sodinokibi | f4e5d7a95681d920dda75fe5dd89be249905e2a7712f9b3b39e19351f5ef5e69

Analysis

max time kernel
134s
max time network
153s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06-09-2024 17:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
Size

179KB
MD5

d0190f94e6d05104977c53b55dbc2911
SHA1

c0ff002b0e26b180a741c3cefff15190df7746cc
SHA256

f4e5d7a95681d920dda75fe5dd89be249905e2a7712f9b3b39e19351f5ef5e69
SHA512

d4b1cc032f9d8254ac6035c27948147d8c4c5f60be51e632ba26c6e34ada87515b3113b4bd1cec3cedfa1a73c465a1267681ca05356d8f2f08d81c4fef04d868
SSDEEP

3072:LNKQ4JTBg0Q8F63VETed7/kBazzFbULpC15RM:LNn4FQS63VE6F/M4qE15

Score

10^/10

sodinokibi defense_evasion discovery execution impact ransomware

Malware Config

Extracted

Path

C:\Users\9jc5qld80-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 9jc5qld80. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/1757521EA40659C9 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/1757521EA40659C9 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: zdHPXbdB8l4Qdu1QaoXDCFEbWJWtfCCE6VNx2jwxwjvyg9bgG7OM2EvjCFj2RJxN Is254dkumEwtChzOjNfAQLEHDDw3GFFVcJ1hqsZLCVLzro9xt825MC79lIEE3mBZ KFBmRjkm1Hi5fcGMQgj4Ky9p2XZ1TzfKQifoOomYPU7v6NdFyvkT+MxqFo1oNo+v 8yzqeMxd1+rX4t540IUsaN4Peb9pAvwaiDy0zdEXh1kw9FPQc5n7ce3dN+3ekEbd NCOnPtodvbS7HReCUn+7P6G0TXhPqndRXxNR4RXv7b7N1SKqMw9VrMYl3cNOhIFK IS/D8owsKSfYX1SJ+1XhXhlXEeWQ1Vh/DlZZefbf4rROIpnEu78PRlJnjXT3rdbY CGWsELMeKJJrfRMhAt4wJ7w7BaA0+cqCO59kKqcNJ7ztG0ZBpOauwGKAfeaw969q hc6gZqfN5oxFkEsMOEHo6GPbfwFgErh9LabTM9YlHh4+AuwwQbDvRip0Pm0NGkz9 2SJUAxtGHOkHEgGq3WXgSfRceWFM+PRGHp/88CzMvzTnGyeYW2sf1ge6Aec9VMhe Z3qiFY6FjTG3GMPVFDwfmC5hirCZHy/wzFOcMFGifiVMmD2WYdZJ85QXrjm8arXT hZCDdnKdCUHGEtymOF390BBIgmy+cNOC5fjgewwP1fmldp1kWpLpctXXibTnLWqv B9N5D5m8yS7mnLYWSTZfP6cuDPS06ASgNdMQYBaA6Hlh+sx8V6tAXitKD7dQGSri vYIbWYVMocZuzbE9e3kgf+x6HM9CVT17AsV4KBG7gEsS0cSOcIg0dUhbo+UTIfbq UCeyDOUrFjHi0okdsTvGJwwk1UaMtyu6hBM+BH4cuEnG7eXwu7qtampkCyrA5KJq uN/y5+S9heUIcPhsSlW2EDP079bvIrL1D4bhfJboyGhnlrTsW2g7bhN8kUZV/zE3 QG/P+LKbqXUx/8BeA4RVRBjw41J6YV92q7WzSBjbNWjU26anxMT5poAnQOo9Vteh 7MgadZDN80yD7oHXrW5A8ohO5CqHfeUGCQptbVh5ozGinpd1kNHldXArQZMAYjhO cr4jQkLdv8+ICQPr2C4gBrDdePsWRL/4gjqcm1/1h7V/TpYtrXpPuSvY5mB2zaib NNLLaP6GIc/xM4PiHJFlEaGyEahL96R9XdabGDtch/waIWrbZ2ONnB5qg6cyegGc lumHMAtjig1nXjdhzn0= Extension name: 9jc5qld80 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/1757521EA40659C9

http://decryptor.top/1757521EA40659C9

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Drops desktop.ini file(s) 28 IoCs

description	ioc	Process
File opened for modification	\??\c:\users\admin\downloads\desktop.ini	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened for modification	\??\c:\users\admin\favorites\desktop.ini	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened for modification	\??\c:\program files\desktop.ini	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened for modification	\??\c:\users\admin\searches\desktop.ini	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened for modification	\??\c:\users\public\music\desktop.ini	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened for modification	\??\c:\users\admin\favorites\links\desktop.ini	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened for modification	\??\c:\users\admin\pictures\desktop.ini	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened for modification	\??\c:\users\public\recorded tv\desktop.ini	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened for modification	\??\c:\users\public\videos\sample videos\desktop.ini	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened for modification	\??\c:\users\public\documents\desktop.ini	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened for modification	\??\c:\users\admin\links\desktop.ini	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened for modification	\??\c:\users\public\recorded tv\sample media\desktop.ini	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened for modification	\??\c:\users\admin\desktop\desktop.ini	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened for modification	\??\c:\users\admin\saved games\desktop.ini	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened for modification	\??\c:\users\admin\videos\desktop.ini	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened for modification	\??\c:\users\public\desktop.ini	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened for modification	\??\c:\users\public\libraries\desktop.ini	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened for modification	\??\c:\users\public\videos\desktop.ini	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened for modification	\??\c:\users\public\pictures\sample pictures\desktop.ini	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened for modification	\??\c:\users\public\downloads\desktop.ini	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened for modification	\??\c:\users\public\pictures\desktop.ini	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened for modification	\??\c:\users\admin\favorites\links for united states\desktop.ini	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened for modification	\??\c:\users\public\music\sample music\desktop.ini	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened for modification	\??\c:\program files (x86)\desktop.ini	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened for modification	\??\c:\users\admin\documents\desktop.ini	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened for modification	\??\c:\users\admin\music\desktop.ini	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened for modification	\??\c:\users\public\desktop\desktop.ini	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened for modification	\??\c:\users\admin\contacts\desktop.ini	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened (read-only)	\??\Q:	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened (read-only)	\??\E:	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened (read-only)	\??\M:	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened (read-only)	\??\W:	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened (read-only)	\??\D:	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened (read-only)	\??\X:	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened (read-only)	\??\Y:	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened (read-only)	\??\A:	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened (read-only)	\??\U:	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened (read-only)	\??\V:	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened (read-only)	\??\Z:	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened (read-only)	\??\F:	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened (read-only)	\??\G:	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened (read-only)	\??\I:	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened (read-only)	\??\N:	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened (read-only)	\??\B:	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened (read-only)	\??\H:	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened (read-only)	\??\K:	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened (read-only)	\??\L:	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened (read-only)	\??\P:	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened (read-only)	\??\T:	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened (read-only)	\??\O:	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened (read-only)	\??\R:	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened (read-only)	\??\S:	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3293r856q8.bmp"	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe

Drops file in Program Files directory 35 IoCs

description	ioc	Process
File created	\??\c:\program files\9jc5qld80-readme.txt	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ClearDismount.vb	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened for modification	\??\c:\program files\desktop.ini	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened for modification	\??\c:\program files\UnpublishLock.dotx	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened for modification	\??\c:\program files\CompleteShow.jtx	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ConvertFromRestore.dxf	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened for modification	\??\c:\program files\HideSubmit.asx	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened for modification	\??\c:\program files\MergeRestart.temp	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened for modification	\??\c:\program files\UninstallUpdate.ods	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ApproveMeasure.eps	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened for modification	\??\c:\program files\MountSearch.wmf	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened for modification	\??\c:\program files\PushUse.wmx	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened for modification	\??\c:\program files\SaveFind.rmi	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened for modification	\??\c:\program files\PushUndo.html	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened for modification	\??\c:\program files\WatchWrite.mpeg	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\9jc5qld80-readme.txt	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened for modification	\??\c:\program files (x86)\desktop.ini	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File created	\??\c:\program files (x86)\9jc5qld80-readme.txt	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened for modification	\??\c:\program files\OutOpen.mpe	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ResolveMount.mp3	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened for modification	\??\c:\program files\TraceReset.dwfx	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened for modification	\??\c:\program files\WriteDebug.emf	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\v3.5\9jc5qld80-readme.txt	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ConvertCompress.asf	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ConvertFromPop.wm	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened for modification	\??\c:\program files\RegisterHide.odp	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ResetEnable.dib	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\9jc5qld80-readme.txt	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ConvertToSubmit.midi	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened for modification	\??\c:\program files\CopyConnect.wdp	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened for modification	\??\c:\program files\RevokeRead.xps	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened for modification	\??\c:\program files\StartEnable.wpl	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ClearJoin.vssx	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened for modification	\??\c:\program files\NewTest.crw	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
File opened for modification	\??\c:\program files\SearchConvertTo.ps1xml	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
2964	vssadmin.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2728	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeBackupPrivilege	872	vssvc.exe
Token: SeRestorePrivilege	872	vssvc.exe
Token: SeAuditPrivilege	872	vssvc.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2728 wrote to memory of 3052	2728	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe	31
PID 2728 wrote to memory of 3052	2728	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe	31
PID 2728 wrote to memory of 3052	2728	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe	31
PID 2728 wrote to memory of 3052	2728	d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe	31
PID 3052 wrote to memory of 2964	3052	cmd.exe	35
PID 3052 wrote to memory of 2964	3052	cmd.exe	35
PID 3052 wrote to memory of 2964	3052	cmd.exe	35
PID 3052 wrote to memory of 2964	3052	cmd.exe	35

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d0190f94e6d05104977c53b55dbc2911_JaffaCakes118.exe"
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3052
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin.exe Delete Shadows /All /Quiet
    3⤵
    - System Location Discovery: System Language Discovery
    - Interacts with shadow copies
    PID:2964

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:1920

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\9jc5qld80-readme.txt

Filesize
6KB

MD5
ab0b422ffbd4fade9c4ca2f0fc561df4

SHA1
af046852cde685c9d597c5011b0c7e23aff0d376

SHA256
4016631ee1fcc5cd1f80f583c3c01395205d4a5aaeeea1a7b6289028910c429f

SHA512
9094800df7f15b427abe53f9393042df18546e0c9a6f78f13fda1ab3838f0ae94c9428e7fd1d1dc8ff51411b8a03dd31717edaddc37beab65c0d5fa73dcca462

Download Submit