Overview

overview

10

Static

static

10

ff6818d770...18.exe

windows7-x64

10

ff6818d770...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    131s
  • max time network
    135s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/09/2024, 22:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ff6818d770e34c64c37e6a83a7b24be5_JaffaCakes118.exe
  • Size 165KB
  • Sample240929-2g3c7axejg
  • SHA256 47e05f24669a0ffd7ca461aaf7e76e0b6e17f6cf424e4d854ddc584ee26ef42c
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
sodinokibidiscoveryransomware

Malware Config

Extracted

Path

  • C:\Users\23tdzd366f-readme.txt

  • sodinokibi

Ransom Note
  • ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 23tdzd366f. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/CA244B4892B6571B 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/CA244B4892B6571B Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: +chjeCtVZngz2+GnfQd6SdtSQIyuiwtpu7iDCGZAMWRf/s9kCcUqwwPWH/VbhzbF AndmRr4mF1ksKZ9JeuhUQasZ+fuQ7t8zv544ApygxxEDEYqkvhCOOlFO3EdJ7YxP OjLgmMbGDjXB1Ox0JSRXKT3pOmar+Xn6RKo29VZydt57PKwv1M4nS5Uq2Isao+V5 ym1p4WapU+cf8whJAoUwC2l2pnekPYh2ceR3e2uA9+PNnmarpL0vUomoIobOebIB y0FJ6VkIjAkbkfUzuS65QSUrK5lP2JEOu2RL/Lg7BHV8XmO8uQp9tOio6X7rTrkS 9YRP+u/HsJ++nDerE43nqX1Njx94CvtrFF9XrNwf9MzrEUseIWmJcneKbY5MckU6 Zy/HPimOmC0Hyb1sVuNJaNLBByrG/avPnPbFjm3FDTxRMnhRc8EsZZzP7W5MVv8Z kJFUSkxAnw7FE/SLS01i+Sy0sw6mZMnWBcXxUCiR83PXJ/1u49IS0YAuhSeRg6E+ EULNB1WdaymNYHRsGULPGOZZptA9MJmb47dvHhwXNaOm4VXcFvHGdFpErmJOExEh Au4wfb3PRvi4OMzxQzW3KkvMLtfM7zTUNTo2ks07kMEZgj2NtnitybuX8OgSTvtq 6Dbb80BLIhLFWCwb9Jsbvghz+7OEcEKu9xWVFj1cz9HaVtzaCbxuPHEdiDZuZQLI ivJDXCjEOSvaAQMRdHikzG3J4cOeunuoeclW3x+Biym6elY+2aQmZpmLtieFx6Wr N27EZASE9fY4Kh+q7Q6uZBo5KwudOY1r15Ga0nYs3FXFAJnLUHRPe6/8RQLejnsE IN/PvOrNA58KxDQkVmfMg0ifBt1Q6NXXB5A0iDmxlLZz0ORQhD1Hcic4Cmg1l2L7 /ER6KTJ8i8Vevyc1bEIw9P+RVTyOX7dOwiwcqUUdJTsZ5llUi3cb35+3dCPcClq1 v0TChBprAnb1f/BZfVCrx17AZdXjCDZGs9HRPJToXybDKEwtVX5tSEEUaXRjU36N 1pc2kWrUZdjJrutGx37nXkZBsSkTxuNo5WkR7CMLegB0KF6zkjxQ8zU+EOSXZWYV 4K7CQAbaGAJzPVU8B1JhmH2c1MXe2ZxQ7fHnVbyN+lc5Jd/WoCrZDAyVUaFQtwbv UHd3NIx/afTLwBOeJEJqeicKz5qgZothYP8y4SOYs2kXrHOyx/J5Zp7cAlqfzMK/ 5jNpRvolTFtUxzaPCvKkLvxk3TeURP7qD70= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

  • http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/CA244B4892B6571B

  • http://decryptor.cc/CA244B4892B6571B

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 34 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\ff6818d770e34c64c37e6a83a7b24be5_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ff6818d770e34c64c37e6a83a7b24be5_JaffaCakes118.exe"
    1⤵
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4768
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4220
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:784
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3940
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4148,i,7447299413640964517,4240724842020506306,262144 --variations-seed-version --mojo-platform-channel-handle=3884 /prefetch:8
      1⤵
        PID:284

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            23tdzd366f-readme.txt
            • Path C:\Users\23tdzd366f-readme.txt
            • Size 6KB
            • SHA256 027eba4b9cb8eb60893d7bae304820f73d81dfa63f7fe0a7f51d96b809b13df0
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            __PSScriptPolicyTest_nnvced11.2xp.ps1
            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nnvced11.2xp.ps1
            • Size 60B
            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
            • MD5 SHA1 SHA512
            Submit Download

            memory/4220-0-0x00007FFBF3A13000-0x00007FFBF3A15000-memory.dmp
            Download

            memory/4220-6-0x0000024AC84D0000-0x0000024AC84F2000-memory.dmp
            Download

            memory/4220-11-0x00007FFBF3A10000-0x00007FFBF44D1000-memory.dmp
            Download

            memory/4220-12-0x00007FFBF3A10000-0x00007FFBF44D1000-memory.dmp
            Download

            memory/4220-15-0x00007FFBF3A10000-0x00007FFBF44D1000-memory.dmp
            Download