Overview

overview

10

Static

static

3

JaffaCakes...08.exe

windows7-x64

10

JaffaCakes...08.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    JaffaCakes118_4d6db255a6f3ac059db04ec85c5af708
  • Size 5.6MB
  • Sample250107-e2eraswmcl
  • SHA256 19889563a01396e02d971bac3be7194500fc09b8b4409cec21affd1f6a11741c
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
sodinokibi$2a$12$prox/4ekl8zrpgsc5lnhpecevs5nockouw5r3s4jjydnzzsghvbkq8254discoveryevasionpersistenceprivilege_escalationransomware

Malware Config

Extracted

Family

  • sodinokibi

Botnet

  • $2a$12$prOX/4eKl8zrpGSC5lnHPecevs5NOckOUW5r3s4JJYDnZZSghvBkq

Campaign

  • 8254

Decoy

  • boisehosting.net

  • fotoideaymedia.es

  • dubnew.com

  • stallbyggen.se

  • koken-voor-baby.nl

  • juneauopioidworkgroup.org

  • vancouver-print.ca

  • zewatchers.com

  • bouquet-de-roses.com

  • seevilla-dr-sturm.at

  • olejack.ru

  • i-trust.dk

  • wasmachtmeinfonds.at

  • appsformacpc.com

  • friendsandbrgrs.com

  • thenewrejuveme.com

  • xn--singlebrsen-vergleich-nec.com

  • sabel-bf.com

  • seminoc.com

  • ceres.org.au

Attributes
  • net

    false

  • pid

    $2a$12$prOX/4eKl8zrpGSC5lnHPecevs5NOckOUW5r3s4JJYDnZZSghvBkq

  • prc

    encsvc

    powerpnt

    ocssd

    steam

    isqlplussvc

    outlook

    sql

    ocomm

    agntsvc

    mspub

    onenote

    winword

    thebat

    excel

    mydesktopqos

    ocautoupds

    thunderbird

    synctime

    infopath

    mydesktopservice

    firefox

    oracle

    sqbcoreservice

    dbeng50

    tbirdconfig

    msaccess

    visio

    dbsnmp

    wordpad

    xfssvccon

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [-] Whats HapPen? [-] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DON'T try to change files by yourself, DON'T use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    8254

  • svc

    veeam

    memtas

    sql

    backup

    vss

    sophos

    svc$

    mepocs

Extracted

Path

  • C:\Users\3977691ln-readme.txt

Ransom Note
  • ---=== Welcome. Again. ===--- [-] Whats HapPen? [-] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 3977691ln. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7311A9C26B888B61 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/7311A9C26B888B61 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: yvHY4E33QvXIr0ga4jcFLEsZocvjq2NYrFsMW9gC2RmyKzkgTbUj4t0TRMlLxJW1 +vvY7iOoyZQtdoOTxmrAc7QSpViEGAEozTvzLqLQmCe8XE/4opc2cnxoLNjY9BFv N6jB1oosLiFDsPqF39v1EzlnqhRA57GNjlW7/4q0mRs7QUN5+JXEg4pS+26t4woL 0TaslatGbH5H7Cf5LTPOaBMgrZl6C6gcPV6yQydO0WZn8w9VJb1MNYvy+Ezvz6x1 O7Hhtu3soEo8J6RTfgXCVfhoUO9BvVZ0Qd6oVUKBoaTDJFs0w3yMNtqOUxHwEQyb R6NSYk42EjGxFYZbB6Wkf5CSIqc9ZG0VMwPwFLuk9HlbppTnaQx7xVPOQ5sSQ/YM a/ceavCF/Vl7BhD/0m4PoGaSLBLz0bdl9VDz2OuuiSrgcYS7xltOelwCGmnscCSP xboDS96/w/Zh+iJPEwyfIT0gh82vAoHwO2CEd2Ad8krZfgyz/C+ZmBXwPnHKeKTA 6KK5cFHIiunsSiAeSy16gfXlQrlpl+t6A09oS6NT7WZ9Xyycz6Brqtf8cnAE+qGI mWqMV6/HhUpu1vYa6rKx3PClO2d8tX1EXmrEpjklMLQh3NBIOPYIOCazm+UYnTXx zNH6NRTWFEYhGq5eYgE/IgHB87K8Xx/ZF5wDAnz9E7DEMUjRTkpOVs/MPmon6rsn X6iM+3JnJLVuJIdCEaErjxwkAqzxadvRVewnv1VY2G4FbhzGWCfMeM96AeJUofMk cIGggv/UDYfz26yo7qVVpC62cTKpwa8qYOnUKCNwL9hFUMSrDt7AIjK0VewZYPXa +NYFIeY8ziXNoTxFmZOT+vnd7YCUOSHcjURbMuCZCWoXLbBr7U+cBFRL7KDUVano eUfu4ufKNcjOZ1AiIHloUAk3glGc+J2CaBgUMj5NcwK4M7IeX/wiuIMArf0c0Ed8 dh8/zFLWgPoTraZNomnkpUS9WY5JQkH3SJkzmhjxdAZWx981HrCVZtDKL7YJUGq1 j9+jboOeRoDokg6rzyQKd3nJ9tVBClAZ+rf7saZ/Myd3MZGm4oevuu/lN3twoGET xInBNzjV98fPVrlrMTdsJx7uI3B25vgXPTAtmO2VduU5mOy3ddqxS/qEWnTMIyRw 5NuYxhsKhtQBQJ8GXo4kp97i3fVM9ER+UFe/djOwdi8Bk/2p+moF6dr3veWFDliN oj92k6gWyfRngNn7ijW4hQJVeUmLy7SyNeFLdDsZK2miHMcK41zVftjlnwLYhXVy RcSHFmj+3c+hdSui12kNkVnduS2t1xwNn5Dpr4q0g5YNmOi1NlGfbOZBulUzPYIT PqWzPkVemXzWCp9M8W5CsvALbLn9JXeQdNemsg== ----------------------------------------------------------------------------------------- !!! DANGER !!! DON'T try to change files by yourself, DON'T use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

  • http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7311A9C26B888B61

  • http://decoder.re/7311A9C26B888B61

Extracted

Path

  • C:\Users\831l1864-readme.txt

Ransom Note
  • ---=== Welcome. Again. ===--- [-] Whats HapPen? [-] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 831l1864. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/ABDE0477481B7585 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/ABDE0477481B7585 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: vTjj6zDj0orYN42R5jBQ4GkGG2pmmEaB3EOW6Rr1teL/EoLTYK+/v20hmh61h14B Cp/O9Mclg9LHCkkBorhYKgE3kodCqwZp5KDiTsIDQbvyAfZ8fueoHqmVPB3wMOP4 WC1F4jzREHIR8+ok5Q6mRZ0UTqq/Gq487JhJpYjKoPWldYtYxKcEi+lWGWABwU4A xD+qx/ilnzuBGPPFLHAVBROmHL65LUfLU3NE8G/igANPgPJvXK4KFMSYmjqqjhUT 05od0pBMZmQ8T1cnaZh3hGEELHYBw42QoNtACSr+JPzSLabS0/hTcVmL4VfHabIT rDjrZMhD4vdCHi48ctwOnjl96IGng/osBe7IzM3fOH4M4DvbfNeMUd7Moj3FGKCY TL0wSEq4DLf98Kce81vbfZ+msGpmW+1QOQaEvkvBY6ygWOed2Wvt6dqiTxkHxRJA egkA8lLOzyW1yzvBfyu2PnmhO+THtJcE//4VFrrCXA+IEfXS0WhRUiW/hbARzxTH yfwJTCVnXeFuMRmVXAxTauvuFAQdf2DcpR2LWH7CRRzYPoctNSCHYVbJ0RSWUrSa iYdv0GOUX8LTotfKWbsbhwN9DZ2lTHhVcdQUnF72QexUEoVElU0MlHXQc/06/tP6 Ue603KgJ9DMKcxYAdMYIyLxuih0ed37qFa/Su81TwOEuQcaHGTOr+G8b+H302jwF CpEgV/MIsZwSchlmJjkxOiVkbwhW1/HjTDCBvcWnKP7Skg4OTOYTgU8fDkO0DSsT Wd1pGn/bBmWdHwDdt8hBcertVC/ArCwb2uCIjPQ6hyS9sgfMhikytbifbxLzhm0u 94bMIVMcCV8O9Mj3tzYy9003w87djVY0VRAUije+M6pV7WLxtdx8T3RkS9EP0W5Y Fuvq+lQmCPm8mS4sgyRdVJVsaLBfbNd1lwHlmMB9NwA/CH+dIPH2cRTsw1qXff72 NRyETYT1tWkUmd0SA64B0Wch4XKm6+4FeGfN/RuPBjBaMXKNFRJzs3/YOjdnprDc +LEBEoIYjTCyi6PzNJMT7l+yb19p6h5dmc4mcLkYlmF03xI57LgY+p6WqxPmA3FT H8C6vgFGrCoNHrsSZ/exganKIaHf1rA+RdyNp57Wi7XEIYvKTNCG3RJXPbsF/hx8 EQmff6oBZG22Nmbp9BQNd1Fa9r6Ee2AmPYHCXnJ7grgEbeiS+/VqfW+U5ix1hZHk 8tSKNlHlh4uiS7DOhvLGRmt5xkPt8VnvIN+Sh0M4pdz/TJ+eknkhufxZBelgi/Bp nzGx8fzkDL1+d1xv0lP7iTgUOxptIzpp1ZAq/ne+X10ovTKgtdxymzUd0JEUtLFQ f/7Ro6Cq/JBgbvUzEI+RIbUsNEq/ASl2dO2UiVYIejU= ----------------------------------------------------------------------------------------- !!! DANGER !!! DON'T try to change files by yourself, DON'T use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

  • http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/ABDE0477481B7585

  • http://decoder.re/ABDE0477481B7585

Targets

    • Target
      JaffaCakes118_4d6db255a6f3ac059db04ec85c5af708
    • Size 5.6MB
    • SHA256 19889563a01396e02d971bac3be7194500fc09b8b4409cec21affd1f6a11741c
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    sodinokibi$2a$12$prox/4ekl8zrpgsc5lnhpecevs5nockouw5r3s4jjydnzzsghvbkq8254discoveryevasionpersistenceprivilege_escalationransomware

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

      ransomwaresodinokibi

    • Sodinokibi family

      sodinokibi

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Modifies Windows Firewall

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

      ransomware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks