Analysis
-
max time kernel
145s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system -
submitted
07-12-2023 12:09
Behavioral task
behavioral1
Sample
sample1.exe
Resource
win10v2004-20231130-en
windows10-2004-x64
General
-
Target
sample1.exe
-
Size
2.9MB
-
MD5
ff8a7dd8b1cb0420dd18810041d172a7
-
SHA1
cc166bc3eaa024aac4a2cdc02174ae87fcf47e28
-
SHA256
ecea6b772742758a2240898ef772ca11aa9d870aec711cffab8994c23044117c
-
SHA512
edac57212b21a8046ab07213bf0ea51d1f3c5c9c539812fb1dffba6663b1f74e137991128f1c3135f4c1ab2ff4b470dcc6563ecae5079546dd1f6dfda210ba60
-
SSDEEP
49152:VUzeOdI+NDXIgqUPGPiTgvRZHrn7hQyZ9haNSAXpuNh/RgaJ2wf3:VUzekDpRGaTARZHPhQMCcyYvwwf3
Malware Config
Extracted
blackcat
-
enable_network_discovery
true
-
enable_self_propagation
true
-
enable_set_wallpaper
true
-
extension
kh1ftzx
-
note_file_name
RECOVER-${EXTENSION}-FILES.txt
-
note_full_text
>> What happened? Important files on your network was ENCRYPTED and now they have "${EXTENSION}" extension. In order to recover your files you need to follow instructions below. >> Sensitive Data Sensitive data on your system was DOWNLOADED. If you DON'T WANT your sensitive data to be PUBLISHED you have to act quickly. Data includes: - Employees personal data, CVs, DL, SSN. - Complete network map including credentials for local and remote services. - Private financial information including: clients data, bills, budgets, annual reports, bank statements. - Manufacturing documents including: datagrams, schemas, drawings in solidworks format - And more... >> CAUTION DO NOT MODIFY ENCRYPTED FILES YOURSELF. DO NOT USE THIRD PARTY SOFTWARE TO RESTORE YOUR DATA. YOU MAY DAMAGE YOUR FILES, IT WILL RESULT IN PERMANENT DATA LOSS. >> What should I do next? Follow these simple steps to get everything back to normal: 1) Download and install Tor Browser from: https://torproject.org/ 2) Navigate to: http://rfosusl6qdm4zhoqbqnjxaloprld2qz35u77h4aap46rhwkouejsooqd.onion/?access-key=${ACCESS_KEY}
Signatures
-
BlackCat
A Rust-based ransomware sold as RaaS first seen in late 2021.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 63 IoCs
pid Process 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 888 taskmgr.exe Token: SeSystemProfilePrivilege 888 taskmgr.exe Token: SeCreateGlobalPrivilege 888 taskmgr.exe Token: 33 888 taskmgr.exe Token: SeIncBasePriorityPrivilege 888 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\sample1.exe"C:\Users\Admin\AppData\Local\Temp\sample1.exe"1⤵PID:3908
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1000
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:888
-
C:\Users\Admin\AppData\Local\Temp\sample1.exe"C:\Users\Admin\AppData\Local\Temp\sample1.exe"1⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\sample1.exe"C:\Users\Admin\AppData\Local\Temp\sample1.exe"1⤵PID:368