sodinokibi | 58cf92a67428816faa2f2ff2778ecfd8b129deb94b1a2ef1cbb3c13f665ffdac

Analysis

max time kernel
145s
max time network
149s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
17-06-2024 05:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe
Size

165KB
MD5

b6fcb19eb3bcbf3eaf16c7bf3f134d61
SHA1

6211ba0a1160b344c1740654b636a8fdd775fbd8
SHA256

58cf92a67428816faa2f2ff2778ecfd8b129deb94b1a2ef1cbb3c13f665ffdac
SHA512

8f6ed156e2d55dabc35a6012f5bbc8ce0bc031c7430e814d21f0d6d8d2ccf53e6ae4408c604359e2e4a37ca830d9a61efdf9422e9f4f3183c7c466b00d2bd020
SSDEEP

3072:eCEq0R0nZ5ys5n4Y9doh7O79siUs/NadXHX0Fq:lw02sJPi7O93NwHX0Fq

Score

10^/10

sodinokibi persistence ransomware

Malware Config

Extracted

Path

C:\Recovery\How to decrypt sa5n92qybx-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension sa5n92qybx. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5E8DE5371A38494D 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/5E8DE5371A38494D Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: +agFUEyAMzoZ8Sc1/Nr2P0I9EX2DHf+zMWlnj7VMC+gMLXLsvdjfIDOnbtyOMf5O hgLJxhUKiVAhGLeHQM5ilpzxKec0565L8E2b9FCwVSP5vHZhOMe1HBvOsode5kt8 PGS6KQSqBIWBUqNuT+xc/hGpsnZPcrw7CODcg1gpvf7jeskXPZT3YgWTtzeXgXeN nPwFZ29xKxI12Dy6cDZ6YPuCxjNSJCDtPl9eeOneogg5qx80qZbHtCsTXjE7IoRC W+db6wVsxGYenll1CoSkTVT8q3zTLQqip76zpZCD4tF4aTniQBATuME+UZ1C/dK+ st8Tt2o1SmA/9SOJN2Ijm8TVBWZTaFVYWy/UwfktYz5pwdVihOAswSNhos7bo5W0 yJtC7MnnY2931BELyI6+GUgclmtIG0v/6dX0q/mE8jyvGr8QOq/z2IcsbGkSEqq4 NOm36byRKBmXZeCa8bbVL7WoF+6WDc9t4DBtVONfUckpDMYs9Si6zW8qEe9wHQDM mUSz+4bhzaVuFpF2sOFr8Fz8GElE7T9FI3m+/F8C067xC0f1nPKr38AFdAd4TBcA UbPwGYBt1GWXX8LTap9zBdl9GHQFW+Cn5Me5+EI/gsDhJJElSOq4YW5LqgrvBoWe ni1P3EUhwm4qQNTXNtyLZmNCotg7lKLbqQMHG6vzVnnCp/jT8B75qBmpzJqxrJfe QOpMoYII7B6LKuhgFPjYmqQ+1/nvFzrzHecRT58OUr1gqkZHEffuDHep1DytbNyB /F8QJppO4yBDDSAf6bqGthh7uTrST1wyk8ecsH2qs96V12OcqM19sGgpA1JRtkZP xJ+JX9qMLr+AnhcxqnkTIHzbxTpthkZPkAcmAgWu2LVHr0n4V1A4y3gRQ4F4VV/u 2Eua+/AYP9AlKpn/oRHsN3CbQe42rx+N8cx2KZFeLMY2b45aGVotQOsP612Znjbv 9Q3ebRNNhiYGtF+g3AA3YAWjYlotM3oEs/FM8e/8cXqasivhiBdrn20jXRGXIYGb 5B4PEZIZP7+8n/RP0DsQz0tGUGtN+H87Q1dTOjTEAuJ1NFaQfr9cxYvcYEq9lEVp y06fM1RuZ5obtX2nGlQPq9lyRb99h2R7uDQNX3UT4My3ptXTAh1So9X3VKqzyG+b sY2A1wV7m3ZBxBAv09xk863p+dXsZaBcPwbAHTngaG5aeIW4r1lnYTeJu5SnpJAM 3KWU6mzomRlP+bt0mO/ROyVsSJE= Extension name: sa5n92qybx ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5E8DE5371A38494D

http://decryptor.top/5E8DE5371A38494D

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\L2mKLMcNmB = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe"	b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe
File opened (read-only)	\??\T:	b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe
File opened (read-only)	\??\V:	b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe
File opened (read-only)	\??\B:	b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe
File opened (read-only)	\??\G:	b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe
File opened (read-only)	\??\U:	b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe
File opened (read-only)	\??\K:	b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe
File opened (read-only)	\??\R:	b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe
File opened (read-only)	\??\S:	b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe
File opened (read-only)	\??\Q:	b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe
File opened (read-only)	\??\X:	b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe
File opened (read-only)	\??\I:	b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe
File opened (read-only)	\??\L:	b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe
File opened (read-only)	\??\N:	b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe
File opened (read-only)	\??\Y:	b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe
File opened (read-only)	\??\F:	b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe
File opened (read-only)	\??\H:	b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe
File opened (read-only)	\??\D:	b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe
File opened (read-only)	\??\J:	b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe
File opened (read-only)	\??\M:	b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe
File opened (read-only)	\??\O:	b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe
File opened (read-only)	\??\W:	b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe
File opened (read-only)	\??\A:	b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe
File opened (read-only)	\??\P:	b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe
File opened (read-only)	\??\Z:	b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\e8w.bmp"	b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe

Drops file in Program Files directory 39 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files\CloseConvertFrom.emf	b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ExportInstall.odt	b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe
File opened for modification	\??\c:\program files\RepairMerge.dotm	b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe
File opened for modification	\??\c:\program files\RestartEnable.aif	b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe
File opened for modification	\??\c:\program files\SuspendDismount.wax	b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe
File opened for modification	\??\c:\program files\UnregisterRestore.bmp	b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe
File opened for modification	\??\c:\program files\AddCheckpoint.sql	b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ExpandExit.rar	b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ImportPing.M2V	b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe
File opened for modification	\??\c:\program files\RenameHide.cfg	b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ConvertFromMove.ADT	b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe
File opened for modification	\??\c:\program files\CompleteSwitch.midi	b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe
File opened for modification	\??\c:\program files\MeasureProtect.inf	b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe
File opened for modification	\??\c:\program files\PopRestore.ps1xml	b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ResetMeasure.ppsm	b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe
File opened for modification	\??\c:\program files\StepBackup.mp4v	b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\How to decrypt sa5n92qybx-readme.txt	b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe
File created	\??\c:\program files (x86)\How to decrypt sa5n92qybx-readme.txt	b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe
File opened for modification	\??\c:\program files\WatchHide.shtml	b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe
File created	\??\c:\program files\How to decrypt sa5n92qybx-readme.txt	b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe
File opened for modification	\??\c:\program files\AssertRename.mp4	b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe
File opened for modification	\??\c:\program files\BackupExport.001	b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe
File opened for modification	\??\c:\program files\GetUndo.vsd	b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe
File opened for modification	\??\c:\program files\MoveClose.aif	b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\v3.5\How to decrypt sa5n92qybx-readme.txt	b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ApproveClose.wma	b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe
File opened for modification	\??\c:\program files\GetSuspend.gif	b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe
File opened for modification	\??\c:\program files\MountConvert.mov	b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ReceiveApprove.mp3	b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe
File opened for modification	\??\c:\program files\StopExpand.3gpp	b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\How to decrypt sa5n92qybx-readme.txt	b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ConnectWait.ps1xml	b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe
File opened for modification	\??\c:\program files\CloseCompress.xlsm	b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe
File opened for modification	\??\c:\program files\LimitJoin.xltx	b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe
File opened for modification	\??\c:\program files\RestartMerge.easmx	b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe
File opened for modification	\??\c:\program files\UnregisterSuspend.vsx	b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ApprovePing.wma	b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe
File opened for modification	\??\c:\program files\StepUnlock.asp	b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe
File opened for modification	\??\c:\program files\EnterDisable.mp4	b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1832	b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe
1916	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1916	powershell.exe
Token: SeBackupPrivilege	2816	vssvc.exe
Token: SeRestorePrivilege	2816	vssvc.exe
Token: SeAuditPrivilege	2816	vssvc.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1832 wrote to memory of 1916	1832	b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe	28
PID 1832 wrote to memory of 1916	1832	b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe	28
PID 1832 wrote to memory of 1916	1832	b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe	28
PID 1832 wrote to memory of 1916	1832	b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe	28

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1832
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1916

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:2616

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Recovery\How to decrypt sa5n92qybx-readme.txt

Filesize
6KB

MD5
45a59966952569910d466c279d668611

SHA1
bd65ef4764495bc5869507e5a42ac685cc311831

SHA256
555bd7f8a78305c50eeb61246eda5c80c361df626b97998637dd12148bc896f2

SHA512
c6faffa8068bb4051119f75282d84020fd1d163e24f4ade1c16c20f1d3be18e093c4056d115fe5850387b4303a2cd5411f4f2755e1ec9912813c07f327860aaf

Download Submit
memory/1916-4-0x000007FEF5E7E000-0x000007FEF5E7F000-memory.dmp

Filesize
4KB

Download
memory/1916-5-0x000000001B5E0000-0x000000001B8C2000-memory.dmp

Filesize
2.9MB

Download
memory/1916-6-0x00000000022D0000-0x00000000022D8000-memory.dmp

Filesize
32KB

Download
memory/1916-7-0x000007FEF5BC0000-0x000007FEF655D000-memory.dmp

Filesize
9.6MB

Download
memory/1916-8-0x000007FEF5BC0000-0x000007FEF655D000-memory.dmp

Filesize
9.6MB

Download
memory/1916-9-0x000007FEF5BC0000-0x000007FEF655D000-memory.dmp

Filesize
9.6MB

Download
memory/1916-10-0x000007FEF5BC0000-0x000007FEF655D000-memory.dmp

Filesize
9.6MB

Download