Overview

overview

10

Static

static

10

9bae897c19...58.exe

windows7-x64

10

9bae897c19...58.exe

windows10-2004-x64

10

9bae897c19...58.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    142s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-04-2024 23:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    9bae897c19f237c22b6bdc024df27455e739be24bed07ef0d409f2df87eeda58.exe

  • Size

    95KB

  • MD5

    757139e76fae876ae50dd2c3ac11d5d8

  • SHA1

    1c150493014d29c1f8a51e397e527f7d7c1476c7

  • SHA256

    9bae897c19f237c22b6bdc024df27455e739be24bed07ef0d409f2df87eeda58

  • SHA512

    852febe5dc991fa6dc5ff994b2de18548e98a2f53de903a480ed871d9d25413159b167a3c0ff39175bbf7c339604bb1eccc2f9425415ab16089bc56e3e998974

  • SSDEEP

    1536:5UICS4ADkFAztzRyxoWtBErqylVxn1fkGzyKJtM5w1w0:NBkwtdyxoUH4Blkij1

Score
10/10
blackmatterransomware

Malware Config

Extracted

Path

F:\MaiYWlrYr.README.txt

Family

blackmatter

Ransom Note
~+ * + ' BLACK | () .-.,='``'=. - o - '=/_ \ | * | '=._ | \ `=./`, ' . '=.__.=' `=' * + Matter + O * ' . >>> What happens? Your network is encrypted, and currently not operational. We need only money, after payment we will give you a decryptor for the entire network and you will restore all the data. >>> What data stolen? From your network was stolen large amount of data. If you do not contact us we will publish all your data in our blog and will send it to the biggest mass media. >>> What guarantees? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. If we do not give you decrypters or we do not delete your data, no one will pay us in the future, this does not comply with our goals. We always keep our promises. >> How to contact with us? 1. Download and install TOR Browser (https://www.torproject.org/). 2. Open http://supp24maprinktc7uizgfyqhisx7lkszb6ogh6lwdzpac23w3mh4tvyd.onion/U6H6RKDF6W3B8XOWL >> Warning! Recovery recommendations. We strongly recommend you to do not MODIFY or REPAIR your files, that will damage them.
URLs

http://supp24maprinktc7uizgfyqhisx7lkszb6ogh6lwdzpac23w3mh4tvyd.onion/U6H6RKDF6W3B8XOWL

Signatures

  • BlackMatter Ransomware

    BlackMatter ransomware group claims to be Darkside and REvil succesor.

    ransomwareblackmatter
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
  • Modifies Control Panel 3 IoCs
    evasion
  • Modifies registry class 5 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 17 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\9bae897c19f237c22b6bdc024df27455e739be24bed07ef0d409f2df87eeda58.exe
    "C:\Users\Admin\AppData\Local\Temp\9bae897c19f237c22b6bdc024df27455e739be24bed07ef0d409f2df87eeda58.exe"
    1⤵
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2240
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4016
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4124 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:4356
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:60
      • C:\Windows\system32\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Documents\MaiYWlrYr.README.txt
        1⤵
        • Opens file in notepad (likely ransom note)
        PID:3736

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • F:\MaiYWlrYr.README.txt
        Filesize

        1KB

        MD5

        0842767cb65fc2fd8159fe4f2b718945

        SHA1

        bff9ec531535e40e4f0f8365add7430d813ce035

        SHA256

        ce9645e29fd75e2b99ad49c64d40a1fb8a5412d8a9a8cd438a64664cfed539e7

        SHA512

        367d25b261a866a94d080e388b410485232cc00aee6862b01e164dbf0dac7f0182bf741aee95e5b7786dc6668e29fc604db3d12c17f802dc22361591dd435c7f

        Download Submit

      • memory/2240-0-0x00000000005A0000-0x00000000005B0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2240-2-0x00000000005A0000-0x00000000005B0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2240-1-0x00000000005A0000-0x00000000005B0000-memory.dmp

        Filesize

        64KB

        Download