blackmatter | 8561226f674aeb4abc1b9910ddc4855ac8ac2fcd4f5face1f84e34878ac98afc

Analysis

max time kernel
150s
max time network
106s
platform
windows7_x64
resource
win7-en-20211104
submitted
23-11-2021 10:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9cf9441554ac727f9d191ad9de1dc101867ffe5264699cafcf2734a4b89d5d6a.exe
Size

78KB
MD5

d298d54961823dd20b7a4d14b9326964
SHA1

5b70fd4f2ef2000cf2af1d2eb8a5158cc8802c90
SHA256

9cf9441554ac727f9d191ad9de1dc101867ffe5264699cafcf2734a4b89d5d6a
SHA512

64be2de822607f8d85066a972468528706133cc3133f90f0fb51cd5874e83d0bce5d240d9aabc021730dbd654a26069933850db5de895011fc4d4045564ba6ca

Score

10^/10

blackmatter ransomware suricata

Malware Config

Extracted

Path

C:\gawreXkrr.README.txt

Family

blackmatter

Ransom Note

~+ * + ' BLACK | () .-.,='``'=. - o - '=/_ \ | * | '=._ | \ `=./`, ' . '=.__.=' `=' * + Matter + O * ' . >>> What happens? Your network is encrypted, and currently not operational. We need only money, after payment we will give you a decryptor for the entire network and you will restore all the data. >>> What guarantees? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. If we do not give you decrypters or we do not delete your data, no one will pay us in the future, this does not comply with our goals. We always keep our promises. >>> How to contact with us? 1. Download and install TOR Browser (https://www.torproject.org/). 2. Open http://supp24maprinktc7uizgfyqhisx7lkszb6ogh6lwdzpac23w3mh4tvyd.onion/1ILW209PJZUAJJEX >>> Warning! Recovery recommendations. We strongly recommend you to do not MODIFY or REPAIR your files, that will damage them.

URLs

http://supp24maprinktc7uizgfyqhisx7lkszb6ogh6lwdzpac23w3mh4tvyd.onion/1ILW209PJZUAJJEX

Signatures

BlackMatter Ransomware
BlackMatter ransomware group claims to be Darkside and REvil succesor.
ransomware blackmatter
suricata: ET MALWARE BlackMatter CnC Domain in DNS Lookup (mojobiden .com)
suricata: ET MALWARE BlackMatter CnC Domain in DNS Lookup (mojobiden .com)
suricata
suricata: ET MALWARE BlackMatter CnC Domain in DNS Lookup (nowautomation .com)
suricata: ET MALWARE BlackMatter CnC Domain in DNS Lookup (nowautomation .com)
suricata

Modifies extensions of user files 5 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

9cf9441554ac727f9d191ad9de1dc101867ffe5264699cafcf2734a4b89d5d6a.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Pictures\RequestPop.tif.gawreXkrr	9cf9441554ac727f9d191ad9de1dc101867ffe5264699cafcf2734a4b89d5d6a.exe
File opened for modification	C:\Users\Admin\Pictures\UnlockNew.tiff	9cf9441554ac727f9d191ad9de1dc101867ffe5264699cafcf2734a4b89d5d6a.exe
File renamed	C:\Users\Admin\Pictures\UnlockNew.tiff => C:\Users\Admin\Pictures\UnlockNew.tiff.gawreXkrr	9cf9441554ac727f9d191ad9de1dc101867ffe5264699cafcf2734a4b89d5d6a.exe
File opened for modification	C:\Users\Admin\Pictures\UnlockNew.tiff.gawreXkrr	9cf9441554ac727f9d191ad9de1dc101867ffe5264699cafcf2734a4b89d5d6a.exe
File renamed	C:\Users\Admin\Pictures\RequestPop.tif => C:\Users\Admin\Pictures\RequestPop.tif.gawreXkrr	9cf9441554ac727f9d191ad9de1dc101867ffe5264699cafcf2734a4b89d5d6a.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

9cf9441554ac727f9d191ad9de1dc101867ffe5264699cafcf2734a4b89d5d6a.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\gawreXkrr.bmp"	9cf9441554ac727f9d191ad9de1dc101867ffe5264699cafcf2734a4b89d5d6a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\gawreXkrr.bmp"	9cf9441554ac727f9d191ad9de1dc101867ffe5264699cafcf2734a4b89d5d6a.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

Processes:

9cf9441554ac727f9d191ad9de1dc101867ffe5264699cafcf2734a4b89d5d6a.exe

pid	process
520	9cf9441554ac727f9d191ad9de1dc101867ffe5264699cafcf2734a4b89d5d6a.exe
520	9cf9441554ac727f9d191ad9de1dc101867ffe5264699cafcf2734a4b89d5d6a.exe
520	9cf9441554ac727f9d191ad9de1dc101867ffe5264699cafcf2734a4b89d5d6a.exe
520	9cf9441554ac727f9d191ad9de1dc101867ffe5264699cafcf2734a4b89d5d6a.exe
520	9cf9441554ac727f9d191ad9de1dc101867ffe5264699cafcf2734a4b89d5d6a.exe
520	9cf9441554ac727f9d191ad9de1dc101867ffe5264699cafcf2734a4b89d5d6a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Control Panel 3 IoCs

evasion

Processes:

9cf9441554ac727f9d191ad9de1dc101867ffe5264699cafcf2734a4b89d5d6a.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Control Panel\International	9cf9441554ac727f9d191ad9de1dc101867ffe5264699cafcf2734a4b89d5d6a.exe
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Control Panel\Desktop	9cf9441554ac727f9d191ad9de1dc101867ffe5264699cafcf2734a4b89d5d6a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Control Panel\Desktop\WallpaperStyle = "10"	9cf9441554ac727f9d191ad9de1dc101867ffe5264699cafcf2734a4b89d5d6a.exe

Modifies registry class 20 IoCs

Processes:

splwow64.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	splwow64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 9e0000001a00eebbfe23000010007db10d7bd29c934a973346cc89022e7c00002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020002a0000000000efbe7e47b3fbe4c93b4ba2bad3f5d3cd46f98207ba827a5b6945b5d7ec83085f08cc20002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020000000	splwow64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	splwow64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	splwow64.exe
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	splwow64.exe
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	splwow64.exe
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	splwow64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	splwow64.exe
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	splwow64.exe
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_Classes\Local Settings	splwow64.exe
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	splwow64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f4225481e03947bc34db131e946b44c8dd50000	splwow64.exe
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	splwow64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	splwow64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	splwow64.exe
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	splwow64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_FolderType = "{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}"	splwow64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_TopViewID = "{82BA0782-5B7A-4569-B5D7-EC83085F08CC}"	splwow64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_TopViewVersion = "0"	splwow64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	splwow64.exe

Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

1640 NOTEPAD.EXE

pid	process
1640	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

9cf9441554ac727f9d191ad9de1dc101867ffe5264699cafcf2734a4b89d5d6a.exe

pid	process
520	9cf9441554ac727f9d191ad9de1dc101867ffe5264699cafcf2734a4b89d5d6a.exe
520	9cf9441554ac727f9d191ad9de1dc101867ffe5264699cafcf2734a4b89d5d6a.exe
520	9cf9441554ac727f9d191ad9de1dc101867ffe5264699cafcf2734a4b89d5d6a.exe
520	9cf9441554ac727f9d191ad9de1dc101867ffe5264699cafcf2734a4b89d5d6a.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

Processes:

9cf9441554ac727f9d191ad9de1dc101867ffe5264699cafcf2734a4b89d5d6a.exevssvc.exe

description	pid	process
Token: SeBackupPrivilege	520	9cf9441554ac727f9d191ad9de1dc101867ffe5264699cafcf2734a4b89d5d6a.exe
Token: SeDebugPrivilege	520	9cf9441554ac727f9d191ad9de1dc101867ffe5264699cafcf2734a4b89d5d6a.exe
Token: 36	520	9cf9441554ac727f9d191ad9de1dc101867ffe5264699cafcf2734a4b89d5d6a.exe
Token: SeImpersonatePrivilege	520	9cf9441554ac727f9d191ad9de1dc101867ffe5264699cafcf2734a4b89d5d6a.exe
Token: SeIncBasePriorityPrivilege	520	9cf9441554ac727f9d191ad9de1dc101867ffe5264699cafcf2734a4b89d5d6a.exe
Token: SeIncreaseQuotaPrivilege	520	9cf9441554ac727f9d191ad9de1dc101867ffe5264699cafcf2734a4b89d5d6a.exe
Token: 33	520	9cf9441554ac727f9d191ad9de1dc101867ffe5264699cafcf2734a4b89d5d6a.exe
Token: SeManageVolumePrivilege	520	9cf9441554ac727f9d191ad9de1dc101867ffe5264699cafcf2734a4b89d5d6a.exe
Token: SeProfSingleProcessPrivilege	520	9cf9441554ac727f9d191ad9de1dc101867ffe5264699cafcf2734a4b89d5d6a.exe
Token: SeRestorePrivilege	520	9cf9441554ac727f9d191ad9de1dc101867ffe5264699cafcf2734a4b89d5d6a.exe
Token: SeSecurityPrivilege	520	9cf9441554ac727f9d191ad9de1dc101867ffe5264699cafcf2734a4b89d5d6a.exe
Token: SeSystemProfilePrivilege	520	9cf9441554ac727f9d191ad9de1dc101867ffe5264699cafcf2734a4b89d5d6a.exe
Token: SeTakeOwnershipPrivilege	520	9cf9441554ac727f9d191ad9de1dc101867ffe5264699cafcf2734a4b89d5d6a.exe
Token: SeShutdownPrivilege	520	9cf9441554ac727f9d191ad9de1dc101867ffe5264699cafcf2734a4b89d5d6a.exe
Token: SeBackupPrivilege	736	vssvc.exe
Token: SeRestorePrivilege	736	vssvc.exe
Token: SeAuditPrivilege	736	vssvc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

splwow64.exe

pid process

1244 splwow64.exe

pid	process
1244	splwow64.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

9cf9441554ac727f9d191ad9de1dc101867ffe5264699cafcf2734a4b89d5d6a.exeNOTEPAD.EXE

description	pid	process	target process
PID 520 wrote to memory of 1640	520	9cf9441554ac727f9d191ad9de1dc101867ffe5264699cafcf2734a4b89d5d6a.exe	NOTEPAD.EXE
PID 520 wrote to memory of 1640	520	9cf9441554ac727f9d191ad9de1dc101867ffe5264699cafcf2734a4b89d5d6a.exe	NOTEPAD.EXE
PID 520 wrote to memory of 1640	520	9cf9441554ac727f9d191ad9de1dc101867ffe5264699cafcf2734a4b89d5d6a.exe	NOTEPAD.EXE
PID 520 wrote to memory of 1640	520	9cf9441554ac727f9d191ad9de1dc101867ffe5264699cafcf2734a4b89d5d6a.exe	NOTEPAD.EXE
PID 1640 wrote to memory of 1244	1640	NOTEPAD.EXE	splwow64.exe
PID 1640 wrote to memory of 1244	1640	NOTEPAD.EXE	splwow64.exe
PID 1640 wrote to memory of 1244	1640	NOTEPAD.EXE	splwow64.exe
PID 1640 wrote to memory of 1244	1640	NOTEPAD.EXE	splwow64.exe

C:\Users\Admin\AppData\Local\Temp\9cf9441554ac727f9d191ad9de1dc101867ffe5264699cafcf2734a4b89d5d6a.exe
"C:\Users\Admin\AppData\Local\Temp\9cf9441554ac727f9d191ad9de1dc101867ffe5264699cafcf2734a4b89d5d6a.exe"
1⤵
- Modifies extensions of user files
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:520

C:\Windows\SysWOW64\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" /p C:\gawreXkrr.README.txt
2⤵
- Opens file in notepad (likely ransom note)
- Suspicious use of WriteProcessMemory
PID:1640

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
3⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1244

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:736

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Documents\MeasureConvertTo.xps.gawreXkrr
MD5
e8c942b9e3014116aba15fce91b16789

SHA1
a0d4069cd9a105666543d904b6ab52f144a2dada

SHA256
b7e3fb2c62179442bd95ccca72eaa694b09a009c6930c6b3dfa48d557b1f88ad

SHA512
8c81744deba1e03e4f3f4a40e36716fdf529b2363afb91bf5b6661c5cdfa879af4dd07f69be9923490dce67b1aedf4fbb8ee35bbc517c98d67bb10571522cb0a

Download Submit
C:\Users\Admin\Documents\MoveDebug.xps.gawreXkrr
MD5
4b75516de4d8926cddffd6b6028596f0

SHA1
f37057156b694f2cf0d504bd26eebfdc6dd46ee8

SHA256
eba8564a2e80852a7c43af8b9fa046fdd26f364651fe2506cab3eee88dc75f11

SHA512
3e1a0bd8de88fcc49a58a9a54c65ebaaf69b3275d181915552ebb2e070ca28e87c418fbcef7820eec5c6fa11761c5337123298a34d066cbd486719e5bdbd652c

Download Submit
C:\Users\Admin\Documents\StopComplete.xps.gawreXkrr
MD5
948e3cc6e7c3561e25bb0046affcd2c1

SHA1
d76c5418c1e1aab117c6fc1ed6ecf3c573e9dc5a

SHA256
cafb4a461539866f91bbd0d0970e654109ba7c238aaac0ad122b6bda191bf8db

SHA512
36454d902573dba6edf9a86fb8efbeb4a69b8f9c864c9a85245c0aee2516d5d149dd078809f9632272b9833f6fe16a50b278a870154ac944a4fe79fe6ce6a22a

Download Submit
C:\gawreXkrr.README.txt
MD5
17ac384c6fba598efb3bdd0de6420431

SHA1
ca1584ea94bff53cc3cc8e7bace03cbd1e40f22b

SHA256
94eb5e2cafd95db7364247f120c0c9ced03db5409f3add3d081cbf7555f9767c

SHA512
b70b6c0ff9fc1b00eed3a2980b11e7008a249cfc78f286353e09006b4ed3bce22a23409e3aa94656ee4461b9287087abc1b5a599ff8d2f5870fcc175153d744f

Download Submit
memory/520-55-0x0000000075D61000-0x0000000075D63000-memory.dmp

Filesize
8KB

Download
memory/520-56-0x00000000020D5000-0x00000000020E6000-memory.dmp

Filesize
68KB

Download
memory/520-57-0x00000000020D0000-0x00000000020D1000-memory.dmp

Filesize
4KB

Download
memory/520-58-0x00000000020E6000-0x00000000020E7000-memory.dmp

Filesize
4KB

Download
memory/1244-62-0x0000000000000000-mapping.dmp

Download
memory/1244-63-0x000007FEFBFF1000-0x000007FEFBFF3000-memory.dmp

Filesize
8KB

Download
memory/1244-64-0x0000000004140000-0x0000000004141000-memory.dmp

Filesize
4KB

Download
memory/1640-59-0x0000000000000000-mapping.dmp

Download