinkexcel.com

rimborsobancario.net

deepsouthclothingcompany.com

ligiercenter-sachsen.de

webhostingsrbija.rs

marcuswhitten.site

asteriag.com

edv-live.de

levdittliv.se

vickiegrayimages.com

iwr.nl

Attributes
  • net

    true

  • pid

    $2a$10$bYPwfV5f.unsW7RpjYqD/u290WiTDfoU8OCGlN3G.nU1ZtWwaUIdm

  • prc

    sql

    firefox

    visio

    mspub

    xfssvccon

    msaccess

    oracle

    ocautoupds

    tbirdconfig

    infopath

    ocssd

    excel

    thebat

    winword

    wordpad

    steam

    isqlplussvc

    dbeng50

    outlook

    thunderbird

    dbsnmp

    mydesktopqos

    mydesktopservice

    synctime

    sqbcoreservice

    ocomm

    onenote

    powerpnt

    agntsvc

    encsvc

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    3253

  • svc

    memtas

    mepocs

    svc$

    veeam

    sophos

    sql

    vss

    backup

Extracted

Path

C:\Users\2ycy26y7i0-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 2ycy26y7i0. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/05BD86C3188A847E 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/05BD86C3188A847E Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 99uQhDvwHbi7w2on4celQTbM1W0kbDEWlzeTt7S8lMANX3ahy258SmEeZfUwV2HP jYsA9SgmjliauBfhoMrI7XD4lALQwl4ISqnUwR1CBOWwiGHRZhmjAiLdqkgHj8jX qB3ss2QYf+PScjYnS1OdLHXt4M21utilThw0YofLTy2R8fElcm4ggiN7zTX69zjc koA4FRQnMKaTeD/eNRn45ncXdtXTuKhQmQVC3KnFxZuctwknANRoEzGfVcVavSK9 cHOi51rSIY/P9dgPD9+nQQEmd0maitvo3U+jmWYxIwnn5DRFFr59E4BLqUJgipSs Q70MhaF1LeofGVtONeKjCjG722l7HX30OOGMzayu9EO/W0xx7xn51Fri4+KbL4qw fpTUS94ZjgyP2q+Xb/ixEvCWcBOOnUW0XJG0CNDNJWftMm9DPU0ReFkVOjNVwkrI sG2sDg8rmdQZ38m+4JTkfd2rpTH6pCAPiUt3f5EfEG24FvGcMEWomqy6QLjpWHao sRcygUXLdxPyaXinYjFCSI0WGp98cHrKMsNGHTBcPC4oA/Do2Bn/c6IBkNcD2zzW +Hale+rK0WEB9s1tqQVh6yerg9ZeUB9L1dZQ8qS9ZVd08Z2DSx4axrnpp29o2soT RRnwVZmX5Tvsk6wR7Hg24t7Co3cCimdl2t7AuDHRo953YPtVQWXW1DBel4uasyWx EB23mAOR+HTtW3nYkU9eJMikBEm4mvfZhNxAy8UfZQzt+j6lRLaUnsRhDY0wcgXM 9+kWpQY2q47tTDVbY9D+yNPZaiP21db4k6SHtnbfCLWNMhpVWyKWtkvqSOkaxuSx gutwxVCdcnBh5mcZA7N7cTq7znKfYyJLw0Peb4DzOb/MwPlEM1WN74gY2cM280fW P8cOMKddloKwuOppfN3Oq8h6z5KdlPyNpuBqyewFsOg2YtcMZFpIRRCOrnjWDm9Q VHEURtCWBPAGqVIRbK5349bstmeKchWQ6t9rDYwvhF7TlCEiOwICN1nbg/EY/xyP Eod+UcU0uzFfxEUqoxMr4PpJHUby7f6ScTlhykzD3xjMWExOSaoB2Z1YVBIS21R0 1MCAat8zyp/rHjAxe/ywy/ZqVMollqsRNTpxTCaptR+jdS1N6ne0/CeTIii9/aSM UK7Se1I0gFnS8ReZhpFFazwmTIuM5FDlxGsurAJItJ5vg9Aa2C1xygiis+857/X9 eyo0RwI9GISFSQ23b2famb/8FB9yza9LwHT9+HhcFwgen+K6Szr4aakooPgZR2On QqEYHKvdmYbblyJo5+AS7a+pkxbLlPDEzRFrxMGq85xmntKS5gvpc+7jFS0PR/cE 5aNB9ZXvwPzPF/aqqgdo30Lsk0ULgWUmo1PuiQSbz30300lkfNxUQg== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/05BD86C3188A847E

http://decryptor.cc/05BD86C3188A847E

Extracted

Path

C:\Recovery\1j6zsdt5-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 1j6zsdt5. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C368F7263F3A6B03 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/C368F7263F3A6B03 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: V6YW3ISATgJbS1gMvLcJnmsf8frnG0m+nr3dvSDwoqnGL9tNjplyZj91hFw4Uref Rg2Tm6YiUCSBUUEKx7OhFrDchBgp65QSJnEqVHYDjL4/uv78kXeqVlCbSkrvVSLT CSLeQzxswISax/M5WAtaSCZji1guUedYYrlv4H++7JyIkz9cZEorXMlShsLgqrqQ 22eAKCqNHL32nLOKyw0ny7/taPYEQ012heOhc5akgZSlz3pPMgCbM/HjXpkAM+km Wp92RD39HIfv1pmWNFilHoHGF/YA5JtDK5s36+FMJqHScc93qJEWd7B75bRale8/ cvIzyYllM9+C/Hc6y5HHs7Fmj7PIIeAg1OTGf1N+h8DlHkBg+eI8hSt2Q229azgx se8Lpnro9GihM59mlT6fnzfmPCq+j4woWfK2z7G9C6f7fYPxvD9FDQudu1WwWBwO 6UDntuVvPnJbMrHt1JFVDxDAw12NntlyyEKOXOhql4KmCe+kytlD4S63ZhdwTsyv 9jxG3PhC5N4XZApDLxyi2Y8WsnqEMDTOrYhliHDvzvaNXElmwJrHCkna0H7t2bJr zopF3N+jdxO704JrfmXbrJrPRRPCUc5KV9JGoNj/emMBFovC8Kuzgs5UWXNJihiL CEaTBJ763Vw0yG0cETsKbpZMQJwrGAdzUvBEiGdxLeuyd+HHUKRC3AZ9xT8669EU NDLdcbMOcYpdXafA7/yNZag3b1GyN3WykbNGX+6rrFEvYGOXUKKYtbS8+SJmiymj zeT8OpAexJ1g+TEaWCYmDvbNDoHNm/bl7RM6Eenv/HEZyJ2rBgEm3Txk++Na3lCF HqToSN2NZeLeoF08Dbt+wukllWwPvpJOJJRWPA85fm6PUGLawJZ6eBOv8hV6mh53 yyxVZ/2Osq4m0aGn68F0xF801KLO5udD3qBnpaqc6L/4HkAixobhz+Ij50h+pIa0 N2V71aSXvjNibl3hflwLl6VWOv4juTERE4eAOxsGfq1FztbbvsNeMQ5+QpHA3uVG cnDLoBFqyJuw+O83vu7T3varXBSWCUI1flqefbDYx9xV4ewa1+sxPEXWPDALv0Vt lptKPwnyY+uct9rTVWgVDIp8KeZUEHjboQGjlsGtfciEgS8wWobvSpnoCV/UXfJW 0uWQsjGhmIweWuwVNNAbOXQd2Q/mBvzNbloFdhIjksRKa+IH07o/MdQo6DrziaJn InVLKomZ3Y13rNyjxxUgoJy7iLDZXx/pCYYq1tCvaSZgcmUngj7kNzpn1zQjkoQp lxGYNLclb7+E3EW4LkCVTqFS2xKvY6Fydvlhh2GfVxi9lCS/DFRkiQVc6dhViUCp L8Kn+L4wH0JzQ0HUhfeUOPrsdg9OdXocS/SjmX3AdgAmNATrYS38jPe0 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C368F7263F3A6B03

http://decryptor.cc/C368F7263F3A6B03

Targets

    • Target

      9efbbace685671cc174a24989e4dda08_JaffaCakes118

    • Size

      166KB

    • MD5

      9efbbace685671cc174a24989e4dda08

    • SHA1

      9234b5bd774ca12b0fe46ce74c80f1ea76d85600

    • SHA256

      65980c4eba464e9bdaa06ac6bad34b90405c591769accb078ac352288be9def5

    • SHA512

      a2af96b0e6557c1f4bb4900f5abb0d39594847521156d37c33c7f3c744475bf8e91a8f14e0910e6c4f192da9aa25e40acd691b7efe841adcf95ac8670b140133

    • SSDEEP

      3072:1LFrb30BRtBZZg+i2ayy2RjLTuVyu7CJDgoMT3Qlz:ZJ0BXScFy2RsQJ8zglz

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v15

Tasks