Overview

overview

10

Static

static

10

c20ceab7c0...18.exe

windows7-x64

10

c20ceab7c0...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    136s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    26-08-2024 01:53

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c20ceab7c093c47be023c81164b544ce_JaffaCakes118.exe

  • Size

    160KB

  • MD5

    c20ceab7c093c47be023c81164b544ce

  • SHA1

    de182d48bcc37bcbd1a25f22a0fc6619ce96f69b

  • SHA256

    207b3353fa8bcb64966ba9f126e62753a00d22ac3702f2bdd34ec658d6d6144c

  • SHA512

    add2c95045cfc9313d03e5b8cc351e90d0d82f2758208f48800db2ad02a39f8f8c60bcf8dce089d5a25e92e9ae2623cb30fc164de384620ce21276d261b32361

  • SSDEEP

    1536:LzE8ZQwf8u+MM3PqBmD9PVpVO0Aj7Pbi4eTMluxtXDCntTnICS4Ag9JbMBBjV11l:Kt38mD9P3ILbi4eTMlwDCnumU9zx

Score
10/10
sodinokibidefense_evasiondiscoveryexecutionimpactransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\92btn-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 92btn. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/1BEC11C8D837290B 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/1BEC11C8D837290B Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: OGsacOdS671JXbxBroPYdgqHSO+6o5VmBjRM32rDSvM6QeZiDuY8a4h9ODIQlANW a9GwNMfy1HCH18PMKjvxEfAtTnvj25ZR8xgbI48Kz7OfwSIZ7OTreBqzwlN0+iPw Vlvs03RfD4iffoHIHGFMNK1j3Hjfuj50AayRWuYpP0Bj59gpSidX+cwmq714qAQi NqvKBjQ24wPJLy8+OOoQ6ksYNu3OEwXZevU/BI0k/qAa6UXp+7gq3EQsOZkt4p97 3htnNaPxMabpt663RuCE5fcY7SG7naaBFnMx5ce/oeYhF2trZbhPPbJwBphlIMlZ DL9n7X+d1CCuH7poZv5GMnxWBqUtCfD1HTKE9vnYYvWpopwBZUb8rZ93Rvzhd+PP QaJ32mlWEdPB9ga5hGkRT4QrNf4JSxb+wvwJzeRqL62TakR5wEWrNvfc55krwRB/ bxttMyA1jaqU6M7mPQ7HWMkjrkfyv/HfCZQR2v3BBN+YGdJzGrZPsi/6yBfCd2Iq ZVkM8w0xi7dzDTzlkBWlgvvAtvQpqmsF3jgYpQk3kuEM4VDGCBh6HlwD9wQcTmdz so8QB6sVvGjFYGFGumXkg4CznrwDqVkK7BNxnVXXFtfMTzZQokKXO1MlhUEfWmkz vAVLsLJp/ia/3kYOB74NwWEOC9PH11TxB77jcbK+UHaGT5qmNblMx3YohTW1glZe SY+UkYlYPSJ0UN3Oi3AX1heywP1Lh6cXcquqvVlQn7kyusSWkfr7Glzr2QwFCfF0 WdZlpIjgKUa0ST0USXYabVuC71uak0GhDfDepXdnGajAlleFHJMNjP+4g6Xdb3cC NQw3VFDhS5vctZEC63vmHmoTxRw+IQcS+dtynXZTKqprshpqvIaYOvArrXsgap1K YqMFxnWL3rpHW8Uxb2traSzSDHkkHUdBcHVQzMCoOoqP80+LopaaGTQvzdv1meEO P1ZBt1UeDJuPJNxo37vuz2kZ0k153s2fDhav4ttBpQvFgpxaZIwYYQRXHzB/1Sry +g+r5fREZxmC06Mlr0vKh3I1IDG8AxMPwD0WdEfidqGI1fQfVzLtbhbtCxPSQVvx 9gbC3ftg2MdSi4ji4cou1LMkCQdbFCE4zAY89sjoKHdExeYzJ3y8+ardcyXBAeeB a3hToJWUUbUQnVq9mtqYK/TUQg+z9l6QKUuvTRWYFe46K3gMBlo56p0mLI1e8My9 1Sc8vgCb Extension name: 92btn ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/1BEC11C8D837290B

http://decryptor.top/1BEC11C8D837290B

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 47 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\c20ceab7c093c47be023c81164b544ce_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\c20ceab7c093c47be023c81164b544ce_JaffaCakes118.exe"
    1⤵
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2420
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2328
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin.exe Delete Shadows /All /Quiet
        3⤵
        • System Location Discovery: System Language Discovery
        • Interacts with shadow copies
        PID:1912
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2516

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\92btn-readme.txt
    Filesize

    6KB

    MD5

    5ace0f8a526d0bade0744214ba3a5708

    SHA1

    7d11b4aaf81e53ec90ef0a5841ee25e4b444e66c

    SHA256

    bc44119e051011a37122ebcf7859a3a953adcb0922000791e3d2c32a2f39b38b

    SHA512

    524dd33a72198d0f09b5768d02eddc058b8996af6b17e655f1be7276183e28451544bfa857b79eefa803848c25ce8d1bab63534aeaebe5f6f51009154191b93b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\CabEADE.tmp
    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\TarEB00.tmp
    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    Download Submit