sodinokibi | f7c922293637486c307b6d1f05da1eb686a330c527981e0b0f079602e9cfd3d3

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
08-09-2024 07:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d3e026324b81c755f9058d7a42e96c75_JaffaCakes118.exe
Size

165KB
MD5

d3e026324b81c755f9058d7a42e96c75
SHA1

35d30a689c4b826e43d9255574fa09965c0a6ba7
SHA256

f7c922293637486c307b6d1f05da1eb686a330c527981e0b0f079602e9cfd3d3
SHA512

e9eb060168da1db8dafac357835ffc2272dc3fdbae31c77d810c188299657c824255cc1f337ac25420c57ebe821a838f4e92e5fdf7778a4a6692e777305b3913
SSDEEP

3072:eCEq0R0nZ5ys5n4Y9doh7O79siUs/Na/CUtnBr8rl2a:lw02sJPi7O93NSnBkl

Score

10^/10

sodinokibi discovery ransomware

Malware Config

Extracted

Path

C:\Users\fme92-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. CDHFUND. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension fme92. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F04BCE0F12281737 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/F04BCE0F12281737 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: f963x1EimsibPhLjGacvKOx8xAkCGQzhVNOYDaiosZlwAUJsIDuIjU1okvkbqfaP c278D2AEG04yS4WrSdEAf9gONANMsj9ThBgtYr7yiB0dx+de04+k0VqkvttO8UsQ VW6fRHv0IOya9oWLE97vrkDkrzaeaWC7M6gV6YZWpnLuJRsdJqU2EEXHTwGacvRE ZwGnjiOryqdyg5aaDXVc5Uq08VDxBSEp+CUsYIR6X3XgKg/FhkR8MUBGnYC+RkvS LsOd9dml9DbzvShPvz8jDI0FRCO7i9IrXgvvDZVCuXJuhV+WlAFBjarQwHPgV+VJ GpW1zuaUUBFFNRx7NWEqzQ/Fp8ILo3u1nW3v/4PD04KT0eBCdfALQhMck51Xrm8h 6Zr2EjWvauq9qIIfsi8iABD/xmCsI51Shuqzt4lBbpBTzVLQy88+C7DG4TBnWUrz PROs9E+XvLMzvEdj/Lc+p400VKLFqW1sr4G9/fhxGv322quH+89PXMqtLm1XkAq1 ulm4BpiwY7VTZO2weKGTlHXRvLNSoaYLJ+v2LptNFSIj5oQGRu/Z4J+ZMt4sdrVY OIYNbfSqNHu2uAqLxBvyWN8IRLY97Gc0juJbkTyWFkuPi9MFAEYFqimHmr9TP/wO dWIkJYd5FOm2AAPTcpMLBtfh0ADczaisWooi5PTnUa88lAvvi6YE3TqPVXKGdElS +iK5E5NkbvgKf7hpULQ9D6ZkODOGzCxj8vOOnDqU+D819FBJBGNaPIjDZz1ufEym FYzTUp7P7IP22qRz6E0Q0/fsjG9HcM3+4FsWIZTnW4WccjCt4HhRqN3adCcQrZsh RSePIqOuGm9FNgWd9wfqVq9ctWPUth8cjpawKeCANlFYoakqShZC1A106DVCu5hL RD9GcYJ9e61qlkNPwa/sALM5+EgoYa7WvF8DYDX86N8M/bwh/04iFIvUYRD5+h/Q NB2jdGNFq0bt6A+6I/Ioh+fi4jHik0Rk7UZtb7nr3tHbvyj1QmIK+yUk/sq6zqre ljPW49WbYghZlFYlNcVWl9EuflLChCO28cj2IuhDRh2XzLQJ0kG/Qgr7qg6AkCBy j57DXXEHdmCGuJwex6vNsoLzEq0UmYHGnJxVjhaBpvB/EMk2qPUbmnwpwPe+jJKV Q1bZYnWxbBsqlU67qhb2Kw3uHj6K+tvo/6EYGFE3pd4b9zLmygKQTpCiQAyjRK88 5SeQnhVTuwYgyA== Extension name: fme92 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F04BCE0F12281737

http://decryptor.top/F04BCE0F12281737

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	d3e026324b81c755f9058d7a42e96c75_JaffaCakes118.exe
File opened (read-only)	\??\I:	d3e026324b81c755f9058d7a42e96c75_JaffaCakes118.exe
File opened (read-only)	\??\Y:	d3e026324b81c755f9058d7a42e96c75_JaffaCakes118.exe
File opened (read-only)	\??\B:	d3e026324b81c755f9058d7a42e96c75_JaffaCakes118.exe
File opened (read-only)	\??\R:	d3e026324b81c755f9058d7a42e96c75_JaffaCakes118.exe
File opened (read-only)	\??\S:	d3e026324b81c755f9058d7a42e96c75_JaffaCakes118.exe
File opened (read-only)	\??\U:	d3e026324b81c755f9058d7a42e96c75_JaffaCakes118.exe
File opened (read-only)	\??\W:	d3e026324b81c755f9058d7a42e96c75_JaffaCakes118.exe
File opened (read-only)	\??\Z:	d3e026324b81c755f9058d7a42e96c75_JaffaCakes118.exe
File opened (read-only)	\??\G:	d3e026324b81c755f9058d7a42e96c75_JaffaCakes118.exe
File opened (read-only)	\??\O:	d3e026324b81c755f9058d7a42e96c75_JaffaCakes118.exe
File opened (read-only)	\??\T:	d3e026324b81c755f9058d7a42e96c75_JaffaCakes118.exe
File opened (read-only)	\??\F:	d3e026324b81c755f9058d7a42e96c75_JaffaCakes118.exe
File opened (read-only)	\??\L:	d3e026324b81c755f9058d7a42e96c75_JaffaCakes118.exe
File opened (read-only)	\??\N:	d3e026324b81c755f9058d7a42e96c75_JaffaCakes118.exe
File opened (read-only)	\??\P:	d3e026324b81c755f9058d7a42e96c75_JaffaCakes118.exe
File opened (read-only)	\??\V:	d3e026324b81c755f9058d7a42e96c75_JaffaCakes118.exe
File opened (read-only)	\??\H:	d3e026324b81c755f9058d7a42e96c75_JaffaCakes118.exe
File opened (read-only)	\??\X:	d3e026324b81c755f9058d7a42e96c75_JaffaCakes118.exe
File opened (read-only)	\??\E:	d3e026324b81c755f9058d7a42e96c75_JaffaCakes118.exe
File opened (read-only)	\??\J:	d3e026324b81c755f9058d7a42e96c75_JaffaCakes118.exe
File opened (read-only)	\??\M:	d3e026324b81c755f9058d7a42e96c75_JaffaCakes118.exe
File opened (read-only)	\??\D:	d3e026324b81c755f9058d7a42e96c75_JaffaCakes118.exe
File opened (read-only)	\??\K:	d3e026324b81c755f9058d7a42e96c75_JaffaCakes118.exe
File opened (read-only)	\??\Q:	d3e026324b81c755f9058d7a42e96c75_JaffaCakes118.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kg9qj7l5hr7.bmp"	d3e026324b81c755f9058d7a42e96c75_JaffaCakes118.exe

Drops file in Program Files directory 34 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files\AssertOpen.dotx	d3e026324b81c755f9058d7a42e96c75_JaffaCakes118.exe
File opened for modification	\??\c:\program files\NewPop.svgz	d3e026324b81c755f9058d7a42e96c75_JaffaCakes118.exe
File opened for modification	\??\c:\program files\PublishLimit.dwfx	d3e026324b81c755f9058d7a42e96c75_JaffaCakes118.exe
File opened for modification	\??\c:\program files\UnlockPop.pot	d3e026324b81c755f9058d7a42e96c75_JaffaCakes118.exe
File opened for modification	\??\c:\program files\UnprotectUnlock.pot	d3e026324b81c755f9058d7a42e96c75_JaffaCakes118.exe
File opened for modification	\??\c:\program files\MergeUnprotect.mhtml	d3e026324b81c755f9058d7a42e96c75_JaffaCakes118.exe
File opened for modification	\??\c:\program files\PingSkip.ADT	d3e026324b81c755f9058d7a42e96c75_JaffaCakes118.exe
File opened for modification	\??\c:\program files\WaitRead.xml	d3e026324b81c755f9058d7a42e96c75_JaffaCakes118.exe
File created	\??\c:\program files\fme92-readme.txt	d3e026324b81c755f9058d7a42e96c75_JaffaCakes118.exe
File opened for modification	\??\c:\program files\CompareMove.midi	d3e026324b81c755f9058d7a42e96c75_JaffaCakes118.exe
File opened for modification	\??\c:\program files\UndoMeasure.xltm	d3e026324b81c755f9058d7a42e96c75_JaffaCakes118.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\fme92-readme.txt	d3e026324b81c755f9058d7a42e96c75_JaffaCakes118.exe
File created	\??\c:\program files (x86)\fme92-readme.txt	d3e026324b81c755f9058d7a42e96c75_JaffaCakes118.exe
File opened for modification	\??\c:\program files\DismountRedo.asp	d3e026324b81c755f9058d7a42e96c75_JaffaCakes118.exe
File opened for modification	\??\c:\program files\MountConvertFrom.rmi	d3e026324b81c755f9058d7a42e96c75_JaffaCakes118.exe
File opened for modification	\??\c:\program files\OutSave.mpeg	d3e026324b81c755f9058d7a42e96c75_JaffaCakes118.exe
File opened for modification	\??\c:\program files\PushResolve.MTS	d3e026324b81c755f9058d7a42e96c75_JaffaCakes118.exe
File opened for modification	\??\c:\program files\TraceRemove.sql	d3e026324b81c755f9058d7a42e96c75_JaffaCakes118.exe
File opened for modification	\??\c:\program files\AddConfirm.nfo	d3e026324b81c755f9058d7a42e96c75_JaffaCakes118.exe
File opened for modification	\??\c:\program files\CompressMeasure.xltm	d3e026324b81c755f9058d7a42e96c75_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ConvertStep.css	d3e026324b81c755f9058d7a42e96c75_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ConvertFromStep.mhtml	d3e026324b81c755f9058d7a42e96c75_JaffaCakes118.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\fme92-readme.txt	d3e026324b81c755f9058d7a42e96c75_JaffaCakes118.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\v3.5\fme92-readme.txt	d3e026324b81c755f9058d7a42e96c75_JaffaCakes118.exe
File opened for modification	\??\c:\program files\DisableAdd.WTV	d3e026324b81c755f9058d7a42e96c75_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ExportHide.scf	d3e026324b81c755f9058d7a42e96c75_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ResolveSave.ttf	d3e026324b81c755f9058d7a42e96c75_JaffaCakes118.exe
File opened for modification	\??\c:\program files\SendDisconnect.ini	d3e026324b81c755f9058d7a42e96c75_JaffaCakes118.exe
File opened for modification	\??\c:\program files\SetPop.bmp	d3e026324b81c755f9058d7a42e96c75_JaffaCakes118.exe
File opened for modification	\??\c:\program files\LimitExpand.ppsm	d3e026324b81c755f9058d7a42e96c75_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ReadResume.docx	d3e026324b81c755f9058d7a42e96c75_JaffaCakes118.exe
File opened for modification	\??\c:\program files\RestoreSearch.rmi	d3e026324b81c755f9058d7a42e96c75_JaffaCakes118.exe
File opened for modification	\??\c:\program files\SetMount.xlsx	d3e026324b81c755f9058d7a42e96c75_JaffaCakes118.exe
File opened for modification	\??\c:\program files\UnblockConvert.m4a	d3e026324b81c755f9058d7a42e96c75_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d3e026324b81c755f9058d7a42e96c75_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2136	d3e026324b81c755f9058d7a42e96c75_JaffaCakes118.exe
1448	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1448	powershell.exe
Token: SeBackupPrivilege	2812	vssvc.exe
Token: SeRestorePrivilege	2812	vssvc.exe
Token: SeAuditPrivilege	2812	vssvc.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 1448	2136	d3e026324b81c755f9058d7a42e96c75_JaffaCakes118.exe	30
PID 2136 wrote to memory of 1448	2136	d3e026324b81c755f9058d7a42e96c75_JaffaCakes118.exe	30
PID 2136 wrote to memory of 1448	2136	d3e026324b81c755f9058d7a42e96c75_JaffaCakes118.exe	30
PID 2136 wrote to memory of 1448	2136	d3e026324b81c755f9058d7a42e96c75_JaffaCakes118.exe	30

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\d3e026324b81c755f9058d7a42e96c75_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d3e026324b81c755f9058d7a42e96c75_JaffaCakes118.exe"
1⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1448

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:2076

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\fme92-readme.txt

Filesize
6KB

MD5
47a9a1c1b5e1993526642a09c15262f1

SHA1
bdd66be196310f08f02ee6a44aa0ead0605a4599

SHA256
0121310194fa1f6b49e0aaf3ab298c014d3b88995b6e6631fdccec8a2d5b0a2d

SHA512
807ff7cefd51053eb4d953f1280cc467794f92f5933ff30114f9580efa841333bb2ac041d44c671166325b0ab6c7739499d51dac23a9b2ff716d02d8680dec41

Download Submit
memory/1448-4-0x000007FEF53AE000-0x000007FEF53AF000-memory.dmp

Filesize
4KB

Download
memory/1448-5-0x000000001B570000-0x000000001B852000-memory.dmp

Filesize
2.9MB

Download
memory/1448-6-0x0000000002910000-0x0000000002918000-memory.dmp

Filesize
32KB

Download
memory/1448-7-0x000007FEF50F0000-0x000007FEF5A8D000-memory.dmp

Filesize
9.6MB

Download
memory/1448-8-0x000007FEF50F0000-0x000007FEF5A8D000-memory.dmp

Filesize
9.6MB

Download
memory/1448-9-0x000007FEF50F0000-0x000007FEF5A8D000-memory.dmp

Filesize
9.6MB

Download
memory/1448-10-0x000007FEF50F0000-0x000007FEF5A8D000-memory.dmp

Filesize
9.6MB

Download
memory/1448-11-0x000007FEF50F0000-0x000007FEF5A8D000-memory.dmp

Filesize
9.6MB

Download
memory/1448-12-0x000007FEF50F0000-0x000007FEF5A8D000-memory.dmp

Filesize
9.6MB

Download