Analysis
-
max time kernel
120s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
29-05-2024 13:08
General
-
Target
e062947f0a9ff634202c08eb1c2f469dea4f876f21270b35bc0a51ebae96fe2c.exe
-
Size
3.1MB
-
MD5
351e0d9464955221bab6194ec7d63498
-
SHA1
9461fdbfb4b08e1613a383802869621092b9f346
-
SHA256
e062947f0a9ff634202c08eb1c2f469dea4f876f21270b35bc0a51ebae96fe2c
-
SHA512
92f3fe37aac5c0f7527a2adb8cbbe699f99bf3ef65e7c612442527c2f1a6f2beaf7b0654b215c448035a5b6fe0be4c51fecfdd0d382a536ac8fa683496c9435f
-
SSDEEP
98304:5a6DNs7nPItaM5Uswlm/75cQck75odavXKzgs:JDQnaxU6m05ogvXKr
Malware Config
Extracted
blackcat
-
enable_network_discovery
true
-
enable_self_propagation
true
-
enable_set_wallpaper
true
-
extension
xcjl29p
-
note_file_name
RECOVER-${EXTENSION}-FILES.txt
-
note_full_text
>> What happened? Important files on your network was ENCRYPTED and now they have "${EXTENSION}" extension. In order to recover your files you need to follow instructions below. >> Sensitive Data Sensitive data on your system was DOWNLOADED. If you DON'T WANT your sensitive data to be PUBLISHED you have to act quickly. http://alphvmmm27o3abo3r2mlmjrpdmzle3rykajqc5xsj7j7ejksbpsa36ad.onion/2d64b2e5-1d7c-4169-9a81-7f35a32b70fd/8147b6748b7c87e90dca260a62134f3a6e7bf579f22393ac37d999d911cc3942 Data includes: - Employees personal data, CVs, DL, SSN. - Complete network map including credentials for local and remote services. - Private financial information including: clients data, bills, budgets, annual reports, bank statements. - Manufacturing documents including: datagrams, schemas, drawings in solidworks format - And more... >> CAUTION DO NOT MODIFY ENCRYPTED FILES YOURSELF. DO NOT USE THIRD PARTY SOFTWARE TO RESTORE YOUR DATA. YOU MAY DAMAGE YOUR FILES, IT WILL RESULT IN PERMANENT DATA LOSS. >> What should I do next? Follow these simple steps to get everything back to normal: 1) Download and install Tor Browser from: https://torproject.org/ 2) Navigate to: http://43nk37hlzlc6w4fyqlco3w4ue34pocmzzliiy2ibkzc3tec7vqcdqsid.onion/?access-key=${ACCESS_KEY}
Signatures
-
BlackCat
A Rust-based ransomware sold as RaaS first seen in late 2021.
Processes
-
C:\Users\Admin\AppData\Local\Temp\e062947f0a9ff634202c08eb1c2f469dea4f876f21270b35bc0a51ebae96fe2c.exe"C:\Users\Admin\AppData\Local\Temp\e062947f0a9ff634202c08eb1c2f469dea4f876f21270b35bc0a51ebae96fe2c.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
2.0MB
-
Filesize
8KB
-
Filesize
3.1MB
-
Filesize
2.0MB