Overview

overview

10

Static

static

1

ccfde14922...18.exe

windows7-x64

10

ccfde14922...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    121s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    31-08-2024 14:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ccfde149220e87e97198c23fb8115d5a_JaffaCakes118.exe

  • Size

    292KB

  • MD5

    ccfde149220e87e97198c23fb8115d5a

  • SHA1

    d514d08571ecd8cece8d704adc8d0c4fa87665ca

  • SHA256

    34dffdb04ca07b014cdaee857690f86e490050335291ccc84c94994fa91e0160

  • SHA512

    392a14c9a0c3a98c46e15b873919bdae13f5306a937fd8c869b2a2b435d236433a1eb78d6a953a1722d5b43cb69b4028459d6ea2387a904b4c0f2ec5bc36992e

  • SSDEEP

    6144:qGZamLIoveyefyOrA80qE1lHJv3loPHVb6L:qEsomyef5k8k3Sby

Score
10/10
sodinokibi73defense_evasiondiscoveryexecutionimpactransomwarespywarestealer

Malware Config

Extracted

Family

sodinokibi

Botnet

7

Campaign

3

Decoy

sochi-okna23.ru

www.blavait.fr

kamin-somnium.de

geoweb.software

www.drbrianhweeks.com

kombi-dress.com

johnkoen.com

prodentalblue.com

transifer.fr

matteoruzzaofficial.com

jax-interim-and-projectmanagement.com

hawaiisteelbuilding.com

www.kausette.com

www.galaniuklaw.com

www.atma.nl

www.piestar.com

www.kerstliedjeszingen.nl

biodentify.ai

endlessrealms.net

condormobile.fr
Attributes
  • net

    false

  • pid

    7

  • prc

    mysql.exe

  • ransom_oneliner

    Image text

  • ransom_template

    Hello dear friend! Your files are encrypted, and, as result you can't use it. You must visit our page to get instructions about decryption process. All encrypted files have got {EXT} extension. Instructions into the TOR network ----------------------------- Install TOR browser from https://torproject.org/ Visit the following link: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} Instructions into WWW (The following link can not be in work state, if true, use TOR above): ----------------------------- Visit the following link: http://decryptor.top/{UID} Page will ask you for the key, here it is: {KEY}

  • sub

    3

Extracted

Path

C:\Users\Default\j4xg27p-readme.txt

Family

sodinokibi

Ransom Note
Hello dear friend! Your files are encrypted, and, as result you can't use it. You must visit our page to get instructions about decryption process. All encrypted files have got j4xg27p extension. Instructions into the TOR network ----------------------------- Install TOR browser from https://torproject.org/ Visit the following link: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/E7A5BF92BB389A48 Instructions into WWW (The following link can not be in work state, if true, use TOR above): ----------------------------- Visit the following link: http://decryptor.top/E7A5BF92BB389A48 Page will ask you for the key, here it is: X+/OhohqssfsR9rQ2Bl79BeNIsCqBLGNePFsnkWG2Fhs7joAO+kqPrls7NFsoR7y rWNwfhTvfJH9twzwhtQKWvHDtLzXLetepxcQhFW4mFUVr7Tuiu/QIWmZr5vqrAdB bQAF1ygJNEOGKuWVMs/C9ICDrUJ33a92qObX3t1gSHDpKL+DHe97t3b49owthmsl xmZF/Mfw/aUCfxfHtu92KSqUwsTdA7p2SsgFzvU4XAFyfl7XrM+m0sxdSTqpRNE4 GV5yt/LoNGx1+Nan6HA/VmlGI+rxV40DAKoEP8Jjg+UYSd68FFsH230IWBBVK6uq t+tdd5nm+EWihzziHwJ0lRlfydogRWlx49e3jESuAnI0kOSel6rudEzwPEjbT5BK 6PyHEiUF0Zf3tYZbVKUPnt/sS0n943jGnJPQzaY0DXGncB+2NHAFb2fKc0u5mr2M GBy7+wm21JidKpVSt0xJ/D5YtRahfZhhRgf4mjpY0fiagG7wI4WCS0OPFvR8ZW0o JPzp1FyGiRVgiI3oaI3MBMVJrRAXjR9YbzuMw/bLBwHhyFa5soVPCwjikxO07af8 6c7XV2dlyzneNKTT6FXkkqiYZlqi50Vrr49lghy6py2Q0Dk0k+Kc4Yj5vITk3uOD uPdWyTrWrT7bEKGIbzGMN2e72mX5ia8RcnFDy375lzNnVbdabqmPd3SHCAgsOyvE EAg9ITOyh7o2wlyuUw3EDTVwrxnSlbYWkQ7xfvcegUWJC0x1mfKkWF/AvGo3E83s hq7P9MQXdFOg7xtpVD3Q+RFSrBniDxgWWIErSq80vxcUlIEfimQMuqGpk8m+ndF8 YMhd9b1vq8EyNbXzrdmhBURldRT5CU3sA0hWeyTcc1s8lPXSSdnrC9zM/kwZHNhA vEGT55HsFceHMEr188J7NsHpfegrsPKkFzSYZqf6pcNzIyWZgMataEwA11++eCKq srMr6t9roSSg5EEoT8XMAvhohFBxIqLgWK85T0QhPVi2nyvI9yzvDqGmAEjloBpP ucs8enLsUSnuTUhfJK27wQEhEfgutfX0Snq+SNfZcSIAc7/PlvfmB0BgpZrt60/V TvbqotK07EJ8p0aMOERj9L8UOCvCovxmtNl/jjiQHPIsKDV67Qg0cLVuXq/NmTUw uAIjBa6CDmH+m8hCK4FtKcFN2eXMdg==
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/E7A5BF92BB389A48

http://decryptor.top/E7A5BF92BB389A48

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Renames multiple (202) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\ccfde149220e87e97198c23fb8115d5a_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ccfde149220e87e97198c23fb8115d5a_JaffaCakes118.exe"
    1⤵
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2104
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2272
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin.exe Delete Shadows /All /Quiet
        3⤵
        • System Location Discovery: System Language Discovery
        • Interacts with shadow copies
        PID:2276
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2784

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Default\j4xg27p-readme.txt
    Filesize

    3KB

    MD5

    f4178fb06e391837ed688df31e97139b

    SHA1

    b1ef9de1bcc3117e0ce787fa55ae3ef27e2098f9

    SHA256

    008abdf35e4055313902a46549b46543335dc7b6419f3625ac38c3730afb10f0

    SHA512

    95b0d043a0f824181122b68efb496fe8daef022dd02bc3c7177d43d5a0a0c50caaccc79b3dc4533f5877e975cddda3c393d3a5b8cb47143c2bd7f1342a1ead02

    Download Submit

  • memory/2104-5-0x00000000021F0000-0x000000000228F000-memory.dmp

    Filesize

    636KB

    Download

  • memory/2104-6-0x0000000000400000-0x00000000004DF000-memory.dmp

    Filesize

    892KB

    Download

  • memory/2104-4-0x0000000002120000-0x00000000021E9000-memory.dmp

    Filesize

    804KB

    Download

  • memory/2104-7-0x0000000002290000-0x00000000023BD000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/2104-9-0x0000000002700000-0x0000000002809000-memory.dmp

    Filesize

    1.0MB

    Download

  • memory/2104-10-0x0000000000260000-0x0000000000266000-memory.dmp

    Filesize

    24KB

    Download

  • memory/2104-3-0x0000000000220000-0x000000000022A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/2104-1-0x00000000005F0000-0x00000000006F0000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/2104-8-0x00000000002A0000-0x00000000002BF000-memory.dmp

    Filesize

    124KB

    Download

  • memory/2104-11-0x0000000000260000-0x0000000000266000-memory.dmp

    Filesize

    24KB

    Download

  • memory/2104-13-0x00000000005F0000-0x00000000006F0000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/2104-14-0x0000000000400000-0x000000000042B000-memory.dmp

    Filesize

    172KB

    Download

  • memory/2104-15-0x0000000000400000-0x00000000004DF000-memory.dmp

    Filesize

    892KB

    Download

  • memory/2104-2-0x0000000000400000-0x000000000042B000-memory.dmp

    Filesize

    172KB

    Download

  • memory/2104-483-0x0000000000400000-0x00000000004DF000-memory.dmp

    Filesize

    892KB

    Download

  • memory/2104-484-0x0000000000400000-0x000000000042B000-memory.dmp

    Filesize

    172KB

    Download