Analysis
- max time kernel
117s - max time network
119s - platform
windows7_x64 - resource
win7-20240708-en - resource tags
- submitted
07/01/2025, 04:25
General
- Target JaffaCakes118_4d6db255a6f3ac059db04ec85c5af708.exe
- Size 5.6MB
- Sample250107-e2eraswmcl
- SHA256 19889563a01396e02d971bac3be7194500fc09b8b4409cec21affd1f6a11741c
Malware Config
Extracted
-
sodinokibi
-
$2a$12$prOX/4eKl8zrpGSC5lnHPecevs5NOckOUW5r3s4JJYDnZZSghvBkq
-
8254
-
boisehosting.net
-
fotoideaymedia.es
-
dubnew.com
-
stallbyggen.se
-
koken-voor-baby.nl
-
juneauopioidworkgroup.org
-
vancouver-print.ca
-
zewatchers.com
-
bouquet-de-roses.com
-
seevilla-dr-sturm.at
-
olejack.ru
-
i-trust.dk
-
wasmachtmeinfonds.at
-
appsformacpc.com
-
friendsandbrgrs.com
-
thenewrejuveme.com
-
xn--singlebrsen-vergleich-nec.com
-
sabel-bf.com
-
seminoc.com
-
ceres.org.au
-
net
false
-
pid
$2a$12$prOX/4eKl8zrpGSC5lnHPecevs5NOckOUW5r3s4JJYDnZZSghvBkq
-
prc
encsvc
powerpnt
ocssd
steam
isqlplussvc
outlook
sql
ocomm
agntsvc
mspub
onenote
winword
thebat
excel
mydesktopqos
ocautoupds
thunderbird
synctime
infopath
mydesktopservice
firefox
oracle
sqbcoreservice
dbeng50
tbirdconfig
msaccess
visio
dbsnmp
wordpad
xfssvccon
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [-] Whats HapPen? [-] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DON'T try to change files by yourself, DON'T use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
8254
-
svc
veeam
memtas
sql
backup
vss
sophos
svc$
mepocs
Extracted
-
C:\Users\3977691ln-readme.txt
- ---=== Welcome. Again. ===--- [-] Whats HapPen? [-] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 3977691ln. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7311A9C26B888B61 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/7311A9C26B888B61 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: yvHY4E33QvXIr0ga4jcFLEsZocvjq2NYrFsMW9gC2RmyKzkgTbUj4t0TRMlLxJW1 +vvY7iOoyZQtdoOTxmrAc7QSpViEGAEozTvzLqLQmCe8XE/4opc2cnxoLNjY9BFv N6jB1oosLiFDsPqF39v1EzlnqhRA57GNjlW7/4q0mRs7QUN5+JXEg4pS+26t4woL 0TaslatGbH5H7Cf5LTPOaBMgrZl6C6gcPV6yQydO0WZn8w9VJb1MNYvy+Ezvz6x1 O7Hhtu3soEo8J6RTfgXCVfhoUO9BvVZ0Qd6oVUKBoaTDJFs0w3yMNtqOUxHwEQyb R6NSYk42EjGxFYZbB6Wkf5CSIqc9ZG0VMwPwFLuk9HlbppTnaQx7xVPOQ5sSQ/YM a/ceavCF/Vl7BhD/0m4PoGaSLBLz0bdl9VDz2OuuiSrgcYS7xltOelwCGmnscCSP xboDS96/w/Zh+iJPEwyfIT0gh82vAoHwO2CEd2Ad8krZfgyz/C+ZmBXwPnHKeKTA 6KK5cFHIiunsSiAeSy16gfXlQrlpl+t6A09oS6NT7WZ9Xyycz6Brqtf8cnAE+qGI mWqMV6/HhUpu1vYa6rKx3PClO2d8tX1EXmrEpjklMLQh3NBIOPYIOCazm+UYnTXx zNH6NRTWFEYhGq5eYgE/IgHB87K8Xx/ZF5wDAnz9E7DEMUjRTkpOVs/MPmon6rsn X6iM+3JnJLVuJIdCEaErjxwkAqzxadvRVewnv1VY2G4FbhzGWCfMeM96AeJUofMk cIGggv/UDYfz26yo7qVVpC62cTKpwa8qYOnUKCNwL9hFUMSrDt7AIjK0VewZYPXa +NYFIeY8ziXNoTxFmZOT+vnd7YCUOSHcjURbMuCZCWoXLbBr7U+cBFRL7KDUVano eUfu4ufKNcjOZ1AiIHloUAk3glGc+J2CaBgUMj5NcwK4M7IeX/wiuIMArf0c0Ed8 dh8/zFLWgPoTraZNomnkpUS9WY5JQkH3SJkzmhjxdAZWx981HrCVZtDKL7YJUGq1 j9+jboOeRoDokg6rzyQKd3nJ9tVBClAZ+rf7saZ/Myd3MZGm4oevuu/lN3twoGET xInBNzjV98fPVrlrMTdsJx7uI3B25vgXPTAtmO2VduU5mOy3ddqxS/qEWnTMIyRw 5NuYxhsKhtQBQJ8GXo4kp97i3fVM9ER+UFe/djOwdi8Bk/2p+moF6dr3veWFDliN oj92k6gWyfRngNn7ijW4hQJVeUmLy7SyNeFLdDsZK2miHMcK41zVftjlnwLYhXVy RcSHFmj+3c+hdSui12kNkVnduS2t1xwNn5Dpr4q0g5YNmOi1NlGfbOZBulUzPYIT PqWzPkVemXzWCp9M8W5CsvALbLn9JXeQdNemsg== ----------------------------------------------------------------------------------------- !!! DANGER !!! DON'T try to change files by yourself, DON'T use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7311A9C26B888B61
-
http://decoder.re/7311A9C26B888B61
Signatures
- Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
- Sodinokibi family
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Modifies Windows Firewall 2 TTPs 1 IoCs
- Executes dropped EXE 1 IoCs
- Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Sets desktop wallpaper using registry 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Drops file in Program Files directory 37 IoCs
- Drops file in Windows directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of WriteProcessMemory 19 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4d6db255a6f3ac059db04ec85c5af708.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4d6db255a6f3ac059db04ec85c5af708.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4d6db255a6f3ac059db04ec85c5af708.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4d6db255a6f3ac059db04ec85c5af708.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\MsMpEng.exe"C:\Windows\MsMpEng.exe"3⤵
- Executes dropped EXE
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall set rule group="Network Discovery" new enable=Yes4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
3977691ln-readme.txt
MsMpEng.exe
mpsvc.dll
memory/2032-11-0x0000000000400000-0x00000000004E1000-memory.dmp
memory/2032-5-0x0000000000400000-0x00000000004E1000-memory.dmp
memory/2032-3-0x0000000000400000-0x00000000004E1000-memory.dmp
memory/2484-15-0x00000000001A0000-0x00000000001C2000-memory.dmp
memory/2484-16-0x00000000001A0000-0x00000000001C2000-memory.dmp
memory/2484-525-0x00000000001A0000-0x00000000001C2000-memory.dmp
memory/2484-544-0x00000000001A0000-0x00000000001C2000-memory.dmp
memory/2484-546-0x0000000074030000-0x00000000740FA000-memory.dmp
memory/2492-10-0x00000000744F0000-0x0000000074BDE000-memory.dmp
memory/2492-0-0x00000000744FE000-0x00000000744FF000-memory.dmp
memory/2492-2-0x0000000004C70000-0x0000000004CFE000-memory.dmp
memory/2492-14-0x00000000744F0000-0x0000000074BDE000-memory.dmp
memory/2492-1-0x0000000000B00000-0x00000000010AC000-memory.dmp