sodinokibi | b6e27e49d83f82f0feaa1b41d7b8906b9237e08968bb2cd5ae6f4f97b4c9f5c8

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20-09-2024 18:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
Size

160KB
MD5

ee2ffb5c60f9963a1551871a392ed0d0
SHA1

97ac4115665ee440bdf4f6f171337cc4bc3e07d3
SHA256

b6e27e49d83f82f0feaa1b41d7b8906b9237e08968bb2cd5ae6f4f97b4c9f5c8
SHA512

0eed7a60c0322f19bff85489a972f1a15cacf43391d2f497f0a161bdda0c42ac4e86fe4468ee396079db90414e2aa39c8c6758fabca4d856fe935c88c0f10133
SSDEEP

3072:Kt38mD9P3ILbi4eTMlwDCnumJ+2JzmJTfmWL:KdNBPAbnWJmcfmWL

Score

10^/10

sodinokibi discovery ransomware

Malware Config

Extracted

Path

C:\Users\0v6at9m04i-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 0v6at9m04i. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/62F4D4AE0706ECB1 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/62F4D4AE0706ECB1 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: +e01TXF97reFK+1MOLF84BSz8glOWckHY5ZD1NhQWXrGSq9ilsr5GMcY0TnoEVjC 7wxVJNWRd3jDvjjLSqhael7q3vH5or4P1xL/pORhHBldtjT6RIjLNoH5uxlVVUTB X88xM3QCjaC/1n+lEfBoSBNzN2LWUfa2Q5ZXhdehKGm3IvUhONK2HrGs1TS2UlLG hUoUl6eGbbmFyCAwZAQRBIHKpcRneOvI7ITVj5LhPsWJ2wnc8v5/2AsvuAiui/bf CYR2TIudveiPWeFF/rfRw+3ytLGXlqheophpbEvb1Ifecjm2kIWotwU5wTwUYFcS mpapwRzSMoKgBdyMFCMZ2qWqzie/07HF3k+6jXPEjJp+je3PUjkryOfaLDfCBLtx vesAQks9MMba0uXkwPDyJKEJm2zuyl91Mv9/9XzD+pwKBwWLYryrAOxnW/RVbW6Y dE98toI6h+MK8K1cfIMu35KEi6accYMRwudHZ/A84o9BNdiQwPSR0RkAl0OPB9KH M71gTOR0NfB9j6DoF58MuyfoePeev8q4Fti+1NqBBzIv11ehZXkQYNuXnNxNJmk/ lPpVuhc9QWrVHnd3m1KoqFnrb5DO1bMLxnZanmyqUrCU7wS+BuwZsf1Q1nGgcNcf /eXaB8WZ55uwsbc911MC4AevK/2+pH02ILgtlpXl99FMl2PHVY36c4I84eYP0Fly AIkv2z2KJkYUL+CqhAlaxTg9aB2aH6uSdsfXTx+wakFnUVBvXfuMj3Fgq39Uc9us PouIl6aYSrgYGx+tXi1fLI7XU+7slwKZigrt9dNzugVbZ4kjI2dd3YmgDJ/27BT+ uS5FlHk3pROi1cQldy+ogZURr6Fiv/53olgnIxX5n3IzdZi871Ru5aptJfUzrF5E Q5h3/3HZXvZpdQrYBrx5iChrHpGDR+t5BTK4ONzVbYJoHxEN5W6cbmjZC3CMybia bWog1KcoZchUJNkDy2Hr7GBxmBgnpSGtRhv5/Oom905478n20shWo0QrMLLdTfz8 PuAI3OwEr0yAqZ7bftJiAXmn7KsJKtM72kSQRRrGBNjl70GwYmOAu/9QtPl9KwbG R/8V96q7NDP9qQbhodHb3X/EybFZsm9MpuyMnXxWUdxoYFKuZ51N8WF9DpzJ7Q0G l0caFQEjIq7WX5QF6hYivHzx3w/HEaWjcMSRhPsennqLyF+yJAb2nMsdblWnhSk/ kAwylaHT1+0gg1vm0eED4Uqznv671A== Extension name: 0v6at9m04i ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/62F4D4AE0706ECB1

http://decryptor.top/62F4D4AE0706ECB1

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened (read-only)	\??\W:	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened (read-only)	\??\U:	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened (read-only)	\??\D:	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened (read-only)	\??\F:	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened (read-only)	\??\L:	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened (read-only)	\??\M:	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened (read-only)	\??\R:	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened (read-only)	\??\V:	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened (read-only)	\??\X:	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened (read-only)	\??\E:	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened (read-only)	\??\O:	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened (read-only)	\??\P:	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened (read-only)	\??\Z:	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened (read-only)	\??\G:	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened (read-only)	\??\H:	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened (read-only)	\??\Q:	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened (read-only)	\??\S:	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened (read-only)	\??\Y:	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened (read-only)	\??\B:	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened (read-only)	\??\I:	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened (read-only)	\??\J:	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened (read-only)	\??\T:	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened (read-only)	\??\A:	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened (read-only)	\??\K:	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\z42714e3tm.bmp"	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe

Drops file in Program Files directory 36 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files\ClearBackup.docm	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened for modification	\??\c:\program files\UnblockCheckpoint.vstx	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened for modification	\??\c:\program files\WaitDismount.3gp	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ProtectSend.ttc	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened for modification	\??\c:\program files\RegisterGroup.mpg	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened for modification	\??\c:\program files\UnblockCopy.m4a	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened for modification	\??\c:\program files\WaitRestore.easmx	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File created	\??\c:\program files (x86)\8a8ddc23.lock	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened for modification	\??\c:\program files\EditConvertFrom.wma	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened for modification	\??\c:\program files\PopTrace.mht	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened for modification	\??\c:\program files\NewLimit.docx	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ResumeSelect.DVR-MS	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened for modification	\??\c:\program files\UnlockComplete.crw	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File created	\??\c:\program files (x86)\0v6at9m04i-readme.txt	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ExpandGrant.WTV	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened for modification	\??\c:\program files\MoveConvert.vbs	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ClearHide.7z	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened for modification	\??\c:\program files\SearchGroup.dib	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened for modification	\??\c:\program files\RevokeSplit.mp2v	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened for modification	\??\c:\program files\SaveComplete.asp	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File created	\??\c:\program files\0v6at9m04i-readme.txt	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ClearRegister.bmp	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened for modification	\??\c:\program files\MergeClear.vdw	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ExpandBackup.wmf	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened for modification	\??\c:\program files\HideReset.wmx	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened for modification	\??\c:\program files\MergeImport.xsl	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened for modification	\??\c:\program files\RenameSubmit.html	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened for modification	\??\c:\program files\SaveSend.asf	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File created	\??\c:\program files\8a8ddc23.lock	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened for modification	\??\c:\program files\CompressConfirm.m1v	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ConfirmClose.avi	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ShowUnpublish.search-ms	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ExitShow.gif	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ConfirmUndo.asp	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ResumeTrace.emf	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened for modification	\??\c:\program files\UpdateSelect.mpv2	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4696	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
4696	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4696 wrote to memory of 700	4696	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe	85
PID 4696 wrote to memory of 700	4696	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe	85
PID 4696 wrote to memory of 700	4696	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4696
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - System Location Discovery: System Language Discovery
  PID:700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\0v6at9m04i-readme.txt

Filesize
6KB

MD5
686a77f2a42a3e8a6d97709918b37af9

SHA1
fee929ab121318d08f54d6043b002f819c68d730

SHA256
566c019a69c6ea2d7d8fe5f2dcaf97c914e93523c5cd5ae87ee5911cb352049e

SHA512
277f06453429c7dde9791c2143a37f2120df7d11d55b77b689206e5062afbf757a719dc7441cb7e76ddd8d23dcc0fc63cb06b5f74ca2f6c94d5ea8ddbb9fadb7

Download Submit