Analysis
-
max time kernel
119s -
max time network
125s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
03-12-2021 13:54
Static task
static1
Behavioral task
behavioral1
Sample
OTSLG.ps1
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
OTSLG.ps1
Resource
win10-en-20211104
General
-
Target
OTSLG.ps1
-
Size
915KB
-
MD5
001bfe6f72fe64660ba498107c658bdc
-
SHA1
0946baf23e867f2564302b60f777db72a1244a30
-
SHA256
c22a6401a415fe642f3d96f38a887dd8ad23dd83a9255ee89d9adf4650ab98da
-
SHA512
32836eff8285a5a301be0b4410d34a73d99d4c04b38b0b67b937c1bc5ae6ab2d033a97089b6588c245371dfd8e95c420c8bbd3862a632a828122861e0ec839d3
Malware Config
Extracted
C:\eeWDzMyD5.README.txt
blackmatter
http://supp24yy6a66hwszu2piygicgwzdtbwftb76htfj7vnip3getgqnzxid.onion/O1E1HJ9H8JNKNNHC8
Signatures
-
BlackMatter Ransomware
BlackMatter ransomware group claims to be Darkside and REvil succesor.
-
Modifies extensions of user files 14 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
powershell.exedescription ioc process File renamed C:\Users\Admin\Pictures\SyncExit.raw => C:\Users\Admin\Pictures\SyncExit.raw.eeWDzMyD5 powershell.exe File renamed C:\Users\Admin\Pictures\BlockPush.tif => C:\Users\Admin\Pictures\BlockPush.tif.eeWDzMyD5 powershell.exe File renamed C:\Users\Admin\Pictures\ConfirmJoin.raw => C:\Users\Admin\Pictures\ConfirmJoin.raw.eeWDzMyD5 powershell.exe File opened for modification C:\Users\Admin\Pictures\SearchHide.tif.eeWDzMyD5 powershell.exe File opened for modification C:\Users\Admin\Pictures\UnpublishRequest.raw.eeWDzMyD5 powershell.exe File opened for modification C:\Users\Admin\Pictures\BlockPush.tif.eeWDzMyD5 powershell.exe File renamed C:\Users\Admin\Pictures\InvokeStart.crw => C:\Users\Admin\Pictures\InvokeStart.crw.eeWDzMyD5 powershell.exe File opened for modification C:\Users\Admin\Pictures\SyncExit.raw.eeWDzMyD5 powershell.exe File opened for modification C:\Users\Admin\Pictures\CloseEdit.raw.eeWDzMyD5 powershell.exe File opened for modification C:\Users\Admin\Pictures\ConfirmJoin.raw.eeWDzMyD5 powershell.exe File renamed C:\Users\Admin\Pictures\SearchHide.tif => C:\Users\Admin\Pictures\SearchHide.tif.eeWDzMyD5 powershell.exe File renamed C:\Users\Admin\Pictures\UnpublishRequest.raw => C:\Users\Admin\Pictures\UnpublishRequest.raw.eeWDzMyD5 powershell.exe File renamed C:\Users\Admin\Pictures\CloseEdit.raw => C:\Users\Admin\Pictures\CloseEdit.raw.eeWDzMyD5 powershell.exe File opened for modification C:\Users\Admin\Pictures\InvokeStart.crw.eeWDzMyD5 powershell.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
powershell.exedescription ioc process File opened (read-only) \??\Z: powershell.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
Processes:
powershell.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\eeWDzMyD5.bmp" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\eeWDzMyD5.bmp" powershell.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
Processes:
powershell.exepid process 652 powershell.exe 652 powershell.exe 652 powershell.exe 652 powershell.exe 652 powershell.exe 652 powershell.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
powershell.exepowershell.exepid process 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 652 powershell.exe 652 powershell.exe 652 powershell.exe 652 powershell.exe 652 powershell.exe 652 powershell.exe 652 powershell.exe -
Suspicious use of AdjustPrivilegeToken 19 IoCs
Processes:
powershell.exepowershell.exevssvc.exedescription pid process Token: SeDebugPrivilege 3064 powershell.exe Token: SeDebugPrivilege 652 powershell.exe Token: SeBackupPrivilege 652 powershell.exe Token: SeDebugPrivilege 652 powershell.exe Token: 36 652 powershell.exe Token: SeImpersonatePrivilege 652 powershell.exe Token: SeIncBasePriorityPrivilege 652 powershell.exe Token: SeIncreaseQuotaPrivilege 652 powershell.exe Token: 33 652 powershell.exe Token: SeManageVolumePrivilege 652 powershell.exe Token: SeProfSingleProcessPrivilege 652 powershell.exe Token: SeRestorePrivilege 652 powershell.exe Token: SeSecurityPrivilege 652 powershell.exe Token: SeSystemProfilePrivilege 652 powershell.exe Token: SeTakeOwnershipPrivilege 652 powershell.exe Token: SeShutdownPrivilege 652 powershell.exe Token: SeBackupPrivilege 1520 vssvc.exe Token: SeRestorePrivilege 1520 vssvc.exe Token: SeAuditPrivilege 1520 vssvc.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
powershell.exedescription pid process target process PID 3064 wrote to memory of 652 3064 powershell.exe powershell.exe PID 3064 wrote to memory of 652 3064 powershell.exe powershell.exe PID 3064 wrote to memory of 652 3064 powershell.exe powershell.exe
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\OTSLG.ps11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -ex bypass -NonI C:\Users\Admin\AppData\Local\Temp\OTSLG.ps12⤵
- Modifies extensions of user files
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
385b4a9d826a52e13e9d36280175f8e8
SHA1879c00dae1b257f93f21634aa7eaa184c9fcf5a0
SHA256253c4f5f363812e3bf95830653b86aa2efb50c6db490754a8f1899a0fe6b92dd
SHA5125ea3458f5bbb6e01ed8d2360a508b2be19d132303cafa94de82898058c4c378811556298ae844ee0b54e09a665f7816157a6c8a0e8f015d0292703896754aef8
-
memory/652-173-0x0000000004D10000-0x0000000004D11000-memory.dmpFilesize
4KB
-
memory/652-185-0x00000000048C0000-0x00000000048C1000-memory.dmpFilesize
4KB
-
memory/652-438-0x000000000B4D0000-0x000000000BB48000-memory.dmpFilesize
6.5MB
-
memory/652-174-0x00000000074B0000-0x00000000074B1000-memory.dmpFilesize
4KB
-
memory/652-437-0x000000000B4D0000-0x000000000BB48000-memory.dmpFilesize
6.5MB
-
memory/652-435-0x0000000004DC6000-0x0000000004DC8000-memory.dmpFilesize
8KB
-
memory/652-290-0x0000000004DC3000-0x0000000004DC4000-memory.dmpFilesize
4KB
-
memory/652-175-0x0000000004DC0000-0x0000000004DC1000-memory.dmpFilesize
4KB
-
memory/652-220-0x000000007EFD0000-0x000000007EFD1000-memory.dmpFilesize
4KB
-
memory/652-178-0x0000000007B50000-0x0000000007B51000-memory.dmpFilesize
4KB
-
memory/652-184-0x00000000084E0000-0x00000000084E1000-memory.dmpFilesize
4KB
-
memory/652-143-0x0000000000000000-mapping.dmp
-
memory/652-183-0x0000000008260000-0x0000000008261000-memory.dmpFilesize
4KB
-
memory/652-176-0x0000000004DC2000-0x0000000004DC3000-memory.dmpFilesize
4KB
-
memory/652-172-0x00000000048C0000-0x00000000048C1000-memory.dmpFilesize
4KB
-
memory/652-182-0x0000000007C10000-0x0000000007C11000-memory.dmpFilesize
4KB
-
memory/652-180-0x0000000007F10000-0x0000000007F11000-memory.dmpFilesize
4KB
-
memory/652-179-0x0000000007C30000-0x0000000007C31000-memory.dmpFilesize
4KB
-
memory/652-171-0x00000000048C0000-0x00000000048C1000-memory.dmpFilesize
4KB
-
memory/652-177-0x0000000007360000-0x0000000007361000-memory.dmpFilesize
4KB
-
memory/3064-128-0x000002E672806000-0x000002E672808000-memory.dmpFilesize
8KB
-
memory/3064-126-0x000002E672800000-0x000002E672802000-memory.dmpFilesize
8KB
-
memory/3064-122-0x000002E65A290000-0x000002E65A291000-memory.dmpFilesize
4KB
-
memory/3064-119-0x000002E6586E0000-0x000002E6586E2000-memory.dmpFilesize
8KB
-
memory/3064-118-0x000002E6586E0000-0x000002E6586E2000-memory.dmpFilesize
8KB
-
memory/3064-170-0x000002E6586E0000-0x000002E6586E2000-memory.dmpFilesize
8KB
-
memory/3064-129-0x000002E6586E0000-0x000002E6586E2000-memory.dmpFilesize
8KB
-
memory/3064-120-0x000002E6586E0000-0x000002E6586E2000-memory.dmpFilesize
8KB
-
memory/3064-127-0x000002E672803000-0x000002E672805000-memory.dmpFilesize
8KB
-
memory/3064-125-0x000002E672A40000-0x000002E672A41000-memory.dmpFilesize
4KB
-
memory/3064-124-0x000002E6586E0000-0x000002E6586E2000-memory.dmpFilesize
8KB
-
memory/3064-123-0x000002E6586E0000-0x000002E6586E2000-memory.dmpFilesize
8KB
-
memory/3064-121-0x000002E6586E0000-0x000002E6586E2000-memory.dmpFilesize
8KB