Analysis
-
max time kernel
149s -
max time network
45s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
17-08-2021 17:09
Static task
static1
Behavioral task
behavioral1
Sample
1 (2).exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
1 (2).exe
Resource
win10v20210410
General
-
Target
1 (2).exe
-
Size
79KB
-
MD5
f1c260c31b9d3f9ff54a142d508ec602
-
SHA1
6b25c80e8b2dca94ea6b6a95745a496ec0bcabd3
-
SHA256
2466fca0e29b06c78ffa8a44193fb58c30e6bec4e54bbef8e6622349b95cce4c
-
SHA512
9412a185d008ded02e2061cd4e998222071923f6260ecdcc9a3f1969ea2aa89a9493866e13450d82b8ab390ec78b24d7ba82a6e2618d11cf27d67f43a7d39d6a
Malware Config
Extracted
C:\tgln8vJnC.README.txt
blackmatter
https://prnt.sc/1o6e5a2
https://prnt.sc/1o6ei7g
https://prnt.sc/1o6exr8
https://prnt.sc/1o6fbxu
https://prnt.sc/1o6fvkn
http://supp24yy6a66hwszu2piygicgwzdtbwftb76htfj7vnip3getgqnzxid.onion/EBVCVJNCPM6A3NKJ
Signatures
-
BlackMatter Ransomware
BlackMatter ransomware group claims to be Darkside and REvil succesor.
-
Modifies extensions of user files 6 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
1 (2).exedescription ioc process File opened for modification C:\Users\Admin\Pictures\ProtectNew.crw.tgln8vJnC 1 (2).exe File renamed C:\Users\Admin\Pictures\StepCompare.png => C:\Users\Admin\Pictures\StepCompare.png.tgln8vJnC 1 (2).exe File opened for modification C:\Users\Admin\Pictures\StepCompare.png.tgln8vJnC 1 (2).exe File renamed C:\Users\Admin\Pictures\InitializeExport.raw => C:\Users\Admin\Pictures\InitializeExport.raw.tgln8vJnC 1 (2).exe File opened for modification C:\Users\Admin\Pictures\InitializeExport.raw.tgln8vJnC 1 (2).exe File renamed C:\Users\Admin\Pictures\ProtectNew.crw => C:\Users\Admin\Pictures\ProtectNew.crw.tgln8vJnC 1 (2).exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
Processes:
1 (2).exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\tgln8vJnC.bmp" 1 (2).exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\tgln8vJnC.bmp" 1 (2).exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
Processes:
1 (2).exepid process 1856 1 (2).exe 1856 1 (2).exe 1856 1 (2).exe 1856 1 (2).exe 1856 1 (2).exe 1856 1 (2).exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies Control Panel 3 IoCs
Processes:
1 (2).exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Control Panel\International 1 (2).exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Control Panel\Desktop 1 (2).exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Control Panel\Desktop\WallpaperStyle = "10" 1 (2).exe -
Modifies registry class 20 IoCs
Processes:
splwow64.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg splwow64.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 splwow64.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_FolderType = "{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}" splwow64.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_TopViewID = "{82BA0782-5B7A-4569-B5D7-EC83085F08CC}" splwow64.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell splwow64.exe Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f4225481e03947bc34db131e946b44c8dd50000 splwow64.exe Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 splwow64.exe Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff splwow64.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 splwow64.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_TopViewVersion = "0" splwow64.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" splwow64.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags splwow64.exe Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots splwow64.exe Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff splwow64.exe Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff splwow64.exe Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff splwow64.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_Classes\Local Settings splwow64.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU splwow64.exe Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 9e0000001a00eebbfe23000010007db10d7bd29c934a973346cc89022e7c00002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020002a0000000000efbe7e47b3fbe4c93b4ba2bad3f5d3cd46f98207ba827a5b6945b5d7ec83085f08cc20002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020000000 splwow64.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 splwow64.exe -
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
NOTEPAD.EXEpid process 872 NOTEPAD.EXE -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
1 (2).exepid process 1856 1 (2).exe 1856 1 (2).exe 1856 1 (2).exe 1856 1 (2).exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
splwow64.exepid process 944 splwow64.exe -
Suspicious use of AdjustPrivilegeToken 17 IoCs
Processes:
1 (2).exevssvc.exedescription pid process Token: SeBackupPrivilege 1856 1 (2).exe Token: SeDebugPrivilege 1856 1 (2).exe Token: 36 1856 1 (2).exe Token: SeImpersonatePrivilege 1856 1 (2).exe Token: SeIncBasePriorityPrivilege 1856 1 (2).exe Token: SeIncreaseQuotaPrivilege 1856 1 (2).exe Token: 33 1856 1 (2).exe Token: SeManageVolumePrivilege 1856 1 (2).exe Token: SeProfSingleProcessPrivilege 1856 1 (2).exe Token: SeRestorePrivilege 1856 1 (2).exe Token: SeSecurityPrivilege 1856 1 (2).exe Token: SeSystemProfilePrivilege 1856 1 (2).exe Token: SeTakeOwnershipPrivilege 1856 1 (2).exe Token: SeShutdownPrivilege 1856 1 (2).exe Token: SeBackupPrivilege 888 vssvc.exe Token: SeRestorePrivilege 888 vssvc.exe Token: SeAuditPrivilege 888 vssvc.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
splwow64.exepid process 944 splwow64.exe 944 splwow64.exe 944 splwow64.exe 944 splwow64.exe 944 splwow64.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
1 (2).exeNOTEPAD.EXEdescription pid process target process PID 1856 wrote to memory of 872 1856 1 (2).exe NOTEPAD.EXE PID 1856 wrote to memory of 872 1856 1 (2).exe NOTEPAD.EXE PID 1856 wrote to memory of 872 1856 1 (2).exe NOTEPAD.EXE PID 1856 wrote to memory of 872 1856 1 (2).exe NOTEPAD.EXE PID 872 wrote to memory of 944 872 NOTEPAD.EXE splwow64.exe PID 872 wrote to memory of 944 872 NOTEPAD.EXE splwow64.exe PID 872 wrote to memory of 944 872 NOTEPAD.EXE splwow64.exe PID 872 wrote to memory of 944 872 NOTEPAD.EXE splwow64.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1 (2).exe"C:\Users\Admin\AppData\Local\Temp\1 (2).exe"1⤵
- Modifies extensions of user files
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" /p C:\tgln8vJnC.README.txt2⤵
- Opens file in notepad (likely ransom note)
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Documents\SwitchOut.xps.tgln8vJnCMD5
a6093c068b8590eb37e0d805cf2fdc10
SHA11e97e9215bea394b8084992f17de5be4cc7d44b9
SHA256de9c97279ca0ad2c3f0d0a131bfdef119578e1ae5b73eb314a9ef371f6889d12
SHA5122d52d2a4fcdc72c5907a18174fe4eb1aaa9454c352f11118215f3662673c3c43fe53f125548da8965bd844f8894261fbdf123207e8a86c7184094ca08874993e
-
C:\tgln8vJnC.README.txtMD5
b920836834910a56ea82efc009b2d4ce
SHA1a5d1b656b5ab0ab51357afe4c68619f706a9a7c2
SHA256d6af899e20548251735c7a379d4d6067b16c4d8b42d8c5c2960576d1890058cc
SHA512e914574fe9d28e0e90eb9ba49f085c39f8c65a458778251845ccd5b5a6a1e30d35b181a6e70c8844de0552a9e010a6b43c3f7b0472eb8e6db1a2507fc8cd01e7
-
memory/872-63-0x0000000000000000-mapping.dmp
-
memory/944-66-0x0000000000000000-mapping.dmp
-
memory/944-67-0x000007FEFBD21000-0x000007FEFBD23000-memory.dmpFilesize
8KB
-
memory/944-69-0x00000000042E0000-0x00000000042E1000-memory.dmpFilesize
4KB
-
memory/1856-59-0x0000000075FE1000-0x0000000075FE3000-memory.dmpFilesize
8KB
-
memory/1856-62-0x0000000001E46000-0x0000000001E47000-memory.dmpFilesize
4KB
-
memory/1856-61-0x0000000001E30000-0x0000000001E31000-memory.dmpFilesize
4KB
-
memory/1856-60-0x0000000001E35000-0x0000000001E46000-memory.dmpFilesize
68KB