Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

blackcat.exe

windows7-x64

10

blackcat.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    601s
  • max time network
    487s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/10/2022, 09:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    blackcat.exe

  • Size

    2.6MB

  • MD5

    bb266486ee8ac70c0687989e02cefa14

  • SHA1

    11203786b17bb3873d46acae32a898c8dac09850

  • SHA256

    0c6f444c6940a3688ffc6f8b9d5774c032e3551ebbccb64e4280ae7fc1fac479

  • SHA512

    a167779fc95a5cf0a3eff86211e9e08c282470e050b17ae62c7499a82ea59b3447446eafea9d7b5c5ba833b7a2d060f76530b00509dd5ff7904a0735d83e14c4

  • SSDEEP

    49152:rEqvaaAjc2hdKjb8WXqE1PiEbE/TKMt3/RgaJ2wW4PRT8O1:rbyaALKjwWXV1P9oVvwwW4JT8

Score
10/10
blackcatdiscoveryevasionransomwaretrojan

Malware Config

Extracted

Path

C:\Users\Admin\Searches\RECOVER-sykffle-FILES.txt

Ransom Note
>> Introduction Important files on your system was ENCRYPTED and now they have have "sykffle" extension. In order to recover your files you need to follow instructions below. >> Sensitive Data Sensitive data on your system was DOWNLOADED and it will be PUBLISHED if you refuse to cooperate. Data includes: - Employees personal data, CVs, DL, SSN. - Complete network map including credentials for local and remote services. - Financial information including clients data, bills, budgets, annual reports, bank statements. - Complete datagrams/schemas/drawings for manufacturing in solidworks format - And more... Private preview is published here: http://zujgzbu5y64xbmvc42addp4lxkoosb4tslf5mehnh7pvqjpwxn5gokyd.onion/b21e1fb6-ff88-425b-8339-3523179a1e3e/886cf430a907bbe9a3fd38fb704d524dbd199c1b042ad6f65dc72ad78704e21 >> CAUTION DO NOT MODIFY FILES YOURSELF. DO NOT USE THIRD PARTY SOFTWARE TO RESTORE YOUR DATA. YOU MAY DAMAGE YOUR FILES, IT WILL RESULT IN PERMANENT DATA LOSS. YOUR DATA IS STRONGLY ENCRYPTED, YOU CAN NOT DECRYPT IT WITHOUT CIPHER KEY. >> Recovery procedure Follow these simple steps to get in touch and recover your data: 1) Download and install Tor Browser from: https://torproject.org/ 2) Navigate to: http://mu75ltv3lxd24dbyu6gtvmnwybecigs5auki7fces437xvvflzva2nqd.onion/?access-key=lL8swMvodAg%2FYAyc5utbsRPdxD8bJqfb4qHRoSdT6PwVywXgHBy2zTaT0OO21dClM%2Buit0pHzTNYnv1zE2ogXDnfp7V2AMqRPd4VS5TPNl6fFq%2FBkBb9iuNZqeMaNMx5EpJTNhPqw5UIS%2FGq4T5MLJivk1ZME7D8TSetu6aP5VxuviEkDLGeP%2BaJbkJAKy3VfNOS%2BjO2l%2FJdb2Npd1pbgETH7pUnst12C1sc%2Fmakz7HvLmaB94JeKSWb1ka5TsDmatNPHKQqJ8xmF2%2F0m%2BgTwkycUbF2oDZ4agpgQm6uUQvF7MeGc%2BwC%2B3j5YGB6rrvCxTDaBQgF7D0gFfCtuTBDsg%3D%3D
URLs

http://zujgzbu5y64xbmvc42addp4lxkoosb4tslf5mehnh7pvqjpwxn5gokyd.onion/b21e1fb6-ff88-425b-8339-3523179a1e3e/886cf430a907bbe9a3fd38fb704d524dbd199c1b042ad6f65dc72ad78704e21

http://mu75ltv3lxd24dbyu6gtvmnwybecigs5auki7fces437xvvflzva2nqd.onion/?access-key=lL8swMvodAg%2FYAyc5utbsRPdxD8bJqfb4qHRoSdT6PwVywXgHBy2zTaT0OO21dClM%2Buit0pHzTNYnv1zE2ogXDnfp7V2AMqRPd4VS5TPNl6fFq%2FBkBb9iuNZqeMaNMx5EpJTNhPqw5UIS%2FGq4T5MLJivk1ZME7D8TSetu6aP5VxuviEkDLGeP%2BaJbkJAKy3VfNOS%2BjO2l%2FJdb2Npd1pbgETH7pUnst12C1sc%2Fmakz7HvLmaB94JeKSWb1ka5TsDmatNPHKQqJ8xmF2%2F0m%2BgTwkycUbF2oDZ4agpgQm6uUQvF7MeGc%2BwC%2B3j5YGB6rrvCxTDaBQgF7D0gFfCtuTBDsg%3D%3D

Extracted

Family

blackcat

Credentials
  • Username:
    KELLERSUPPLY\Administrator
  • Password:
    d@gw00d
  • Username:
    KELLERSUPPLY\AdminRecovery
  • Password:
    K3ller!$Supp1y
  • Username:
    .\Administrator
  • Password:
    d@gw00d
  • Username:
    .\Administrator
  • Password:
    K3ller!$Supp1y
Attributes
  • enable_network_discovery

    true

  • enable_self_propagation

    false

  • enable_set_wallpaper

    true

  • extension

    sykffle

  • note_file_name

    RECOVER-${EXTENSION}-FILES.txt

  • note_full_text

    >> Introduction Important files on your system was ENCRYPTED and now they have have "${EXTENSION}" extension. In order to recover your files you need to follow instructions below. >> Sensitive Data Sensitive data on your system was DOWNLOADED and it will be PUBLISHED if you refuse to cooperate. Data includes: - Employees personal data, CVs, DL, SSN. - Complete network map including credentials for local and remote services. - Financial information including clients data, bills, budgets, annual reports, bank statements. - Complete datagrams/schemas/drawings for manufacturing in solidworks format - And more... Private preview is published here: http://zujgzbu5y64xbmvc42addp4lxkoosb4tslf5mehnh7pvqjpwxn5gokyd.onion/b21e1fb6-ff88-425b-8339-3523179a1e3e/886cf430a907bbe9a3fd38fb704d524dbd199c1b042ad6f65dc72ad78704e21 >> CAUTION DO NOT MODIFY FILES YOURSELF. DO NOT USE THIRD PARTY SOFTWARE TO RESTORE YOUR DATA. YOU MAY DAMAGE YOUR FILES, IT WILL RESULT IN PERMANENT DATA LOSS. YOUR DATA IS STRONGLY ENCRYPTED, YOU CAN NOT DECRYPT IT WITHOUT CIPHER KEY. >> Recovery procedure Follow these simple steps to get in touch and recover your data: 1) Download and install Tor Browser from: https://torproject.org/ 2) Navigate to: http://mu75ltv3lxd24dbyu6gtvmnwybecigs5auki7fces437xvvflzva2nqd.onion/?access-key=${ACCESS_KEY}

rsa_pubkey.plain

Signatures

  • BlackCat

    A Rust-based ransomware sold as RaaS first seen in late 2021.

    ransomwareblackcat
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Disables taskbar notifications via registry modification
    evasion
  • Executes dropped EXE 3 IoCs
  • Modifies extensions of user files 4 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Windows security modification 2 TTPs 2 IoCs
    evasiontrojan
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 41 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 34 IoCs
  • Drops file in Windows directory 2 IoCs
  • Interacts with shadow copies 2 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies Control Panel 1 IoCs
    evasion
  • Modifies data under HKEY_USERS 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 51 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\blackcat.exe
    C:\Users\Admin\AppData\Local\Temp\blackcat.exe -a 12345
    1⤵
    • Modifies extensions of user files
    • Enumerates connected drives
    • Drops file in System32 directory
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2148
    • C:\Windows\SysWOW64\cmd.exe
      "cmd" /c "wmic csproduct get UUID"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4696
      • C:\Windows\SysWOW64\Wbem\WMIC.exe
        wmic csproduct get UUID
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4848
    • C:\Windows\SysWOW64\cmd.exe
      "cmd" /c "fsutil behavior set SymlinkEvaluation R2L:1"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4180
      • C:\Windows\SysWOW64\fsutil.exe
        fsutil behavior set SymlinkEvaluation R2L:1
        3⤵
          PID:212
      • C:\Windows\SysWOW64\cmd.exe
        "cmd" /c "fsutil behavior set SymlinkEvaluation R2R:1"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:320
        • C:\Windows\SysWOW64\fsutil.exe
          fsutil behavior set SymlinkEvaluation R2R:1
          3⤵
            PID:3592
        • C:\Windows\SYSTEM32\cmd.exe
          "cmd" /c "vssadmin.exe delete shadows /all /quiet"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:3232
          • C:\Windows\system32\vssadmin.exe
            vssadmin.exe delete shadows /all /quiet
            3⤵
            • Interacts with shadow copies
            PID:1068
        • C:\Windows\SysWOW64\cmd.exe
          "cmd" /c "reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters /v MaxMpxCt /d 65535 /t REG_DWORD /f"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2152
          • C:\Windows\SysWOW64\reg.exe
            reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters /v MaxMpxCt /d 65535 /t REG_DWORD /f
            3⤵
              PID:1076
          • C:\Windows\SysWOW64\cmd.exe
            "cmd" /c "arp -a"
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:3768
            • C:\Windows\SysWOW64\ARP.EXE
              arp -a
              3⤵
                PID:4272
            • C:\Windows\SYSTEM32\cmd.exe
              "cmd" /c "vssadmin.exe delete shadows /all /quiet"
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:2208
              • C:\Windows\system32\vssadmin.exe
                vssadmin.exe delete shadows /all /quiet
                3⤵
                • Interacts with shadow copies
                PID:3864
          • C:\Windows\system32\vssvc.exe
            C:\Windows\system32\vssvc.exe
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:3108
          • C:\Windows\System32\alg.exe
            C:\Windows\System32\alg.exe
            1⤵
            • Executes dropped EXE
            • Windows security modification
            • Enumerates connected drives
            • Drops file in System32 directory
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • System policy modification
            PID:864
          • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
            C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
            1⤵
            • Executes dropped EXE
            PID:1348
          • C:\Windows\System32\svchost.exe
            C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
            1⤵
              PID:2972
            • C:\Windows\system32\fxssvc.exe
              C:\Windows\system32\fxssvc.exe
              1⤵
              • Executes dropped EXE
              • Modifies data under HKEY_USERS
              • Suspicious use of AdjustPrivilegeToken
              PID:1424
            • C:\Windows\system32\vssvc.exe
              C:\Windows\system32\vssvc.exe
              1⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:4592

            Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
              Filesize

              491KB

              MD5

              76a97d710fa88a93c0e1b8701409b153

              SHA1

              a738d68e8bdc9285145be7d999b7bd5c388864ef

              SHA256

              e59ed73e1a5125bb2eb401b6cd307b59b9f42a05307217b6b0535c6446b7c9e6

              SHA512

              a9c220b026f99a7ce534a31f6f2e76aaee2610aa335ecf2b338c0875bfc503fd4d8b3c1607a55d7f035e77dadbfba2dbc8a9a6e234a80e3cce134453bbe58c31

              Download Submit

            • C:\Windows\System32\FXSSVC.exe
              Filesize

              1.0MB

              MD5

              f3e3dfb8dceb0ba74ee470c39736411a

              SHA1

              0ada4c299c931a4b4261360cf680d285325544dc

              SHA256

              13a2b8e9643b60a5da646a2d7b1d66fd307af032b8c87b77a982dbc3b5be63b0

              SHA512

              5584d51b2095144f55242d7b00e6fc25689aed2439cb1ecb40bd69c8fd5be507cba2fe5722bf1badc4fd41d22422f4c5ff923ba428fda6de96040494032e4580

              Download Submit

            • C:\Windows\System32\alg.exe
              Filesize

              493KB

              MD5

              ab94db71db9b69e8dc22a70de0c6b218

              SHA1

              bc574693faf9fa814098f5590b8da3a3add615ea

              SHA256

              cfc49266b09c3c98c2047f16fdb16fe6d77f32e56625e01d9e0a8bfe2828ce34

              SHA512

              ba1076406bbfa4608144cd5afc16aafb3addde4e99976e31c2ae93c858e28d07fd296eb202fed3d9b0ca866d788c90e3d1e55ebdce59a9e4dbe1c6f94e9a3990

              Download Submit

            • \??\c:\windows\system32\Appvclient.exe
              Filesize

              1.1MB

              MD5

              c4e882b73f16e70915604619e33bd1f7

              SHA1

              05c90977673c8ec969d8d334c7f71e27f5a66033

              SHA256

              37128f1c046e0b109f20ce2066269223fbd5104ecd6b2fb996ed2896956ef081

              SHA512

              01d048b016ccb82dabd8a8f55b8b571c3becb6bf93de25ae693d1c3af2de1bc94925a48b62c9d1ad003b758b12f9815ab9c8a70d2aca0759f89748eb99af867b

              Download Submit

            • memory/864-150-0x0000000140000000-0x00000001400D5000-memory.dmp

              Filesize

              852KB

              Download

            • memory/864-160-0x0000000140000000-0x00000001400D5000-memory.dmp

              Filesize

              852KB

              Download

            • memory/864-156-0x0000000140000000-0x00000001400D5000-memory.dmp

              Filesize

              852KB

              Download

            • memory/1348-162-0x0000000140000000-0x00000001400D4000-memory.dmp

              Filesize

              848KB

              Download

            • memory/1348-152-0x0000000140000000-0x00000001400D4000-memory.dmp

              Filesize

              848KB

              Download

            • memory/1424-158-0x0000000140000000-0x0000000140160000-memory.dmp

              Filesize

              1.4MB

              Download

            • memory/1424-159-0x0000000140000000-0x0000000140160000-memory.dmp

              Filesize

              1.4MB

              Download

            • memory/2148-146-0x0000000000400000-0x00000000006C7000-memory.dmp

              Filesize

              2.8MB

              Download

            • memory/2148-147-0x0000000000400000-0x00000000006C7000-memory.dmp

              Filesize

              2.8MB

              Download

            • memory/2148-148-0x0000000000400000-0x00000000006C7000-memory.dmp

              Filesize

              2.8MB

              Download

            • memory/2148-135-0x0000000000400000-0x00000000006C7000-memory.dmp

              Filesize

              2.8MB

              Download

            • memory/2148-161-0x0000000000400000-0x00000000006C7000-memory.dmp

              Filesize

              2.8MB

              Download

            • memory/2148-132-0x0000000000400000-0x00000000006C7000-memory.dmp

              Filesize

              2.8MB

              Download