sodinokibi | 6eb992c4c8453e929ebc737780067f78e50a18934358e44db6d95fca3106e8e2

General

Target

ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe
Size

179KB
MD5

ef1ca1995495a6fad440bbc08ff3f119
SHA1

7ba2c18108be1d12a29f090cc1f96f41908ecf6d
SHA256

6eb992c4c8453e929ebc737780067f78e50a18934358e44db6d95fca3106e8e2
SHA512

558a13b2ef020c246bd840816c983fc8f2e67fb1f59dba1dbb12689a8cba7cb217b190ebedb27dad01b209a6a99fb57df1799f894ecd6f35860e5764fc2f936a
SSDEEP

3072:QCmB1vuTljjCAj3jrAprhFmyvEjQDKaUznxQaPx2oL+Bpvjrlc:4BlICIwhFjED39jujxc

Score

10^/10

sodinokibi discovery persistence ransomware

Malware Config

Extracted

Path

C:\Users\3nhsb6a3-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 3nhsb6a3. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/58717A77FB0F58A8 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/58717A77FB0F58A8 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: X653ns7ZrsezIT6sCmoQ9f1yFvgpcoYF22R297JtNEmKgw7apBlD7kRvev/iS0Mu gJhWSso+Hr07IYajrAY2kCggyv74uFDsygu5x8msAFzs76y0sDQH+keFN85S1XWk UytKhnrwDE0RskhP3ARLkfgVoU5sZqazkafa4QRbhwiH+BL8FrNzpYJH7z9FSLx3 vOyefhjJrVD78ACK+f0Yz0H2M+pOh18fz4m0ZTtVO6cBKrWc+CVZm4Y8/ewk34L7 FiDwNxVX5mVCozUnCg18ZaSQ4nZ2btDeVhTepUcK0SEQa6oAOePliCQeM+BSO82f UkeB/rkeTAAu2SrwJFa5+pcCiPAb58WfcHcVd/l5pQOkdTYl2ZkAWucS58Zxv3WP wVIFEWh4KPbROZH2t5ZCyILvH2Tm2OdxaBpReeBHYf4G8Td1qcsY+glTxOQkpoRh cWY2Ume1UTdXxEJf8af5ecyxEbi2oqecB5sEb/HYrNc4ReypJLJjVmZLFUKs5ShZ uEI8dreCknWto3rqtsJBFMQTTIZjnSoIhFDUczCNPYIkTiQ58m52B4P6pHqHlzqn +KnvVtemVCXjmI5qwPc0zRLzmM4Pt7ZQAwUVEXiUazpar7/aowtZGeBWT5w/EujN eSIoE6jULtTZpeYJcSTSW860i40M2+b4l6qiUp3R1IMJHDOa3+0vE9EsucrxTd6b ciDG6J6R1QRaP/YTM+bpCutSh2gfB9Fa7FlVP8m9m8xjEFFenG/gO9WDjTS42fPo 2d4Ia/Rs+kueEGcRGHpmtstX1n2dffWpMTu0l99JBKVSh8n3RJAcWvsrtA+1sNL7 +6Gj4aD19v/32eNEKbycaK/hH8q+OZzL6fnMvWk9sc9NUn/TA4kb2maVxZ/fpS5M QT7rG+DVw/BxfbVMkgLRoTmEaxYzapZ8Fzd39pzAplMKu4qVETtFd9gAIRe6puwA sEDfR76Bnecjpevb/DDlQdtT6b49CwKlD7GNTq+zjUWLTTC84rmbp4n2FrVVNTUp sjmUsklOZDKxYFfjanOzPo9WpVxG0XnARePN23Yo8NtMjfQD4oWehF0gOmj7aBUn VkoKeQYoa/P4s3itjvDhXiUxfJlbAJ5yk8yL+4ILyaALZIkEalHlyGeXqIc3ockt AlQlbVOQaH+Pp1uSkhmsL0xkGiASDGNdkf4ulSYvgzcklJjsctCmH2h+ea1HDvnw /3S0Utv4S//SEan59R8= Extension name: 3nhsb6a3 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/58717A77FB0F58A8

http://decryptor.top/58717A77FB0F58A8

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\sNpEShi30R = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe"	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe

description	ioc	process
File opened (read-only)	\??\W:	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe
File opened (read-only)	\??\D:	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe
File opened (read-only)	\??\F:	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe
File opened (read-only)	\??\B:	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe
File opened (read-only)	\??\V:	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe
File opened (read-only)	\??\Y:	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe
File opened (read-only)	\??\A:	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe
File opened (read-only)	\??\G:	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe
File opened (read-only)	\??\O:	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe
File opened (read-only)	\??\H:	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe
File opened (read-only)	\??\K:	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe
File opened (read-only)	\??\P:	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe
File opened (read-only)	\??\R:	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe
File opened (read-only)	\??\U:	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe
File opened (read-only)	\??\X:	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe
File opened (read-only)	\??\N:	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe
File opened (read-only)	\??\M:	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe
File opened (read-only)	\??\T:	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe
File opened (read-only)	\??\Z:	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe
File opened (read-only)	\??\Q:	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe
File opened (read-only)	\??\S:	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe
File opened (read-only)	\??\E:	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe
File opened (read-only)	\??\I:	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe
File opened (read-only)	\??\J:	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe
File opened (read-only)	\??\L:	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe

Drops file in System32 directory 1 IoCs

Processes:

ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe

description ioc process

File opened for modification C:\Windows\System32\CatRoot2\dberr.txt ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2495omt366.bmp"	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe

Drops file in Program Files directory 26 IoCs

Processes:

ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe

description	ioc	process
File opened for modification	\??\c:\program files\PushGet.ADT	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe
File opened for modification	\??\c:\program files\StopReceive.wmx	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe
File created	\??\c:\program files (x86)\3nhsb6a3-readme.txt	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe
File opened for modification	\??\c:\program files\DebugNew.raw	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe
File opened for modification	\??\c:\program files\EditSet.ps1xml	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\v3.5\3nhsb6a3-readme.txt	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe
File opened for modification	\??\c:\program files\CheckpointRepair.potx	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ConvertFromLock.html	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe
File opened for modification	\??\c:\program files\MergeDisable.cr2	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe
File opened for modification	\??\c:\program files\PublishRedo.m1v	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ReadEdit.wav	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe
File opened for modification	\??\c:\program files\SelectGrant.xml	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe
File opened for modification	\??\c:\program files\AssertPush.vssm	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe
File opened for modification	\??\c:\program files\DisableSearch.mov	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ResetGrant.xps	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe
File opened for modification	\??\c:\program files\SaveSwitch.WTV	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe
File opened for modification	\??\c:\program files\EditExport.xsl	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe
File opened for modification	\??\c:\program files\RevokeCompress.M2V	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe
File opened for modification	\??\c:\program files\UnprotectMeasure.3gp	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe
File created	\??\c:\program files\3nhsb6a3-readme.txt	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe
File opened for modification	\??\c:\program files\MergeRestart.nfo	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe
File opened for modification	\??\c:\program files\RevokeConnect.mpeg2	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\3nhsb6a3-readme.txt	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\3nhsb6a3-readme.txt	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ProtectRemove.xls	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe
File opened for modification	\??\c:\program files\SaveWrite.dxf	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

powershell.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 30bf8b59e30bdb01	powershell.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d578112861900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

Processes:

ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exepowershell.exe

pid	process
468	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe
468	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe
2672	powershell.exe
468	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe
468	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe
468	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe
468	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe
468	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe
468	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe
468	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe
468	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe
468	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe
468	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe
468	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe
468	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe
468	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe
468	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe
468	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe
468	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

powershell.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	2672	powershell.exe
Token: SeBackupPrivilege	2544	vssvc.exe
Token: SeRestorePrivilege	2544	vssvc.exe
Token: SeAuditPrivilege	2544	vssvc.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe

description	pid	process	target process
PID 468 wrote to memory of 2672	468	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe	powershell.exe
PID 468 wrote to memory of 2672	468	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe	powershell.exe
PID 468 wrote to memory of 2672	468	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe	powershell.exe
PID 468 wrote to memory of 2672	468	ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe	powershell.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:468
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2672

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:2656

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

3

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\3nhsb6a3-readme.txt

Filesize
6KB

MD5
afd0df811ec17a73d471b8b5323be18c

SHA1
3eac2db6354e8e6d73d181e2ae3ad31b2d4dbf3e

SHA256
9c3bce88e0002cf11257dee49bdd89fc17e0545c95aa9b0052967c3e7eafa1d8

SHA512
559d5f212c270d134ec6c42d2c2b26e49a0817d7622263b33b010d5f84b4dd9009b3e5ba0ab0644281b5d49939d33f8bf285332b181472e8249596defa84ff37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0c9fb4e2245f08c4ffa81a10b160e46a

SHA1
31db3f62bb185f8e384d78a2ecd10d0c7dab022f

SHA256
e139c301c5a410bdbd43181cbd21042b3496af0d17cdd983e9cc49455ef34de1

SHA512
7098638439b4470d2292b3c02a697d81414b4cc195979d93b94083a3bf3bb48e7781288678a9c9079972c334c38df8dffe0b2f310e8595fad6ff20fa31400ff6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab673D.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar677F.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Windows\System32\catroot2\dberr.txt

Filesize
191KB

MD5
c87d8abd3c0af676a100c8982b1f4ffc

SHA1
8fb9c1130a657e622191fb6457bc9253a31620e3

SHA256
4076b21cd80388334ca8ae59a4c2a2ea9969b4f4a5045e5a9743f42c0c48b174

SHA512
5c5e355ed730240c9c89395887fb27258efb100263bb18f96655f670e5708f86292cbd806b1e70a95e76e13c12906cd6bf9159c1026681fbbd86e67d03aa298c

Download Submit
\??\PIPE\srvsvc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/468-20-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/468-4-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/468-2-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/468-10-0x0000000002630000-0x0000000002739000-memory.dmp

Filesize
1.0MB

Download
memory/468-11-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/468-12-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/468-6-0x0000000000D70000-0x0000000000E0F000-memory.dmp

Filesize
636KB

Download
memory/468-7-0x0000000000E10000-0x0000000000F3D000-memory.dmp

Filesize
1.2MB

Download
memory/468-1-0x00000000001C0000-0x00000000001CA000-memory.dmp

Filesize
40KB

Download
memory/468-5-0x0000000000A80000-0x0000000000B49000-memory.dmp

Filesize
804KB

Download
memory/468-9-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/468-3-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/468-8-0x0000000000870000-0x000000000088F000-memory.dmp

Filesize
124KB

Download
memory/2672-23-0x000007FEF6020000-0x000007FEF69BD000-memory.dmp

Filesize
9.6MB

Download
memory/2672-26-0x000007FEF62DE000-0x000007FEF62DF000-memory.dmp

Filesize
4KB

Download
memory/2672-27-0x000007FEF6020000-0x000007FEF69BD000-memory.dmp

Filesize
9.6MB

Download
memory/2672-28-0x000007FEF6020000-0x000007FEF69BD000-memory.dmp

Filesize
9.6MB

Download
memory/2672-29-0x000007FEF6020000-0x000007FEF69BD000-memory.dmp

Filesize
9.6MB

Download
memory/2672-25-0x000007FEF6020000-0x000007FEF69BD000-memory.dmp

Filesize
9.6MB

Download
memory/2672-24-0x000007FEF6020000-0x000007FEF69BD000-memory.dmp

Filesize
9.6MB

Download
memory/2672-22-0x0000000001E40000-0x0000000001E48000-memory.dmp

Filesize
32KB

Download
memory/2672-21-0x000000001B240000-0x000000001B522000-memory.dmp

Filesize
2.9MB

Download
memory/2672-19-0x000007FEF6020000-0x000007FEF69BD000-memory.dmp

Filesize
9.6MB

Download
memory/2672-18-0x000007FEF62DE000-0x000007FEF62DF000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads