Analysis
-
max time kernel
122s -
max time network
146s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
23-11-2021 11:09
Static task
static1
Behavioral task
behavioral1
Sample
6155637f8b98426258f5d4321bce4104df56c7771967813d61362c2118632a7b.ps1
Resource
win7-en-20211104
Behavioral task
behavioral2
Sample
6155637f8b98426258f5d4321bce4104df56c7771967813d61362c2118632a7b.ps1
Resource
win10-en-20211104
General
-
Target
6155637f8b98426258f5d4321bce4104df56c7771967813d61362c2118632a7b.ps1
-
Size
887KB
-
MD5
66d8f3d21088cea87dd99f37efb92795
-
SHA1
ba7cad1cbb5204ac8d2ddb3d399738657f08e209
-
SHA256
6155637f8b98426258f5d4321bce4104df56c7771967813d61362c2118632a7b
-
SHA512
df0cd4d9a9c3337aed6a62bce14ddb3c6001e215ab956f7f0e98d9a9c7ae69ec24fc2aff48cc5899312f8473f397f9d9bcf554b5b9ef626a8c95f257f5f23554
Malware Config
Extracted
C:\eeWDzMyD5.README.txt
blackmatter
http://supp24yy6a66hwszu2piygicgwzdtbwftb76htfj7vnip3getgqnzxid.onion/GDBJS76DH3D4IKQD2QO7R
Signatures
-
BlackMatter Ransomware
BlackMatter ransomware group claims to be Darkside and REvil succesor.
-
Blocklisted process makes network request 10 IoCs
flow pid Process 25 3772 powershell.exe 27 3772 powershell.exe 29 3772 powershell.exe 31 3772 powershell.exe 32 3772 powershell.exe 33 3772 powershell.exe 35 3772 powershell.exe 36 3772 powershell.exe 37 3772 powershell.exe 38 3772 powershell.exe -
Modifies extensions of user files 16 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\SaveCheckpoint.tif.eeWDzMyD5 powershell.exe File opened for modification C:\Users\Admin\Pictures\ExpandPush.raw.eeWDzMyD5 powershell.exe File renamed C:\Users\Admin\Pictures\SkipSplit.crw => C:\Users\Admin\Pictures\SkipSplit.crw.eeWDzMyD5 powershell.exe File opened for modification C:\Users\Admin\Pictures\SwitchStep.raw.eeWDzMyD5 powershell.exe File renamed C:\Users\Admin\Pictures\FormatPing.crw => C:\Users\Admin\Pictures\FormatPing.crw.eeWDzMyD5 powershell.exe File opened for modification C:\Users\Admin\Pictures\CompleteHide.tif.eeWDzMyD5 powershell.exe File opened for modification C:\Users\Admin\Pictures\FormatPing.crw.eeWDzMyD5 powershell.exe File renamed C:\Users\Admin\Pictures\SaveCheckpoint.tif => C:\Users\Admin\Pictures\SaveCheckpoint.tif.eeWDzMyD5 powershell.exe File renamed C:\Users\Admin\Pictures\CompleteHide.tif => C:\Users\Admin\Pictures\CompleteHide.tif.eeWDzMyD5 powershell.exe File opened for modification C:\Users\Admin\Pictures\ConvertToCompress.png.eeWDzMyD5 powershell.exe File renamed C:\Users\Admin\Pictures\DismountComplete.crw => C:\Users\Admin\Pictures\DismountComplete.crw.eeWDzMyD5 powershell.exe File opened for modification C:\Users\Admin\Pictures\DismountComplete.crw.eeWDzMyD5 powershell.exe File renamed C:\Users\Admin\Pictures\ExpandPush.raw => C:\Users\Admin\Pictures\ExpandPush.raw.eeWDzMyD5 powershell.exe File opened for modification C:\Users\Admin\Pictures\SkipSplit.crw.eeWDzMyD5 powershell.exe File renamed C:\Users\Admin\Pictures\SwitchStep.raw => C:\Users\Admin\Pictures\SwitchStep.raw.eeWDzMyD5 powershell.exe File renamed C:\Users\Admin\Pictures\ConvertToCompress.png => C:\Users\Admin\Pictures\ConvertToCompress.png.eeWDzMyD5 powershell.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: powershell.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\eeWDzMyD5.bmp" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\eeWDzMyD5.bmp" powershell.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 3772 powershell.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4024 powershell.exe 4024 powershell.exe 4024 powershell.exe 3772 powershell.exe 3772 powershell.exe 3772 powershell.exe 3772 powershell.exe 3772 powershell.exe 3772 powershell.exe 3772 powershell.exe -
Suspicious use of AdjustPrivilegeToken 19 IoCs
description pid Process Token: SeDebugPrivilege 4024 powershell.exe Token: SeDebugPrivilege 3772 powershell.exe Token: SeBackupPrivilege 3772 powershell.exe Token: SeDebugPrivilege 3772 powershell.exe Token: 36 3772 powershell.exe Token: SeImpersonatePrivilege 3772 powershell.exe Token: SeIncBasePriorityPrivilege 3772 powershell.exe Token: SeIncreaseQuotaPrivilege 3772 powershell.exe Token: 33 3772 powershell.exe Token: SeManageVolumePrivilege 3772 powershell.exe Token: SeProfSingleProcessPrivilege 3772 powershell.exe Token: SeRestorePrivilege 3772 powershell.exe Token: SeSecurityPrivilege 3772 powershell.exe Token: SeSystemProfilePrivilege 3772 powershell.exe Token: SeTakeOwnershipPrivilege 3772 powershell.exe Token: SeShutdownPrivilege 3772 powershell.exe Token: SeBackupPrivilege 1516 vssvc.exe Token: SeRestorePrivilege 1516 vssvc.exe Token: SeAuditPrivilege 1516 vssvc.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4024 wrote to memory of 3772 4024 powershell.exe 70 PID 4024 wrote to memory of 3772 4024 powershell.exe 70 PID 4024 wrote to memory of 3772 4024 powershell.exe 70
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\6155637f8b98426258f5d4321bce4104df56c7771967813d61362c2118632a7b.ps11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -ex bypass -NonI C:\Users\Admin\AppData\Local\Temp\6155637f8b98426258f5d4321bce4104df56c7771967813d61362c2118632a7b.ps12⤵
- Blocklisted process makes network request
- Modifies extensions of user files
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3772
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1516