General

  • Target

    f725792a5ef0512f3c5356d79fb3be5afcbaffaa4af41498342f7d09d703761f

  • Size

    718KB

  • Sample

    221226-m3htcacg89

  • MD5

    d7a24de75b761cb98f580dafda4ba885

  • SHA1

    86dc51cfc817937f9525b8aa2fa71e918288a44d

  • SHA256

    f725792a5ef0512f3c5356d79fb3be5afcbaffaa4af41498342f7d09d703761f

  • SHA512

    c3fd50a296b4d251a614816756eb17632779c0ef0e72826d9d276ccae8b1689ca0523a22027509ce20bf125f858f713b08967ae55501c457bc9d8fca956b0e9e

  • SSDEEP

    12288:YuLRIEFPULfzlsH5HCSSv5zEWptZ/Vlt:YeRIEF6zlsu5AWptRVlt

Malware Config

Extracted

Path

C:\ProgramData\#BlackHunt_ReadMe.hta

Ransom Note
YOUR WHOLE NETWORK HAS BEEN PENETRATED BY Black Hunt ! We also have uploaded your sensitive data, which we Will leak or sell in case of no cooperation! Restore your data possible only buying private key from us ATTENTION remember, there are many middle man services out there pretending that they can recover or decrypt your files , whom neither will contact us or scam you, Remember we are first and last solution for your files otherwise you will only waste money and time trying to decrypt your files without our decryptor and through third party softwares will make your files completely useless, there is no third party decryptor since we are the only key holders we have uploaded many critical data and information from your machines , we won't leak or sell any of them in Case of successful Corporation, however if we don't hear from you in 14 days we will either sell or leak your data in many forums Remain all of your files untouched, do not change their name, extension and... CONTACT US Your system is offline. in order to contact us you can email this address amike1096@gmail.com this ID ( fTzI0OtPuLCVZME3 ) for the title of your email. If you weren't able to contact us whitin 24 hours please email: onion746@onionmail.com Check your data situation in http://sdjf982lkjsdvcjlksaf2kjhlksvvnktyoiasuc92lf.onion
Emails

amike1096@gmail.com

onion746@onionmail.com

URLs

http://sdjf982lkjsdvcjlksaf2kjhlksvvnktyoiasuc92lf.onion

Extracted

Path

C:\ProgramData\#BlackHunt_ReadMe.hta

Ransom Note
YOUR WHOLE NETWORK HAS BEEN PENETRATED BY Black Hunt ! We also have uploaded your sensitive data, which we Will leak or sell in case of no cooperation! Restore your data possible only buying private key from us ATTENTION remember, there are many middle man services out there pretending that they can recover or decrypt your files , whom neither will contact us or scam you, Remember we are first and last solution for your files otherwise you will only waste money and time trying to decrypt your files without our decryptor and through third party softwares will make your files completely useless, there is no third party decryptor since we are the only key holders we have uploaded many critical data and information from your machines , we won't leak or sell any of them in Case of successful Corporation, however if we don't hear from you in 14 days we will either sell or leak your data in many forums Remain all of your files untouched, do not change their name, extension and... CONTACT US Your system is offline. in order to contact us you can email this address amike1096@gmail.com this ID ( u5xdXjHizdoubvsA ) for the title of your email. If you weren't able to contact us whitin 24 hours please email: onion746@onionmail.com Check your data situation in http://sdjf982lkjsdvcjlksaf2kjhlksvvnktyoiasuc92lf.onion
Emails

amike1096@gmail.com

onion746@onionmail.com

URLs

http://sdjf982lkjsdvcjlksaf2kjhlksvvnktyoiasuc92lf.onion

Targets

    • Target

      f725792a5ef0512f3c5356d79fb3be5afcbaffaa4af41498342f7d09d703761f

    • Size

      718KB

    • MD5

      d7a24de75b761cb98f580dafda4ba885

    • SHA1

      86dc51cfc817937f9525b8aa2fa71e918288a44d

    • SHA256

      f725792a5ef0512f3c5356d79fb3be5afcbaffaa4af41498342f7d09d703761f

    • SHA512

      c3fd50a296b4d251a614816756eb17632779c0ef0e72826d9d276ccae8b1689ca0523a22027509ce20bf125f858f713b08967ae55501c457bc9d8fca956b0e9e

    • SSDEEP

      12288:YuLRIEFPULfzlsH5HCSSv5zEWptZ/Vlt:YeRIEF6zlsu5AWptRVlt

    • Deletes NTFS Change Journal

      The USN change journal is a persistent log of all changes made to local files used by Windows Server systems.

    • Modifies Windows Defender Real-time Protection settings

    • UAC bypass

    • Clears Windows event logs

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Modifies boot configuration data using bcdedit

    • Deletes backup catalog

      Uses wbadmin.exe to inhibit system recovery.

    • Disables Task Manager via registry modification

    • Disables use of System Restore points

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Adds Run key to start application

    • Checks whether UAC is enabled

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v6

Execution

Command-Line Interface

1
T1059

Scheduled Task

1
T1053

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Bypass User Account Control

1
T1088

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

5
T1112

Disabling Security Tools

2
T1089

Bypass User Account Control

1
T1088

Indicator Removal on Host

1
T1070

File Deletion

3
T1107

Discovery

Query Registry

3
T1012

System Information Discovery

5
T1082

Peripheral Device Discovery

2
T1120

Impact

Inhibit System Recovery

6
T1490

Data Destruction

1
T1485

Defacement

1
T1491

Tasks