General

  • Target

    d0190f94e6d05104977c53b55dbc2911_JaffaCakes118

  • Size

    179KB

  • Sample

    240906-v82seazbjl

  • MD5

    d0190f94e6d05104977c53b55dbc2911

  • SHA1

    c0ff002b0e26b180a741c3cefff15190df7746cc

  • SHA256

    f4e5d7a95681d920dda75fe5dd89be249905e2a7712f9b3b39e19351f5ef5e69

  • SHA512

    d4b1cc032f9d8254ac6035c27948147d8c4c5f60be51e632ba26c6e34ada87515b3113b4bd1cec3cedfa1a73c465a1267681ca05356d8f2f08d81c4fef04d868

  • SSDEEP

    3072:LNKQ4JTBg0Q8F63VETed7/kBazzFbULpC15RM:LNn4FQS63VE6F/M4qE15

Malware Config

Extracted

Family

sodinokibi

Botnet

19

Campaign

96

Decoy

speiserei-hannover.de

delegationhub.com

subyard.com

martha-frets-ceramics.nl

hostastay.com

luvbec.com

dayenne-styling.nl

111firstdelray.com

lidkopingsnytt.nu

fbmagazine.ru

peppergreenfarmcatering.com.au

ya-elka.ru

mundo-pieces-auto.fr

mediabolmong.com

yuanshenghotel.com

fidelitytitleoregon.com

penumbuhrambutkeiskei.com

2020hindsight.info

aslog.fr

teethinadaydentalimplants.com

Attributes
  • net

    true

  • pid

    19

  • prc

    tbirdconfig

    onenote

    sqlbrowser

    firefoxconfig

    ocautoupds

    ocssd

    thebat

    winword

    mspub

    dbeng50

    steam

    sqlwriter

    sqlservr

    msftesql

    encsvc

    infopath

    mysqld_nt

    sqlagent

    mydesktopqos

    synctime

    wordpad

    powerpnt

    outlook

    dbsnmp

    isqlplussvc

    ocomm

    sqbcoreservice

    oracle

    thunderbird

    xfssvccon

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    96

  • svc

    veeam

    backup

    sql

    mepocs

    sophos

    svc$

    vss

    memtas

Extracted

Path

C:\Users\9jc5qld80-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 9jc5qld80. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/1757521EA40659C9 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/1757521EA40659C9 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: zdHPXbdB8l4Qdu1QaoXDCFEbWJWtfCCE6VNx2jwxwjvyg9bgG7OM2EvjCFj2RJxN Is254dkumEwtChzOjNfAQLEHDDw3GFFVcJ1hqsZLCVLzro9xt825MC79lIEE3mBZ KFBmRjkm1Hi5fcGMQgj4Ky9p2XZ1TzfKQifoOomYPU7v6NdFyvkT+MxqFo1oNo+v 8yzqeMxd1+rX4t540IUsaN4Peb9pAvwaiDy0zdEXh1kw9FPQc5n7ce3dN+3ekEbd NCOnPtodvbS7HReCUn+7P6G0TXhPqndRXxNR4RXv7b7N1SKqMw9VrMYl3cNOhIFK IS/D8owsKSfYX1SJ+1XhXhlXEeWQ1Vh/DlZZefbf4rROIpnEu78PRlJnjXT3rdbY CGWsELMeKJJrfRMhAt4wJ7w7BaA0+cqCO59kKqcNJ7ztG0ZBpOauwGKAfeaw969q hc6gZqfN5oxFkEsMOEHo6GPbfwFgErh9LabTM9YlHh4+AuwwQbDvRip0Pm0NGkz9 2SJUAxtGHOkHEgGq3WXgSfRceWFM+PRGHp/88CzMvzTnGyeYW2sf1ge6Aec9VMhe Z3qiFY6FjTG3GMPVFDwfmC5hirCZHy/wzFOcMFGifiVMmD2WYdZJ85QXrjm8arXT hZCDdnKdCUHGEtymOF390BBIgmy+cNOC5fjgewwP1fmldp1kWpLpctXXibTnLWqv B9N5D5m8yS7mnLYWSTZfP6cuDPS06ASgNdMQYBaA6Hlh+sx8V6tAXitKD7dQGSri vYIbWYVMocZuzbE9e3kgf+x6HM9CVT17AsV4KBG7gEsS0cSOcIg0dUhbo+UTIfbq UCeyDOUrFjHi0okdsTvGJwwk1UaMtyu6hBM+BH4cuEnG7eXwu7qtampkCyrA5KJq uN/y5+S9heUIcPhsSlW2EDP079bvIrL1D4bhfJboyGhnlrTsW2g7bhN8kUZV/zE3 QG/P+LKbqXUx/8BeA4RVRBjw41J6YV92q7WzSBjbNWjU26anxMT5poAnQOo9Vteh 7MgadZDN80yD7oHXrW5A8ohO5CqHfeUGCQptbVh5ozGinpd1kNHldXArQZMAYjhO cr4jQkLdv8+ICQPr2C4gBrDdePsWRL/4gjqcm1/1h7V/TpYtrXpPuSvY5mB2zaib NNLLaP6GIc/xM4PiHJFlEaGyEahL96R9XdabGDtch/waIWrbZ2ONnB5qg6cyegGc lumHMAtjig1nXjdhzn0= Extension name: 9jc5qld80 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/1757521EA40659C9

http://decryptor.top/1757521EA40659C9

Extracted

Path

C:\Users\7m7n045-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 7m7n045. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/557D3C3EC7AB7055 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/557D3C3EC7AB7055 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: dA7pdvKB7426yxzvojf3NOgs/72fzWmvRPGm4fy0PDnuvo9Cx69uWtHdrojiJf7V Dj1tG0aDo+pjlaRrNiISnDLHHXHgvw7oWh3Adn0CIRSCk9YcP/Brru+h+0xmPy48 IzYWZz5WUKZZQSOLNCKyNM/2RXIkoluB8IjmThjwhuOpU3GlhkPe4IrenoWrqT9S kI7kJESWH3BqDWnxfpWvkyUpGUZlV/kD7MJHedoqNa2QpoqP8sCDRamto0L3KRN1 GHoWNFAPjfLKoF4f/oktlGAFUJS2DcS5BqQjc12sVSdOJqdj83cmZDRG/eaBFe6+ /eVlSfcK4dovSX9gAvFmqlJnuD/bJVJy2mmABrk6phStKRo6OhsVkB7WlVypMZqb Ii5RyNt2akW5Zv9hWVJ8fcm3/JD+XhXj560Q/Lz2+WTsXcl1XLi5AwGjz7mEz0++ dXGuDpkE2N8eOVCRA6n5ifRcQDQVMbaLa+2sMsWC6N4pMqFFcVB8ZNzTzCaupaSK l9KFXJrgHl4J9my2gR5Asv0YGkJhAG8rr26kUABl80aAj0sUh1SQlIFEQfrnMpP5 /N5BZPhxKtlabyw0oJQsx3uTvptW4yVz6or1OUh0ziKpne1lU7VXjI/IdRu2XEfz V+RFDQjQuew6tUGaQSap25QiVEUzsgt4LcZhPThpdMKeIrZlVSvbv7vOGKRgpITv WmpG4PDQZnLpQCpW7eZv4rX07dtmgfNeIxohGzcadUfjI3bFuDcZj+BKWtrKIC8b P0GZfWqjXcNf68IwMaEca/Fjnpjj2xncnqOxN7iHONsv70T7nmS3WKPwFAk3aDWr tFPKHYR8kn815f3L/0qRvaml+cVXKAn5ZsNKLXv8Y7dXaPAsT0agRogaT3AtkWgh Dsw69xVnOQjDUTiHKgnLHWvVyZWTPKXs0hgqIO+DtVJ77KSTvY7ynmIGhWekCZ83 4IeNV/fbSshUU3xG4J7nS9HD6/6yGehdXRcBXIQzx2a8MAYCSnBLPv//FSanwCMO K+O6Lw6huEUS7Zqp03wBUSySN+NCRFa8Nmq6tLET1zLmvmoeMCYPfPNuftV9VtAZ PQVMn7vaPdTXHJL0uG27UiTmx1Xu0Ffz+4GB91dYyuJN4BYdlcHJ+L2yuBB586RO +hYXcqGdQqzNNVULF1YUIVqNcdadv8sUz60eKDCMPSUvqt9SwGj4aViVl2V2XiQk SfTcNM5Vuv2tq8wA7Su/Vg== Extension name: 7m7n045 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/557D3C3EC7AB7055

http://decryptor.top/557D3C3EC7AB7055

Targets

    • Target

      d0190f94e6d05104977c53b55dbc2911_JaffaCakes118

    • Size

      179KB

    • MD5

      d0190f94e6d05104977c53b55dbc2911

    • SHA1

      c0ff002b0e26b180a741c3cefff15190df7746cc

    • SHA256

      f4e5d7a95681d920dda75fe5dd89be249905e2a7712f9b3b39e19351f5ef5e69

    • SHA512

      d4b1cc032f9d8254ac6035c27948147d8c4c5f60be51e632ba26c6e34ada87515b3113b4bd1cec3cedfa1a73c465a1267681ca05356d8f2f08d81c4fef04d868

    • SSDEEP

      3072:LNKQ4JTBg0Q8F63VETed7/kBazzFbULpC15RM:LNn4FQS63VE6F/M4qE15

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v15

Tasks