Overview

overview

10

Static

static

1

ccfde14922...18.exe

windows7-x64

10

ccfde14922...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    137s
  • max time network
    138s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31-08-2024 14:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ccfde149220e87e97198c23fb8115d5a_JaffaCakes118.exe

  • Size

    292KB

  • MD5

    ccfde149220e87e97198c23fb8115d5a

  • SHA1

    d514d08571ecd8cece8d704adc8d0c4fa87665ca

  • SHA256

    34dffdb04ca07b014cdaee857690f86e490050335291ccc84c94994fa91e0160

  • SHA512

    392a14c9a0c3a98c46e15b873919bdae13f5306a937fd8c869b2a2b435d236433a1eb78d6a953a1722d5b43cb69b4028459d6ea2387a904b4c0f2ec5bc36992e

  • SSDEEP

    6144:qGZamLIoveyefyOrA80qE1lHJv3loPHVb6L:qEsomyef5k8k3Sby

Score
10/10
sodinokibi73discoveryransomwarespywarestealer

Malware Config

Extracted

Family

sodinokibi

Botnet

7

Campaign

3

Decoy

sochi-okna23.ru

www.blavait.fr

kamin-somnium.de

geoweb.software

www.drbrianhweeks.com

kombi-dress.com

johnkoen.com

prodentalblue.com

transifer.fr

matteoruzzaofficial.com

jax-interim-and-projectmanagement.com

hawaiisteelbuilding.com

www.kausette.com

www.galaniuklaw.com

www.atma.nl

www.piestar.com

www.kerstliedjeszingen.nl

biodentify.ai

endlessrealms.net

condormobile.fr
Attributes
  • net

    false

  • pid

    7

  • prc

    mysql.exe

  • ransom_oneliner

    Image text

  • ransom_template

    Hello dear friend! Your files are encrypted, and, as result you can't use it. You must visit our page to get instructions about decryption process. All encrypted files have got {EXT} extension. Instructions into the TOR network ----------------------------- Install TOR browser from https://torproject.org/ Visit the following link: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} Instructions into WWW (The following link can not be in work state, if true, use TOR above): ----------------------------- Visit the following link: http://decryptor.top/{UID} Page will ask you for the key, here it is: {KEY}

  • sub

    3

Extracted

Path

C:\Users\Default\21x75d7i3-readme.txt

Family

sodinokibi

Ransom Note
Hello dear friend! Your files are encrypted, and, as result you can't use it. You must visit our page to get instructions about decryption process. All encrypted files have got 21x75d7i3 extension. Instructions into the TOR network ----------------------------- Install TOR browser from https://torproject.org/ Visit the following link: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/4CFECFDC36A9209F Instructions into WWW (The following link can not be in work state, if true, use TOR above): ----------------------------- Visit the following link: http://decryptor.top/4CFECFDC36A9209F Page will ask you for the key, here it is: +dIAUEyMbA5+bgfa3xnD1jk2eBPiKktuFEeiK3RE8ilXTvGYuX0P2Diizy2rVjkf kOQvgYrSjn75v2NXWW/SYZclgPCFvfnT2JNYPpZ120agi52BM5/dNPZIdNyzjSOm 0PF5HJZMYkewh8bT6ktZ66+dYkHsEEVwpg36yxtUeXT0XQYoYGxY0qMnH/Lld7K4 wlRMHpzsiq/rfiOVSp3vUhwCl92B0A25BqMaboAnwb+9rob95WEsGrfEi41eUDkI W26aEeI79Yv+CTutDytQJC9pxITKm8HKfCdu14BbsSZE7u5tEc1/TmmN3hlPfd35 ujWj74ek3YPzIqaUVsA2Yx8p6W2c649gDHkCKgcdGqKEqaTFuUq3zpxjq+zukp11 5ZP3uVCvLIV5XasvIlJHatJ7VuMPMldRRCFWqiSzmGAGjWNzoEvFIzxUG6AGpFeq gC/aQOeNnrPZgMMO1sleEOEZfipAaai+24+UGnP2YcVXuzzj8cpR5UGLlVgQEJKG KfPqawiShjhwVYqFa2kgXLv/EncM2PSIE6US6bK9DwdotfzSVj13iJeYB6eyPUuk 1Fb8W7P+KSBDGrZghcCLgqRhYQUorvCIRtxZDzEfLLxWHFTViEBUiIfc2/etqYat cs8O0Xx/oNtgO7QffcFHHWr7ueyf5T6gxDv+XAY1ZR5MFxONuWmZW7DHR1mCTNfV G5pEu3opzji+diS4BiyBHf9c4Zb1BlT3ymH21B7xdquz9/vD4cJPlihIXVztn8+7 Qs2efBx9+fbpj5RLwGYRwrXMmaYtYOR/X9ykecL+3S/9C374/te01+9sBn+We2bC qjEg5HkXkm6sGVZFcVSXoB0ppTGdIMwy2r5bPW/3vKBMxQLlH2kyANYYfpZ7a0WL 8UGE1Ze3h/tTSu6kDVEa62r0Auf92/VFx14aEh67Be/kJ8pXV7ZeOGlDEQOKz/Jd xEZAdfJ1fjn49Ow7ku2/UwRo4DrWZB1jjWaX54iQtq+WmuTop1gYVjnUvOltG3Xc jJlFXdGoqK/OzMjorr1JgabfzmoDx3or+exxwyxVaR3ShGVEYhU+S7jG6D0BMVqx ikctmxhkIa4snNbyyI0cSoCjIrGkFQdpH8ql4LzaiyrxevlWv8cq8zNNx8VPkFBp q7TQkDNkbT36pZTU/gHRbG+yi7ys051yxlR/bQ==
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/4CFECFDC36A9209F

http://decryptor.top/4CFECFDC36A9209F

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Renames multiple (185) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ccfde149220e87e97198c23fb8115d5a_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ccfde149220e87e97198c23fb8115d5a_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3608
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3772
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3608 -s 1804
      2⤵
      • Program crash
      PID:5104
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3820,i,2904906934812054273,11716976550456127484,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:8
    1⤵
      PID:392
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3608 -ip 3608
      1⤵
        PID:1436

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Default\21x75d7i3-readme.txt
        Filesize

        3KB

        MD5

        b1ec8ff5c22167ecc795ace895a289d2

        SHA1

        e4f7a39e5da5c2ecb55ee9853b2c317d74623fbd

        SHA256

        def16714e59dd381de562b47ab514ad13d33688b599b9a4c9634ccf1610167d0

        SHA512

        22f1415e376a641cf1d17be5aa95ae25b90c08866109abb69112fd13ac269df7d24430d37287502a438a72aac03ce5625b20ec49f453c2972bc3547cc38686ad

        Download Submit

      • memory/3608-1-0x0000000000760000-0x0000000000860000-memory.dmp

        Filesize

        1024KB

        Download

      • memory/3608-2-0x0000000000400000-0x000000000042B000-memory.dmp

        Filesize

        172KB

        Download

      • memory/3608-3-0x0000000000760000-0x0000000000860000-memory.dmp

        Filesize

        1024KB

        Download

      • memory/3608-5-0x0000000000400000-0x000000000042B000-memory.dmp

        Filesize

        172KB

        Download

      • memory/3608-4-0x0000000000400000-0x00000000004DF000-memory.dmp

        Filesize

        892KB

        Download

      • memory/3608-420-0x0000000000400000-0x00000000004DF000-memory.dmp

        Filesize

        892KB

        Download

      • memory/3608-423-0x0000000000400000-0x00000000004DF000-memory.dmp

        Filesize

        892KB

        Download

      • memory/3608-424-0x0000000000400000-0x000000000042B000-memory.dmp

        Filesize

        172KB

        Download