Analysis
-
max time kernel
92s -
max time network
20s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
12-08-2021 19:55
Static task
static1
Behavioral task
behavioral1
Sample
w1i488c2sdfmss6.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
w1i488c2sdfmss6.exe
Resource
win10v20210410
General
-
Target
w1i488c2sdfmss6.exe
-
Size
71KB
-
MD5
10aa058a3ac49e016cad7987b8e09886
-
SHA1
cca6682330a819592c3b1ea0448ceb4e141593dc
-
SHA256
6d4712df42ad0982041ef0e2e109ab5718b43830f2966bd9207a7fac3af883db
-
SHA512
f115fb62b1ca5e18f6340d42ff4393e2b175917312ae1cc14e7a6a9322cf8adaf22457bc8213e2baafdc2cb19d5db1e5a9c003155cbf142d5a08604495e22f6e
Malware Config
Extracted
C:\tgln8vJnC.README.txt
blackmatter
http://supp24maprinktc7uizgfyqhisx7lkszb6ogh6lwdzpac23w3mh4tvyd.onion/OYPF561W4U8HVA0NLVCKJCZB
Signatures
-
BlackMatter Ransomware
BlackMatter ransomware group claims to be Darkside and REvil succesor.
-
Modifies extensions of user files 14 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\SaveDebug.raw => C:\Users\Admin\Pictures\SaveDebug.raw.tgln8vJnC w1i488c2sdfmss6.exe File opened for modification C:\Users\Admin\Pictures\GetTrace.png.tgln8vJnC w1i488c2sdfmss6.exe File renamed C:\Users\Admin\Pictures\MoveUnpublish.png => C:\Users\Admin\Pictures\MoveUnpublish.png.tgln8vJnC w1i488c2sdfmss6.exe File opened for modification C:\Users\Admin\Pictures\MoveUnpublish.png.tgln8vJnC w1i488c2sdfmss6.exe File opened for modification C:\Users\Admin\Pictures\RepairRemove.tif.tgln8vJnC w1i488c2sdfmss6.exe File renamed C:\Users\Admin\Pictures\SubmitClose.tif => C:\Users\Admin\Pictures\SubmitClose.tif.tgln8vJnC w1i488c2sdfmss6.exe File opened for modification C:\Users\Admin\Pictures\UninstallCompress.crw.tgln8vJnC w1i488c2sdfmss6.exe File renamed C:\Users\Admin\Pictures\GetTrace.png => C:\Users\Admin\Pictures\GetTrace.png.tgln8vJnC w1i488c2sdfmss6.exe File opened for modification C:\Users\Admin\Pictures\SubmitClose.tif.tgln8vJnC w1i488c2sdfmss6.exe File renamed C:\Users\Admin\Pictures\WriteStop.tif => C:\Users\Admin\Pictures\WriteStop.tif.tgln8vJnC w1i488c2sdfmss6.exe File opened for modification C:\Users\Admin\Pictures\WriteStop.tif.tgln8vJnC w1i488c2sdfmss6.exe File renamed C:\Users\Admin\Pictures\RepairRemove.tif => C:\Users\Admin\Pictures\RepairRemove.tif.tgln8vJnC w1i488c2sdfmss6.exe File renamed C:\Users\Admin\Pictures\UninstallCompress.crw => C:\Users\Admin\Pictures\UninstallCompress.crw.tgln8vJnC w1i488c2sdfmss6.exe File opened for modification C:\Users\Admin\Pictures\SaveDebug.raw.tgln8vJnC w1i488c2sdfmss6.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\system32\spool\PRINTERS\00002.SPL splwow64.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\tgln8vJnC.bmp" w1i488c2sdfmss6.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\tgln8vJnC.bmp" w1i488c2sdfmss6.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
pid Process 1040 w1i488c2sdfmss6.exe 1040 w1i488c2sdfmss6.exe 1040 w1i488c2sdfmss6.exe 1040 w1i488c2sdfmss6.exe 1040 w1i488c2sdfmss6.exe 1040 w1i488c2sdfmss6.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies Control Panel 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Control Panel\Desktop w1i488c2sdfmss6.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Control Panel\Desktop\WallpaperStyle = "10" w1i488c2sdfmss6.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Control Panel\International w1i488c2sdfmss6.exe -
Modifies registry class 31 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff splwow64.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" splwow64.exe Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff splwow64.exe Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\Sort = 000000000000000000000000000000000200000030f125b7ef471a10a5f102608c9eebac0a0000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff splwow64.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC} splwow64.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\LogicalViewMode = "1" splwow64.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU splwow64.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 splwow64.exe Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff splwow64.exe Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 splwow64.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\FFlags = "1" splwow64.exe Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f4225481e03947bc34db131e946b44c8dd50000 splwow64.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 splwow64.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 splwow64.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_TopViewVersion = "0" splwow64.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg splwow64.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\Mode = "4" splwow64.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders splwow64.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg splwow64.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\IconSize = "16" splwow64.exe Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 splwow64.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_Classes\Local Settings splwow64.exe Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots splwow64.exe Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 9e0000001a00eebbfe23000010007db10d7bd29c934a973346cc89022e7c00002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020002a0000000000efbe7e47b3fbe4c93b4ba2bad3f5d3cd46f98207ba827a5b6945b5d7ec83085f08cc20002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020000000 splwow64.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_TopViewID = "{82BA0782-5B7A-4569-B5D7-EC83085F08CC}" splwow64.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell splwow64.exe Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff splwow64.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags splwow64.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\FFlags = "1092616257" splwow64.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_FolderType = "{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}" splwow64.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9} splwow64.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 1348 NOTEPAD.EXE -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1040 w1i488c2sdfmss6.exe 1040 w1i488c2sdfmss6.exe 1040 w1i488c2sdfmss6.exe 1040 w1i488c2sdfmss6.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1708 splwow64.exe -
Suspicious use of AdjustPrivilegeToken 17 IoCs
description pid Process Token: SeBackupPrivilege 1040 w1i488c2sdfmss6.exe Token: SeDebugPrivilege 1040 w1i488c2sdfmss6.exe Token: 36 1040 w1i488c2sdfmss6.exe Token: SeImpersonatePrivilege 1040 w1i488c2sdfmss6.exe Token: SeIncBasePriorityPrivilege 1040 w1i488c2sdfmss6.exe Token: SeIncreaseQuotaPrivilege 1040 w1i488c2sdfmss6.exe Token: 33 1040 w1i488c2sdfmss6.exe Token: SeManageVolumePrivilege 1040 w1i488c2sdfmss6.exe Token: SeProfSingleProcessPrivilege 1040 w1i488c2sdfmss6.exe Token: SeRestorePrivilege 1040 w1i488c2sdfmss6.exe Token: SeSecurityPrivilege 1040 w1i488c2sdfmss6.exe Token: SeSystemProfilePrivilege 1040 w1i488c2sdfmss6.exe Token: SeTakeOwnershipPrivilege 1040 w1i488c2sdfmss6.exe Token: SeShutdownPrivilege 1040 w1i488c2sdfmss6.exe Token: SeBackupPrivilege 432 vssvc.exe Token: SeRestorePrivilege 432 vssvc.exe Token: SeAuditPrivilege 432 vssvc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1708 splwow64.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1040 wrote to memory of 1348 1040 w1i488c2sdfmss6.exe 35 PID 1040 wrote to memory of 1348 1040 w1i488c2sdfmss6.exe 35 PID 1040 wrote to memory of 1348 1040 w1i488c2sdfmss6.exe 35 PID 1040 wrote to memory of 1348 1040 w1i488c2sdfmss6.exe 35 PID 1348 wrote to memory of 1708 1348 NOTEPAD.EXE 36 PID 1348 wrote to memory of 1708 1348 NOTEPAD.EXE 36 PID 1348 wrote to memory of 1708 1348 NOTEPAD.EXE 36 PID 1348 wrote to memory of 1708 1348 NOTEPAD.EXE 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\w1i488c2sdfmss6.exe"C:\Users\Admin\AppData\Local\Temp\w1i488c2sdfmss6.exe"1⤵
- Modifies extensions of user files
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" /p C:\tgln8vJnC.README.txt2⤵
- Opens file in notepad (likely ransom note)
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1708
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:432