Analysis
-
max time kernel
147s -
max time network
135s -
platform
windows11_x64 -
resource
win11 -
submitted
24-10-2021 15:21
Static task
static1
Behavioral task
behavioral1
Sample
b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe
Resource
win11
windows11_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe
Resource
win10-en-20211014
windows10_x64
0 signatures
0 seconds
General
-
Target
b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe
-
Size
78KB
-
MD5
5e2a1323dbf28eac8b3f4df9cb4f2d45
-
SHA1
af77a09387df4ec967a8314ba0f93da0ef8e57ee
-
SHA256
b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7
-
SHA512
c2ba4f7458298129a8d2f1ac50640601d59086048ecc8d3d88985c31edf4014e4f4838308192ab39fb21d71a9b362a38a93edff58b570ec6f5ccfb940d871b94
Score
10/10
Malware Config
Extracted
Path
\??\Z:\f5yX7OyXn.README.txt
Family
blackmatter
Ransom Note
~+
* +
' BLACK |
() .-.,='``'=. - o -
'=/_ \ |
* | '=._ |
\ `=./`, '
. '=.__.=' `=' *
+ Matter +
O * ' .
>>> What happens?
Your network is encrypted, and currently not operational.
We need only money, after payment we will give you a decryptor for the entire network and you will restore all the data.
>>> What guarantees?
We are not a politically motivated group and we do not need anything other than your money.
If you pay, we will provide you the programs for decryption and we will delete your data.
If we do not give you decrypters or we do not delete your data, no one will pay us in the future, this does not comply with our goals.
We always keep our promises.
>>> How to contact with us?
1. Download and install TOR Browser (https://www.torproject.org/).
2. Open http://supp24yy6a66hwszu2piygicgwzdtbwftb76htfj7vnip3getgqnzxid.onion/O3KTUJZRE6CB4Q1OBR
>>> Warning! Recovery recommendations.
We strongly recommend you to do not MODIFY or REPAIR your files, that will damage them.
URLs
http://supp24yy6a66hwszu2piygicgwzdtbwftb76htfj7vnip3getgqnzxid.onion/O3KTUJZRE6CB4Q1OBR
Signatures
-
BlackMatter Ransomware
BlackMatter ransomware group claims to be Darkside and REvil succesor.
-
suricata: ET MALWARE BlackMatter CnC Domain in DNS Lookup (mojobiden .com)
suricata: ET MALWARE BlackMatter CnC Domain in DNS Lookup (mojobiden .com)
-
suricata: ET MALWARE BlackMatter CnC Domain in DNS Lookup (nowautomation .com)
suricata: ET MALWARE BlackMatter CnC Domain in DNS Lookup (nowautomation .com)
-
Sets service image path in registry 2 TTPs
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\f5yX7OyXn.bmp" b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe Set value (str) \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\f5yX7OyXn.bmp" b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
pid Process 1052 b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe 1052 b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe 1052 b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe 1052 b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe 1052 b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe 1052 b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe -
Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe -
Modifies Control Panel 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Control Panel\International b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe Key created \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Control Panel\Desktop b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe Set value (str) \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Control Panel\Desktop\WallpaperStyle = "10" b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates svchost.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1052 b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe 1052 b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe 1052 b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe 1052 b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe -
Suspicious use of AdjustPrivilegeToken 31 IoCs
description pid Process Token: SeBackupPrivilege 1052 b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe Token: SeDebugPrivilege 1052 b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe Token: 36 1052 b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe Token: SeImpersonatePrivilege 1052 b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe Token: SeIncBasePriorityPrivilege 1052 b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe Token: SeIncreaseQuotaPrivilege 1052 b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe Token: 33 1052 b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe Token: SeManageVolumePrivilege 1052 b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe Token: SeProfSingleProcessPrivilege 1052 b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe Token: SeRestorePrivilege 1052 b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe Token: SeSecurityPrivilege 1052 b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe Token: SeSystemProfilePrivilege 1052 b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe Token: SeTakeOwnershipPrivilege 1052 b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe Token: SeShutdownPrivilege 1052 b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe Token: SeBackupPrivilege 1608 vssvc.exe Token: SeRestorePrivilege 1608 vssvc.exe Token: SeAuditPrivilege 1608 vssvc.exe Token: SeShutdownPrivilege 2492 svchost.exe Token: SeCreatePagefilePrivilege 2492 svchost.exe Token: SeShutdownPrivilege 2492 svchost.exe Token: SeCreatePagefilePrivilege 2492 svchost.exe Token: SeShutdownPrivilege 2492 svchost.exe Token: SeCreatePagefilePrivilege 2492 svchost.exe Token: SeShutdownPrivilege 1496 svchost.exe Token: SeCreatePagefilePrivilege 1496 svchost.exe Token: SeTakeOwnershipPrivilege 4528 WaaSMedicAgent.exe Token: SeSecurityPrivilege 4528 WaaSMedicAgent.exe Token: SeRestorePrivilege 4528 WaaSMedicAgent.exe Token: SeBackupPrivilege 4528 WaaSMedicAgent.exe Token: SeShutdownPrivilege 2492 svchost.exe Token: SeCreatePagefilePrivilege 2492 svchost.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1496 wrote to memory of 1880 1496 svchost.exe 86 PID 1496 wrote to memory of 1880 1496 svchost.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe"C:\Users\Admin\AppData\Local\Temp\b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe"1⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1052
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe b34634922f00db267e803f4858beb050 GEwTR/2hiEy0A5uai15Dxg.0.1.0.3.01⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4528
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1608
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2492
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Windows\uus\AMD64\MoUsoCoreWorker.exeC:\Windows\uus\AMD64\MoUsoCoreWorker.exe2⤵PID:1880
-
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe b34634922f00db267e803f4858beb050 GEwTR/2hiEy0A5uai15Dxg.0.1.0.3.01⤵
- Modifies data under HKEY_USERS
PID:1476