General

  • Target

    d2f4275c5c0ed02ac27c5c502fabeaec_JaffaCakes118

  • Size

    165KB

  • Sample

    240907-2ahp7s1cna

  • MD5

    d2f4275c5c0ed02ac27c5c502fabeaec

  • SHA1

    24d68dde7bf39797ac7c03a39b5f11d36957834f

  • SHA256

    4e5c233cf1270e2dac1a35ab36907ee23189fd424625fbcd7da10e49e7ae331c

  • SHA512

    a1e3240b0ef8347f30885741f553ac43cf17ec1b7d179aaf396707a017a4ee8b9dba28a58bfdfe7b7092e320b44daef754f24fbb0a1d41998c3918fcdeb841fa

  • SSDEEP

    3072:dopp2Xda3yJQZiiykM2pngXEOkzMvo3qBVj:dGp3zZiXkMEnSEVzMQaz

Malware Config

Extracted

Family

sodinokibi

Botnet

16

Campaign

2807

Decoy

tutvracks.com

wasnederland.nl

housesofwa.com

jglconsultancy.com

uncensoredhentaigif.com

michaelfiegel.com

greeneyetattoo.com

ciga-france.fr

shrinkingplanet.com

aberdeenartwalk.org

saint-malo-developpement.fr

afbudsrejserallinclusive.dk

ahgarage.com

charlesfrancis.photos

duthler.nl

awaisghauri.com

agrifarm.dk

loparnille.se

theboardroomafrica.com

spartamovers.com

Attributes
  • net

    true

  • pid

    16

  • prc

    ocssd

    onenote

    firefox

    tbirdconfig

    synctime

    steam

    sql

    mspub

    msaccess

    ocomm

    winword

    excel

    agntsvc

    thunderbird

    thebat

    dbsnmp

    oracle

    dbeng50

    encsvc

    xfssvccon

    ocautoupds

    powerpnt

    infopath

    mydesktopqos

    sqbcoreservice

    isqlplussvc

    mydesktopservice

    visio

    outlook

    wordpad

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    2807

  • svc

    svc$

    backup

    memtas

    sophos

    sql

    mepocs

    vss

    veeam

Extracted

Path

C:\Users\9e28nf86-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 9e28nf86. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/352ABE9B61DEBAA2 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/352ABE9B61DEBAA2 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: p/6u5biMG3KDDkuWviL1v2di1eztkuYiFBIKRPJBoFO/PPR4XFYoX0wqLoszJ58t bXLnDXiM66r8M/f6CBK9p2lSAMZkJ6EWwKw+NgSqw7vDZ4FGAPcrtEKOmrMkONJI sil4nzL6vGcHiWE5c3p4ynf/VGSzwY6ntRpWkncpfxUpFe82d3acEn2O7Dr+63am BmDSTToEf2xsAPaDMNqkFbQD1a2waIBhse/dUkNaVQ5URkYAU4Bh3Mo9b7/wHIQc dEWx9NhK8ffW7JAh0QD576g28xghnJ963mi0tKoBWHL3NpVtulCsklDH4LDa9wMc 4uO9j5jaifpN/vkc4JprjclE6PlmKXaCPn6eUZwVunnNQpddeg0Ms6OaGrnevmie fktrzYxyHPKZDEa6jpke4oPpDKjMqa1UME/eybhSRawlfKzJ8Ksl1g+bbLmzcRkJ VkNZwRo5haQ1g69uRDO1r/QvaAymxZKi1tPdXM+opCrTrE8SZFpavaI4YiAo5idg vbGZR5Nh6nK6TIrRRfbollAHw+iqfJ7ZunpR/Or/DwbzFsqo70oBSVUuXLdaFHi5 VqvQQtZKpKcC+2w88gbC+J0JITJ0/+N0bFiJAHGe/YJX1ZimpFSmJokmYsp40HNP gKFDvUrZWGcUvlqErLmsoA5WLSCexl8zvxbTISIDt2kODe55Ji0UA9WIiGk+12wC W4YEYuj0OW/aBlZETnLt2lKb9xpuwflBDo7rZwKbfwWLDnWnQyeI1lwwbfz7g+eg v7+FetSybUwtQrRYh2dDoTUwHLgChGYqrGaau1lxyILUM8t0okV0YrKu8JLjmbmn c2ud67OVnWV7c0N3soVEjm7IJLDx1sJBKzU+TzJZmiZQIc9P7yIuaMUJ6af+OU5b d8YLxcJDNVc5H0MK5CnIFUCyyVocBwDsqBU2B6lWLhKtQjvChisA5zl7Ukm3nkiS yV5q9mPrhh+kfJUAcbjzBiH8ZyZzMnn7rZXv5YdWcXz5M6jzDJyIVMTZ+1EPNBCI Ee20chrZkuLTcXLUobKtcFs9RZMHmohUMs+lAmRG8kSN+N9Vbz/+rmfx9CAw2Irm oQ1zSkiQ3gTm+UFDP0aEGUU53Y+K+1uDOdZeAA3wX95O+XMdxzUZqdOL+TWMJDet 44WyNBkBDfl+uZOzgG1ABDN1VBmkxe3CtjqX+wfYQkqrVzqKATF5EauEli3DC2W4 en+ehVDvVCwypizaX3b97A== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/352ABE9B61DEBAA2

http://decryptor.cc/352ABE9B61DEBAA2

Extracted

Path

C:\Users\vvg43lwwa5-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension vvg43lwwa5. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/DDD00E53DF068FEB 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/DDD00E53DF068FEB Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: rFa/VJpWhfcAmduNTaSxQyueo6wQ6KSUAazUW6dKjJqB+GBVJXXh0Tk5g3tn11pW qyJt2eW0D6P304WVtkVb+v0wWkKhgBqBJrb7fcRTBJ5j1IIr5mgYc9Cj8v/h+oBs P949UjrBrwtDGgor6Qpf/eANOB5Qq+FS79dcgdzhLnaOBiW++Zbp4rudFWycUbup qaRwJWVa9ALuy9IQktiuKJNpmk+oobsa/hjYq5pFzBv6Nof+cI1Mkxk3gyGwLF8i CebYHsv2khklz4ACib9oLGYQ2qYAj9EBMS+JobDaBmEtnjRv9PN3iB7VgXtA8VME ab39OPAPpKblPnv7qr3Ezr9nNO8WWeUdQIG3lBoyh5W8YCuhRU5Vpd7dT0ToHpH9 alqhVq0BrI+3WlmTrhgYHota7XrwRGwxnOVhz7YlNOvE3/PfanL66MMrgGg1faeA q9K0h3HDuT+RoYbtGeyzU+n/D4Oqq8YWzznmltaymUgBrLSoEpnx9HhukqHZ4Q5I s0dy4+5QNYACqHTt5FvxA7ZvHk8KyKxlT8msVwR/IuOhEA99As3LcDNFnTnO8DBx PAy3fWACtfY/FEN7DHW5z828MUtnNBUmY0v375JCuPuuUa0/nb6J+y7nmIWvCKji d5iYY3CElTens+/syT3hHld2klWeTpn0ax7cAwb1+OYXrr+AjNFd5lqcZoEUd4ju iPGss/RhIRv5dkQyG4/aDRY0is4VQqugIFmJzY6AIbQLin0xmO3+nKAgRSk22rQI oORBPzMotJCJbyWvzbLDr05ddtLgLPvKkQgN6QQrNFMyJrI/2cRI8if9JHnTfJkj u69NVD/yt0hg1zKeAHQwL7+r9xXvJr9/bzGUZRieYhFD2S8tJNsn0hvqbiA0HWnu nw9LYGTdB+qIubPAzHGj/TvV8m5FXk4KuxKPLpNXHwvqeF3YNST+4fdFu4wI0hFw 5V45mr0ODuZrvcY2d1Bcet7b/j0ZGwaI0c7SVR7DfZ1+EugPG0gkQFL5zHG82WTD x/OIVhSLtDUEy09aRgCOpBfifhUfhwJ8y5kGK0loJ80n6gm7usTI+bTiww/sxgzK nEtcCIx9a2tS7Y+1ZmQFvET60o8uyrrkBJXuVgN4AUN/M7MVlF2GfvFq6CRxlNiU bxE+WG4gCoeQRL019TWco7fIfasSWAHEWW3Sljf5Fv/l5h7ewoi2jVG6PawhEIL0 tzGohUxcx7gcCc8iYp7/xFatT9Hqx4zt35E= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/DDD00E53DF068FEB

http://decryptor.cc/DDD00E53DF068FEB

Targets

    • Target

      d2f4275c5c0ed02ac27c5c502fabeaec_JaffaCakes118

    • Size

      165KB

    • MD5

      d2f4275c5c0ed02ac27c5c502fabeaec

    • SHA1

      24d68dde7bf39797ac7c03a39b5f11d36957834f

    • SHA256

      4e5c233cf1270e2dac1a35ab36907ee23189fd424625fbcd7da10e49e7ae331c

    • SHA512

      a1e3240b0ef8347f30885741f553ac43cf17ec1b7d179aaf396707a017a4ee8b9dba28a58bfdfe7b7092e320b44daef754f24fbb0a1d41998c3918fcdeb841fa

    • SSDEEP

      3072:dopp2Xda3yJQZiiykM2pngXEOkzMvo3qBVj:dGp3zZiXkMEnSEVzMQaz

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v15

Tasks