sodinokibi | a728d45de941ca5730401f224c80fa1dcc2224477e309f5e4a1de8276939dfbf

Resubmissions

05-10-2024 14:22

241005-rpzl6avdkm 10

02-10-2024 19:27

241002-x55e8swflc 10

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02-10-2024 19:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0c280ffb12537bca109724ec89d1ccc6_JaffaCakes118.exe
Size

179KB
MD5

0c280ffb12537bca109724ec89d1ccc6
SHA1

a8d5d8d5d1b8f288e919fe303787c5e1869ad653
SHA256

a728d45de941ca5730401f224c80fa1dcc2224477e309f5e4a1de8276939dfbf
SHA512

13c15edf4f022f74b3dd57cc203dc5a6bdde773a85ae83df772d536dd4c538ac11415a7c5d8fbb8b39e5e27c52d869a4b5cb19eb7c21c799e4bd8a53440b568a
SSDEEP

3072:yEa2d8CfSXceqmPDu4lPZU/CZtpysa8ustqzhy2Is80nwnyxVps:ACqlPDuGPG/abesYzg2I70nqoDs

Score

10^/10

sodinokibi discovery ransomware

Malware Config

Extracted

Path

C:\Users\7679429-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. CDHFUND. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension 7679429. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/6C94692D3AC314A8 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/6C94692D3AC314A8 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 60TEKPzEQpPeWA++VZLOdZGLC5zEVaDaMm7Bo5OZ6ztpcauYfYs+QytslVn+HHFc 1JBBORUlDU5/kHtCpTR2yyjnLZpkv/zowxbDRlMKWPiP2aZ+QYk5S9pFxVj/0EJa ShF12sP8C29XRRL5kGSAwozij//PvhYzKihTY/96Jjl3NUWaFBYxx2BPk5+OzAPz t1amBVsn5FdtoXvLrtsyf1+AGwtDjNXmGaNeCMp2YQSudsZ3cNj1LEEMy61SNPQ3 kj3t7uW7ziSuvdvsCoKDRlhMtU6ejUy9c24pf7KI2qnauLQtZLzkBucynN7tFSnf wiMF403l7vqDnkmY7cg+VC2+CSx2sE3iE4qCri3K7EdlY3yZDDvyXBKkaMx36rGT 03V1jSdrN1s09qP5WrPk3cZa6p95ZtSa2lTXE2hbOoo2hyXHwxu/Zk7hgZtpzf5O zrLB1PXIGMJmRVHc6/4f0IyWPPO1GO9qT8wOsOavWi8P2A+wrlz4NdIpRb9Gqkkg 8Rr7TQeM8hJC6URekoWChDHk6pMDXub8/7Yblyh7bDmwVTFegja5UfAbbe4aGLVJ HvLzD8Gytnu9Zy2CEr0cyLU0FziFkl4QtP6VEkv2WXx4O96uSlzqy3Fsj4VLieSh MKdHWamXxnMDn6CRhp5x9ebrcVskAXRYu//VHCePg2UNQ8fq9LJiJnIrRJGgY7Io pLQP2Gmtjt06x3XXSrvEF106RVklAm6DvDW49eZy7b1wBLYnosJNc10Lab7Gbi/5 FJQTptyKkOlkerHOJZtZj04ni4ce3iv8DFEIx+MnSviUcxIJ79js2cWOnGs9F6gm tS6ujR9yoZbf3bG7K5btxQP0agahKNtqv9AzS6lvtpY6CABj6eT6+ujxZOkPNMiv 9e8hZdPhSrtWeiMdSUlmLdqj6pOMsF32CC+K3l5lFgXGrpnX4pIShrSnakQNKYrD YaAW1tjudlDLmm1BaYIaoPIxza1BIac8FHmDBecuVTq3psYG2Gtl3vWUUs6Jectq K0O2NhhfjsdlKYmugoiCv8rcHk5Xw0TYzlVs3MtppB0ZC4yhFpDXaaecNpmz0MMO MUn7tbs0fqqrh1nabh3U+5iJ+dAT7sSaqWCpdOo/QjjkAnfZN5T31d/s8i4PZcaG n1PAkkKdNJVeEFEx79jgft5x8frlXVAw1dVXNMLlopCJXbn2AclEStR92wk339f1 vrq020Urf/fqDiBi1Ow= Extension name: 7679429 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/6C94692D3AC314A8

http://decryptor.top/6C94692D3AC314A8

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	0c280ffb12537bca109724ec89d1ccc6_JaffaCakes118.exe
File opened (read-only)	\??\R:	0c280ffb12537bca109724ec89d1ccc6_JaffaCakes118.exe
File opened (read-only)	\??\U:	0c280ffb12537bca109724ec89d1ccc6_JaffaCakes118.exe
File opened (read-only)	\??\W:	0c280ffb12537bca109724ec89d1ccc6_JaffaCakes118.exe
File opened (read-only)	\??\Y:	0c280ffb12537bca109724ec89d1ccc6_JaffaCakes118.exe
File opened (read-only)	\??\B:	0c280ffb12537bca109724ec89d1ccc6_JaffaCakes118.exe
File opened (read-only)	\??\G:	0c280ffb12537bca109724ec89d1ccc6_JaffaCakes118.exe
File opened (read-only)	\??\K:	0c280ffb12537bca109724ec89d1ccc6_JaffaCakes118.exe
File opened (read-only)	\??\F:	0c280ffb12537bca109724ec89d1ccc6_JaffaCakes118.exe
File opened (read-only)	\??\A:	0c280ffb12537bca109724ec89d1ccc6_JaffaCakes118.exe
File opened (read-only)	\??\H:	0c280ffb12537bca109724ec89d1ccc6_JaffaCakes118.exe
File opened (read-only)	\??\J:	0c280ffb12537bca109724ec89d1ccc6_JaffaCakes118.exe
File opened (read-only)	\??\N:	0c280ffb12537bca109724ec89d1ccc6_JaffaCakes118.exe
File opened (read-only)	\??\Q:	0c280ffb12537bca109724ec89d1ccc6_JaffaCakes118.exe
File opened (read-only)	\??\S:	0c280ffb12537bca109724ec89d1ccc6_JaffaCakes118.exe
File opened (read-only)	\??\Z:	0c280ffb12537bca109724ec89d1ccc6_JaffaCakes118.exe
File opened (read-only)	\??\D:	0c280ffb12537bca109724ec89d1ccc6_JaffaCakes118.exe
File opened (read-only)	\??\E:	0c280ffb12537bca109724ec89d1ccc6_JaffaCakes118.exe
File opened (read-only)	\??\L:	0c280ffb12537bca109724ec89d1ccc6_JaffaCakes118.exe
File opened (read-only)	\??\M:	0c280ffb12537bca109724ec89d1ccc6_JaffaCakes118.exe
File opened (read-only)	\??\O:	0c280ffb12537bca109724ec89d1ccc6_JaffaCakes118.exe
File opened (read-only)	\??\T:	0c280ffb12537bca109724ec89d1ccc6_JaffaCakes118.exe
File opened (read-only)	\??\V:	0c280ffb12537bca109724ec89d1ccc6_JaffaCakes118.exe
File opened (read-only)	\??\X:	0c280ffb12537bca109724ec89d1ccc6_JaffaCakes118.exe
File opened (read-only)	\??\I:	0c280ffb12537bca109724ec89d1ccc6_JaffaCakes118.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\9hxsp3q.bmp"	0c280ffb12537bca109724ec89d1ccc6_JaffaCakes118.exe

Drops file in Program Files directory 40 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files\DisablePublish.mp2v	0c280ffb12537bca109724ec89d1ccc6_JaffaCakes118.exe
File opened for modification	\??\c:\program files\MergeShow.htm	0c280ffb12537bca109724ec89d1ccc6_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ResumeRevoke.odt	0c280ffb12537bca109724ec89d1ccc6_JaffaCakes118.exe
File opened for modification	\??\c:\program files\UninstallExport.dib	0c280ffb12537bca109724ec89d1ccc6_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ExportSelect.raw	0c280ffb12537bca109724ec89d1ccc6_JaffaCakes118.exe
File opened for modification	\??\c:\program files\SelectStop.3gp2	0c280ffb12537bca109724ec89d1ccc6_JaffaCakes118.exe
File opened for modification	\??\c:\program files\UnprotectPublish.ppt	0c280ffb12537bca109724ec89d1ccc6_JaffaCakes118.exe
File opened for modification	\??\c:\program files\UnpublishUse.WTV	0c280ffb12537bca109724ec89d1ccc6_JaffaCakes118.exe
File opened for modification	\??\c:\program files\InstallEdit.xla	0c280ffb12537bca109724ec89d1ccc6_JaffaCakes118.exe
File opened for modification	\??\c:\program files\InvokeDeny.m3u	0c280ffb12537bca109724ec89d1ccc6_JaffaCakes118.exe
File opened for modification	\??\c:\program files\UndoSelect.htm	0c280ffb12537bca109724ec89d1ccc6_JaffaCakes118.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\7679429-readme.txt	0c280ffb12537bca109724ec89d1ccc6_JaffaCakes118.exe
File created	\??\c:\program files\7679429-readme.txt	0c280ffb12537bca109724ec89d1ccc6_JaffaCakes118.exe
File opened for modification	\??\c:\program files\AssertSet.htm	0c280ffb12537bca109724ec89d1ccc6_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ResumeMerge.wmv	0c280ffb12537bca109724ec89d1ccc6_JaffaCakes118.exe
File opened for modification	\??\c:\program files\SelectUnblock.rm	0c280ffb12537bca109724ec89d1ccc6_JaffaCakes118.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\v3.5\7679429-readme.txt	0c280ffb12537bca109724ec89d1ccc6_JaffaCakes118.exe
File opened for modification	\??\c:\program files\FindSwitch.aifc	0c280ffb12537bca109724ec89d1ccc6_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ResumeDismount.vst	0c280ffb12537bca109724ec89d1ccc6_JaffaCakes118.exe
File opened for modification	\??\c:\program files\StepSet.m4v	0c280ffb12537bca109724ec89d1ccc6_JaffaCakes118.exe
File opened for modification	\??\c:\program files\UndoShow.txt	0c280ffb12537bca109724ec89d1ccc6_JaffaCakes118.exe
File opened for modification	\??\c:\program files\UseSwitch.DVR	0c280ffb12537bca109724ec89d1ccc6_JaffaCakes118.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\7679429-readme.txt	0c280ffb12537bca109724ec89d1ccc6_JaffaCakes118.exe
File created	\??\c:\program files (x86)\7679429-readme.txt	0c280ffb12537bca109724ec89d1ccc6_JaffaCakes118.exe
File opened for modification	\??\c:\program files\CompareFind.jtx	0c280ffb12537bca109724ec89d1ccc6_JaffaCakes118.exe
File opened for modification	\??\c:\program files\NewRequest.wpl	0c280ffb12537bca109724ec89d1ccc6_JaffaCakes118.exe
File opened for modification	\??\c:\program files\RedoPush.tif	0c280ffb12537bca109724ec89d1ccc6_JaffaCakes118.exe
File opened for modification	\??\c:\program files\UseClose.eprtx	0c280ffb12537bca109724ec89d1ccc6_JaffaCakes118.exe
File opened for modification	\??\c:\program files\CloseRepair.zip	0c280ffb12537bca109724ec89d1ccc6_JaffaCakes118.exe
File opened for modification	\??\c:\program files\FormatResume.jpg	0c280ffb12537bca109724ec89d1ccc6_JaffaCakes118.exe
File opened for modification	\??\c:\program files\FormatSearch.midi	0c280ffb12537bca109724ec89d1ccc6_JaffaCakes118.exe
File opened for modification	\??\c:\program files\SwitchClear.au	0c280ffb12537bca109724ec89d1ccc6_JaffaCakes118.exe
File opened for modification	\??\c:\program files\TraceInvoke.wdp	0c280ffb12537bca109724ec89d1ccc6_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ApproveSend.mp3	0c280ffb12537bca109724ec89d1ccc6_JaffaCakes118.exe
File opened for modification	\??\c:\program files\GetCopy.pptm	0c280ffb12537bca109724ec89d1ccc6_JaffaCakes118.exe
File opened for modification	\??\c:\program files\LimitPop.wvx	0c280ffb12537bca109724ec89d1ccc6_JaffaCakes118.exe
File opened for modification	\??\c:\program files\LockConvert.wmf	0c280ffb12537bca109724ec89d1ccc6_JaffaCakes118.exe
File opened for modification	\??\c:\program files\PublishSuspend.csv	0c280ffb12537bca109724ec89d1ccc6_JaffaCakes118.exe
File opened for modification	\??\c:\program files\TestConfirm.xsl	0c280ffb12537bca109724ec89d1ccc6_JaffaCakes118.exe
File opened for modification	\??\c:\program files\UpdateGroup.ppsm	0c280ffb12537bca109724ec89d1ccc6_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0c280ffb12537bca109724ec89d1ccc6_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2324	0c280ffb12537bca109724ec89d1ccc6_JaffaCakes118.exe
2288	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2288	powershell.exe
Token: SeBackupPrivilege	2844	vssvc.exe
Token: SeRestorePrivilege	2844	vssvc.exe
Token: SeAuditPrivilege	2844	vssvc.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 2288	2324	0c280ffb12537bca109724ec89d1ccc6_JaffaCakes118.exe	32
PID 2324 wrote to memory of 2288	2324	0c280ffb12537bca109724ec89d1ccc6_JaffaCakes118.exe	32
PID 2324 wrote to memory of 2288	2324	0c280ffb12537bca109724ec89d1ccc6_JaffaCakes118.exe	32
PID 2324 wrote to memory of 2288	2324	0c280ffb12537bca109724ec89d1ccc6_JaffaCakes118.exe	32

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\0c280ffb12537bca109724ec89d1ccc6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0c280ffb12537bca109724ec89d1ccc6_JaffaCakes118.exe"
1⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2288

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:2424

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\7679429-readme.txt

Filesize
6KB

MD5
4e9cd9158d13001f0a8e920e07b2a43f

SHA1
0780cc6921464f2d5e74be42ad25da89f92645d7

SHA256
1da37002a83fd157998e1da803607a86fdbaba48dc4d94f53b402b752f294eb5

SHA512
b3c39a30c23a62da147a9d64c11318fa71f9cca632a5e55d1bed80123046364e0c0a59ce1070b3aa5e4b0b9de367512f6052f403b3c61fd79afd351769292ad8

Download Submit
memory/2288-4-0x000007FEF56EE000-0x000007FEF56EF000-memory.dmp

Filesize
4KB

Download
memory/2288-5-0x000000001B4E0000-0x000000001B7C2000-memory.dmp

Filesize
2.9MB

Download
memory/2288-6-0x0000000002910000-0x0000000002918000-memory.dmp

Filesize
32KB

Download
memory/2288-7-0x000007FEF5430000-0x000007FEF5DCD000-memory.dmp

Filesize
9.6MB

Download
memory/2288-8-0x000007FEF5430000-0x000007FEF5DCD000-memory.dmp

Filesize
9.6MB

Download
memory/2288-9-0x000007FEF5430000-0x000007FEF5DCD000-memory.dmp

Filesize
9.6MB

Download
memory/2288-10-0x000007FEF5430000-0x000007FEF5DCD000-memory.dmp

Filesize
9.6MB

Download
memory/2288-11-0x000007FEF5430000-0x000007FEF5DCD000-memory.dmp

Filesize
9.6MB

Download