Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
03-08-2021 14:23
Static task
static1
Behavioral task
behavioral1
Sample
6155637f8b98426258f5d4321bce4104df56c7771967813d61362c2118632a7b.ps1
Resource
win7v20210408
Behavioral task
behavioral2
Sample
6155637f8b98426258f5d4321bce4104df56c7771967813d61362c2118632a7b.ps1
Resource
win10v20210410
General
-
Target
6155637f8b98426258f5d4321bce4104df56c7771967813d61362c2118632a7b.ps1
-
Size
887KB
-
MD5
66d8f3d21088cea87dd99f37efb92795
-
SHA1
ba7cad1cbb5204ac8d2ddb3d399738657f08e209
-
SHA256
6155637f8b98426258f5d4321bce4104df56c7771967813d61362c2118632a7b
-
SHA512
df0cd4d9a9c3337aed6a62bce14ddb3c6001e215ab956f7f0e98d9a9c7ae69ec24fc2aff48cc5899312f8473f397f9d9bcf554b5b9ef626a8c95f257f5f23554
Malware Config
Extracted
C:\oSPvdHTvI.README.txt
blackmatter
http://supp24yy6a66hwszu2piygicgwzdtbwftb76htfj7vnip3getgqnzxid.onion/GDBJS76DH3D4IKQD2QO7R
Signatures
-
BlackMatter Ransomware
BlackMatter ransomware group claims to be Darkside and REvil succesor.
-
Blocklisted process makes network request 10 IoCs
flow pid Process 16 1224 powershell.exe 17 1224 powershell.exe 19 1224 powershell.exe 21 1224 powershell.exe 23 1224 powershell.exe 25 1224 powershell.exe 27 1224 powershell.exe 28 1224 powershell.exe 29 1224 powershell.exe 30 1224 powershell.exe -
Modifies extensions of user files 6 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\DisableMerge.png => C:\Users\Admin\Pictures\DisableMerge.png.oSPvdHTvI powershell.exe File opened for modification C:\Users\Admin\Pictures\DisableMerge.png.oSPvdHTvI powershell.exe File renamed C:\Users\Admin\Pictures\ImportDismount.crw => C:\Users\Admin\Pictures\ImportDismount.crw.oSPvdHTvI powershell.exe File opened for modification C:\Users\Admin\Pictures\ImportDismount.crw.oSPvdHTvI powershell.exe File renamed C:\Users\Admin\Pictures\ReceiveUnregister.crw => C:\Users\Admin\Pictures\ReceiveUnregister.crw.oSPvdHTvI powershell.exe File opened for modification C:\Users\Admin\Pictures\ReceiveUnregister.crw.oSPvdHTvI powershell.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: powershell.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\oSPvdHTvI.bmp" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\oSPvdHTvI.bmp" powershell.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 1224 powershell.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3968 powershell.exe 3968 powershell.exe 3968 powershell.exe 1224 powershell.exe 1224 powershell.exe 1224 powershell.exe 1224 powershell.exe 1224 powershell.exe 1224 powershell.exe 1224 powershell.exe -
Suspicious use of AdjustPrivilegeToken 19 IoCs
description pid Process Token: SeDebugPrivilege 3968 powershell.exe Token: SeDebugPrivilege 1224 powershell.exe Token: SeBackupPrivilege 1224 powershell.exe Token: SeDebugPrivilege 1224 powershell.exe Token: 36 1224 powershell.exe Token: SeImpersonatePrivilege 1224 powershell.exe Token: SeIncBasePriorityPrivilege 1224 powershell.exe Token: SeIncreaseQuotaPrivilege 1224 powershell.exe Token: 33 1224 powershell.exe Token: SeManageVolumePrivilege 1224 powershell.exe Token: SeProfSingleProcessPrivilege 1224 powershell.exe Token: SeRestorePrivilege 1224 powershell.exe Token: SeSecurityPrivilege 1224 powershell.exe Token: SeSystemProfilePrivilege 1224 powershell.exe Token: SeTakeOwnershipPrivilege 1224 powershell.exe Token: SeShutdownPrivilege 1224 powershell.exe Token: SeBackupPrivilege 640 vssvc.exe Token: SeRestorePrivilege 640 vssvc.exe Token: SeAuditPrivilege 640 vssvc.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3968 wrote to memory of 1224 3968 powershell.exe 79 PID 3968 wrote to memory of 1224 3968 powershell.exe 79 PID 3968 wrote to memory of 1224 3968 powershell.exe 79
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\6155637f8b98426258f5d4321bce4104df56c7771967813d61362c2118632a7b.ps11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -ex bypass -NonI C:\Users\Admin\AppData\Local\Temp\6155637f8b98426258f5d4321bce4104df56c7771967813d61362c2118632a7b.ps12⤵
- Blocklisted process makes network request
- Modifies extensions of user files
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1224
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:640