sodinokibi | 58ca453b81a5506420ef00a945ad3b3841e4ad7d5ecaf1bb983ac3c3db5ab8c1

Analysis

max time kernel
142s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
24-09-2024 12:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe
Size

166KB
MD5

f399f74045c127d9bab9b10fa2e81ea9
SHA1

fa73ebc39f144e16da0b823baa594861535d094d
SHA256

58ca453b81a5506420ef00a945ad3b3841e4ad7d5ecaf1bb983ac3c3db5ab8c1
SHA512

3533726b13aa0f98338896afa74b04f5f5a9b8a585357077916b06c02871585ead103048aee981e5ea9d9fdd1c87c196db445b55e98d1a984b1aeff43bd5c7d1
SSDEEP

3072:EJMawtnGqtWoKeZC62aoNUSncCyxFXtuk3F8/A:+w9vteQJYUoczJIA

Score

10^/10

sodinokibi discovery persistence ransomware

Malware Config

Extracted

Path

C:\Users\4teh8h-read-me.txt

Family

sodinokibi

Ransom Note

---=== Welcome Progetti Servizi Verona s.r.l ===--- [+] Whats Happen? [+] Your network has been penetrated. Your files are encrypted with strong military algorithm, and currently unavailable. You can check it: all files on your system has extension 4teh8h. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). Also, all your business info copyed to our servers. Personal data of your clients and business contacts extracted. If you do not take action to contact us, the data will be published fo free access everyone. It can also cause GDPR compilance. “Article 32, (1) – c states that “The controller and the processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident.” It can hurt organizations where it matters most – Penalties can be as high as €20M or 4% of annual revenues, not to mention the negative public relations fallout. As soon as we receive the payment, all data will be deleted from our servers. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F65B27EB260E0788 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/F65B27EB260E0788 Contact with us in chat on website. You have 3 days. If you need more time to make a decision and collect money for payment - inform the support chat about this. [+] How will the decryption process proceed after payment? [+] After payment we will send to you our scanner-decoder program and detailed instructions for use. With this program you will be able to decrypt all your encrypted files. Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: BcBpV2CJDjUapNL4K1Z1s3tI/vvlL11gOAwfxyD2KZA4lbA5ngz5WZkXx9KIhVnF MFObel9sZ+Rq7bhlhdH7Ggkn35HUvIHMdganYjLvyE+mlzhi2FLw6Bass1dFXPqL Mgk4P7GNvlgVotq8JAaNIKM9aWTSAuHT7xW2BC1fUXwCGbQVlwZG+XyRwYCtMeqr 8Fp4sRFo++110GabkfhQb8Lqca4gM5ZBiwulO9Tdop6Y1O2sAkFyG2SHyBTlo37Y ho+HpBioyeRvb6I3s0DFushT+W2vumMMgMp1JtnDGcnWelPLp2BQ+KXVwkzxYkw5 zz3ryyJm22tExigg4Udi/TfPRvVu6iRIP7NtQXKalVvr7fe48BKT/2I5O8Ofj69I WLvb6R7NKFQXZczfwlFm8fOvJCPeCsNVp6SoaU9kOxmaSdXkvPIcobDVfazil1au 1ZEJ2dWKwEFkQInuJXE4P9tJvxzOFi7BvD0sIMn7hg0T7fggnxZtDU0bYSvTIavj MpyVDbdC7jNH7iTooZBrSXrtp0zs/Ym+5+x/CAghW2S7KeAlAwEHJtdbaNaPniRF 8IsoYW38NV3u/bNjNOV8rYWunCiNoGojLBqivL/DWmM7jOrq8Wi12U0dAJGubQZo BMmyrkZiba0gm4lrvnNy39I+v+A3Oo/TvGyoorOZ5siRjfm2NFbqimagj6AD3P6c 8T2KzgJeT5Mjl2vkbkO112mXDk9Pa0uBbnqTm5Vtbp7IamByKNtgCY6KeD25G16m wtLpqbGidFhBI8su6l4uFchjti3MSCiwQ8CGEWsq1fnt8x7S6cQk/paCmOW1UPHt vdMiW3wm0j4n/6zmNJI50Y3VdizemUs/OxEStyhlqKOQ6e/G1K2zdw/Y7EQNksh6 G2MGkMiBL1J4Xv0xWR1sk1jEnDGFrM4XGl9bHLj9Ov8f1LUm+fRu1LyMHNTy2ACh Id5nQbe6V147CC5/fhc5b39jzQ7SoWQXlfxq+hj/yTWKgHWs6pdpXy6qdPqmXpPg Vd/8T0+wkxPMSxvrAiVrevCgtuhWFzaSjG5fpzMorIeYKhkvrZ8zE5rKD8LcIYaC w3sb/A8uajkEKhR2VTzPcBtrS95uhs6XYPi/Wu5Edl9meACTnIjS3JtaxETLAbuf xR/r3LbGUWxspdc8lO3Gz1tYWCUrMM/kqD3l8mGWWbmncznN02nQA5+N1DbtNl9L mo/WqmIrLUrGRJICaoSvwfZpMepFweceOdJhFfucmNRVqUaONXfkahxmefslz5Dc y3+Otpk2k0E+tH4qCOIy62Tc7veQC8pUXTORKUQYcIeTQd02YQGwJsNFnam54HfM nqbNsyg9QtyWK9YZZFVksrGVfDuRq6PYTJ91qwPMjlI= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F65B27EB260E0788

http://decryptor.cc/F65B27EB260E0788

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\oXnEn2JlQT = "C:\\Users\\Admin\\AppData\\Local\\Temp\\f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe"	f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe

description	ioc	Process
File opened (read-only)	\??\F:	f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe
File opened (read-only)	\??\A:	f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe
File opened (read-only)	\??\E:	f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe
File opened (read-only)	\??\J:	f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe
File opened (read-only)	\??\K:	f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe
File opened (read-only)	\??\P:	f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe
File opened (read-only)	\??\Q:	f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe
File opened (read-only)	\??\T:	f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe
File opened (read-only)	\??\V:	f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe
File opened (read-only)	\??\G:	f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe
File opened (read-only)	\??\L:	f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe
File opened (read-only)	\??\M:	f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe
File opened (read-only)	\??\O:	f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe
File opened (read-only)	\??\Z:	f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe
File opened (read-only)	\??\S:	f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe
File opened (read-only)	\??\U:	f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe
File opened (read-only)	\??\W:	f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe
File opened (read-only)	\??\B:	f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe
File opened (read-only)	\??\H:	f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe
File opened (read-only)	\??\I:	f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe
File opened (read-only)	\??\N:	f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe
File opened (read-only)	\??\R:	f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe
File opened (read-only)	\??\X:	f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe
File opened (read-only)	\??\Y:	f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe
File opened (read-only)	\??\D:	f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\i69065s2h.bmp"	f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe

Drops file in Program Files directory 36 IoCs

Processes:

f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe

description	ioc	Process
File opened for modification	\??\c:\program files\EnterUnprotect.vb	f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe
File opened for modification	\??\c:\program files\MeasureSearch.wmv	f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe
File opened for modification	\??\c:\program files\RestoreUnprotect.xht	f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe
File opened for modification	\??\c:\program files\SkipFormat.ini	f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\v3.5\4teh8h-read-me.txt	f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ConfirmUnprotect.html	f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe
File opened for modification	\??\c:\program files\DisconnectRevoke.mid	f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ConvertFromDisconnect.mpg	f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe
File opened for modification	\??\c:\program files\GetWatch.rtf	f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe
File opened for modification	\??\c:\program files\PublishSet.M2V	f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe
File opened for modification	\??\c:\program files\UnregisterComplete.aiff	f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\4teh8h-read-me.txt	f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe
File created	\??\c:\program files (x86)\4teh8h-read-me.txt	f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe
File opened for modification	\??\c:\program files\BackupEdit.xhtml	f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe
File opened for modification	\??\c:\program files\RegisterStep.xla	f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe
File opened for modification	\??\c:\program files\SplitStop.nfo	f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe
File opened for modification	\??\c:\program files\UnpublishRestore.easmx	f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe
File opened for modification	\??\c:\program files\HideSet.vsd	f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe
File opened for modification	\??\c:\program files\TraceDeny.zip	f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe
File opened for modification	\??\c:\program files\CompletePush.ttc	f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe
File opened for modification	\??\c:\program files\JoinResume.wvx	f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe
File opened for modification	\??\c:\program files\UnblockSelect.jpg	f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe
File opened for modification	\??\c:\program files\UnpublishMerge.mpeg	f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe
File created	\??\c:\program files\4teh8h-read-me.txt	f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe
File opened for modification	\??\c:\program files\CloseProtect.docx	f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe
File opened for modification	\??\c:\program files\SplitMove.dib	f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe
File opened for modification	\??\c:\program files\UseBackup.ogg	f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ExitUse.svg	f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe
File opened for modification	\??\c:\program files\LimitPop.mht	f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe
File opened for modification	\??\c:\program files\GroupResolve.docx	f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe
File opened for modification	\??\c:\program files\InstallReset.ps1xml	f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe
File opened for modification	\??\c:\program files\OpenRepair.xml	f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe
File opened for modification	\??\c:\program files\SuspendExit.pps	f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\4teh8h-read-me.txt	f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe
File opened for modification	\??\c:\program files\AddRead.M2T	f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ConnectSave.ogg	f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exepowershell.exe

pid	Process
2300	f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe
2908	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exepowershell.exevssvc.exe

description	pid	Process
Token: SeDebugPrivilege	2300	f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe
Token: SeDebugPrivilege	2908	powershell.exe
Token: SeBackupPrivilege	896	vssvc.exe
Token: SeRestorePrivilege	896	vssvc.exe
Token: SeAuditPrivilege	896	vssvc.exe
Token: SeTakeOwnershipPrivilege	2300	f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe

description	pid	Process	procid_target
PID 2300 wrote to memory of 2908	2300	f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe	30
PID 2300 wrote to memory of 2908	2300	f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe	30
PID 2300 wrote to memory of 2908	2300	f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe	30
PID 2300 wrote to memory of 2908	2300	f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe	30

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f399f74045c127d9bab9b10fa2e81ea9_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2908

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:2892

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\4teh8h-read-me.txt

Filesize
9KB

MD5
c5643770a085f68b1c1362b9e08bbc57

SHA1
8e76be5673015da6109884d57dc929c19244d2ad

SHA256
8ef9b9ca42bc4390f97592f5fb33c3c001d16dd26aa257bac4ff932d8af8864c

SHA512
7efff8008b110091611383f3484b35bf424e3283393be863beb83e730f9cfb233cee69ab7988e5cf869a3c43559879af6c60a1f73e9325a5bf068e68edd62bd4

Download Submit
memory/2908-4-0x000007FEF553E000-0x000007FEF553F000-memory.dmp

Filesize
4KB

Download
memory/2908-5-0x000000001B7C0000-0x000000001BAA2000-memory.dmp

Filesize
2.9MB

Download
memory/2908-6-0x0000000001D70000-0x0000000001D78000-memory.dmp

Filesize
32KB

Download
memory/2908-7-0x000007FEF5280000-0x000007FEF5C1D000-memory.dmp

Filesize
9.6MB

Download
memory/2908-8-0x000007FEF5280000-0x000007FEF5C1D000-memory.dmp

Filesize
9.6MB

Download
memory/2908-9-0x000007FEF5280000-0x000007FEF5C1D000-memory.dmp

Filesize
9.6MB

Download
memory/2908-10-0x000007FEF5280000-0x000007FEF5C1D000-memory.dmp

Filesize
9.6MB

Download
memory/2908-11-0x000007FEF5280000-0x000007FEF5C1D000-memory.dmp

Filesize
9.6MB

Download
memory/2908-12-0x000007FEF5280000-0x000007FEF5C1D000-memory.dmp

Filesize
9.6MB

Download