blackmatter | 77340f01535db5c80c1f3e725a8f8de17bb227f567b8f568dd339be6ddacf60e

General

Target

77340f01535db5c80c1f3e725a8f8de17bb227f567b8f568dd339be6ddacf60e.exe
Size

1.2MB
MD5

04ae8662cb8528e336b46ae2405f2c92
SHA1

833137ae5978af4b28edbb7fa6f0eec0c448fdbd
SHA256

77340f01535db5c80c1f3e725a8f8de17bb227f567b8f568dd339be6ddacf60e
SHA512

37543ab66e8f761e9d497e2efe0eb59505e5f76b16959a5681f287c7ff8f9d6db7b1383f9c2b051075ddc33c8a734f5f56376aa23ca471bf3fd60145dc621d3a

Score

10^/10

blackmatter ransomware

Malware Config

Extracted

Path

C:\1L3LaWnLv.README.txt

Family

blackmatter

Ransom Note

~+ * + ' BLACK | () .-.,='``'=. - o - '=/_ \ | * | '=._ | \ `=./`, ' . '=.__.=' `=' * + Matter + O * ' . >>> What happens? Your network is encrypted, and currently not operational. We need only money, after payment we will give you a decryptor for the entire network and you will restore all the data. >>> What guarantees? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. If we do not give you decrypters or we do not delete your data, no one will pay us in the future, this does not comply with our goals. We always keep our promises. >>> How to contact with us? 1. Download and install TOR Browser (https://www.torproject.org/). 2. Open http://supp24yy6a66hwszu2piygicgwzdtbwftb76htfj7vnip3getgqnzxid.onion/0JOA98TDMXLHJ77VDOO >>> Warning! Recovery recommendations. We strongly recommend you to do not MODIFY or REPAIR your files, that will damage them.

URLs

http://supp24yy6a66hwszu2piygicgwzdtbwftb76htfj7vnip3getgqnzxid.onion/0JOA98TDMXLHJ77VDOO

Signatures

BlackMatter Ransomware
BlackMatter ransomware group claims to be Darkside and REvil succesor.
ransomware blackmatter

Modifies extensions of user files 6 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\SplitBackup.png.1L3LaWnLv	77340f01535db5c80c1f3e725a8f8de17bb227f567b8f568dd339be6ddacf60e.exe
File renamed	C:\Users\Admin\Pictures\TraceLimit.raw => C:\Users\Admin\Pictures\TraceLimit.raw.1L3LaWnLv	77340f01535db5c80c1f3e725a8f8de17bb227f567b8f568dd339be6ddacf60e.exe
File opened for modification	C:\Users\Admin\Pictures\TraceLimit.raw.1L3LaWnLv	77340f01535db5c80c1f3e725a8f8de17bb227f567b8f568dd339be6ddacf60e.exe
File renamed	C:\Users\Admin\Pictures\ResumeConfirm.png => C:\Users\Admin\Pictures\ResumeConfirm.png.1L3LaWnLv	77340f01535db5c80c1f3e725a8f8de17bb227f567b8f568dd339be6ddacf60e.exe
File opened for modification	C:\Users\Admin\Pictures\ResumeConfirm.png.1L3LaWnLv	77340f01535db5c80c1f3e725a8f8de17bb227f567b8f568dd339be6ddacf60e.exe
File renamed	C:\Users\Admin\Pictures\SplitBackup.png => C:\Users\Admin\Pictures\SplitBackup.png.1L3LaWnLv	77340f01535db5c80c1f3e725a8f8de17bb227f567b8f568dd339be6ddacf60e.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\1L3LaWnLv.bmp"	77340f01535db5c80c1f3e725a8f8de17bb227f567b8f568dd339be6ddacf60e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\1L3LaWnLv.bmp"	77340f01535db5c80c1f3e725a8f8de17bb227f567b8f568dd339be6ddacf60e.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 11 IoCs

pid	Process
3516	77340f01535db5c80c1f3e725a8f8de17bb227f567b8f568dd339be6ddacf60e.exe
3516	77340f01535db5c80c1f3e725a8f8de17bb227f567b8f568dd339be6ddacf60e.exe
3516	77340f01535db5c80c1f3e725a8f8de17bb227f567b8f568dd339be6ddacf60e.exe
3516	77340f01535db5c80c1f3e725a8f8de17bb227f567b8f568dd339be6ddacf60e.exe
3516	77340f01535db5c80c1f3e725a8f8de17bb227f567b8f568dd339be6ddacf60e.exe
3516	77340f01535db5c80c1f3e725a8f8de17bb227f567b8f568dd339be6ddacf60e.exe
3516	77340f01535db5c80c1f3e725a8f8de17bb227f567b8f568dd339be6ddacf60e.exe
3516	77340f01535db5c80c1f3e725a8f8de17bb227f567b8f568dd339be6ddacf60e.exe
3516	77340f01535db5c80c1f3e725a8f8de17bb227f567b8f568dd339be6ddacf60e.exe
3516	77340f01535db5c80c1f3e725a8f8de17bb227f567b8f568dd339be6ddacf60e.exe
3516	77340f01535db5c80c1f3e725a8f8de17bb227f567b8f568dd339be6ddacf60e.exe

Modifies Control Panel 3 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Control Panel\International	77340f01535db5c80c1f3e725a8f8de17bb227f567b8f568dd339be6ddacf60e.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Control Panel\Desktop	77340f01535db5c80c1f3e725a8f8de17bb227f567b8f568dd339be6ddacf60e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Control Panel\Desktop\WallpaperStyle = "10"	77340f01535db5c80c1f3e725a8f8de17bb227f567b8f568dd339be6ddacf60e.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3516	77340f01535db5c80c1f3e725a8f8de17bb227f567b8f568dd339be6ddacf60e.exe
3516	77340f01535db5c80c1f3e725a8f8de17bb227f567b8f568dd339be6ddacf60e.exe
3516	77340f01535db5c80c1f3e725a8f8de17bb227f567b8f568dd339be6ddacf60e.exe
3516	77340f01535db5c80c1f3e725a8f8de17bb227f567b8f568dd339be6ddacf60e.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeBackupPrivilege	3516	77340f01535db5c80c1f3e725a8f8de17bb227f567b8f568dd339be6ddacf60e.exe
Token: SeDebugPrivilege	3516	77340f01535db5c80c1f3e725a8f8de17bb227f567b8f568dd339be6ddacf60e.exe
Token: 36	3516	77340f01535db5c80c1f3e725a8f8de17bb227f567b8f568dd339be6ddacf60e.exe
Token: SeImpersonatePrivilege	3516	77340f01535db5c80c1f3e725a8f8de17bb227f567b8f568dd339be6ddacf60e.exe
Token: SeIncBasePriorityPrivilege	3516	77340f01535db5c80c1f3e725a8f8de17bb227f567b8f568dd339be6ddacf60e.exe
Token: SeIncreaseQuotaPrivilege	3516	77340f01535db5c80c1f3e725a8f8de17bb227f567b8f568dd339be6ddacf60e.exe
Token: 33	3516	77340f01535db5c80c1f3e725a8f8de17bb227f567b8f568dd339be6ddacf60e.exe
Token: SeManageVolumePrivilege	3516	77340f01535db5c80c1f3e725a8f8de17bb227f567b8f568dd339be6ddacf60e.exe
Token: SeProfSingleProcessPrivilege	3516	77340f01535db5c80c1f3e725a8f8de17bb227f567b8f568dd339be6ddacf60e.exe
Token: SeRestorePrivilege	3516	77340f01535db5c80c1f3e725a8f8de17bb227f567b8f568dd339be6ddacf60e.exe
Token: SeSecurityPrivilege	3516	77340f01535db5c80c1f3e725a8f8de17bb227f567b8f568dd339be6ddacf60e.exe
Token: SeSystemProfilePrivilege	3516	77340f01535db5c80c1f3e725a8f8de17bb227f567b8f568dd339be6ddacf60e.exe
Token: SeTakeOwnershipPrivilege	3516	77340f01535db5c80c1f3e725a8f8de17bb227f567b8f568dd339be6ddacf60e.exe
Token: SeShutdownPrivilege	3516	77340f01535db5c80c1f3e725a8f8de17bb227f567b8f568dd339be6ddacf60e.exe
Token: SeBackupPrivilege	2008	vssvc.exe
Token: SeRestorePrivilege	2008	vssvc.exe
Token: SeAuditPrivilege	2008	vssvc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3516	77340f01535db5c80c1f3e725a8f8de17bb227f567b8f568dd339be6ddacf60e.exe

C:\Users\Admin\AppData\Local\Temp\77340f01535db5c80c1f3e725a8f8de17bb227f567b8f568dd339be6ddacf60e.exe
"C:\Users\Admin\AppData\Local\Temp\77340f01535db5c80c1f3e725a8f8de17bb227f567b8f568dd339be6ddacf60e.exe"
1⤵
- Modifies extensions of user files
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3516

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2008

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3516-119-0x0000000002D60000-0x0000000002D61000-memory.dmp

Filesize
4KB

Download
memory/3516-118-0x0000000002D63000-0x0000000002D65000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing