Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
11-02-2022 15:45
Static task
static1
Behavioral task
behavioral1
Sample
entry_1_0/Malware_111113.exe
Resource
win10-en-20211208
General
-
Target
entry_1_0/Malware_111113.exe
-
Size
67KB
-
MD5
31bb101acf2dac98da60970b19724556
-
SHA1
2059a0e17ae68b6342f7fd60f9e27286cc4e5410
-
SHA256
bd0a7378cd96701edafc0a8ddd7b2a9904552be29804750bff47b3e08e23319f
-
SHA512
7266fa80ff54ad0a7a290f8e5a85b616dc0e4ad68049536907487cb4083ab2464761ea858bc99168816606e9d5407bb74dc2e73eb027228c3da3d23b2a86b012
Malware Config
Extracted
C:\uR7ZOTnZH.README.txt
blackmatter
http://supp24yy6a66hwszu2piygicgwzdtbwftb76htfj7vnip3getgqnzxid.onion/7NT6LXKC1XQHW5039BLOV
Signatures
-
BlackMatter Ransomware
BlackMatter ransomware group claims to be Darkside and REvil succesor.
-
Modifies extensions of user files 12 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
Malware_111113.exedescription ioc process File renamed C:\Users\Admin\Pictures\BackupUnpublish.raw => C:\Users\Admin\Pictures\BackupUnpublish.raw.uR7ZOTnZH Malware_111113.exe File renamed C:\Users\Admin\Pictures\PopStart.png => C:\Users\Admin\Pictures\PopStart.png.uR7ZOTnZH Malware_111113.exe File opened for modification C:\Users\Admin\Pictures\PopStart.png.uR7ZOTnZH Malware_111113.exe File renamed C:\Users\Admin\Pictures\SelectUnlock.tif => C:\Users\Admin\Pictures\SelectUnlock.tif.uR7ZOTnZH Malware_111113.exe File opened for modification C:\Users\Admin\Pictures\SelectUnlock.tif.uR7ZOTnZH Malware_111113.exe File opened for modification C:\Users\Admin\Pictures\UninstallEnable.png.uR7ZOTnZH Malware_111113.exe File opened for modification C:\Users\Admin\Pictures\BackupUnpublish.raw.uR7ZOTnZH Malware_111113.exe File renamed C:\Users\Admin\Pictures\CompareFind.crw => C:\Users\Admin\Pictures\CompareFind.crw.uR7ZOTnZH Malware_111113.exe File opened for modification C:\Users\Admin\Pictures\CompareFind.crw.uR7ZOTnZH Malware_111113.exe File renamed C:\Users\Admin\Pictures\StepRestart.raw => C:\Users\Admin\Pictures\StepRestart.raw.uR7ZOTnZH Malware_111113.exe File opened for modification C:\Users\Admin\Pictures\StepRestart.raw.uR7ZOTnZH Malware_111113.exe File renamed C:\Users\Admin\Pictures\UninstallEnable.png => C:\Users\Admin\Pictures\UninstallEnable.png.uR7ZOTnZH Malware_111113.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
Processes:
Malware_111113.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\uR7ZOTnZH.bmp" Malware_111113.exe Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\uR7ZOTnZH.bmp" Malware_111113.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
Processes:
Malware_111113.exepid process 1724 Malware_111113.exe 1724 Malware_111113.exe 1724 Malware_111113.exe 1724 Malware_111113.exe 1724 Malware_111113.exe 1724 Malware_111113.exe -
Modifies Control Panel 3 IoCs
Processes:
Malware_111113.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Control Panel\International Malware_111113.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Control Panel\Desktop Malware_111113.exe Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Control Panel\Desktop\WallpaperStyle = "10" Malware_111113.exe -
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
NOTEPAD.EXEpid process 1304 NOTEPAD.EXE -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
Malware_111113.exepid process 1724 Malware_111113.exe 1724 Malware_111113.exe 1724 Malware_111113.exe 1724 Malware_111113.exe -
Suspicious use of AdjustPrivilegeToken 17 IoCs
Processes:
Malware_111113.exevssvc.exedescription pid process Token: SeBackupPrivilege 1724 Malware_111113.exe Token: SeDebugPrivilege 1724 Malware_111113.exe Token: 36 1724 Malware_111113.exe Token: SeImpersonatePrivilege 1724 Malware_111113.exe Token: SeIncBasePriorityPrivilege 1724 Malware_111113.exe Token: SeIncreaseQuotaPrivilege 1724 Malware_111113.exe Token: 33 1724 Malware_111113.exe Token: SeManageVolumePrivilege 1724 Malware_111113.exe Token: SeProfSingleProcessPrivilege 1724 Malware_111113.exe Token: SeRestorePrivilege 1724 Malware_111113.exe Token: SeSecurityPrivilege 1724 Malware_111113.exe Token: SeSystemProfilePrivilege 1724 Malware_111113.exe Token: SeTakeOwnershipPrivilege 1724 Malware_111113.exe Token: SeShutdownPrivilege 1724 Malware_111113.exe Token: SeBackupPrivilege 1600 vssvc.exe Token: SeRestorePrivilege 1600 vssvc.exe Token: SeAuditPrivilege 1600 vssvc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\entry_1_0\Malware_111113.exe"C:\Users\Admin\AppData\Local\Temp\entry_1_0\Malware_111113.exe"1⤵
- Modifies extensions of user files
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\uR7ZOTnZH.README.txt1⤵
- Opens file in notepad (likely ransom note)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Desktop\uR7ZOTnZH.README.txtMD5
f66968c47a64569e2281f65a95991be0
SHA1ef9e3e80bfbea4c3021b226cb8cd00687013b8a8
SHA2564b950c763006e7c4569df8742855cec31bf82f835bd7e2bdcb5f128db34c82bf
SHA512cb4ace1b3e891ab100b3950c6bc133b216e91c8978a3af1ffd75617b606bb7ceb0133f44d37a30a827655e5b84b016d736a732f5f37635bb727e1a5b722cad24
-
memory/1724-115-0x0000000001273000-0x0000000001275000-memory.dmpFilesize
8KB
-
memory/1724-116-0x0000000001270000-0x0000000001271000-memory.dmpFilesize
4KB