sodinokibi | 93bd21cb6331ce96cc28dc7a1f0b6b2b2ed8ec064d2ac6e1f428af59c924cb57

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
29-07-2024 09:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3ec350b912bf27249dfb93221a4b7a9b_JaffaCakes118.dll
Size

116KB
MD5

3ec350b912bf27249dfb93221a4b7a9b
SHA1

2142fe0caa3f08b98ffe6b3f9ae82f4bfb5f3abf
SHA256

93bd21cb6331ce96cc28dc7a1f0b6b2b2ed8ec064d2ac6e1f428af59c924cb57
SHA512

1e54a3204d8ca0665617093e725f3e32d46ffeef3b25f019cd5039dc1a24022d52d595bc2bf1a630985b8f1899ed01fbe22f9a943f9037743946b2cea3379d02
SSDEEP

1536:CPp8kFF4+utlznGEvCrUmUYwGOmpX2yaICS4Aa7AYHiqcrUzSNYr:8vnuGqfGOqVBWitN4

Score

10^/10

sodinokibi discovery ransomware

Malware Config

Extracted

Path

C:\Users\a69y87wi3-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension a69y87wi3. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] WE ARE READY TO PUBLISH UR DATA TO PUBLIC ACCESS IF YOU NOT CONTACT US [+](USE TOR BROWSER) http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/posts/164?s=8461e11922fbbd5471dfee87150dd27c [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/B90860DBB5007BF7 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/B90860DBB5007BF7 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: krsGR5JZPspf1B7Bq22DApIiXU+GyfmwmXQgTaNKL9laLznGSq/FcvzBHPUhBUkL X+4+ZOWsbeDFLlsV5r3oCOf7pto9rVyYDcRagrgGxdNF8x8/kA2sWI0qAVIP9vBD iANjIBrm7MW8JZzxMs9QVqA2rWiyK282MM3T/7w/2W8vkG04I/tZTNihyPflPT5U IrDzsWmAMoCKdPtItvzBScoOwEI+joej92OTtNQfHZYlr5JvN0vn9DQ/Hd2+U0gY 5CSsluGRtN2NOB8UnNVOWbwyoYFPCByUt4Se4PC/r55sDlDHFjHNf9af1lk6X6IH 7iA1nvrr1nV6RynES+ExMAB07ULM8Uml0pvl2EJjVxIrIpA2983u3gX6CQ9f4hQc TCQjsZPJgSnKQymMElaw3jp4VZ8BYj0p7KYUyqIYJUFy1/VwH6cSnSQxlEFoAzfS N9Ja4ZK1sLqzngtxigu050vN2nAEdU2zYUG7XGVw14h6NhWXEGelN6WyPHaYMUIh 4V3ndxrVcg1cbiOy8t7px/TLdSCNhqI7QWvQ0MZ/QWEubjJsosnOzFCR6OERGp+B nlWPNjeIamVDtY3k0ETtWwtz33Gmp5X7yLmQJ3+JVtpoMFnpGFQzgvSikJJEdGyY oSr7gQIKeqWftzEgmCAfVQMDf2pa/vedIKH+yV0tJ4wOZtQ7/hBjN11Ma0ec0cnc g+c6ClZrx9dfbXndVbCbBxqbeAVPZATqZm3cQi5Ar2JXix2STiQFicln84OGd755 pUk1GO3duCz5dHJT5KGvFgo3g/qVZO8e/InsLGUU0Z/XGx+pP5BoJLSZQg1IdDDm bagBP4qWyQIDEeSPXsw7a1Q/I4SjzJdpLLyvEtDgMM4bjqJgsR46rUCAOu8L5SlM /w30ru2uZTQd2nUumgxAq8pIW5OkFqYz0qMtcVBh10gFCBbU35Hvgu6JmcchcUQL KTxxlgorypYcDDRH+zguwHuWeFrVSE8+af1vUfYkaOwZfHM+Opg/afmwImK/B9+4 LtrChOwjUtWb2MQ/ovmuQQfLzwBuogi/7evyo7cVLpMXd5Dt6hXqXE8COEzY9THU gLPlQ5fRkQ4/iYLcaDjWhOvysej4I44u10jOWgBblvpjMnOXxzt9/Di6JTMueo0a uVnu0bvHaN/X+VCrKbUgWT8xNmnO7Ggw+SpI8aM3yEmoyoK4mtJcGjd0XZC3jZnq QTZoZRFBGLmQ51nEhczaL951n896Q4xl9zRboRCK78qDGertGzTuy/H1R6kAjmeM Y8yWrbnNJXgtc1v8v33oa0Ne0rHBzG7xQ69Lu6I8JHrBzvq82eg3h8W2CDkNp10R CChMTCS7CghYAvU3iZU6JtwniUbBUBjw0RgbwP/I6b37NNeaoHQ= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/B90860DBB5007BF7

http://decryptor.cc/B90860DBB5007BF7

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	rundll32.exe
File opened (read-only)	\??\N:	rundll32.exe
File opened (read-only)	\??\U:	rundll32.exe
File opened (read-only)	\??\W:	rundll32.exe
File opened (read-only)	\??\S:	rundll32.exe
File opened (read-only)	\??\V:	rundll32.exe
File opened (read-only)	\??\G:	rundll32.exe
File opened (read-only)	\??\I:	rundll32.exe
File opened (read-only)	\??\J:	rundll32.exe
File opened (read-only)	\??\K:	rundll32.exe
File opened (read-only)	\??\L:	rundll32.exe
File opened (read-only)	\??\T:	rundll32.exe
File opened (read-only)	\??\X:	rundll32.exe
File opened (read-only)	\??\Y:	rundll32.exe
File opened (read-only)	\??\A:	rundll32.exe
File opened (read-only)	\??\H:	rundll32.exe
File opened (read-only)	\??\O:	rundll32.exe
File opened (read-only)	\??\P:	rundll32.exe
File opened (read-only)	\??\Q:	rundll32.exe
File opened (read-only)	\??\B:	rundll32.exe
File opened (read-only)	\??\E:	rundll32.exe
File opened (read-only)	\??\R:	rundll32.exe
File opened (read-only)	\??\Z:	rundll32.exe

Drops file in Program Files directory 35 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files\ClearProtect.docx	rundll32.exe
File opened for modification	\??\c:\program files\ExportPop.ogg	rundll32.exe
File opened for modification	\??\c:\program files\PublishConvert.potm	rundll32.exe
File opened for modification	\??\c:\program files\RepairSend.bmp	rundll32.exe
File opened for modification	\??\c:\program files\ResolveBlock.nfo	rundll32.exe
File opened for modification	\??\c:\program files\CloseCopy.pot	rundll32.exe
File opened for modification	\??\c:\program files\ConvertSave.pot	rundll32.exe
File opened for modification	\??\c:\program files\DisablePing.vst	rundll32.exe
File opened for modification	\??\c:\program files\RegisterHide.avi	rundll32.exe
File opened for modification	\??\c:\program files\RemoveOpen.docx	rundll32.exe
File opened for modification	\??\c:\program files\EnterExpand.mid	rundll32.exe
File opened for modification	\??\c:\program files\RequestMount.zip	rundll32.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\v3.5\a69y87wi3-readme.txt	rundll32.exe
File opened for modification	\??\c:\program files\InvokeLock.m4a	rundll32.exe
File opened for modification	\??\c:\program files\SelectDeny.TTS	rundll32.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\a69y87wi3-readme.txt	rundll32.exe
File opened for modification	\??\c:\program files\HideUninstall.rle	rundll32.exe
File opened for modification	\??\c:\program files\LimitReceive.xlsx	rundll32.exe
File opened for modification	\??\c:\program files\OutProtect.DVR-MS	rundll32.exe
File created	\??\c:\program files (x86)\a69y87wi3-readme.txt	rundll32.exe
File opened for modification	\??\c:\program files\GrantWrite.wps	rundll32.exe
File opened for modification	\??\c:\program files\RegisterSearch.vssx	rundll32.exe
File opened for modification	\??\c:\program files\SplitGet.mid	rundll32.exe
File opened for modification	\??\c:\program files\TraceSwitch.pot	rundll32.exe
File opened for modification	\??\c:\program files\CompressApprove.wdp	rundll32.exe
File opened for modification	\??\c:\program files\LockSync.mp2	rundll32.exe
File opened for modification	\??\c:\program files\OutExpand.xhtml	rundll32.exe
File opened for modification	\??\c:\program files\SubmitImport.mpg	rundll32.exe
File opened for modification	\??\c:\program files\UninstallLimit.mpeg	rundll32.exe
File created	\??\c:\program files\a69y87wi3-readme.txt	rundll32.exe
File opened for modification	\??\c:\program files\CompareHide.doc	rundll32.exe
File opened for modification	\??\c:\program files\ConfirmUse.reg	rundll32.exe
File opened for modification	\??\c:\program files\ExitRequest.doc	rundll32.exe
File opened for modification	\??\c:\program files\GetSubmit.aiff	rundll32.exe
File opened for modification	\??\c:\program files\PushMount.xlsm	rundll32.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2384	rundll32.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2384	rundll32.exe
Token: SeTakeOwnershipPrivilege	2384	rundll32.exe
Token: SeBackupPrivilege	1984	vssvc.exe
Token: SeRestorePrivilege	1984	vssvc.exe
Token: SeAuditPrivilege	1984	vssvc.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 2384	2496	rundll32.exe	30
PID 2496 wrote to memory of 2384	2496	rundll32.exe	30
PID 2496 wrote to memory of 2384	2496	rundll32.exe	30
PID 2496 wrote to memory of 2384	2496	rundll32.exe	30
PID 2496 wrote to memory of 2384	2496	rundll32.exe	30
PID 2496 wrote to memory of 2384	2496	rundll32.exe	30
PID 2496 wrote to memory of 2384	2496	rundll32.exe	30

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ec350b912bf27249dfb93221a4b7a9b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ec350b912bf27249dfb93221a4b7a9b_JaffaCakes118.dll,#1
  2⤵
  - Enumerates connected drives
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2384

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:888

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\a69y87wi3-readme.txt

Filesize
7KB

MD5
d557c700253b0d4d4247a856b5b2e45a

SHA1
71dbc52861ffbcb48ecf504c4f5b10f9e115163c

SHA256
1beb15db8c4986c7e52392774a5fc19f8e7c2c0b02622b45cd182fc263c74a03

SHA512
273c870969c63df169d37df04f9e718e3390da7d673809b92ea374e7c35c5ae7aeb38c909263950cee489c402978dcf4f110403ad4ff0c17e7061a70569d4686

Download Submit