Overview

overview

10

Static

static

10

da50c8e2ae...18.exe

windows7-x64

10

da50c8e2ae...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-09-2024 12:08

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    da50c8e2aeeecc39e8ae49cef8271733_JaffaCakes118.exe

  • Size

    115KB

  • MD5

    da50c8e2aeeecc39e8ae49cef8271733

  • SHA1

    768d0597775446938114e0b5f1ad74b7c51b2a5b

  • SHA256

    6cff57ed233dd9083464ccc23c0a59df300c8a0aece0d3651e5c9e7984c937fd

  • SHA512

    adf77baf9095cd1be5a9a2639978e9b1150485d08c09d8146645930528e552bb1329467cc4e70901c17faee0b734b849d5ef83feb0da760ef7d636d75e1c4786

  • SSDEEP

    3072:mlnXEXyk7yvh4NKm437uM0IItpaHV6B+:mtqyg34L8tpky+

Score
10/10
sodinokibicredential_accessdiscoverypersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\ProgramData\c3b71ms3o-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension c3b71ms3o. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/1DDD5635137CE474 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/1DDD5635137CE474 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: NMgMQunswdYneyPDYvBYJlrGl9elsaeBsvBYPMQbTxdPrdWSRzrlbH/fTXcMMOl4 qyM1f9YXA1Fk4ZK3C2gWCmbXl1JNM1J5sp3NUQGP4jtuFVDHp3VXOv+KQPfx+MDC Hgm73/gszC18aiNV4l2indHqucKnKFb5S0JD+b16LBA5Z/LrHrco842/ZTUdc0hn G9GXXyFws3A2DySKUeBDPEe1ea7TBBVsQnx+L193GAiKwkVMVacQht7GYp/sz3hS DtcZRxwnwGGcqtT6djPxI8x6DhOnitECNp1M8ulZHiR4DPlIAtS0utCPgbtVb1ZN hdrSuWEqejQILRUHMa2LxZ+x6ThPRXOHiNguUWvXdNs/kqKmPdZgAhOeknmPn/a9 cO1PTVkPY+I7rUoxlf/vjUhedQPywE5+2RWtwFqaEAahoY/l7IeuCHL3RAbNVNuJ 0n7WCGxP7s1viHAtCcFNEjtF/bqKUNHGalddphQTLNsPZuouEze2O1y6vYRU/ucb KHhsDTvuB//BJpIYYU9tUEruM+CXFXvbzvt/eyN/mnSGdtGjGVk3fiab9hU+mBUl v26HEniVh5w6j2hwN/8G/igs2iLp4Kneogx2zo7J1tkINcyxr9DeifLEaNRmg56C FXh5yODqzg5gj7IsZ5Q725oFGhfvxF78jNkxQUpE7fqqcVU2wxxNkBWDH97B6gP6 tIp35PLuZ+aiBubTgspDNAQ+DbWFc3yPhF0Qw9z2PtPQaifLxEBtpASYrq9XwUHF qCl+byxbf+SMu+DdZcBfiiUcYcqS8amm+UH2NTcg4I4TmEI3jHF19/dmEV4kErNC 8yYujEdt+41OE8xGHLbGiGyJRXmaZ4yTPAAW3HDlkzKfbvk9Mt+BmXMliO/0wRfC QVgrvIiZGeY9m78j+uZGVMd007V34Onv2PJZ6sOlZAvotTbF+AZ2jT9bCkS2Hox8 jnoqa0vBHJ5Gp9Z2eN1IjZmkqdYJb8mnv5ftORLE/7XOE2bp2ulicMS2oJb/PYe1 YSwKBlkGyVCJJWjPQIOW4iHNOy/prI32WGBzTkqViIdYCTVcumUhRF9ZdWrssWxX k7brguyQVV8j+i3PjyYMYl4GXx9qVd9wvb9WE9TYPd7Rh53TRNCn0gt+ukSsUDtv 1yn0Ajoak8LgkNWJL5x1MT0mVqQcRyvWH+/3zziRJM/0axzEu4ffThMTo7T2fg8E CT6fMoh4YOh96/TN/vrXjazzuDpsi7TQ40evaDIItB+OxMV25nBFs5jYSomy3/Ta lI2oN9BS6YGNdzaUKcUdSD3Ujh5O9Njr1QdoT7TNg5VyirqhGjzVNIcN2Lsp83JG sGNKJ3Uvn/Q6qo4MIZmOGV7J2GdrgjwbkSkPTpVoDzN9o+Jr/dY9iKSmvRs= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/1DDD5635137CE474

http://decryptor.cc/1DDD5635137CE474

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Drops startup file 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops desktop.ini file(s) 64 IoCs
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 37 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\da50c8e2aeeecc39e8ae49cef8271733_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\da50c8e2aeeecc39e8ae49cef8271733_JaffaCakes118.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    PID:1540
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

3
T1112

Credential Access

Credentials from Password Stores

2
T1555

Credentials from Web Browsers

1
T1555.003

Windows Credential Manager

1
T1555.004

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Browser Information Discovery

1
T1217

Peripheral Device Discovery

1
T1120

Query Registry

1
T1012

System Information Discovery

1
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Defacement

1
T1491

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Microsoft\Windows\Caches\{811D10E7-63B6-4581-ADA9-2A2816DF1D43}.2.ver0x0000000000000001.db.c3b71ms3o
    Filesize

    1KB

    MD5

    e44c21afe8ec75c09908a2f3024bdf5a

    SHA1

    d6d6475dbb085683da63ca1b56e1da5b2a7d5cc7

    SHA256

    f7f94d9eb99b10f0ef85aa655b5643ea3fafc75ca040c3e32e28fecc62597b11

    SHA512

    9002215c72201e25c0ba46b41eba38c2b04f184504b300a3d5bab5213b29f0f3e437b1011681b3d578009f82856f589e910d421eebe9cec6edfa57372755a2ec

    Download Submit

  • C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.c3b71ms3o
    Filesize

    623KB

    MD5

    9f43f7955c1acc1f6f57f0c7f93459de

    SHA1

    cc3883026018fd3c7989d157445003ee4ca01746

    SHA256

    2ec126bbc87884878511e8664bbe4ada295bce2440b6bc5864729c7fdd505b2e

    SHA512

    bc18b66fba1ca83dae3fd513dfa6a0d8646b9a9a37ed8e318dde3a1d5ea2b444487244eb4c2db97bb43a43e8e4a793301938dcd444e999e0a71eefd4166f6599

    Download Submit

  • C:\ProgramData\c3b71ms3o-readme.txt
    Filesize

    6KB

    MD5

    3af1aab38745de75235f459d7fd10c04

    SHA1

    612481caa138a08c41619f5ff0e80ec7dec725c8

    SHA256

    c91919488beb18bc720eb50fd7f66aff504f2641ff2d542c456e332b81b8efbc

    SHA512

    ea3cd3ce9a83d43ef3f5dc079cb1df1b58e0c7c4922827f2dbbfa3faa20552c07fe1fb330abbab979e2523876926451fe1338d8ce519aa368efbd9db8c80df33

    Download Submit