Overview
overview
10Static
static
1022d7d67c3a...d6.exe
windows7-x64
1022d7d67c3a...d6.exe
windows10-2004-x64
1022d7d67c3a...d6.exe
android-9-x86
22d7d67c3a...d6.exe
android-10-x64
22d7d67c3a...d6.exe
android-11-x64
22d7d67c3a...d6.exe
macos-10.15-amd64
122d7d67c3a...d6.exe
ubuntu-18.04-amd64
22d7d67c3a...d6.exe
debian-9-armhf
22d7d67c3a...d6.exe
debian-9-mips
22d7d67c3a...d6.exe
debian-9-mipsel
Analysis
-
max time kernel
143s -
max time network
176s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
27-07-2022 06:31
Behavioral task
behavioral1
Sample
22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.exe
Resource
win7-20220718-en
windows7-x64
8 signatures
300 seconds
Behavioral task
behavioral2
Sample
22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.exe
Resource
win10v2004-20220721-en
windows10-2004-x64
7 signatures
300 seconds
Behavioral task
behavioral3
Sample
22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.exe
Resource
android-x86-arm-20220621-en
android-9-x86
0 signatures
300 seconds
Behavioral task
behavioral4
Sample
22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.exe
Resource
android-x64-20220621-en
android-10-x64
0 signatures
300 seconds
Behavioral task
behavioral5
Sample
22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.exe
Resource
android-x64-arm64-20220621-en
android-11-x64
0 signatures
300 seconds
Behavioral task
behavioral6
Sample
22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.exe
Resource
macos-20220504-en
macos-10.15-amd64
0 signatures
300 seconds
Behavioral task
behavioral7
Sample
22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.exe
Resource
ubuntu1804-amd64-en-20211208
ubuntu-18.04-amd64
0 signatures
300 seconds
Behavioral task
behavioral8
Sample
22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.exe
Resource
debian9-armhf-en-20211208
debian-9-armhf
0 signatures
300 seconds
Behavioral task
behavioral9
Sample
22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.exe
Resource
debian9-mipsbe-en-20211208
debian-9-mips
0 signatures
300 seconds
Behavioral task
behavioral10
Sample
22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.exe
Resource
debian9-mipsel-en-20211208
debian-9-mipsel
0 signatures
300 seconds
General
-
Target
22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.exe
-
Size
67KB
-
MD5
598c53bfef81e489375f09792e487f1a
-
SHA1
80a29bd2c349a8588edf42653ed739054f9a10f5
-
SHA256
22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6
-
SHA512
6a82ad5009588d2fa343bef8d9d2a02e2e76eec14979487a929a96a6b6965e82265a69ef8dd29a01927e9713468de3aedd7b5ee5e79839a1a50649855a160c35
Score
10/10
Malware Config
Extracted
Path
C:\zdYRw8MR1.README.txt
Family
blackmatter
Ransom Note
~+
* +
' BLACK |
() .-.,='``'=. - o -
'=/_ \ |
* | '=._ |
\ `=./`, '
. '=.__.=' `=' *
+ Matter +
O * ' .
>>> What happens?
Your network is encrypted, and currently not operational. We have downloaded 1TB from your fileserver.
We need only money, after payment we will give you a decryptor for the entire network and you will restore all the data.
>>> What guarantees?
We are not a politically motivated group and we do not need anything other than your money.
If you pay, we will provide you the programs for decryption and we will delete your data.
If we do not give you decrypters or we do not delete your data, no one will pay us in the future, this does not comply with our goals.
We always keep our promises.
>> Data leak includes
1. Full emloyeers personal data
2. Network information
3. Schemes of buildings, active project information, architect details and contracts,
4. Finance info
>>> How to contact with us?
1. Download and install TOR Browser (https://www.torproject.org/).
2. Open http://supp24yy6a66hwszu2piygicgwzdtbwftb76htfj7vnip3getgqnzxid.onion/7NT6LXKC1XQHW5039BLOV.
>>> Warning! Recovery recommendations.
We strongly recommend you to do not MODIFY or REPAIR your files, that will damage them.
URLs
http://supp24yy6a66hwszu2piygicgwzdtbwftb76htfj7vnip3getgqnzxid.onion/7NT6LXKC1XQHW5039BLOV
Signatures
-
BlackMatter Ransomware
BlackMatter ransomware group claims to be Darkside and REvil succesor.
-
Modifies extensions of user files 24 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\SkipRequest.crw => C:\Users\Admin\Pictures\SkipRequest.crw.zdYRw8MR1 22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.exe File renamed C:\Users\Admin\Pictures\UnprotectMount.tif => C:\Users\Admin\Pictures\UnprotectMount.tif.zdYRw8MR1 22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.exe File renamed C:\Users\Admin\Pictures\WaitConnect.crw => C:\Users\Admin\Pictures\WaitConnect.crw.zdYRw8MR1 22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.exe File renamed C:\Users\Admin\Pictures\ClearClose.raw => C:\Users\Admin\Pictures\ClearClose.raw.zdYRw8MR1 22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.exe File opened for modification C:\Users\Admin\Pictures\ClearClose.raw.zdYRw8MR1 22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.exe File renamed C:\Users\Admin\Pictures\PopStep.png => C:\Users\Admin\Pictures\PopStep.png.zdYRw8MR1 22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.exe File renamed C:\Users\Admin\Pictures\ConvertToInvoke.raw => C:\Users\Admin\Pictures\ConvertToInvoke.raw.zdYRw8MR1 22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.exe File opened for modification C:\Users\Admin\Pictures\SkipSuspend.tiff 22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.exe File opened for modification C:\Users\Admin\Pictures\WaitConnect.crw.zdYRw8MR1 22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.exe File opened for modification C:\Users\Admin\Pictures\NewConfirm.crw.zdYRw8MR1 22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.exe File opened for modification C:\Users\Admin\Pictures\PopStep.png.zdYRw8MR1 22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.exe File renamed C:\Users\Admin\Pictures\ProtectRestart.tiff => C:\Users\Admin\Pictures\ProtectRestart.tiff.zdYRw8MR1 22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.exe File opened for modification C:\Users\Admin\Pictures\UnprotectMount.tif.zdYRw8MR1 22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.exe File opened for modification C:\Users\Admin\Pictures\ConvertToInvoke.raw.zdYRw8MR1 22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.exe File opened for modification C:\Users\Admin\Pictures\ImportCompare.crw.zdYRw8MR1 22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.exe File renamed C:\Users\Admin\Pictures\NewConfirm.crw => C:\Users\Admin\Pictures\NewConfirm.crw.zdYRw8MR1 22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.exe File renamed C:\Users\Admin\Pictures\SearchCheckpoint.crw => C:\Users\Admin\Pictures\SearchCheckpoint.crw.zdYRw8MR1 22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.exe File opened for modification C:\Users\Admin\Pictures\SearchCheckpoint.crw.zdYRw8MR1 22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.exe File opened for modification C:\Users\Admin\Pictures\SkipRequest.crw.zdYRw8MR1 22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.exe File renamed C:\Users\Admin\Pictures\SkipSuspend.tiff => C:\Users\Admin\Pictures\SkipSuspend.tiff.zdYRw8MR1 22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.exe File opened for modification C:\Users\Admin\Pictures\SkipSuspend.tiff.zdYRw8MR1 22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.exe File renamed C:\Users\Admin\Pictures\ImportCompare.crw => C:\Users\Admin\Pictures\ImportCompare.crw.zdYRw8MR1 22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.exe File opened for modification C:\Users\Admin\Pictures\ProtectRestart.tiff 22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.exe File opened for modification C:\Users\Admin\Pictures\ProtectRestart.tiff.zdYRw8MR1 22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\zdYRw8MR1.bmp" 22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.exe Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\zdYRw8MR1.bmp" 22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
pid Process 4984 22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.exe 4984 22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.exe 4984 22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.exe 4984 22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.exe 4984 22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.exe 4984 22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.exe -
Modifies Control Panel 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Control Panel\International 22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.exe Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Control Panel\Desktop 22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.exe Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Control Panel\Desktop\WallpaperStyle = "10" 22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4984 22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.exe 4984 22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.exe 4984 22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.exe 4984 22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.exe -
Suspicious use of AdjustPrivilegeToken 17 IoCs
description pid Process Token: SeBackupPrivilege 4984 22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.exe Token: SeDebugPrivilege 4984 22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.exe Token: 36 4984 22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.exe Token: SeImpersonatePrivilege 4984 22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.exe Token: SeIncBasePriorityPrivilege 4984 22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.exe Token: SeIncreaseQuotaPrivilege 4984 22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.exe Token: 33 4984 22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.exe Token: SeManageVolumePrivilege 4984 22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.exe Token: SeProfSingleProcessPrivilege 4984 22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.exe Token: SeRestorePrivilege 4984 22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.exe Token: SeSecurityPrivilege 4984 22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.exe Token: SeSystemProfilePrivilege 4984 22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.exe Token: SeTakeOwnershipPrivilege 4984 22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.exe Token: SeShutdownPrivilege 4984 22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.exe Token: SeBackupPrivilege 4576 vssvc.exe Token: SeRestorePrivilege 4576 vssvc.exe Token: SeAuditPrivilege 4576 vssvc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.exe"C:\Users\Admin\AppData\Local\Temp\22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.exe"1⤵
- Modifies extensions of user files
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4984
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4576