Resubmissions

28-12-2022 20:20

221228-y4jb2see8z 10

28-12-2022 20:01

221228-yrsd7aee5y 10

General

  • Target

    f3474589cafa855a73d0830883b9909095f82c28aa468e999940faf85beca4c1

  • Size

    66KB

  • Sample

    221228-y4jb2see8z

  • MD5

    62e9edb7e44dc3eecd59ad14f9324dff

  • SHA1

    537f2f42c2aeef0134c2a32a84733796909f0f3e

  • SHA256

    f3474589cafa855a73d0830883b9909095f82c28aa468e999940faf85beca4c1

  • SHA512

    93ed22604d2fac6ffb2002617a04bb7793c78cbb96fa79aead8ac4cb22ffffe8bd2ae7c7c7c026780eb3c5185af7cc534a3ed3238c05c73c9d4b21003729bd0c

  • SSDEEP

    1536:jzICS4AT6GxdEe+TOdincJXvKvWLBjklE:8R7auJXSOhCE

Score
10/10

Malware Config

Extracted

Family

blackmatter

Version

1.2

Extracted

Path

C:\4tYDr68D1.README.txt

Family

blackmatter

Ransom Note
~+ * + ' BLACK | () .-.,='``'=. - o - '=/_ \ | * | '=._ | \ `=./`, ' . '=.__.=' `=' * + Matter + O * ' . >>> What happens? Your network is encrypted, and currently not operational. We need only money, after payment we will give you a decryptor for the entire network and you will restore all the data. >>> What guarantees? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. If we do not give you decrypters or we do not delete your data, no one will pay us in the future, this does not comply with our goals. We always keep our promises. >>> How to contact with us? 1. Download and install TOR Browser (https://www.torproject.org/). 2. Open http://supp24yy6a66hwszu2piygicgwzdtbwftb76htfj7vnip3getgqnzxid.onion/GDBJS76DH3D4IKQD2QO7R. >>> Warning! Recovery recommendations. We strongly recommend you to do not MODIFY or REPAIR your files, that will damage them.
URLs

http://supp24yy6a66hwszu2piygicgwzdtbwftb76htfj7vnip3getgqnzxid.onion/GDBJS76DH3D4IKQD2QO7R

Targets

    • Target

      f3474589cafa855a73d0830883b9909095f82c28aa468e999940faf85beca4c1

    • Size

      66KB

    • MD5

      62e9edb7e44dc3eecd59ad14f9324dff

    • SHA1

      537f2f42c2aeef0134c2a32a84733796909f0f3e

    • SHA256

      f3474589cafa855a73d0830883b9909095f82c28aa468e999940faf85beca4c1

    • SHA512

      93ed22604d2fac6ffb2002617a04bb7793c78cbb96fa79aead8ac4cb22ffffe8bd2ae7c7c7c026780eb3c5185af7cc534a3ed3238c05c73c9d4b21003729bd0c

    • SSDEEP

      1536:jzICS4AT6GxdEe+TOdincJXvKvWLBjklE:8R7auJXSOhCE

    Score
    10/10
    • BlackMatter Ransomware

      BlackMatter ransomware group claims to be Darkside and REvil succesor.

    • Executes dropped EXE

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Sets desktop wallpaper using registry

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Impact

Defacement

1
T1491

Tasks