Overview

overview

10

Static

static

10

9efbbace68...18.exe

windows7-x64

10

9efbbace68...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    142s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    11/06/2024, 17:29

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    9efbbace685671cc174a24989e4dda08_JaffaCakes118.exe

  • Size

    166KB

  • MD5

    9efbbace685671cc174a24989e4dda08

  • SHA1

    9234b5bd774ca12b0fe46ce74c80f1ea76d85600

  • SHA256

    65980c4eba464e9bdaa06ac6bad34b90405c591769accb078ac352288be9def5

  • SHA512

    a2af96b0e6557c1f4bb4900f5abb0d39594847521156d37c33c7f3c744475bf8e91a8f14e0910e6c4f192da9aa25e40acd691b7efe841adcf95ac8670b140133

  • SSDEEP

    3072:1LFrb30BRtBZZg+i2ayy2RjLTuVyu7CJDgoMT3Qlz:ZJ0BXScFy2RsQJ8zglz

Score
10/10
sodinokibipersistenceransomware

Malware Config

Extracted

Path

C:\Users\2ycy26y7i0-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 2ycy26y7i0. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/05BD86C3188A847E 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/05BD86C3188A847E Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 99uQhDvwHbi7w2on4celQTbM1W0kbDEWlzeTt7S8lMANX3ahy258SmEeZfUwV2HP jYsA9SgmjliauBfhoMrI7XD4lALQwl4ISqnUwR1CBOWwiGHRZhmjAiLdqkgHj8jX qB3ss2QYf+PScjYnS1OdLHXt4M21utilThw0YofLTy2R8fElcm4ggiN7zTX69zjc koA4FRQnMKaTeD/eNRn45ncXdtXTuKhQmQVC3KnFxZuctwknANRoEzGfVcVavSK9 cHOi51rSIY/P9dgPD9+nQQEmd0maitvo3U+jmWYxIwnn5DRFFr59E4BLqUJgipSs Q70MhaF1LeofGVtONeKjCjG722l7HX30OOGMzayu9EO/W0xx7xn51Fri4+KbL4qw fpTUS94ZjgyP2q+Xb/ixEvCWcBOOnUW0XJG0CNDNJWftMm9DPU0ReFkVOjNVwkrI sG2sDg8rmdQZ38m+4JTkfd2rpTH6pCAPiUt3f5EfEG24FvGcMEWomqy6QLjpWHao sRcygUXLdxPyaXinYjFCSI0WGp98cHrKMsNGHTBcPC4oA/Do2Bn/c6IBkNcD2zzW +Hale+rK0WEB9s1tqQVh6yerg9ZeUB9L1dZQ8qS9ZVd08Z2DSx4axrnpp29o2soT RRnwVZmX5Tvsk6wR7Hg24t7Co3cCimdl2t7AuDHRo953YPtVQWXW1DBel4uasyWx EB23mAOR+HTtW3nYkU9eJMikBEm4mvfZhNxAy8UfZQzt+j6lRLaUnsRhDY0wcgXM 9+kWpQY2q47tTDVbY9D+yNPZaiP21db4k6SHtnbfCLWNMhpVWyKWtkvqSOkaxuSx gutwxVCdcnBh5mcZA7N7cTq7znKfYyJLw0Peb4DzOb/MwPlEM1WN74gY2cM280fW P8cOMKddloKwuOppfN3Oq8h6z5KdlPyNpuBqyewFsOg2YtcMZFpIRRCOrnjWDm9Q VHEURtCWBPAGqVIRbK5349bstmeKchWQ6t9rDYwvhF7TlCEiOwICN1nbg/EY/xyP Eod+UcU0uzFfxEUqoxMr4PpJHUby7f6ScTlhykzD3xjMWExOSaoB2Z1YVBIS21R0 1MCAat8zyp/rHjAxe/ywy/ZqVMollqsRNTpxTCaptR+jdS1N6ne0/CeTIii9/aSM UK7Se1I0gFnS8ReZhpFFazwmTIuM5FDlxGsurAJItJ5vg9Aa2C1xygiis+857/X9 eyo0RwI9GISFSQ23b2famb/8FB9yza9LwHT9+HhcFwgen+K6Szr4aakooPgZR2On QqEYHKvdmYbblyJo5+AS7a+pkxbLlPDEzRFrxMGq85xmntKS5gvpc+7jFS0PR/cE 5aNB9ZXvwPzPF/aqqgdo30Lsk0ULgWUmo1PuiQSbz30300lkfNxUQg== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/05BD86C3188A847E

http://decryptor.cc/05BD86C3188A847E

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 33 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\9efbbace685671cc174a24989e4dda08_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\9efbbace685671cc174a24989e4dda08_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2880
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1648
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:2656
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2804

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\2ycy26y7i0-readme.txt
      Filesize

      6KB

      MD5

      24ddf0b0324647f57091ee1f20ea217a

      SHA1

      ba3ad22fc06b79f88638cf93f7101b40c6312fae

      SHA256

      648b30845357b228741abad2d9eb7416b03066c525d033243002c878577852c9

      SHA512

      bc7ab243449dbdb795ff7ca8675f792e8bb8540c9b83a23e246867bd13bdd09a2bcf1006186c3eda1d0516dabe8c60927b93b0b26c799a91a46e309705eb9fb2

      Download Submit

    • memory/1648-4-0x000007FEF592E000-0x000007FEF592F000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1648-6-0x0000000001DE0000-0x0000000001DE8000-memory.dmp

      Filesize

      32KB

      Download

    • memory/1648-7-0x000007FEF5670000-0x000007FEF600D000-memory.dmp

      Filesize

      9.6MB

      Download

    • memory/1648-5-0x000000001B8C0000-0x000000001BBA2000-memory.dmp

      Filesize

      2.9MB

      Download

    • memory/1648-8-0x000007FEF5670000-0x000007FEF600D000-memory.dmp

      Filesize

      9.6MB

      Download

    • memory/1648-9-0x000007FEF5670000-0x000007FEF600D000-memory.dmp

      Filesize

      9.6MB

      Download

    • memory/1648-10-0x000007FEF5670000-0x000007FEF600D000-memory.dmp

      Filesize

      9.6MB

      Download