Overview

overview

10

Static

static

10

24e77cdf98...JC.exe

windows7-x64

10

24e77cdf98...JC.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    18-08-2023 13:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    24e77cdf989fe275ee1a32971d9df69e_darkside_JC.exe

  • Size

    77KB

  • MD5

    24e77cdf989fe275ee1a32971d9df69e

  • SHA1

    707df9c69ba1e4c1c89eb2652b17dcb309de1a8a

  • SHA256

    bc6a1e3bee0aadbdd1a7132bbd8a56ceb559a479a3f521a56738e146be999f96

  • SHA512

    96194b78e6ad96b54000fe0b5344f1e28bec05e7d6ba6235470b6fbd114e10a18152f20ac852d7fe3b1b49cc583df5f8a2cb950a9e6894ea4e991696a005a85e

  • SSDEEP

    1536:OnICS4ArFnRoHhcVyid9EZZoi+zQQaHYqf5O4QN:pZnmqVyq9EN+MvlZQ

Score
10/10
blackmatterransomware

Malware Config

Extracted

Path

C:\ctFsubls0.README.txt

Family

blackmatter

Ransom Note
~+ * + ' BLACK | () .-.,='``'=. - o - '=/_ \ | * | '=._ | \ `=./`, ' . '=.__.=' `=' * + Matter + O * ' . >>> What happens? Your network is encrypted, and currently not operational. We need only money, after payment we will give you a decryptor for the entire network and you will restore all the data. >>> What guarantees? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. If we do not give you decrypters or we do not delete your data, no one will pay us in the future, this does not comply with our goals. We always keep our promises. >>> How to contact with us? 1. Download and install TOR Browser (https://www.torproject.org/). 2. Open http://supp24yy6a66hwszu2piygicgwzdtbwftb76htfj7vnip3getgqnzxid.onion/O3KTUJZRE6CB4Q1OBR >>> Warning! Recovery recommendations. We strongly recommend you to do not MODIFY or REPAIR your files, that will damage them.
URLs

http://supp24yy6a66hwszu2piygicgwzdtbwftb76htfj7vnip3getgqnzxid.onion/O3KTUJZRE6CB4Q1OBR

Signatures

  • BlackMatter Ransomware

    BlackMatter ransomware group claims to be Darkside and REvil succesor.

    ransomwareblackmatter
  • Renames multiple (152) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Control Panel 3 IoCs
    evasion
  • Modifies registry class 20 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
    evasionspywaretrojan
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 17 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\24e77cdf989fe275ee1a32971d9df69e_darkside_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\24e77cdf989fe275ee1a32971d9df69e_darkside_JC.exe"
    1⤵
    • Sets desktop wallpaper using registry
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Modifies Control Panel
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2020
    • C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" /p C:\ctFsubls0.README.txt
      2⤵
      • Opens file in notepad (likely ransom note)
      • Suspicious use of WriteProcessMemory
      PID:2708
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:2760
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3024

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Defacement

1
T1491

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    bdb4fbd2657475214a9a32d260381d36

    SHA1

    678795b0611a33226f3529619cc05be6b16e317f

    SHA256

    ee8d098deb1a81799de86a46156eb89251a3f880373fc94429cbc3135b1e5ff8

    SHA512

    30e868391b8339f3321484c2f4ac698bcdf6e5071fdddc548da5e0d230b91014522d31ded8dc3ce43c2fc7c89a6c1bcf61f2c423599555f5cce8dc5260343296

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\Cab7DAA.tmp
    Filesize

    62KB

    MD5

    3ac860860707baaf32469fa7cc7c0192

    SHA1

    c33c2acdaba0e6fa41fd2f00f186804722477639

    SHA256

    d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

    SHA512

    d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\Tar7E49.tmp
    Filesize

    164KB

    MD5

    4ff65ad929cd9a367680e0e5b1c08166

    SHA1

    c0af0d4396bd1f15c45f39d3b849ba444233b3a2

    SHA256

    c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

    SHA512

    f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

    Download Submit
  • C:\ctFsubls0.README.txt
    Filesize

    1KB

    MD5

    2a2ac841d6b7515f4b1021b92cc5f072

    SHA1

    e48a7a2be20b978f71a92f12ada328bcfd0b89c6

    SHA256

    9a59566d9ef3bab7faf9abc23f25aa19218d5afa2a910144acd011a78521377e

    SHA512

    a7944a10f2721db3dbdf5c36e80aae057c5fc8e2aab22a8d50c4d4e6436a7e22313257dd934961db1fa5e506c39ca23600c9d3e96a463221c13b54651bd47579

    Download Submit
  • C:\ctFsubls0.README.txt
    Filesize

    1KB

    MD5

    2a2ac841d6b7515f4b1021b92cc5f072

    SHA1

    e48a7a2be20b978f71a92f12ada328bcfd0b89c6

    SHA256

    9a59566d9ef3bab7faf9abc23f25aa19218d5afa2a910144acd011a78521377e

    SHA512

    a7944a10f2721db3dbdf5c36e80aae057c5fc8e2aab22a8d50c4d4e6436a7e22313257dd934961db1fa5e506c39ca23600c9d3e96a463221c13b54651bd47579

    Download Submit
  • memory/2020-54-0x0000000000120000-0x0000000000160000-memory.dmp
    Filesize

    256KB

    Download
  • memory/2760-372-0x0000000004260000-0x0000000004261000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2760-373-0x0000000004350000-0x0000000004360000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2760-374-0x0000000004260000-0x0000000004261000-memory.dmp
    Filesize

    4KB

    Download