bm.ps1
915KB
03-12-2021 12:10
behavioral2
001bfe6f72fe64660ba498107c658bdc
0946baf23e867f2564302b60f777db72a1244a30
c22a6401a415fe642f3d96f38a887dd8ad23dd83a9255ee89d9adf4650ab98da
32836eff8285a5a301be0b4410d34a73d99d4c04b38b0b67b937c1bc5ae6ab2d033a97089b6588c245371dfd8e95c420c8bbd3862a632a828122861e0ec839d3
Extracted
| Path | C:\eeWDzMyD5.README.txt |
| Family | blackmatter |
| Ransom Note |
~+
* +
' BLACK |
() .-.,='``'=. - o -
'=/_ \ |
* | '=._ |
\ `=./`, '
. '=.__.=' `=' *
+ Matter +
O * ' .
>>> What happens?
Your network is encrypted, and currently not operational.
We need only money, after payment we will give you a decryptor for the entire network and you will restore all the data.
>>> What guarantees?
We are not a politically motivated group and we do not need anything other than your money.
If you pay, we will provide you the programs for decryption and we will delete your data.
If we do not give you decrypters or we do not delete your data, no one will pay us in the future, this does not comply with our goals.
We always keep our promises.
>>> How to contact with us?
1. Download and install TOR Browser (https://www.torproject.org/).
2. Open http://supp24yy6a66hwszu2piygicgwzdtbwftb76htfj7vnip3getgqnzxid.onion/O1E1HJ9H8JNKNNHC8
>>> Warning! Recovery recommendations.
We strongly recommend you to do not MODIFY or REPAIR your files, that will damage them.
|
| URLs |
http://supp24yy6a66hwszu2piygicgwzdtbwftb76htfj7vnip3getgqnzxid.onion/O1E1HJ9H8JNKNNHC8 |
Filter: none
-
BlackMatter Ransomware
Description
BlackMatter ransomware group claims to be Darkside and REvil succesor.
Tags
-
Modifies extensions of user filespowershell.exe
Description
Ransomware generally changes the extension on encrypted files.
Tags
Reported IOCs
description ioc process File renamed C:\Users\Admin\Pictures\SaveOpen.crw => C:\Users\Admin\Pictures\SaveOpen.crw.eeWDzMyD5 powershell.exe File opened for modification C:\Users\Admin\Pictures\SaveOpen.crw.eeWDzMyD5 powershell.exe File opened for modification C:\Users\Admin\Pictures\WatchGrant.tiff powershell.exe File renamed C:\Users\Admin\Pictures\WatchGrant.tiff => C:\Users\Admin\Pictures\WatchGrant.tiff.eeWDzMyD5 powershell.exe File opened for modification C:\Users\Admin\Pictures\WatchGrant.tiff.eeWDzMyD5 powershell.exe -
Enumerates connected drivespowershell.exe
Description
Attempts to read the root path of hard drives other than the default C: drive.
TTPs
Reported IOCs
description ioc process File opened (read-only) \??\Z: powershell.exe -
Sets desktop wallpaper using registrypowershell.exe
Tags
TTPs
Reported IOCs
description ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\eeWDzMyD5.bmp" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\eeWDzMyD5.bmp" powershell.exe -
Suspicious use of NtSetInformationThreadHideFromDebuggerpowershell.exe
Reported IOCs
pid process 3240 powershell.exe 3240 powershell.exe 3240 powershell.exe 3240 powershell.exe 3240 powershell.exe 3240 powershell.exe -
Suspicious behavior: EnumeratesProcessespowershell.exepowershell.exe
Reported IOCs
pid process 3636 powershell.exe 3636 powershell.exe 3636 powershell.exe 3240 powershell.exe 3240 powershell.exe 3240 powershell.exe 3240 powershell.exe 3240 powershell.exe 3240 powershell.exe 3240 powershell.exe -
Suspicious use of AdjustPrivilegeTokenpowershell.exepowershell.exevssvc.exe
Reported IOCs
description pid process Token: SeDebugPrivilege 3636 powershell.exe Token: SeDebugPrivilege 3240 powershell.exe Token: SeBackupPrivilege 3240 powershell.exe Token: SeDebugPrivilege 3240 powershell.exe Token: 36 3240 powershell.exe Token: SeImpersonatePrivilege 3240 powershell.exe Token: SeIncBasePriorityPrivilege 3240 powershell.exe Token: SeIncreaseQuotaPrivilege 3240 powershell.exe Token: 33 3240 powershell.exe Token: SeManageVolumePrivilege 3240 powershell.exe Token: SeProfSingleProcessPrivilege 3240 powershell.exe Token: SeRestorePrivilege 3240 powershell.exe Token: SeSecurityPrivilege 3240 powershell.exe Token: SeSystemProfilePrivilege 3240 powershell.exe Token: SeTakeOwnershipPrivilege 3240 powershell.exe Token: SeShutdownPrivilege 3240 powershell.exe Token: SeBackupPrivilege 3508 vssvc.exe Token: SeRestorePrivilege 3508 vssvc.exe Token: SeAuditPrivilege 3508 vssvc.exe -
Suspicious use of WriteProcessMemorypowershell.exe
Reported IOCs
description pid process target process PID 3636 wrote to memory of 3240 3636 powershell.exe powershell.exe PID 3636 wrote to memory of 3240 3636 powershell.exe powershell.exe PID 3636 wrote to memory of 3240 3636 powershell.exe powershell.exe
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePID:3636powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\bm.ps1Suspicious behavior: EnumeratesProcessesSuspicious use of AdjustPrivilegeTokenSuspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exePID:3240"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -ex bypass -NonI C:\Users\Admin\AppData\Local\Temp\bm.ps1Modifies extensions of user filesEnumerates connected drivesSets desktop wallpaper using registrySuspicious use of NtSetInformationThreadHideFromDebuggerSuspicious behavior: EnumeratesProcessesSuspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exePID:3508C:\Windows\system32\vssvc.exeSuspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD538fcd7bfa41917d88106906bf712cbc4
SHA1755d75e36bde59f316b7a81383c6d38be3e5b750
SHA2566b6b349c37d2cfdc11d1866d14204c64a76f4a53caa2fcd3e14f1073a783b9ad
SHA512d12fa1e8290b39232cec91a85b6fe8131c2b4b2ce517e45399624b8c0ab6710bb5450c38c9939d4c91dfc1e9467acea44f27f390b7a9d6b3ed12f24638c8924b
-
memory/3240-177-0x0000000007B90000-0x0000000007B91000-memory.dmp
-
memory/3240-438-0x0000000004F76000-0x0000000004F78000-memory.dmp
-
memory/3240-223-0x000000007F7C0000-0x000000007F7C1000-memory.dmp
-
memory/3240-224-0x0000000004F73000-0x0000000004F74000-memory.dmp
-
memory/3240-188-0x00000000035E0000-0x00000000035E1000-memory.dmp
-
memory/3240-187-0x0000000008A90000-0x0000000008A91000-memory.dmp
-
memory/3240-186-0x0000000008860000-0x0000000008861000-memory.dmp
-
memory/3240-185-0x00000000082E0000-0x00000000082E1000-memory.dmp
-
memory/3240-439-0x000000000FA73000-0x000000000FA75000-memory.dmp
-
memory/3240-183-0x00000000083A0000-0x00000000083A1000-memory.dmp
-
memory/3240-182-0x0000000007AD0000-0x0000000007AD1000-memory.dmp
-
memory/3240-181-0x0000000007A60000-0x0000000007A61000-memory.dmp
-
memory/3240-180-0x00000000078C0000-0x00000000078C1000-memory.dmp
-
memory/3240-179-0x0000000004F72000-0x0000000004F73000-memory.dmp
-
memory/3240-146-0x0000000000000000-mapping.dmp
-
memory/3240-178-0x0000000004F70000-0x0000000004F71000-memory.dmp
-
memory/3240-174-0x00000000035E0000-0x00000000035E1000-memory.dmp
-
memory/3240-175-0x00000000035E0000-0x00000000035E1000-memory.dmp
-
memory/3240-176-0x0000000004F20000-0x0000000004F21000-memory.dmp
-
memory/3240-440-0x000000000FA70000-0x000000000FA71000-memory.dmp
-
memory/3636-173-0x00000261A3870000-0x00000261A3872000-memory.dmp
-
memory/3636-132-0x00000261A3870000-0x00000261A3872000-memory.dmp
-
memory/3636-131-0x00000261BD9B6000-0x00000261BD9B8000-memory.dmp
-
memory/3636-130-0x00000261BD9B3000-0x00000261BD9B5000-memory.dmp
-
memory/3636-129-0x00000261BD9B0000-0x00000261BD9B2000-memory.dmp
-
memory/3636-128-0x00000261BFA90000-0x00000261BFA91000-memory.dmp
-
memory/3636-127-0x00000261A3870000-0x00000261A3872000-memory.dmp
-
memory/3636-126-0x00000261A3870000-0x00000261A3872000-memory.dmp
-
memory/3636-125-0x00000261A3870000-0x00000261A3872000-memory.dmp
-
memory/3636-124-0x00000261A3870000-0x00000261A3872000-memory.dmp
-
memory/3636-123-0x00000261A5430000-0x00000261A5431000-memory.dmp
-
memory/3636-122-0x00000261A3870000-0x00000261A3872000-memory.dmp
-
memory/3636-121-0x00000261A3870000-0x00000261A3872000-memory.dmp
-
memory/3636-120-0x00000261A3870000-0x00000261A3872000-memory.dmp
-
memory/3636-119-0x00000261A3870000-0x00000261A3872000-memory.dmp
-
memory/3636-118-0x00000261A3870000-0x00000261A3872000-memory.dmp