Analysis
-
max time kernel
75s -
max time network
148s -
platform
windows10_x64 -
resource
win10-en -
submitted
14/09/2021, 04:28
Static task
static1
Behavioral task
behavioral1
Sample
0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4.exe
Resource
win10-en
windows10_x64
0 signatures
0 seconds
General
-
Target
0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4.exe
-
Size
79KB
-
MD5
900b7b852674521b306bb03eb991b94a
-
SHA1
ed5b159b94ed5977efc1f3e05490545d7cb6a93e
-
SHA256
0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4
-
SHA512
04db23845665c6152a965d8401502588d09f6a4d30f83797cd772c179db8e445463ec5988e381d3a83789d4f20cd0378631e90560040f44a4b0b6634f373a093
Score
10/10
Malware Config
Extracted
Path
C:\fViGXl6GW.README.txt
Family
blackmatter
Ransom Note
~+
* +
' BLACK |
() .-.,='``'=. - o -
'=/_ \ |
* | '=._ |
\ `=./`, '
. '=.__.=' `=' *
+ Matter +
O * ' .
>>> What happens?
Your network is encrypted, and currently not operational.
We need only money, after payment we will give you a decryptor for the entire network and you will restore all the data.
>>> What data stolen?
From your network was stolen sensitive data.
If you do not contact us we will publish all your data in our blog and will send it to the biggest mass media.
>>> What guarantees?
We are not a politically motivated group and we do not need anything other than your money.
If you pay, we will provide you the programs for decryption and we will delete your data.
If we do not give you decrypters or we do not delete your data, no one will pay us in the future, this does not comply with our goals.
We always keep our promises.
>> How to contact with us?
1. Download and install TOR Browser (https://www.torproject.org/).
2. Open http://supp24yy6a66hwszu2piygicgwzdtbwftb76htfj7vnip3getgqnzxid.onion/D4MX4VGFCMO7MFQ6P
>> Warning! Recovery recommendations.
We strongly recommend you to do not MODIFY or REPAIR your files, that will damage them.
URLs
http://supp24yy6a66hwszu2piygicgwzdtbwftb76htfj7vnip3getgqnzxid.onion/D4MX4VGFCMO7MFQ6P
Signatures
-
BlackMatter Ransomware
BlackMatter ransomware group claims to be Darkside and REvil succesor.
-
Modifies extensions of user files 32 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\ConnectRemove.tiff.fViGXl6GW 0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4.exe File opened for modification C:\Users\Admin\Pictures\RestoreRepair.tiff 0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4.exe File renamed C:\Users\Admin\Pictures\CheckpointResolve.crw => C:\Users\Admin\Pictures\CheckpointResolve.crw.fViGXl6GW 0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4.exe File renamed C:\Users\Admin\Pictures\ConnectRemove.tiff => C:\Users\Admin\Pictures\ConnectRemove.tiff.fViGXl6GW 0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4.exe File opened for modification C:\Users\Admin\Pictures\DenyEnable.raw.fViGXl6GW 0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4.exe File opened for modification C:\Users\Admin\Pictures\MeasureRevoke.tiff 0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4.exe File renamed C:\Users\Admin\Pictures\SendPublish.png => C:\Users\Admin\Pictures\SendPublish.png.fViGXl6GW 0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4.exe File opened for modification C:\Users\Admin\Pictures\UnregisterUninstall.tiff 0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4.exe File renamed C:\Users\Admin\Pictures\CompressUnpublish.raw => C:\Users\Admin\Pictures\CompressUnpublish.raw.fViGXl6GW 0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4.exe File opened for modification C:\Users\Admin\Pictures\GrantNew.tiff.fViGXl6GW 0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4.exe File renamed C:\Users\Admin\Pictures\MeasureRevoke.tiff => C:\Users\Admin\Pictures\MeasureRevoke.tiff.fViGXl6GW 0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4.exe File opened for modification C:\Users\Admin\Pictures\PublishRename.tiff 0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4.exe File opened for modification C:\Users\Admin\Pictures\UnregisterUninstall.tiff.fViGXl6GW 0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4.exe File opened for modification C:\Users\Admin\Pictures\CheckpointResolve.crw.fViGXl6GW 0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4.exe File renamed C:\Users\Admin\Pictures\DenyEnable.raw => C:\Users\Admin\Pictures\DenyEnable.raw.fViGXl6GW 0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4.exe File opened for modification C:\Users\Admin\Pictures\RestoreRepair.tiff.fViGXl6GW 0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4.exe File renamed C:\Users\Admin\Pictures\TraceConnect.tif => C:\Users\Admin\Pictures\TraceConnect.tif.fViGXl6GW 0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4.exe File opened for modification C:\Users\Admin\Pictures\ConnectRemove.tiff 0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4.exe File renamed C:\Users\Admin\Pictures\RestoreRepair.tiff => C:\Users\Admin\Pictures\RestoreRepair.tiff.fViGXl6GW 0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4.exe File opened for modification C:\Users\Admin\Pictures\SendPublish.png.fViGXl6GW 0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4.exe File opened for modification C:\Users\Admin\Pictures\CompressUnpublish.raw.fViGXl6GW 0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4.exe File opened for modification C:\Users\Admin\Pictures\PublishRename.tiff.fViGXl6GW 0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4.exe File renamed C:\Users\Admin\Pictures\RevokeRestart.png => C:\Users\Admin\Pictures\RevokeRestart.png.fViGXl6GW 0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4.exe File opened for modification C:\Users\Admin\Pictures\RevokeRestart.png.fViGXl6GW 0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4.exe File opened for modification C:\Users\Admin\Pictures\MeasureRevoke.tiff.fViGXl6GW 0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4.exe File renamed C:\Users\Admin\Pictures\PublishRename.tiff => C:\Users\Admin\Pictures\PublishRename.tiff.fViGXl6GW 0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4.exe File renamed C:\Users\Admin\Pictures\UnregisterUninstall.tiff => C:\Users\Admin\Pictures\UnregisterUninstall.tiff.fViGXl6GW 0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4.exe File opened for modification C:\Users\Admin\Pictures\TraceConnect.tif.fViGXl6GW 0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4.exe File opened for modification C:\Users\Admin\Pictures\GrantNew.tiff 0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4.exe File renamed C:\Users\Admin\Pictures\GrantNew.tiff => C:\Users\Admin\Pictures\GrantNew.tiff.fViGXl6GW 0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4.exe File renamed C:\Users\Admin\Pictures\RedoReset.png => C:\Users\Admin\Pictures\RedoReset.png.fViGXl6GW 0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4.exe File opened for modification C:\Users\Admin\Pictures\RedoReset.png.fViGXl6GW 0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: 0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\fViGXl6GW.bmp" 0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\fViGXl6GW.bmp" 0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
pid Process 2248 0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4.exe 2248 0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4.exe 2248 0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4.exe 2248 0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4.exe 2248 0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4.exe 2248 0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4.exe -
Modifies Control Panel 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Control Panel\International 0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Control Panel\Desktop 0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Control Panel\Desktop\WallpaperStyle = "10" 0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2248 0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4.exe 2248 0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4.exe 2248 0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4.exe 2248 0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4.exe -
Suspicious use of AdjustPrivilegeToken 17 IoCs
description pid Process Token: SeBackupPrivilege 2248 0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4.exe Token: SeDebugPrivilege 2248 0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4.exe Token: 36 2248 0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4.exe Token: SeImpersonatePrivilege 2248 0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4.exe Token: SeIncBasePriorityPrivilege 2248 0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4.exe Token: SeIncreaseQuotaPrivilege 2248 0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4.exe Token: 33 2248 0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4.exe Token: SeManageVolumePrivilege 2248 0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4.exe Token: SeProfSingleProcessPrivilege 2248 0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4.exe Token: SeRestorePrivilege 2248 0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4.exe Token: SeSecurityPrivilege 2248 0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4.exe Token: SeSystemProfilePrivilege 2248 0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4.exe Token: SeTakeOwnershipPrivilege 2248 0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4.exe Token: SeShutdownPrivilege 2248 0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4.exe Token: SeBackupPrivilege 3808 vssvc.exe Token: SeRestorePrivilege 3808 vssvc.exe Token: SeAuditPrivilege 3808 vssvc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4.exe"C:\Users\Admin\AppData\Local\Temp\0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4.exe"1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2248
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3808