Analysis
-
max time kernel
122s -
max time network
106s -
platform
windows10-1703_x64 -
resource
win10-20230703-en -
resource tags
arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system -
submitted
30-08-2023 02:38
Behavioral task
behavioral1
Sample
sample1.exe
Resource
win10-20230703-en
windows10-1703-x64
General
-
Target
sample1.exe
-
Size
2.9MB
-
MD5
ff8a7dd8b1cb0420dd18810041d172a7
-
SHA1
cc166bc3eaa024aac4a2cdc02174ae87fcf47e28
-
SHA256
ecea6b772742758a2240898ef772ca11aa9d870aec711cffab8994c23044117c
-
SHA512
edac57212b21a8046ab07213bf0ea51d1f3c5c9c539812fb1dffba6663b1f74e137991128f1c3135f4c1ab2ff4b470dcc6563ecae5079546dd1f6dfda210ba60
-
SSDEEP
49152:VUzeOdI+NDXIgqUPGPiTgvRZHrn7hQyZ9haNSAXpuNh/RgaJ2wf3:VUzekDpRGaTARZHPhQMCcyYvwwf3
Malware Config
Extracted
blackcat
-
enable_network_discovery
true
-
enable_self_propagation
true
-
enable_set_wallpaper
true
-
extension
kh1ftzx
-
note_file_name
RECOVER-${EXTENSION}-FILES.txt
-
note_full_text
>> What happened? Important files on your network was ENCRYPTED and now they have "${EXTENSION}" extension. In order to recover your files you need to follow instructions below. >> Sensitive Data Sensitive data on your system was DOWNLOADED. If you DON'T WANT your sensitive data to be PUBLISHED you have to act quickly. Data includes: - Employees personal data, CVs, DL, SSN. - Complete network map including credentials for local and remote services. - Private financial information including: clients data, bills, budgets, annual reports, bank statements. - Manufacturing documents including: datagrams, schemas, drawings in solidworks format - And more... >> CAUTION DO NOT MODIFY ENCRYPTED FILES YOURSELF. DO NOT USE THIRD PARTY SOFTWARE TO RESTORE YOUR DATA. YOU MAY DAMAGE YOUR FILES, IT WILL RESULT IN PERMANENT DATA LOSS. >> What should I do next? Follow these simple steps to get everything back to normal: 1) Download and install Tor Browser from: https://torproject.org/ 2) Navigate to: http://rfosusl6qdm4zhoqbqnjxaloprld2qz35u77h4aap46rhwkouejsooqd.onion/?access-key=${ACCESS_KEY}
Signatures
-
BlackCat
A Rust-based ransomware sold as RaaS first seen in late 2021.
-
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\rescache\_merged\1601268389\3877292338.pri taskmgr.exe File created C:\Windows\rescache\_merged\4183903823\810424605.pri taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 43 IoCs
pid Process 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2740 taskmgr.exe Token: SeSystemProfilePrivilege 2740 taskmgr.exe Token: SeCreateGlobalPrivilege 2740 taskmgr.exe -
Suspicious use of FindShellTrayWindow 56 IoCs
pid Process 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe -
Suspicious use of SendNotifyMessage 55 IoCs
pid Process 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe 2740 taskmgr.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2232 wrote to memory of 3792 2232 cmd.exe 76 PID 2232 wrote to memory of 3792 2232 cmd.exe 76 PID 2232 wrote to memory of 3792 2232 cmd.exe 76
Processes
-
C:\Users\Admin\AppData\Local\Temp\sample1.exe"C:\Users\Admin\AppData\Local\Temp\sample1.exe"1⤵PID:2676
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4848
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\sample1.exesample1.exe --access-token a2⤵PID:3792
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2740