Overview

overview

10

Static

static

10

b63bf2e4a6...18.exe

windows7-x64

10

b63bf2e4a6...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    143s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    17-06-2024 01:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b63bf2e4a6a0bc89f8375aa0f6672cea_JaffaCakes118.exe

  • Size

    164KB

  • MD5

    b63bf2e4a6a0bc89f8375aa0f6672cea

  • SHA1

    2c2ec58749b66d1814f27cbc3e8d845a3e7866fc

  • SHA256

    3ea8f71bfb79e6547788eb5f2718d8cfc31fe6d99e15e6a8062406aedfcdfa90

  • SHA512

    92a96ab7d0e7add812c49013ffc66a4f168becebdd68cf867c7d2655bcf6f2a0bcf1f78199b24b4741d0a832387eeb15ba9ae3c5e3fb0ddcc943e1e084145948

  • SSDEEP

    3072:FHixaVZFiOCDJtOicNDWEzZthCcHR6I2qB:FHigLF5CCj5zZt7D

Score
10/10
sodinokibiransomware

Malware Config

Extracted

Path

C:\Users\x60g282nk-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion x60g282nk. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/AD56BF6C294F0C5A 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/AD56BF6C294F0C5A Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: +F+XYzKjD9kGumzV6AskVUSoMdl6nnhTyPDHcVIGJlEMXtTjbQkUhWsx8BUc/2ux x/RfF3ybxNNorakqxMW0qsefxYgufxY+GlbdIfvO+80LICsWZBfa5cTXfRYn+BTW s736Yr4vRN9L3nRdVqLtYWtcafDnO/PrMGMYhDjXzmCwzI7IVAwzOMZZiZEsHCCP fBmhmdO+CvoR+5yqBR/dZ0JEpjm8LbRPddoYFX/l2+TaBWa2LdcbIdp/BfCyEVrh Psad8R4V3rpNzOWw5RK2TIfGeC884vByC658ea0eC5tz2uLGSTsV6BA1qtDAdg29 cGSsLXYITozy3XfqQIV9ysCv05jPKX5W+go88t3SpnA2lTND6rzYi7d+9gMz/68H /F/vSyUXPMDhfF0QkIthlKDIb5YPRRkyqzTeEKNWUbVoYDJTkavx/c6l0Gu0vbQg ZV9jNFa1c2mRtOuETLkZkxArggnLEgqxqu2CKTd/Da98TqCppqOnm8lMEhnwyncS H4p2ZfPf3PX7irLSm1Q7lrfgmwmX0vM/EX60/OYwDk5hmHP7ckPjs4sFvjFEAxD3 Zgt7rwUOTd1YZrGJbjwcno9wak0vGwsrmWl4VpPdwnVNXIwwkg/Cz9ge6cVR3uds 1BSLqNhwdsl83NHuvCsCGc/FOsZOmF5Zra2MY6MJApJ0GOdzXj8a1sX7m+3RDWTG JWAGU81DZUuvdpVlQEnd/77JFrMN4M1Yag5hCa3UYeQGXidS/Qgm5YcmFYRUz/Y7 tLduTkdaLHw5XewfiPniI4sTGeDWhLQTLefYgpNawVuk/Mtbsrq/0kSn4Vw5Iz3W onweBlSCOWxt9kCJ+7gHPTNerrgu6Q8nT/78jhIo9PGy5ASWTVmqnqRIkHp+JZQs /Xk3R5VIHWe4o36hovGYXyGXMpUcOsyT2OMo9lzRcJIj3udLFtlnxeuzvrJxVCI1 ZQeY6ntQX9Q5PSBXoElHNf+lagH0s1kXkMEOGoT9iBd2Z9LTeBHjmkq+6PiFHm0Z BpyjLIufL2NSH05wS3FoMlXeEE4ylMm2kPAcTplB4XFXjLAsXo27KOaYN9tU0Yw6 Z2inksHiyaNcE1nwX4FiR4gYQEeQKmr4dOkVA9we7dg5mE7mXp4D7qjjw67M6LFX FE0sw0ZhMUMPP7cZuNDshg9XmVeTw4gKXZcjC4Ch+JNP8nLS6yy/OPs1dWI5MzXN hohH6fIXPwZTBs7bN9Y= Extension name: x60g282nk ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/AD56BF6C294F0C5A

http://decryptor.top/AD56BF6C294F0C5A

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 24 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\b63bf2e4a6a0bc89f8375aa0f6672cea_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\b63bf2e4a6a0bc89f8375aa0f6672cea_JaffaCakes118.exe"
    1⤵
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2156
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1240
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:2160
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2492

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\x60g282nk-readme.txt
      Filesize

      6KB

      MD5

      7cd4c622d87e87c22a37dd37346e4a6c

      SHA1

      44143123085fd71ff3de6a0cad3e01c298ed1294

      SHA256

      38f19f715021133a74ab4a3ac2f225434ab66242d44e9fe1ae67eecac9a649c2

      SHA512

      bb630b8857695e22e1734c04c1b20eab81c19c0b2c80cff169ab227862460d5a3cfd53b093b0973930801e77d78327c8919136f4fc318a62f453704a45fc0542

      Download Submit

    • memory/1240-4-0x000007FEF622E000-0x000007FEF622F000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1240-5-0x000000001B5B0000-0x000000001B892000-memory.dmp

      Filesize

      2.9MB

      Download

    • memory/1240-6-0x0000000002080000-0x0000000002088000-memory.dmp

      Filesize

      32KB

      Download

    • memory/1240-7-0x000007FEF5F70000-0x000007FEF690D000-memory.dmp

      Filesize

      9.6MB

      Download

    • memory/1240-8-0x000007FEF5F70000-0x000007FEF690D000-memory.dmp

      Filesize

      9.6MB

      Download

    • memory/1240-9-0x000007FEF5F70000-0x000007FEF690D000-memory.dmp

      Filesize

      9.6MB

      Download

    • memory/1240-10-0x000007FEF5F70000-0x000007FEF690D000-memory.dmp

      Filesize

      9.6MB

      Download

    • memory/1240-11-0x000007FEF5F70000-0x000007FEF690D000-memory.dmp

      Filesize

      9.6MB

      Download