Analysis
- max time kernel
106s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
07/01/2025, 04:25
General
- Target JaffaCakes118_4d6db255a6f3ac059db04ec85c5af708.exe
- Size 5.6MB
- Sample250107-e2eraswmcl
- SHA256 19889563a01396e02d971bac3be7194500fc09b8b4409cec21affd1f6a11741c
Malware Config
Extracted
-
sodinokibi
-
$2a$12$prOX/4eKl8zrpGSC5lnHPecevs5NOckOUW5r3s4JJYDnZZSghvBkq
-
8254
-
boisehosting.net
-
fotoideaymedia.es
-
dubnew.com
-
stallbyggen.se
-
koken-voor-baby.nl
-
juneauopioidworkgroup.org
-
vancouver-print.ca
-
zewatchers.com
-
bouquet-de-roses.com
-
seevilla-dr-sturm.at
-
olejack.ru
-
i-trust.dk
-
wasmachtmeinfonds.at
-
appsformacpc.com
-
friendsandbrgrs.com
-
thenewrejuveme.com
-
xn--singlebrsen-vergleich-nec.com
-
sabel-bf.com
-
seminoc.com
-
ceres.org.au
-
net
false
-
pid
$2a$12$prOX/4eKl8zrpGSC5lnHPecevs5NOckOUW5r3s4JJYDnZZSghvBkq
-
prc
encsvc
powerpnt
ocssd
steam
isqlplussvc
outlook
sql
ocomm
agntsvc
mspub
onenote
winword
thebat
excel
mydesktopqos
ocautoupds
thunderbird
synctime
infopath
mydesktopservice
firefox
oracle
sqbcoreservice
dbeng50
tbirdconfig
msaccess
visio
dbsnmp
wordpad
xfssvccon
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [-] Whats HapPen? [-] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DON'T try to change files by yourself, DON'T use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
8254
-
svc
veeam
memtas
sql
backup
vss
sophos
svc$
mepocs
Extracted
-
C:\Users\831l1864-readme.txt
- ---=== Welcome. Again. ===--- [-] Whats HapPen? [-] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 831l1864. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/ABDE0477481B7585 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/ABDE0477481B7585 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: vTjj6zDj0orYN42R5jBQ4GkGG2pmmEaB3EOW6Rr1teL/EoLTYK+/v20hmh61h14B Cp/O9Mclg9LHCkkBorhYKgE3kodCqwZp5KDiTsIDQbvyAfZ8fueoHqmVPB3wMOP4 WC1F4jzREHIR8+ok5Q6mRZ0UTqq/Gq487JhJpYjKoPWldYtYxKcEi+lWGWABwU4A xD+qx/ilnzuBGPPFLHAVBROmHL65LUfLU3NE8G/igANPgPJvXK4KFMSYmjqqjhUT 05od0pBMZmQ8T1cnaZh3hGEELHYBw42QoNtACSr+JPzSLabS0/hTcVmL4VfHabIT rDjrZMhD4vdCHi48ctwOnjl96IGng/osBe7IzM3fOH4M4DvbfNeMUd7Moj3FGKCY TL0wSEq4DLf98Kce81vbfZ+msGpmW+1QOQaEvkvBY6ygWOed2Wvt6dqiTxkHxRJA egkA8lLOzyW1yzvBfyu2PnmhO+THtJcE//4VFrrCXA+IEfXS0WhRUiW/hbARzxTH yfwJTCVnXeFuMRmVXAxTauvuFAQdf2DcpR2LWH7CRRzYPoctNSCHYVbJ0RSWUrSa iYdv0GOUX8LTotfKWbsbhwN9DZ2lTHhVcdQUnF72QexUEoVElU0MlHXQc/06/tP6 Ue603KgJ9DMKcxYAdMYIyLxuih0ed37qFa/Su81TwOEuQcaHGTOr+G8b+H302jwF CpEgV/MIsZwSchlmJjkxOiVkbwhW1/HjTDCBvcWnKP7Skg4OTOYTgU8fDkO0DSsT Wd1pGn/bBmWdHwDdt8hBcertVC/ArCwb2uCIjPQ6hyS9sgfMhikytbifbxLzhm0u 94bMIVMcCV8O9Mj3tzYy9003w87djVY0VRAUije+M6pV7WLxtdx8T3RkS9EP0W5Y Fuvq+lQmCPm8mS4sgyRdVJVsaLBfbNd1lwHlmMB9NwA/CH+dIPH2cRTsw1qXff72 NRyETYT1tWkUmd0SA64B0Wch4XKm6+4FeGfN/RuPBjBaMXKNFRJzs3/YOjdnprDc +LEBEoIYjTCyi6PzNJMT7l+yb19p6h5dmc4mcLkYlmF03xI57LgY+p6WqxPmA3FT H8C6vgFGrCoNHrsSZ/exganKIaHf1rA+RdyNp57Wi7XEIYvKTNCG3RJXPbsF/hx8 EQmff6oBZG22Nmbp9BQNd1Fa9r6Ee2AmPYHCXnJ7grgEbeiS+/VqfW+U5ix1hZHk 8tSKNlHlh4uiS7DOhvLGRmt5xkPt8VnvIN+Sh0M4pdz/TJ+eknkhufxZBelgi/Bp nzGx8fzkDL1+d1xv0lP7iTgUOxptIzpp1ZAq/ne+X10ovTKgtdxymzUd0JEUtLFQ f/7Ro6Cq/JBgbvUzEI+RIbUsNEq/ASl2dO2UiVYIejU= ----------------------------------------------------------------------------------------- !!! DANGER !!! DON'T try to change files by yourself, DON'T use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/ABDE0477481B7585
-
http://decoder.re/ABDE0477481B7585
Signatures
- Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
- Sodinokibi family
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Modifies Windows Firewall 2 TTPs 1 IoCs
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Sets desktop wallpaper using registry 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Drops file in Program Files directory 26 IoCs
- Drops file in Windows directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of WriteProcessMemory 16 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4d6db255a6f3ac059db04ec85c5af708.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4d6db255a6f3ac059db04ec85c5af708.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4d6db255a6f3ac059db04ec85c5af708.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4d6db255a6f3ac059db04ec85c5af708.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\MsMpEng.exe"C:\Windows\MsMpEng.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall set rule group="Network Discovery" new enable=Yes4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
831l1864-readme.txt
MsMpEng.exe
mpsvc.dll
memory/1124-5-0x0000000000400000-0x00000000004E1000-memory.dmp
memory/1124-6-0x0000000000400000-0x00000000004E1000-memory.dmp
memory/1124-4-0x0000000000400000-0x00000000004E1000-memory.dmp
memory/1124-15-0x0000000000400000-0x00000000004E1000-memory.dmp
memory/2240-19-0x0000000001EC0000-0x0000000001EE2000-memory.dmp
memory/2240-17-0x0000000001EC0000-0x0000000001EE2000-memory.dmp
memory/2240-38-0x0000000001EC0000-0x0000000001EE2000-memory.dmp
memory/2240-408-0x0000000001EC0000-0x0000000001EE2000-memory.dmp
memory/2240-414-0x0000000001EC0000-0x0000000001EE2000-memory.dmp
memory/2240-431-0x0000000001EC0000-0x0000000001EE2000-memory.dmp
memory/4448-18-0x00000000743F0000-0x0000000074BA0000-memory.dmp
memory/4448-16-0x00000000743F0000-0x0000000074BA0000-memory.dmp
memory/4448-2-0x00000000052A0000-0x000000000532E000-memory.dmp
memory/4448-0-0x00000000743FE000-0x00000000743FF000-memory.dmp
memory/4448-3-0x00000000058E0000-0x0000000005E84000-memory.dmp
memory/4448-1-0x0000000000520000-0x0000000000ACC000-memory.dmp