sodinokibi | 8790c52ea21760fde53f3e8003cd23f896c8c7b12ccdf212a615eece41aa5b97

General

Target

c1fcb12f4bd35ee741098773f58cb31a_JaffaCakes118.exe
Size

164KB
MD5

c1fcb12f4bd35ee741098773f58cb31a
SHA1

894be87aa90dd634125497f8b8b5e784be1c385f
SHA256

8790c52ea21760fde53f3e8003cd23f896c8c7b12ccdf212a615eece41aa5b97
SHA512

b67a51c7780d72c5957d4379f6887c10337017979dbd847fa49ceff9100450b2e010974051873dc3675502d249ad4189f7a4f7d89953d297493b5017b4af7ca8
SSDEEP

1536:bs2B7p26CaItF5gNHhKWluLpWmRHICS4AH3o/qTneyW7ZZOBml2uBbKbxoVgAy6B:9fg0NBlu9CNTed7/kBazzFbULREgMT

Score

10^/10

sodinokibi credential_access discovery ransomware stealer

Malware Config

Extracted

Path

C:\Recovery\how to decrypt 29d080u3i3-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension 29d080u3i3. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5986525EDB942762 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/5986525EDB942762 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: vD5FGcKNZoIuRQR1GHeRI5DlovOMO4KHgvvLAnxBccmZVt79XG3kw+utWZHOg2J6 h5c0VctcjoQR2jD4MY0FRWTv+IS1Jq0PErGyJ8m3uj/ih7t/G+QOvP4NLNkT3UPY NSD182790AUGTgkJUY+wozgOL9YmVadjGXrcgKIeltL8Qtxzo3adUf5SHHQUksyM nu6ba9OI/3acVsad7Ln3OCrOFaf+9WkIrcTun5ue/97ogyibujp+XOMZDQfy9Kq5 lUE58C+454TvqV5Xp9AnCZVXT/Fv4pObpkp1imZHKspPom4uU5x1uJVysJkWBMdO IpDUAk+5wT4FumormfqJnTFw4ikNaSIWaz6dlPy/0BYmCzgLEOloxkfLDRwy/Jzt jwyM2ovqUZ8pmSXMYtCnCg0EkJGvxSSLPQDchWyDcCC/6qkj6moZk7K4OQOBZapO eUcGaTwe0aoGItAPsogwx+I2hjajuriHqXQTY7xY0sPxi9fbPFgN4VYjNcZ6fT1j a/bX4ALwVMB/SOq19Wpsz39D81k5nzMT+FYku5CYyO2Wfn6BykYEdio/+XnYKKp4 cukk+sAXG/emDo7LId5M2ulgr0DgThQDRKSo/pfQtwPom3hyELX+Z1QROeLXueIG fqddLunhIuVYFgb125wK19Qms0SWQD3RRkZEbYMP1IMUqYG32nU7BSV9+VgtIxv/ 9kiZ1CFdbK9f9Rv/olbkyqdVq8uED5tQCL11SztLYR5LfjsufSB0v76BQOKna6S1 2/8is8QHmKieZFRjgRwIrVUhd2Y5Xw40pl2rDmp5rgBcAPy0924t2Sk7bI8X7xxT B8rRKbwaVNHZh4RftZZEYSJinx8ApKgzYrpcuR+2v3UA42ZlDcce5MmdkpfN7Cef 6vTZk5bsG4BOPnuGXnjd1SnnDNcgnNHGPSS3IoLwmaAsYCnv5x6miwqkOKU5HemA d1uriRiBqQ1P9JPZaa20pJn4nwswlRne0JNujlV9pOfDIfugVMIaKcPEtO6/qs+r wIBNxdSqu62wMqUmn4jDyxf0hhZ7LSf3bZa9ut3XyPzgVGJQa3SNz9MFhERHvbwS hK8y2RkJEORfjnKsqzZMu/hYf29D1cngUahfcoVxPoBkCcIO7c5Jtsuasj4ShYFm SYHV9y8j1cWwdkVWFNO8z3OD9tMSKhmdMP51EHI5/+V+ZEsn76vw6dr7rOderF6K HVP3rnlr7t1J5nrUebVd0pde3gKE4y94VWo= Extension name: 29d080u3i3 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5986525EDB942762

http://decryptor.top/5986525EDB942762

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	c1fcb12f4bd35ee741098773f58cb31a_JaffaCakes118.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	c1fcb12f4bd35ee741098773f58cb31a_JaffaCakes118.exe
File opened (read-only)	\??\W:	c1fcb12f4bd35ee741098773f58cb31a_JaffaCakes118.exe
File opened (read-only)	\??\X:	c1fcb12f4bd35ee741098773f58cb31a_JaffaCakes118.exe
File opened (read-only)	\??\T:	c1fcb12f4bd35ee741098773f58cb31a_JaffaCakes118.exe
File opened (read-only)	\??\D:	c1fcb12f4bd35ee741098773f58cb31a_JaffaCakes118.exe
File opened (read-only)	\??\H:	c1fcb12f4bd35ee741098773f58cb31a_JaffaCakes118.exe
File opened (read-only)	\??\J:	c1fcb12f4bd35ee741098773f58cb31a_JaffaCakes118.exe
File opened (read-only)	\??\L:	c1fcb12f4bd35ee741098773f58cb31a_JaffaCakes118.exe
File opened (read-only)	\??\O:	c1fcb12f4bd35ee741098773f58cb31a_JaffaCakes118.exe
File opened (read-only)	\??\V:	c1fcb12f4bd35ee741098773f58cb31a_JaffaCakes118.exe
File opened (read-only)	\??\F:	c1fcb12f4bd35ee741098773f58cb31a_JaffaCakes118.exe
File opened (read-only)	\??\G:	c1fcb12f4bd35ee741098773f58cb31a_JaffaCakes118.exe
File opened (read-only)	\??\M:	c1fcb12f4bd35ee741098773f58cb31a_JaffaCakes118.exe
File opened (read-only)	\??\P:	c1fcb12f4bd35ee741098773f58cb31a_JaffaCakes118.exe
File opened (read-only)	\??\U:	c1fcb12f4bd35ee741098773f58cb31a_JaffaCakes118.exe
File opened (read-only)	\??\A:	c1fcb12f4bd35ee741098773f58cb31a_JaffaCakes118.exe
File opened (read-only)	\??\B:	c1fcb12f4bd35ee741098773f58cb31a_JaffaCakes118.exe
File opened (read-only)	\??\E:	c1fcb12f4bd35ee741098773f58cb31a_JaffaCakes118.exe
File opened (read-only)	\??\K:	c1fcb12f4bd35ee741098773f58cb31a_JaffaCakes118.exe
File opened (read-only)	\??\Z:	c1fcb12f4bd35ee741098773f58cb31a_JaffaCakes118.exe
File opened (read-only)	\??\R:	c1fcb12f4bd35ee741098773f58cb31a_JaffaCakes118.exe
File opened (read-only)	\??\Y:	c1fcb12f4bd35ee741098773f58cb31a_JaffaCakes118.exe
File opened (read-only)	\??\I:	c1fcb12f4bd35ee741098773f58cb31a_JaffaCakes118.exe
File opened (read-only)	\??\N:	c1fcb12f4bd35ee741098773f58cb31a_JaffaCakes118.exe
File opened (read-only)	\??\S:	c1fcb12f4bd35ee741098773f58cb31a_JaffaCakes118.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\km26737x.bmp"	c1fcb12f4bd35ee741098773f58cb31a_JaffaCakes118.exe

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files\CloseEdit.cfg	c1fcb12f4bd35ee741098773f58cb31a_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ConfirmUnpublish.vstm	c1fcb12f4bd35ee741098773f58cb31a_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ConvertFromGet.wma	c1fcb12f4bd35ee741098773f58cb31a_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ResumeRegister.asp	c1fcb12f4bd35ee741098773f58cb31a_JaffaCakes118.exe
File opened for modification	\??\c:\program files\SuspendRestart.png	c1fcb12f4bd35ee741098773f58cb31a_JaffaCakes118.exe
File opened for modification	\??\c:\program files\EditGrant.avi	c1fcb12f4bd35ee741098773f58cb31a_JaffaCakes118.exe
File opened for modification	\??\c:\program files\FormatBlock.dwfx	c1fcb12f4bd35ee741098773f58cb31a_JaffaCakes118.exe
File opened for modification	\??\c:\program files\OutBackup.xla	c1fcb12f4bd35ee741098773f58cb31a_JaffaCakes118.exe
File opened for modification	\??\c:\program files\SkipResolve.odt	c1fcb12f4bd35ee741098773f58cb31a_JaffaCakes118.exe
File opened for modification	\??\c:\program files\UnlockSelect.M2V	c1fcb12f4bd35ee741098773f58cb31a_JaffaCakes118.exe
File created	\??\c:\program files\how to decrypt 29d080u3i3-readme.txt	c1fcb12f4bd35ee741098773f58cb31a_JaffaCakes118.exe
File opened for modification	\??\c:\program files\RegisterConvertTo.mpeg3	c1fcb12f4bd35ee741098773f58cb31a_JaffaCakes118.exe
File opened for modification	\??\c:\program files\RestoreMerge.wps	c1fcb12f4bd35ee741098773f58cb31a_JaffaCakes118.exe
File created	\??\c:\program files (x86)\how to decrypt 29d080u3i3-readme.txt	c1fcb12f4bd35ee741098773f58cb31a_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ApproveSave.mht	c1fcb12f4bd35ee741098773f58cb31a_JaffaCakes118.exe
File opened for modification	\??\c:\program files\PublishWrite.TS	c1fcb12f4bd35ee741098773f58cb31a_JaffaCakes118.exe
File opened for modification	\??\c:\program files\RequestBackup.mpe	c1fcb12f4bd35ee741098773f58cb31a_JaffaCakes118.exe
File opened for modification	\??\c:\program files\StartConnect.pcx	c1fcb12f4bd35ee741098773f58cb31a_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c1fcb12f4bd35ee741098773f58cb31a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\00ABEFD055F9A9C784FFDEABD1DCDD8FED741436\Blob = 03000000010000001400000000abefd055f9a9c784ffdeabd1dcdd8fed741436140000000100000014000000bbbcc347a5e4bca9c6c3a4720c108da235e1c8e8040000000100000010000000af1c77aecc8d77e9aacb0c475840c3920f0000000100000020000000e644ba6963e335fe765cb9976b12b10eb54294b42477764ccb3a3acca3acb2fc1900000001000000100000002cd60f91d0dfd482d593b92501780d005c0000000100000004000000000800001800000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000000905000030820505308202eda00302010202104ba85293f79a2fa273064ba8048d75d0300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3234303331333030303030305a170d3237303331323233353935395a3033310b300906035504061302555331163014060355040a130d4c6574277320456e6372797074310c300a0603550403130352313030820122300d06092a864886f70d01010105000382010f003082010a0282010100cf57e5e6c45412edb447fec92758764650288c1d3e88df059dd5b51829bdddb55abffaf6cea3beaf00214b625a5a3c012fc55803f689ff8e1143ebc1b5e01407968f6f1fd7e7ba8139097565b7c2af185b372628e7a3f4072b6d1affab58bc95ae40ffe9cb57c4b55b7f780d1861bc17e754c6bb4991cd6e18d18085eea66536bc74eabc504ceafc21f338169394bab0d36b3806cd16127aca5275c8ad76b2c29c5d98455c6f617bc62dee3c13528601d957e6381cdf8db51f92919ae74a1ccc45a87255f0b0e6a307ecfda71b669e3f488b71847158c93afaef5ef25b442b3c74e78fb247c1076acd9ab70d96f712812651540aec61f6f7f5e2f28ac8950d8d0203010001a381f83081f5300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030206082b0601050507030130120603551d130101ff040830060101ff020100301d0603551d0e04160414bbbcc347a5e4bca9c6c3a4720c108da235e1c8e8301f0603551d2304183016801479b459e67bb6e5e40173800888c81a58f6e99b6e303206082b0601050507010104263024302206082b060105050730028616687474703a2f2f78312e692e6c656e63722e6f72672f30130603551d20040c300a3008060667810c01020130270603551d1f0420301e301ca01aa0188616687474703a2f2f78312e632e6c656e63722e6f72672f300d06092a864886f70d01010b0500038202010092b1e74137eb799d81e6cde225e13a20e9904495a3815ccfc35dfdbda070d5b19628220bd2f228cf0ce7d4e6438c24221dc14292d109af9f4bf4c8704f2016b15add01f61ff81f616b1427b0728d63aeeee2ce4bcf37ddbba3d4cde7ad50adbdbfe3ec3e6236709931a7e88dddea62e212aef59cd43d2c0caad09c79beea3d5c446e9631635a7dd67e4f24a04b057f5e6fd2d4ea5f334b13d657b6cade51b85da3098274fdc7789eb3b9ac16da4a2b96c3b68b628ff97419a29e03dee96f9bb00fd2a05af6855cc204b7c8d54e32c4bf045dbc29f6f7818f0c5d3c53c940908bfbb60865b9a421d509e51384843782ce1028fc76c206257a46524dda5372a4273f6270acbe694800fb670fdb5ba1e8d703212dd7c9f69942398343df770a1208f125d6ba9419541888a5c58ee11a9993796bec1cf93140b0cc3200df9f5ee7b492ab9082918d0de01e95ba593b2e4b5fc2b74635523906c0bdaaac52c122a0449799f70ca021a7a16c714716170168c0caa62665047cb3aec9e79455c26f9b3c1ca9f92ec5201af076e0beec18d64fd825fb7611e8bfe6210fe8e8ccb5b6a7d5b8f79f41cf6122466a83b668972e7cea4e95db23eb2ec82b2884a460e949f4442e3bf9ca625701e25d9016f9c9fc7a23488ea6d58172f128fa5dcefbed4e738f942ed241949899dba7af705ff5befb0220bf66276cb4adfa75120b2b3ece039e	c1fcb12f4bd35ee741098773f58cb31a_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\00ABEFD055F9A9C784FFDEABD1DCDD8FED741436	c1fcb12f4bd35ee741098773f58cb31a_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3600	c1fcb12f4bd35ee741098773f58cb31a_JaffaCakes118.exe
3600	c1fcb12f4bd35ee741098773f58cb31a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3600 wrote to memory of 1540	3600	c1fcb12f4bd35ee741098773f58cb31a_JaffaCakes118.exe	92
PID 3600 wrote to memory of 1540	3600	c1fcb12f4bd35ee741098773f58cb31a_JaffaCakes118.exe	92
PID 3600 wrote to memory of 1540	3600	c1fcb12f4bd35ee741098773f58cb31a_JaffaCakes118.exe	92

C:\Users\Admin\AppData\Local\Temp\c1fcb12f4bd35ee741098773f58cb31a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c1fcb12f4bd35ee741098773f58cb31a_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3600
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1540

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:4860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Credentials from Password Stores

1

T1555

Windows Credential Manager

1

T1555.004

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Recovery\how to decrypt 29d080u3i3-readme.txt

Filesize
6KB

MD5
191cab4c0ab317b77cf2640a1d7e5e6c

SHA1
d48f47c9dfaec9cc722d484780a58ddf2496ce32

SHA256
f8fdc3902cd58a59b7af7ebbf3095f1531b5bf0af3b538d8060a360eb3cedf74

SHA512
563b965fce6239762300afc3a3e92eccdcb405d7b1b25ca9d9af7c45eac2fe542b55b2e69d717c7698b067b01b6ae64bec7d2a1382d17e43c2940ce94abc0074

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads