Overview

overview

10

Static

static

10

0751c42296...a4.exe

windows7-x64

10

0751c42296...a4.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-04-2024 18:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4.exe

  • Size

    79KB

  • MD5

    900b7b852674521b306bb03eb991b94a

  • SHA1

    ed5b159b94ed5977efc1f3e05490545d7cb6a93e

  • SHA256

    0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4

  • SHA512

    04db23845665c6152a965d8401502588d09f6a4d30f83797cd772c179db8e445463ec5988e381d3a83789d4f20cd0378631e90560040f44a4b0b6634f373a093

  • SSDEEP

    1536:rnICS4ArFnRoHhcVyid9EZZoi+zQCQ5xoN:IZnmqVyq9EN+MCZ

Score
10/10
blackmatterransomware

Malware Config

Extracted

Path

C:\bRKN4uKNE.README.txt

Family

blackmatter

Ransom Note
~+ * + ' BLACK | () .-.,='``'=. - o - '=/_ \ | * | '=._ | \ `=./`, ' . '=.__.=' `=' * + Matter + O * ' . >>> What happens? Your network is encrypted, and currently not operational. We need only money, after payment we will give you a decryptor for the entire network and you will restore all the data. >>> What data stolen? From your network was stolen sensitive data. If you do not contact us we will publish all your data in our blog and will send it to the biggest mass media. >>> What guarantees? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. If we do not give you decrypters or we do not delete your data, no one will pay us in the future, this does not comply with our goals. We always keep our promises. >> How to contact with us? 1. Download and install TOR Browser (https://www.torproject.org/). 2. Open http://supp24yy6a66hwszu2piygicgwzdtbwftb76htfj7vnip3getgqnzxid.onion/D4MX4VGFCMO7MFQ6P >> Warning! Recovery recommendations. We strongly recommend you to do not MODIFY or REPAIR your files, that will damage them.
URLs

http://supp24yy6a66hwszu2piygicgwzdtbwftb76htfj7vnip3getgqnzxid.onion/D4MX4VGFCMO7MFQ6P

Signatures

  • BlackMatter Ransomware

    BlackMatter ransomware group claims to be Darkside and REvil succesor.

    ransomwareblackmatter
  • Renames multiple (163) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
  • Modifies Control Panel 3 IoCs
    evasion
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 17 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4.exe
    "C:\Users\Admin\AppData\Local\Temp\0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4.exe"
    1⤵
    • Sets desktop wallpaper using registry
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4452
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4792

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\bRKN4uKNE.README.txt
    Filesize

    1KB

    MD5

    5fc34d51147df5696554dd7cca4febaa

    SHA1

    cc58005940434a64e8c1f18a1a645a09869abeb4

    SHA256

    a811e4d76dc3a6014a3a41a6692a09ce82a0f28276df1b9252b87894a69e3fce

    SHA512

    1a50b466e43259b2f7faf5a472759a8a355609186bd1227dcf64309a3e9eab7d258c0d8931d4c283156a61558b678c1563a6ea05dfe489f75316b1b3c7e9da23

    Download Submit

  • memory/4452-0-0x00000000024C0000-0x00000000024D0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4452-1-0x00000000024C0000-0x00000000024D0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4452-256-0x00000000024C0000-0x00000000024D0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4452-257-0x00000000024C0000-0x00000000024D0000-memory.dmp

    Filesize

    64KB

    Download