Analysis
-
max time kernel
101s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
29-08-2023 17:47
Behavioral task
behavioral1
Sample
sample1.exe
Resource
win7-20230712-en
windows7-x64
Behavioral task
behavioral2
Sample
sample1.exe
Resource
win10v2004-20230824-en
windows10-2004-x64
General
-
Target
sample1.exe
-
Size
2.9MB
-
MD5
ff8a7dd8b1cb0420dd18810041d172a7
-
SHA1
cc166bc3eaa024aac4a2cdc02174ae87fcf47e28
-
SHA256
ecea6b772742758a2240898ef772ca11aa9d870aec711cffab8994c23044117c
-
SHA512
edac57212b21a8046ab07213bf0ea51d1f3c5c9c539812fb1dffba6663b1f74e137991128f1c3135f4c1ab2ff4b470dcc6563ecae5079546dd1f6dfda210ba60
-
SSDEEP
49152:VUzeOdI+NDXIgqUPGPiTgvRZHrn7hQyZ9haNSAXpuNh/RgaJ2wf3:VUzekDpRGaTARZHPhQMCcyYvwwf3
Malware Config
Extracted
blackcat
-
enable_network_discovery
true
-
enable_self_propagation
true
-
enable_set_wallpaper
true
-
extension
kh1ftzx
-
note_file_name
RECOVER-${EXTENSION}-FILES.txt
-
note_full_text
>> What happened? Important files on your network was ENCRYPTED and now they have "${EXTENSION}" extension. In order to recover your files you need to follow instructions below. >> Sensitive Data Sensitive data on your system was DOWNLOADED. If you DON'T WANT your sensitive data to be PUBLISHED you have to act quickly. Data includes: - Employees personal data, CVs, DL, SSN. - Complete network map including credentials for local and remote services. - Private financial information including: clients data, bills, budgets, annual reports, bank statements. - Manufacturing documents including: datagrams, schemas, drawings in solidworks format - And more... >> CAUTION DO NOT MODIFY ENCRYPTED FILES YOURSELF. DO NOT USE THIRD PARTY SOFTWARE TO RESTORE YOUR DATA. YOU MAY DAMAGE YOUR FILES, IT WILL RESULT IN PERMANENT DATA LOSS. >> What should I do next? Follow these simple steps to get everything back to normal: 1) Download and install Tor Browser from: https://torproject.org/ 2) Navigate to: http://rfosusl6qdm4zhoqbqnjxaloprld2qz35u77h4aap46rhwkouejsooqd.onion/?access-key=${ACCESS_KEY}
Signatures
-
BlackCat
A Rust-based ransomware sold as RaaS first seen in late 2021.
-
Suspicious behavior: EnumeratesProcesses 19 IoCs
pid Process 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1904 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1904 taskmgr.exe -
Suspicious use of FindShellTrayWindow 46 IoCs
pid Process 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe -
Suspicious use of SendNotifyMessage 45 IoCs
pid Process 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe 1904 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\sample1.exe"C:\Users\Admin\AppData\Local\Temp\sample1.exe"1⤵PID:2280
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1904