General

  • Target

    c344cb3365d1c252ec9bca116df262c2_JaffaCakes118

  • Size

    207KB

  • Sample

    240826-sp74zasarm

  • MD5

    c344cb3365d1c252ec9bca116df262c2

  • SHA1

    feb6d0bbacdb99b882d563f27b78c9723f2aac49

  • SHA256

    5058c2ecac89eb616b4478e9a1f61522ef906adc2fd18206ee6ab445be3b3ff3

  • SHA512

    ce5b7ab0ded562ca52f6f5a281f0d46b88f76fd39385b52db7bc14e244434143215da8cdf0323f6de4a34b024f7bffc4734353da89fef5193f9ab454ede749be

  • SSDEEP

    3072:1LFrb30BRtBZZg+i2ayy2RjLTuVyu7CJDgoMT3Q092+ZCInhNLFrb30BRtBZZg+f:ZJ0BXScFy2RsQJ8zgkZCihJ0BXScv

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$ZGqIY89Jar0DY9/9Hnp6Ku0nKqXP6FZH6TuF1uc0S2.QEFDPiJ9LS

Campaign

2866

Decoy

spargel-kochen.de

bloggyboulga.net

huehnerauge-entfernen.de

ravensnesthomegoods.com

highlinesouthasc.com

delawarecorporatelaw.com

campus2day.de

gopackapp.com

lubetkinmediacompanies.com

leda-ukraine.com.ua

kaminscy.com

ecoledansemulhouse.fr

oslomf.no

southeasternacademyofprosthodontics.org

kuntokeskusrok.fi

sloverse.com

tuuliautio.fi

coffreo.biz

testcoreprohealthuk.com

ulyssemarketing.com

Attributes
  • net

    true

  • pid

    $2a$10$ZGqIY89Jar0DY9/9Hnp6Ku0nKqXP6FZH6TuF1uc0S2.QEFDPiJ9LS

  • prc

    isqlplussvc

    mydesktopqos

    ocautoupds

    thebat

    dbeng50

    firefox

    tbirdconfig

    thunderbird

    synctime

    powerpnt

    winword

    mspub

    steam

    sqbcoreservice

    encsvc

    onenote

    oracle

    visio

    dbsnmp

    agntsvc

    sql

    infopath

    xfssvccon

    msaccess

    ocssd

    wordpad

    excel

    mydesktopservice

    outlook

    ocomm

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    2866

  • svc

    memtas

    mepocs

    svc$

    vss

    backup

    sql

    veeam

    sophos

Extracted

Path

C:\Program Files (x86)\3368c-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 3368c. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/865D52C0262909CA 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/865D52C0262909CA Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: jKx9km51snk9AU/WYZ0zttJ8e58JVln3+zGr9A6UEdzeokfxT5jw3ECm8sdPOEpz F6OGWPUvgzkzz5J2dmwThMi0fwmgeWLi0zA59s9y7EhQtdRkIfwXQ4in39N7Trbr 8BcwOfeixNKzRagTRzO+/6cdfKze6i332E0A+gGr7P90faLfp+ykZ3qJbwzaYhq0 xjmA7s2+BTehexO/Zvkym0bc3OwyIPf5hVT96WNGKjB1a2tGSfCexRf0v8Jhnb/U RKN+qw4ITGe7LX0APTsmIl0QbWUl3O1zU7vMqxY4tsZEbodwDp5F3hX7I0icj3BH cyh9tLc5WTty5CMfYyiHZxvBdpO4qrwQiarwnqqk81VO5vuLPpETkvJfJ5ZjVJaM GTpOP40TooccP/lFGD66atkaFfKiI0WAS5mKHs0tPBFSY/jus+zeYlV6JX4pPHCo IwxV3fWpg0Qv56gB9mnZ8q/hzXGjcTj4We2owkqvaNaCKnrMdc6X9ZTI3Aao1Ere cV0uJ8BdxI5WIyVrWcSzGoKFQn19LtKkFh3Tqmu6wJnzDmM8Zlr5h7tTsS/Wn0cr StPBEv2oBPlFUVR8MPgjxSl9et4XpRy9uduLBAIIMeKov2zaW/HfA20Zycx97ZYD mDM8gkYcu/74z065lX8ALgPv6fTpRcgWLjDJGObZ8kadXCkwsu3dnePrcvlBx1ub /5JyHvGTxnzcGHsmA7Noe0gL0HmW2w3zYgEJg79KSUJJpmx8aSgD6OMEl0itLeI5 x0BVYqtxa1AO8YXLKt64gTPQo4ydKP16diWa+yGl94W2LELhPtfZJfJwx484RJDz jXteRHGOPJHimljf+OsZC1pu+XLVv5iSq4GDCVqvZ1lHCmK9FS1a5Yz/m8dNQlYG T7Dd4aqqk7FvzpgdQjEctMNmo8FgclVP9eQjh6XMg9A9J6ONAQxwLOdX9XJTti8N T+QiK4EgzIFG064za1KlsgewTqoMxAMprZ/QjkK6VsYcugkKxTxW2H8WRqQ4mk4M 9BhgV79wBYpuGJr3rNpRyyUUx21csWdrDvl1OQ/N36j4FNhfVXVV0tHuALMqLgMa 8rhCYETM6iaul3JMcQfex8RM21Rwbd74+MFZxb0FGtWP4BdgbXtfpFMOpb6kYJF6 2d9U2afItkWpvBgtrsd3KXsOZt8UFTiZ/LUkRno5qMSGmp3coz3GdbL9KGn4rUIM UK9hhJJW2zTxnF3V5+OTOfXL6D+EeZdm4Cux0HlHXl7/w8YbJhfpDhp/IChHRE5p CNESjQxDbBfxAlAPTZ2eIGYbpnIHEcMRXcHUO9a13BDs6vYExSsMDfz2towy/gFr TIkKe4cyODpzXe/ea1DsyvFMVnOJ9IRoALhY7HOW ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/865D52C0262909CA

http://decryptor.cc/865D52C0262909CA

Extracted

Path

C:\ProgramData\7b3f1-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 7b3f1. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/939E5D1045654B3A 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/939E5D1045654B3A Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: pfcRH5jvGg/5vPdKpLcDbDbAg5l/kz3uNwTzH/LiRTLIH5B/XlYGWQZpdkPlSB/v 5vDtUk96ZoMzFsUVUiiHDRqy+7insoiIeOmgbprDZGfN9sFoWZndLKZF/Im3nuSO oQcBokvaMPuSY+HkmtubUyNzqzI+ag4IqBy0cDwK2CbCLRCIcTld2i9Y6BSSSMkM UQe9CnlH4M0Qpd9/a0AxCw1ukOuK+tYiiU6BNCJSQBna6KU+IoblMfY5+N4hWJO3 f9qywecdGrmv2OYLy/R0BA98H2st86mdlhs0Q84Eb3M6y+cke4iXiE083FWufac4 Wa40yEm3aUsw+lYuzZwnjOhnMlTT2GjtmYGepftklEoDh2JineaYS06I7Q3+4O/i tl6jy9Z0nxwL7ARHyNRb+d4tUDGXgFYr/PyTHo5ESUFCQGoAFp9ZLIWcmvS4q8FF bc1SgUhKa+Xc5TZ9gd1mavHyudkIVfBESlzsm4EwOsVnkc1FUGdAaF1y2KSf2N6f cXm8dqnSTIW8k3QYGjEwtkexSCTAypu4hre9KrPR6syvtr7445MH8CyYjrJ53AMw +RHarmJjoSJYqucd19qRL9aYkHFowKVU4or32O1ZNTzahOJOT4wW3tjQ1EdHlZSQ NyKCEcWT0ki4l2JwiWGZ/QEytFX8DK2tRp89yyPsHmuvK1Ntzq/OWTqUIqMoD8SM mrlOZgGJ5XfgzhCz/bKVcA0HaynAl1J0IpMctUIqYL/pNfAaEs5vT8DZODlbt8Jz T0hwxobo2fiGNGeWbPPCB0CUUBrijZKPUEzYEr/QpbZNvxV9GS/Iyt/IGkvQgN4U QqhrM4/BqzlU6hIWlNMpjPCJHktO0TWVdqie1CMzmDKH5OjMDqlos4C+nqDKr0ca bbrK00ExiBAGrMhwudnF0KdJHdUYRFDBGe/3VD6109Uw03LdkNOe61CAwvzCqihp /QAli6DChHvxWFHo2VNH/bj4WEVTa0FUtcQ5LG+ghdIXgsGjDd8nhmnRQ87iF8lq 5AGtjonej55yIdNZ2uQL+/bPqG4ardqBn90ACPSyEvwvYab3Izxal8eeQbU0D/rs mzQZy98GO4IbsQB3uoRSihKgajnENeVwTECFENGtOT7P183bEeSdJ9VJ38iSHbEr STSwqFEUbRq+0jrqSGkHwTvKxI04LQ00UHPauL6nek/zvRF4sMvl8ZBi4jUeaCoX 1IeF7O3AF2mdFfTdtossh5agg5vbn1E2e1dDPmCNARH2pgiWUEuoMYAjR20EUgDr amUI4ioi2aIqC3pDqHhn30LLZZ1f5fxKyRggRn3oFAZApIBVkQTp1coRd7JU2IxL 9QyPNl40kBLrxb1gfRlvQF/Td+rzQwcL9kdwWxS7t544Q8te ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/939E5D1045654B3A

http://decryptor.cc/939E5D1045654B3A

Targets

    • Target

      c344cb3365d1c252ec9bca116df262c2_JaffaCakes118

    • Size

      207KB

    • MD5

      c344cb3365d1c252ec9bca116df262c2

    • SHA1

      feb6d0bbacdb99b882d563f27b78c9723f2aac49

    • SHA256

      5058c2ecac89eb616b4478e9a1f61522ef906adc2fd18206ee6ab445be3b3ff3

    • SHA512

      ce5b7ab0ded562ca52f6f5a281f0d46b88f76fd39385b52db7bc14e244434143215da8cdf0323f6de4a34b024f7bffc4734353da89fef5193f9ab454ede749be

    • SSDEEP

      3072:1LFrb30BRtBZZg+i2ayy2RjLTuVyu7CJDgoMT3Q092+ZCInhNLFrb30BRtBZZg+f:ZJ0BXScFy2RsQJ8zgkZCihJ0BXScv

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • Credentials from Password Stores: Windows Credential Manager

      Suspicious access to Credentials History.

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v15

Tasks