blackmatter | 6d4712df42ad0982041ef0e2e109ab5718b43830f2966bd9207a7fac3af883db

General

Target

10aa058a3ac49e016cad7987b8e09886.exe
Size

71KB
MD5

10aa058a3ac49e016cad7987b8e09886
SHA1

cca6682330a819592c3b1ea0448ceb4e141593dc
SHA256

6d4712df42ad0982041ef0e2e109ab5718b43830f2966bd9207a7fac3af883db
SHA512

f115fb62b1ca5e18f6340d42ff4393e2b175917312ae1cc14e7a6a9322cf8adaf22457bc8213e2baafdc2cb19d5db1e5a9c003155cbf142d5a08604495e22f6e
SSDEEP

768:VjjjjjjjjjDahoICS4AIbxCJhjZeO3r825CiqxLbMnkHYnvizKktsLFYXg/ripMX:NICS4AgxwhjEO3r825exqkHYnKevTiO

Score

10^/10

blackmatter ransomware

Malware Config

Extracted

Path

C:\BzOXaWmXM.README.txt

Family

blackmatter

Ransom Note

~+ * + ' BLACK | () .-.,='``'=. - o - '=/_ \ | * | '=._ | \ `=./`, ' . '=.__.=' `=' * + Matter + O * ' . >>> What happens? Your network is encrypted, and currently not operational. We need only money, after payment we will give you a decryptor for the entire network and you will restore all the data. >>> What data stolen? From your network was stolen 500 GB of data. If you do not contact us we will publish all your data in our blog and will send it to the biggest mass media. Blog post link: %BLOG_URL% >>> What guarantees? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. If we do not give you decrypters or we do not delete your data, no one will pay us in the future, this does not comply with our goals. We always keep our promises. >> How to contact with us? 1. Download and install TOR Browser (https://www.torproject.org/). 2. Open http://supp24maprinktc7uizgfyqhisx7lkszb6ogh6lwdzpac23w3mh4tvyd.onion/OYPF561W4U8HVA0NLVCKJCZB >> Warning! Recovery recommendations. We strongly recommend you to do not MODIFY or REPAIR your files, that will damage them.

URLs

http://supp24maprinktc7uizgfyqhisx7lkszb6ogh6lwdzpac23w3mh4tvyd.onion/OYPF561W4U8HVA0NLVCKJCZB

Signatures

BlackMatter Ransomware
BlackMatter ransomware group claims to be Darkside and REvil succesor.
ransomware blackmatter
Renames multiple (178) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\BzOXaWmXM.bmp"	10aa058a3ac49e016cad7987b8e09886.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\BzOXaWmXM.bmp"	10aa058a3ac49e016cad7987b8e09886.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

pid	Process
2976	10aa058a3ac49e016cad7987b8e09886.exe
2976	10aa058a3ac49e016cad7987b8e09886.exe
2976	10aa058a3ac49e016cad7987b8e09886.exe
2976	10aa058a3ac49e016cad7987b8e09886.exe
2976	10aa058a3ac49e016cad7987b8e09886.exe
2976	10aa058a3ac49e016cad7987b8e09886.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Control Panel 3 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\International	10aa058a3ac49e016cad7987b8e09886.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Desktop	10aa058a3ac49e016cad7987b8e09886.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Desktop\WallpaperStyle = "10"	10aa058a3ac49e016cad7987b8e09886.exe

Modifies registry class 20 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	splwow64.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	splwow64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 9e0000001a00eebbfe23000010007db10d7bd29c934a973346cc89022e7c00002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020002a0000000000efbe7e47b3fbe4c93b4ba2bad3f5d3cd46f98207ba827a5b6945b5d7ec83085f08cc20002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020000000	splwow64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	splwow64.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	splwow64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	splwow64.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	splwow64.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_Classes\Local Settings	splwow64.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	splwow64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f4225481e03947bc34db131e946b44c8dd50000	splwow64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	splwow64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	splwow64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	splwow64.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	splwow64.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	splwow64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_FolderType = "{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}"	splwow64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_TopViewID = "{82BA0782-5B7A-4569-B5D7-EC83085F08CC}"	splwow64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_TopViewVersion = "0"	splwow64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	splwow64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	splwow64.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2752	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2976	10aa058a3ac49e016cad7987b8e09886.exe
2976	10aa058a3ac49e016cad7987b8e09886.exe
2976	10aa058a3ac49e016cad7987b8e09886.exe
2976	10aa058a3ac49e016cad7987b8e09886.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2328	splwow64.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeBackupPrivilege	2976	10aa058a3ac49e016cad7987b8e09886.exe
Token: SeDebugPrivilege	2976	10aa058a3ac49e016cad7987b8e09886.exe
Token: 36	2976	10aa058a3ac49e016cad7987b8e09886.exe
Token: SeImpersonatePrivilege	2976	10aa058a3ac49e016cad7987b8e09886.exe
Token: SeIncBasePriorityPrivilege	2976	10aa058a3ac49e016cad7987b8e09886.exe
Token: SeIncreaseQuotaPrivilege	2976	10aa058a3ac49e016cad7987b8e09886.exe
Token: 33	2976	10aa058a3ac49e016cad7987b8e09886.exe
Token: SeManageVolumePrivilege	2976	10aa058a3ac49e016cad7987b8e09886.exe
Token: SeProfSingleProcessPrivilege	2976	10aa058a3ac49e016cad7987b8e09886.exe
Token: SeRestorePrivilege	2976	10aa058a3ac49e016cad7987b8e09886.exe
Token: SeSecurityPrivilege	2976	10aa058a3ac49e016cad7987b8e09886.exe
Token: SeSystemProfilePrivilege	2976	10aa058a3ac49e016cad7987b8e09886.exe
Token: SeTakeOwnershipPrivilege	2976	10aa058a3ac49e016cad7987b8e09886.exe
Token: SeShutdownPrivilege	2976	10aa058a3ac49e016cad7987b8e09886.exe
Token: SeBackupPrivilege	2800	vssvc.exe
Token: SeRestorePrivilege	2800	vssvc.exe
Token: SeAuditPrivilege	2800	vssvc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2328	splwow64.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 2752	2976	10aa058a3ac49e016cad7987b8e09886.exe	33
PID 2976 wrote to memory of 2752	2976	10aa058a3ac49e016cad7987b8e09886.exe	33
PID 2976 wrote to memory of 2752	2976	10aa058a3ac49e016cad7987b8e09886.exe	33
PID 2976 wrote to memory of 2752	2976	10aa058a3ac49e016cad7987b8e09886.exe	33
PID 2752 wrote to memory of 2328	2752	NOTEPAD.EXE	34
PID 2752 wrote to memory of 2328	2752	NOTEPAD.EXE	34
PID 2752 wrote to memory of 2328	2752	NOTEPAD.EXE	34
PID 2752 wrote to memory of 2328	2752	NOTEPAD.EXE	34

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\10aa058a3ac49e016cad7987b8e09886.exe
"C:\Users\Admin\AppData\Local\Temp\10aa058a3ac49e016cad7987b8e09886.exe"
1⤵
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" /p C:\BzOXaWmXM.README.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  - Suspicious use of WriteProcessMemory
  PID:2752
- - C:\Windows\splwow64.exe
    C:\Windows\splwow64.exe 12288
    3⤵
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2328

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\BzOXaWmXM.README.txt

Filesize
1KB

MD5
9be52968352d6207153fd7a6b8fcb75f

SHA1
e9a821e195712d6f585a2cd60d91b606cad7110e

SHA256
5b5d55b03b22a3611662bd521983fb05da9df710c4a9d7831321c9d983d6c41e

SHA512
1b35ee275af4edf106ca4f80c35419f8ff338e1905bfd0da5992da48eeed5c842215edef55d4fb7e9c2678f734c40bb4d51d7a8e3a4886610963f09a655b8c45

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7429.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar747A.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
memory/2328-437-0x00000000042E0000-0x00000000042E1000-memory.dmp

Filesize
4KB

Download
memory/2328-438-0x0000000004350000-0x0000000004360000-memory.dmp

Filesize
64KB

Download
memory/2328-439-0x00000000042E0000-0x00000000042E1000-memory.dmp

Filesize
4KB

Download
memory/2976-0-0x00000000003E0000-0x0000000000420000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing