Analysis
-
max time kernel
148s -
max time network
133s -
platform
windows7_x64 -
resource
win7-en-20210916 -
submitted
20-09-2021 12:44
General
-
Target
cb5a89a31a97f8d815776ff43f22f4fec00b32aae4f580080c7300875d991163.bin.sample.exe
-
Size
79KB
-
MD5
18b2fb7ecd32c80dc111eabfd58fc575
-
SHA1
d91e95182e554b7eb39b20c7876b610c15bcac1a
-
SHA256
cb5a89a31a97f8d815776ff43f22f4fec00b32aae4f580080c7300875d991163
-
SHA512
44b43b8409de6a5827cb789261518c6d916c244599ea42e6b04965e4da8e5463e2bd70f80a444a2dfc5fd6b459f52c5023b2fd080aa8fbb1eea8f6d521071ad3
Score
10/10
Malware Config
Extracted
Path
C:\SykSKioSK.README.txt
Family
blackmatter
Ransom Note
~+
* +
' BLACK |
() .-.,='``'=. - o -
'=/_ \ |
* | '=._ |
\ `=./`, '
. '=.__.=' `=' *
+ Matter +
O * ' .
>>> Hello Eisvogel Hubert Bernegger GmbH
>>> What happens?
Your network is encrypted, and currently not operational.
We need only money, after payment we will give you a decryptor for the entire network and you will restore all the data.
>>> What data stolen?
From your network was stolen of data.
If you do not contact us we will publish all your data will send it to the biggest mass media and your customers.
>>> What guarantees?
We are not a politically motivated group and we do not need anything other than your money.
If you pay, we will provide you the programs for decryption and we will delete your data.
If we do not give you decrypters or we do not delete your data, no one will pay us in the future, this does not comply with our goals.
We always keep our promises.
>>> How to contact with us?
1. Download and install TOR Browser (https://www.torproject.org/).
2. Open http://supp24maprinktc7uizgfyqhisx7lkszb6ogh6lwdzpac23w3mh4tvyd.onion/5PBOYRSETHVDBDPTL
>>> Warning! Recovery recommendations.
We strongly recommend you to do not MODIFY or REPAIR your files, that will damage them.
URLs
http://supp24maprinktc7uizgfyqhisx7lkszb6ogh6lwdzpac23w3mh4tvyd.onion/5PBOYRSETHVDBDPTL
Signatures
-
BlackMatter Ransomware
BlackMatter ransomware group claims to be Darkside and REvil succesor.
-
Modifies extensions of user files 9 IoCs
Ransomware generally changes the extension on encrypted files.
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
-
Modifies Control Panel 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cb5a89a31a97f8d815776ff43f22f4fec00b32aae4f580080c7300875d991163.bin.sample.exe"C:\Users\Admin\AppData\Local\Temp\cb5a89a31a97f8d815776ff43f22f4fec00b32aae4f580080c7300875d991163.bin.sample.exe"1⤵
- Modifies extensions of user files
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
68KB