Analysis
-
max time kernel
96s -
max time network
34s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
20-09-2021 12:45
Static task
static1
Behavioral task
behavioral1
Sample
1c63a4fdee1528429886a0de5e89eaa540a058bf27cd378b8d139e045a2f7849.bin.sample.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
1c63a4fdee1528429886a0de5e89eaa540a058bf27cd378b8d139e045a2f7849.bin.sample.exe
Resource
win10-en
General
-
Target
1c63a4fdee1528429886a0de5e89eaa540a058bf27cd378b8d139e045a2f7849.bin.sample.exe
-
Size
79KB
-
MD5
f019a40b28dd58603fa3c5194dae6cba
-
SHA1
08e09a6ef7650f5e7d4bf3fa8850ac4ca762da7d
-
SHA256
1c63a4fdee1528429886a0de5e89eaa540a058bf27cd378b8d139e045a2f7849
-
SHA512
22fba76bbeb356ba97412938ab882768f831273251e25b1078c8a31d720dd14c73e8977054bf24cf40952f143635b205917cc905f371499cbbc639388c3df487
Malware Config
Extracted
C:\1rWCqamCt.README.txt
blackmatter
http://supp24maprinktc7uizgfyqhisx7lkszb6ogh6lwdzpac23w3mh4tvyd.onion/IRCWUUXN0Y4BIFFZW
Signatures
-
BlackMatter Ransomware
BlackMatter ransomware group claims to be Darkside and REvil succesor.
-
Modifies extensions of user files 6 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\ExitFind.crw.1rWCqamCt 1c63a4fdee1528429886a0de5e89eaa540a058bf27cd378b8d139e045a2f7849.bin.sample.exe File renamed C:\Users\Admin\Pictures\ImportDebug.tif => C:\Users\Admin\Pictures\ImportDebug.tif.1rWCqamCt 1c63a4fdee1528429886a0de5e89eaa540a058bf27cd378b8d139e045a2f7849.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\ImportDebug.tif.1rWCqamCt 1c63a4fdee1528429886a0de5e89eaa540a058bf27cd378b8d139e045a2f7849.bin.sample.exe File renamed C:\Users\Admin\Pictures\NewReset.raw => C:\Users\Admin\Pictures\NewReset.raw.1rWCqamCt 1c63a4fdee1528429886a0de5e89eaa540a058bf27cd378b8d139e045a2f7849.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\NewReset.raw.1rWCqamCt 1c63a4fdee1528429886a0de5e89eaa540a058bf27cd378b8d139e045a2f7849.bin.sample.exe File renamed C:\Users\Admin\Pictures\ExitFind.crw => C:\Users\Admin\Pictures\ExitFind.crw.1rWCqamCt 1c63a4fdee1528429886a0de5e89eaa540a058bf27cd378b8d139e045a2f7849.bin.sample.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\1rWCqamCt.bmp" 1c63a4fdee1528429886a0de5e89eaa540a058bf27cd378b8d139e045a2f7849.bin.sample.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\1rWCqamCt.bmp" 1c63a4fdee1528429886a0de5e89eaa540a058bf27cd378b8d139e045a2f7849.bin.sample.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
pid Process 2044 1c63a4fdee1528429886a0de5e89eaa540a058bf27cd378b8d139e045a2f7849.bin.sample.exe 2044 1c63a4fdee1528429886a0de5e89eaa540a058bf27cd378b8d139e045a2f7849.bin.sample.exe 2044 1c63a4fdee1528429886a0de5e89eaa540a058bf27cd378b8d139e045a2f7849.bin.sample.exe 2044 1c63a4fdee1528429886a0de5e89eaa540a058bf27cd378b8d139e045a2f7849.bin.sample.exe 2044 1c63a4fdee1528429886a0de5e89eaa540a058bf27cd378b8d139e045a2f7849.bin.sample.exe 2044 1c63a4fdee1528429886a0de5e89eaa540a058bf27cd378b8d139e045a2f7849.bin.sample.exe -
Modifies Control Panel 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Control Panel\Desktop 1c63a4fdee1528429886a0de5e89eaa540a058bf27cd378b8d139e045a2f7849.bin.sample.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Control Panel\Desktop\WallpaperStyle = "10" 1c63a4fdee1528429886a0de5e89eaa540a058bf27cd378b8d139e045a2f7849.bin.sample.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2044 1c63a4fdee1528429886a0de5e89eaa540a058bf27cd378b8d139e045a2f7849.bin.sample.exe 2044 1c63a4fdee1528429886a0de5e89eaa540a058bf27cd378b8d139e045a2f7849.bin.sample.exe 2044 1c63a4fdee1528429886a0de5e89eaa540a058bf27cd378b8d139e045a2f7849.bin.sample.exe 2044 1c63a4fdee1528429886a0de5e89eaa540a058bf27cd378b8d139e045a2f7849.bin.sample.exe -
Suspicious use of AdjustPrivilegeToken 17 IoCs
description pid Process Token: SeBackupPrivilege 2044 1c63a4fdee1528429886a0de5e89eaa540a058bf27cd378b8d139e045a2f7849.bin.sample.exe Token: SeDebugPrivilege 2044 1c63a4fdee1528429886a0de5e89eaa540a058bf27cd378b8d139e045a2f7849.bin.sample.exe Token: 36 2044 1c63a4fdee1528429886a0de5e89eaa540a058bf27cd378b8d139e045a2f7849.bin.sample.exe Token: SeImpersonatePrivilege 2044 1c63a4fdee1528429886a0de5e89eaa540a058bf27cd378b8d139e045a2f7849.bin.sample.exe Token: SeIncBasePriorityPrivilege 2044 1c63a4fdee1528429886a0de5e89eaa540a058bf27cd378b8d139e045a2f7849.bin.sample.exe Token: SeIncreaseQuotaPrivilege 2044 1c63a4fdee1528429886a0de5e89eaa540a058bf27cd378b8d139e045a2f7849.bin.sample.exe Token: 33 2044 1c63a4fdee1528429886a0de5e89eaa540a058bf27cd378b8d139e045a2f7849.bin.sample.exe Token: SeManageVolumePrivilege 2044 1c63a4fdee1528429886a0de5e89eaa540a058bf27cd378b8d139e045a2f7849.bin.sample.exe Token: SeProfSingleProcessPrivilege 2044 1c63a4fdee1528429886a0de5e89eaa540a058bf27cd378b8d139e045a2f7849.bin.sample.exe Token: SeRestorePrivilege 2044 1c63a4fdee1528429886a0de5e89eaa540a058bf27cd378b8d139e045a2f7849.bin.sample.exe Token: SeSecurityPrivilege 2044 1c63a4fdee1528429886a0de5e89eaa540a058bf27cd378b8d139e045a2f7849.bin.sample.exe Token: SeSystemProfilePrivilege 2044 1c63a4fdee1528429886a0de5e89eaa540a058bf27cd378b8d139e045a2f7849.bin.sample.exe Token: SeTakeOwnershipPrivilege 2044 1c63a4fdee1528429886a0de5e89eaa540a058bf27cd378b8d139e045a2f7849.bin.sample.exe Token: SeShutdownPrivilege 2044 1c63a4fdee1528429886a0de5e89eaa540a058bf27cd378b8d139e045a2f7849.bin.sample.exe Token: SeBackupPrivilege 300 vssvc.exe Token: SeRestorePrivilege 300 vssvc.exe Token: SeAuditPrivilege 300 vssvc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c63a4fdee1528429886a0de5e89eaa540a058bf27cd378b8d139e045a2f7849.bin.sample.exe"C:\Users\Admin\AppData\Local\Temp\1c63a4fdee1528429886a0de5e89eaa540a058bf27cd378b8d139e045a2f7849.bin.sample.exe"1⤵
- Modifies extensions of user files
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2044
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:300