Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
21-10-2021 13:17
Static task
static1
Behavioral task
behavioral1
Sample
b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe
Resource
win10-en-20210920
General
-
Target
b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe
-
Size
78KB
-
MD5
5e2a1323dbf28eac8b3f4df9cb4f2d45
-
SHA1
af77a09387df4ec967a8314ba0f93da0ef8e57ee
-
SHA256
b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7
-
SHA512
c2ba4f7458298129a8d2f1ac50640601d59086048ecc8d3d88985c31edf4014e4f4838308192ab39fb21d71a9b362a38a93edff58b570ec6f5ccfb940d871b94
Malware Config
Extracted
C:\6amPnJyPq.README.txt
blackmatter
http://supp24yy6a66hwszu2piygicgwzdtbwftb76htfj7vnip3getgqnzxid.onion/O3KTUJZRE6CB4Q1OBR
Signatures
-
BlackMatter Ransomware
BlackMatter ransomware group claims to be Darkside and REvil succesor.
-
Modifies extensions of user files 18 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\FormatRevoke.raw.6amPnJyPq b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe File opened for modification C:\Users\Admin\Pictures\PublishExit.crw.6amPnJyPq b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe File opened for modification C:\Users\Admin\Pictures\SkipOut.tif.6amPnJyPq b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe File renamed C:\Users\Admin\Pictures\CheckpointShow.tiff => C:\Users\Admin\Pictures\CheckpointShow.tiff.6amPnJyPq b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe File renamed C:\Users\Admin\Pictures\ExitStart.tif => C:\Users\Admin\Pictures\ExitStart.tif.6amPnJyPq b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe File opened for modification C:\Users\Admin\Pictures\RestartSubmit.tiff b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe File opened for modification C:\Users\Admin\Pictures\CheckpointShow.tiff.6amPnJyPq b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe File opened for modification C:\Users\Admin\Pictures\JoinShow.crw.6amPnJyPq b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe File opened for modification C:\Users\Admin\Pictures\InitializeClear.crw.6amPnJyPq b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe File renamed C:\Users\Admin\Pictures\JoinShow.crw => C:\Users\Admin\Pictures\JoinShow.crw.6amPnJyPq b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe File opened for modification C:\Users\Admin\Pictures\RestartSubmit.tiff.6amPnJyPq b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe File opened for modification C:\Users\Admin\Pictures\ExitStart.tif.6amPnJyPq b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe File renamed C:\Users\Admin\Pictures\InitializeClear.crw => C:\Users\Admin\Pictures\InitializeClear.crw.6amPnJyPq b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe File renamed C:\Users\Admin\Pictures\PublishExit.crw => C:\Users\Admin\Pictures\PublishExit.crw.6amPnJyPq b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe File renamed C:\Users\Admin\Pictures\RestartSubmit.tiff => C:\Users\Admin\Pictures\RestartSubmit.tiff.6amPnJyPq b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe File renamed C:\Users\Admin\Pictures\SkipOut.tif => C:\Users\Admin\Pictures\SkipOut.tif.6amPnJyPq b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe File opened for modification C:\Users\Admin\Pictures\CheckpointShow.tiff b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe File renamed C:\Users\Admin\Pictures\FormatRevoke.raw => C:\Users\Admin\Pictures\FormatRevoke.raw.6amPnJyPq b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\6amPnJyPq.bmp" b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe Set value (str) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\6amPnJyPq.bmp" b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
pid Process 1680 b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe 1680 b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe 1680 b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe 1680 b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe 1680 b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe 1680 b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies Control Panel 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Control Panel\International b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Control Panel\Desktop b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe Set value (str) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Control Panel\Desktop\WallpaperStyle = "10" b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe -
Modifies registry class 20 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU splwow64.exe Set value (data) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots splwow64.exe Set value (int) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_TopViewVersion = "0" splwow64.exe Set value (data) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 9e0000001a00eebbfe23000010007db10d7bd29c934a973346cc89022e7c00002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020002a0000000000efbe7e47b3fbe4c93b4ba2bad3f5d3cd46f98207ba827a5b6945b5d7ec83085f08cc20002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020000000 splwow64.exe Set value (data) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 splwow64.exe Set value (data) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff splwow64.exe Set value (data) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff splwow64.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 splwow64.exe Set value (data) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff splwow64.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 splwow64.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell splwow64.exe Set value (int) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" splwow64.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags splwow64.exe Set value (data) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff splwow64.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg splwow64.exe Set value (str) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_FolderType = "{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}" splwow64.exe Set value (str) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_TopViewID = "{82BA0782-5B7A-4569-B5D7-EC83085F08CC}" splwow64.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_Classes\Local Settings splwow64.exe Set value (data) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f4225481e03947bc34db131e946b44c8dd50000 splwow64.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 splwow64.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 1600 NOTEPAD.EXE -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1680 b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe 1680 b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe 1680 b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe 1680 b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 868 splwow64.exe -
Suspicious use of AdjustPrivilegeToken 17 IoCs
description pid Process Token: SeBackupPrivilege 1680 b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe Token: SeDebugPrivilege 1680 b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe Token: 36 1680 b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe Token: SeImpersonatePrivilege 1680 b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe Token: SeIncBasePriorityPrivilege 1680 b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe Token: SeIncreaseQuotaPrivilege 1680 b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe Token: 33 1680 b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe Token: SeManageVolumePrivilege 1680 b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe Token: SeProfSingleProcessPrivilege 1680 b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe Token: SeRestorePrivilege 1680 b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe Token: SeSecurityPrivilege 1680 b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe Token: SeSystemProfilePrivilege 1680 b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe Token: SeTakeOwnershipPrivilege 1680 b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe Token: SeShutdownPrivilege 1680 b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe Token: SeBackupPrivilege 928 vssvc.exe Token: SeRestorePrivilege 928 vssvc.exe Token: SeAuditPrivilege 928 vssvc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 868 splwow64.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1680 wrote to memory of 1600 1680 b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe 35 PID 1680 wrote to memory of 1600 1680 b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe 35 PID 1680 wrote to memory of 1600 1680 b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe 35 PID 1680 wrote to memory of 1600 1680 b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe 35 PID 1600 wrote to memory of 868 1600 NOTEPAD.EXE 36 PID 1600 wrote to memory of 868 1600 NOTEPAD.EXE 36 PID 1600 wrote to memory of 868 1600 NOTEPAD.EXE 36 PID 1600 wrote to memory of 868 1600 NOTEPAD.EXE 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe"C:\Users\Admin\AppData\Local\Temp\b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe"1⤵
- Modifies extensions of user files
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" /p C:\6amPnJyPq.README.txt2⤵
- Opens file in notepad (likely ransom note)
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:868
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:928