sodinokibi | 93bd21cb6331ce96cc28dc7a1f0b6b2b2ed8ec064d2ac6e1f428af59c924cb57

General

Target

3ec350b912bf27249dfb93221a4b7a9b_JaffaCakes118.dll
Size

116KB
MD5

3ec350b912bf27249dfb93221a4b7a9b
SHA1

2142fe0caa3f08b98ffe6b3f9ae82f4bfb5f3abf
SHA256

93bd21cb6331ce96cc28dc7a1f0b6b2b2ed8ec064d2ac6e1f428af59c924cb57
SHA512

1e54a3204d8ca0665617093e725f3e32d46ffeef3b25f019cd5039dc1a24022d52d595bc2bf1a630985b8f1899ed01fbe22f9a943f9037743946b2cea3379d02
SSDEEP

1536:CPp8kFF4+utlznGEvCrUmUYwGOmpX2yaICS4Aa7AYHiqcrUzSNYr:8vnuGqfGOqVBWitN4

Score

10^/10

sodinokibi discovery ransomware

Malware Config

Extracted

Path

C:\Users\14s1s6lk-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 14s1s6lk. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] WE ARE READY TO PUBLISH UR DATA TO PUBLIC ACCESS IF YOU NOT CONTACT US [+](USE TOR BROWSER) http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/posts/164?s=8461e11922fbbd5471dfee87150dd27c [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/86778E0E43FEB2FB 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/86778E0E43FEB2FB Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: DT/88RqTtBphWSspe8XGuNS3oxaf2wxBGeMepbue8LY/fJkZElL71o0zhpQpliQs SnH/lxuPbJTz9dXjyrGE/dRuz+d7AwG1PiMuDR5wfep6dRFp1sSp5NO6PVcUM7U7 0t+pxcqHldZxtyAGJAH3pHsrJ5PdclqC4i6cKKe+W1Vxp3mlgx+8Mi+AUKZEoveX K6nRnj/n3oMPLHb+Dis3WspN0++LGri1zxbwdc0rlt+PbrtX3StybWrgG0Y28j9C EhzHx3sxiJr0ViuQb9fy9jhyue2drYZ9hkEmR3EQDRekgApfFfKaUtyn6bSPbhrg FQxKWBRl0fZ0gLKDvV7Lw8xGir0B6FmImckUeApeMCQnw32fgn29NA4ft04HmVif TK5uW8eRtxB1jcCX7+MaDoSwweIS19OdsFEiGgBVux+VVInUSatU9UmYQgoNWMOQ iGQQw2MKfIimnpCZOj2RfuF0o1y1LPxmO2jAdrpf1XHPbZWkM/owAB3miJCq7ARW 6lFfHaaFC8TRfeW2bYU6k5BSnlHVE+Z4w08IuMaKFhFCl2ThTid6TKhHUFK3okEO k/8DrlhalG1cwy0IUMuMdVjWry7fST6VSj/5LWzG21GzIay95sxG1NBvRy+E/uPa 7cDtkxNuRccape92KUbd/UIVoV5EH/fTHNBn5BvVWtQ6eGXGJE7mxJ0X6pOOBlHM 3gzxLrTuM8HaZ9QeXezRaXZB6FTsY7lZYBtCCOvFedSInVXHA7SO1+2KW8oUEfY8 dQNMdcpzjc1t9869FcR902Pna34M6EnLWr87vFVAM2ePix7yeK5rC3cshPGA/4bK D59o7FWPqPDeKsTgEFp8w0xZfiG37WeUDskm6c4jcVJxWFt310d2XddWNe43rmHE lD9l/t6ZuitI9gvXPA8IZlSvenCQ3xBG++LGEN8c/ZnCkf1rHjrC+ylElYww763o I3+3m19V59L+AWCrxggs6/D0oJzlnhDg6b1AVB5hK7KECr8DHEZeszOFeg4o+WN9 22RVgogzH7Mlk2LXBgX8EOiNWis5x9ZcjwtX4h5l8EDjGvlSUaaeDty7vevfQ/La SbYOaZ8xAZyz99b0duVtZiwIWhB08QnT9SXQJZI3w2poUOgG7wNozGH427WUE0/R qjADw8MZdoBxZdv1GB1GwYxpv9dwaPepKZPivluDnUJzI2SN0Qh1ue3ZGeVdi4E/ SKkzBGp+YV3sI/+GJIQn/rQyF2pwk4GVqdW7c2YoKU3si+0XtdqN5exHwQxLoZFq 3AOH9HglbU8RCC6KhUxbaLIDLXvS8/pLWiChXL472mPzNwPeE65VEg3qTV4WtT5E sDgJPDa/FGeBnigqK0R1a5YYVCMLPR/uvJtEbK26bJvdbOLMqsBhkTxs ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/86778E0E43FEB2FB

http://decryptor.cc/86778E0E43FEB2FB

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	rundll32.exe
File opened (read-only)	\??\P:	rundll32.exe
File opened (read-only)	\??\Q:	rundll32.exe
File opened (read-only)	\??\Y:	rundll32.exe
File opened (read-only)	\??\G:	rundll32.exe
File opened (read-only)	\??\H:	rundll32.exe
File opened (read-only)	\??\K:	rundll32.exe
File opened (read-only)	\??\O:	rundll32.exe
File opened (read-only)	\??\T:	rundll32.exe
File opened (read-only)	\??\W:	rundll32.exe
File opened (read-only)	\??\Z:	rundll32.exe
File opened (read-only)	\??\M:	rundll32.exe
File opened (read-only)	\??\R:	rundll32.exe
File opened (read-only)	\??\S:	rundll32.exe
File opened (read-only)	\??\U:	rundll32.exe
File opened (read-only)	\??\V:	rundll32.exe
File opened (read-only)	\??\A:	rundll32.exe
File opened (read-only)	\??\B:	rundll32.exe
File opened (read-only)	\??\I:	rundll32.exe
File opened (read-only)	\??\J:	rundll32.exe
File opened (read-only)	\??\L:	rundll32.exe
File opened (read-only)	\??\N:	rundll32.exe
File opened (read-only)	\??\X:	rundll32.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files\TestDisconnect.xml	rundll32.exe
File opened for modification	\??\c:\program files\GroupSelect.potx	rundll32.exe
File opened for modification	\??\c:\program files\OpenExport.docx	rundll32.exe
File opened for modification	\??\c:\program files\ProtectUpdate.ogg	rundll32.exe
File opened for modification	\??\c:\program files\RestoreStart.3gpp	rundll32.exe
File opened for modification	\??\c:\program files\ResetInvoke.css	rundll32.exe
File opened for modification	\??\c:\program files\MoveEnable.wma	rundll32.exe
File opened for modification	\??\c:\program files\RegisterOut.mpeg2	rundll32.exe
File opened for modification	\??\c:\program files\SelectMount.wpl	rundll32.exe
File opened for modification	\??\c:\program files\LimitRename.mpe	rundll32.exe
File opened for modification	\??\c:\program files\UnblockResolve.ex_	rundll32.exe
File created	\??\c:\program files\14s1s6lk-readme.txt	rundll32.exe
File created	\??\c:\program files (x86)\14s1s6lk-readme.txt	rundll32.exe
File opened for modification	\??\c:\program files\ConvertToTest.wmf	rundll32.exe
File opened for modification	\??\c:\program files\DismountUnpublish.dot	rundll32.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
648	rundll32.exe
648	rundll32.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	648	rundll32.exe
Token: SeTakeOwnershipPrivilege	648	rundll32.exe
Token: SeBackupPrivilege	3764	vssvc.exe
Token: SeRestorePrivilege	3764	vssvc.exe
Token: SeAuditPrivilege	3764	vssvc.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2832 wrote to memory of 648	2832	rundll32.exe	84
PID 2832 wrote to memory of 648	2832	rundll32.exe	84
PID 2832 wrote to memory of 648	2832	rundll32.exe	84

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ec350b912bf27249dfb93221a4b7a9b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2832
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ec350b912bf27249dfb93221a4b7a9b_JaffaCakes118.dll,#1
  2⤵
  - Enumerates connected drives
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:648

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:4620

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\14s1s6lk-readme.txt

Filesize
7KB

MD5
0dea780de157cf0019e7f15e0bade3c7

SHA1
f5efebf6fd7e7999b5716e995b3b11bc572b55e1

SHA256
e8eda5cb3832a574b5aa997764d6399f115d02802c9d9d090d3fa275e1d0d777

SHA512
ed3edd20eee8f9d43817f576e790ee13b6802e2a2bb3380b324fbc8983575c4e1ccb735287dfda303dd25a91dff237881ed01f23b4342612119e88acf3f78381

Download Submit

Analysis

Sharing