sodinokibi | 1bc9040cfa3738e8a2e0409efb17726c8f4894e462f2e51d2a18664c4c799e16

General

Target

7ec9d06ed280e25df7d85d740f21558a_JaffaCakes118.dll
Size

116KB
MD5

7ec9d06ed280e25df7d85d740f21558a
SHA1

946746d1163ce772b2a72b67db3cadabac2ff1ae
SHA256

1bc9040cfa3738e8a2e0409efb17726c8f4894e462f2e51d2a18664c4c799e16
SHA512

e16702beebe37e69b6146d49376ce29dac50cfc510ecea0690a63ec2b139c6123ce2320d7f0e6d35ba97185a19f98087a551b20e1e68bf32a05f609783aa65d0
SSDEEP

1536:CPp8kFF4+utlznGEvCrUmUYwGOmpX2yaICS4Aa7A9WySHmQGm73P/njCV3e:8vnuGqfGOqVBonYmLn+V3e

Score

10^/10

sodinokibi discovery ransomware

Malware Config

Extracted

Path

C:\Users\s28wn-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension s28wn. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/543D03B565F1912E 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/543D03B565F1912E Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 025TNBFTWJ289ZOgn+5HrQcG6dPBovRGx/qXoGM2CFZDbnR8V96JjY+KJBiKha8E VZNFkmR/qb0JHqohkEY3LWUqtcRw+PnI7p+lC8MCsGLf5kMjkY3JZNVTTKgrMR4l lnM03MffAf8iiglQ4tONx/Ah06VZgbLVAhtWIrRKJPpYNSwAZQKmm8UjBzGzis0/ aOmCmat2+zzygNcgjqcSgEOlxwML4pMpi9Tnx4naduGuhUhYhbpwwEcZun1LD7lE RW1t1WwK7yp14uEqUl2QfErFeRmMLjAraUDvzAsIw7YuJUL/YDKe3KagQVWHLRK+ e4pDk6/ImfhQL7XWj5rwfu1QIrZ1Lp8bGTDJNrM5LTPisCVeYv1YUxcuB5LEf9Z9 w7uNh4BwROxTFpOPA1sUkzfMJIVFeXUQccxyILJXE9+DIZmCmrmIpld851CJIi+D yH8PKHk8NKBRaXUleeEROUzcfLEhQqOw0CwnlAYxr0LhCBUCwNn6PBdLiams246L rZQ+1WlWYr6L6FXc7qmtoHuyxQcJVErV4gLbAmbODSh63JMSNniDwdf+Oel/giKN vAly5NWDNaaKwqhQO6+6Avm0TGwG6U8uEDuaMc1RTP+Qcz2TUhuXCoRUvoowSdf2 od/4fjfft14USE/ecge+jroC9IVBhwXEfAZeE+AEy1Hr6KAwwYQ6cB1oBxUhNB8j g+ICowXiKQADaPCIJWz1Kj9Y5MZmKB5NEr4xt5CxdQGUYeJxDxCzMb/vhAkLfO0y cyO97w3uLwlRvIWq9ci0bxTTNjrwqXLeLhr13BxHE6Bn2bAedrlaYWqnT/w8P1bW 3tuN7nEFIOH+V880Qc86knzJe7fgiOcXfqHWKx8w4Z0KSb0l5Y8FYOwAPYLMedhM BNSi3kFUpxZy3AwMKxyBmo1Ld+GvVBqQ9D2W5LS2taO1AAlRDmHpTU7tDhRcLWzt OMEECyJNQy1WEJy4DVEw06+5mDyAGw+svQ9KzyMXuE9dJn1aVEwQphOVTIYrO4yu 85yqSuMbXstXiy5Ga4sMOyte/gr1WDumEwFgQ6LOqaM5ZObnOI2BXaHdYMsWWV6o 9QZewJIHezUlt760wXzXgrjVSU+J4lf1nY0YaxQc/TutdaxtGkBGPc4gDqRR3snU jCj4xI2K/exwTlWZzQygfkHgqb9bRPGAEdiwhACchQM5QQUdU2mUmbn9Y9lm0ql0 LN9gBp5UaV9NuCA8OElXVwz/NdA76oa7DE3YYchdE1mU6ApxuaGPLkHafwtkv6Hp b4DJzA3ctLrFmHGq13Kxwg6yGCCwl8Q2UrJj2Efg7c1XYzy0TZmAqMq0/HZO2KQE dPucy00lrNVOH1zgxyj14nAFtEZ3YyOu1MfGJ4VC ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/543D03B565F1912E

http://decryptor.cc/543D03B565F1912E

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	rundll32.exe
File opened (read-only)	\??\R:	rundll32.exe
File opened (read-only)	\??\T:	rundll32.exe
File opened (read-only)	\??\Y:	rundll32.exe
File opened (read-only)	\??\H:	rundll32.exe
File opened (read-only)	\??\J:	rundll32.exe
File opened (read-only)	\??\K:	rundll32.exe
File opened (read-only)	\??\S:	rundll32.exe
File opened (read-only)	\??\U:	rundll32.exe
File opened (read-only)	\??\W:	rundll32.exe
File opened (read-only)	\??\A:	rundll32.exe
File opened (read-only)	\??\E:	rundll32.exe
File opened (read-only)	\??\O:	rundll32.exe
File opened (read-only)	\??\Z:	rundll32.exe
File opened (read-only)	\??\B:	rundll32.exe
File opened (read-only)	\??\L:	rundll32.exe
File opened (read-only)	\??\Q:	rundll32.exe
File opened (read-only)	\??\N:	rundll32.exe
File opened (read-only)	\??\V:	rundll32.exe
File opened (read-only)	\??\X:	rundll32.exe
File opened (read-only)	\??\G:	rundll32.exe
File opened (read-only)	\??\I:	rundll32.exe
File opened (read-only)	\??\M:	rundll32.exe

Drops file in Program Files directory 25 IoCs

description	ioc	Process
File created	\??\c:\program files\s28wn-readme.txt	rundll32.exe
File opened for modification	\??\c:\program files\BackupAssert.mov	rundll32.exe
File opened for modification	\??\c:\program files\UndoMount.snd	rundll32.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\s28wn-readme.txt	rundll32.exe
File opened for modification	\??\c:\program files\FormatMeasure.potx	rundll32.exe
File opened for modification	\??\c:\program files\JoinConnect.ttc	rundll32.exe
File opened for modification	\??\c:\program files\MeasureRegister.mht	rundll32.exe
File opened for modification	\??\c:\program files\UpdateAdd.vbe	rundll32.exe
File opened for modification	\??\c:\program files\TestUse.pub	rundll32.exe
File opened for modification	\??\c:\program files\ConvertFromDismount.easmx	rundll32.exe
File opened for modification	\??\c:\program files\ImportHide.m4v	rundll32.exe
File opened for modification	\??\c:\program files\OutLock.wma	rundll32.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\v3.5\s28wn-readme.txt	rundll32.exe
File opened for modification	\??\c:\program files\UnregisterDisable.ttf	rundll32.exe
File opened for modification	\??\c:\program files\RemoveExport.7z	rundll32.exe
File opened for modification	\??\c:\program files\SetCopy.M2T	rundll32.exe
File opened for modification	\??\c:\program files\SetSync.zip	rundll32.exe
File opened for modification	\??\c:\program files\StopGet.pptx	rundll32.exe
File opened for modification	\??\c:\program files\LimitRegister.wm	rundll32.exe
File opened for modification	\??\c:\program files\UseInstall.avi	rundll32.exe
File opened for modification	\??\c:\program files\MergeSplit.rar	rundll32.exe
File opened for modification	\??\c:\program files\SelectRemove.odt	rundll32.exe
File created	\??\c:\program files (x86)\s28wn-readme.txt	rundll32.exe
File opened for modification	\??\c:\program files\ClearDebug.dotx	rundll32.exe
File opened for modification	\??\c:\program files\SendConvert.avi	rundll32.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2764	rundll32.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2764	rundll32.exe
Token: SeTakeOwnershipPrivilege	2764	rundll32.exe
Token: SeBackupPrivilege	2732	vssvc.exe
Token: SeRestorePrivilege	2732	vssvc.exe
Token: SeAuditPrivilege	2732	vssvc.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 2764	2748	rundll32.exe	31
PID 2748 wrote to memory of 2764	2748	rundll32.exe	31
PID 2748 wrote to memory of 2764	2748	rundll32.exe	31
PID 2748 wrote to memory of 2764	2748	rundll32.exe	31
PID 2748 wrote to memory of 2764	2748	rundll32.exe	31
PID 2748 wrote to memory of 2764	2748	rundll32.exe	31
PID 2748 wrote to memory of 2764	2748	rundll32.exe	31

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7ec9d06ed280e25df7d85d740f21558a_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7ec9d06ed280e25df7d85d740f21558a_JaffaCakes118.dll,#1
  2⤵
  - Enumerates connected drives
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2764

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:2028

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\s28wn-readme.txt

Filesize
6KB

MD5
e33ad8f9a31158288cd4490c9f362c5a

SHA1
58f343ef57868db2dc81674d36a0deb6bb5bfe97

SHA256
019bf96eba731478eddaa1886c4eeff2c030a1f905e87795d64db0ce7de26eb7

SHA512
3bacc93f97d87d2e277cc86a0c304691f0acaf3e399ca3b2b7968dc012fdd1edb0d31a348519ad0fc84cd28043d0558db9393dcd581a6afd6ad9743cb04e6fba

Download Submit

Analysis

Sharing