Analysis
-
max time kernel
47s -
max time network
37s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
11-11-2024 19:48
General
-
Target
c22a6401a415fe642f3d96f38a887dd8ad23dd83a9255ee89d9adf4650ab98da.7z
-
Size
320KB
-
MD5
0ae1786f245b0f9f3c56b840f9e66ca4
-
SHA1
5f169c9e72799cef0f6b2d6b16b05822a76b829b
-
SHA256
eb5965f0e5dfe75357019ecc6e18b231b44d32c6d2f5fbf92c15020090e9120d
-
SHA512
dde9821026628656442202190ce56dd9497aaa364339fc32e4368c7d2dccc474543f37ef8f62afbbf3288b53e89e8afc27839b12dc4aafdcc77ef01ef879288a
-
SSDEEP
6144:MaQ0EImY93tS6MK3RqnllYePv3Buo91IOmrI6Uu4gDD6nZ+clLQHYejbU7eXA7Ez:fES938U3RqbYavPHmkmDPyLQHVXBz
Malware Config
Extracted
blackmatter
2.0
a89e0e2e31db3e31a1e7a9630375f437
https://fluentzip.org
http://fluentzip.org
-
attempt_auth
false
-
create_mutex
true
-
encrypt_network_shares
true
-
exfiltrate
true
-
mount_volumes
true
Extracted
F:\ogFRBgZRA.README.txt
blackmatter
http://supp24yy6a66hwszu2piygicgwzdtbwftb76htfj7vnip3getgqnzxid.onion/O1E1HJ9H8JNKNNHC8
Signatures
-
BlackMatter Ransomware
BlackMatter ransomware group claims to be Darkside and REvil succesor.
-
Blackmatter family
-
Renames multiple (155) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 25 IoCs
-
Suspicious use of FindShellTrayWindow 50 IoCs
-
Suspicious use of SendNotifyMessage 47 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\c22a6401a415fe642f3d96f38a887dd8ad23dd83a9255ee89d9adf4650ab98da.7z"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "-Command" "if((Get-ExecutionPolicy ) -ne 'AllSigned') { Set-ExecutionPolicy -Scope Process Bypass }; & 'C:\Users\Admin\Desktop\c22a6401a415fe642f3d96f38a887dd8ad23dd83a9255ee89d9adf4650ab98da.ps1'"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -ex bypass -NonI C:\Users\Admin\Desktop\c22a6401a415fe642f3d96f38a887dd8ad23dd83a9255ee89d9adf4650ab98da.ps12⤵
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\ogFRBgZRA.README.txt1⤵
- Opens file in notepad (likely ransom note)
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD58c4ff6df6a76eb222fbb6719bd2948ea
SHA1cd0c545218fe0f0f6c26a4c4ee61d9112bb5c5b3
SHA2561434a0ec78d3b3928a85a6b791fa0579315daffa7dbd0468958129f97274651b
SHA5122d090864b9eda73570a68331a8168906e8e40bf3fcd04c0b1bd3378437b6500cc7b1573938303a101ade1ee3e182802671baaa08e2b686fbf7bf3f913d1abd6f
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
915KB
MD5001bfe6f72fe64660ba498107c658bdc
SHA10946baf23e867f2564302b60f777db72a1244a30
SHA256c22a6401a415fe642f3d96f38a887dd8ad23dd83a9255ee89d9adf4650ab98da
SHA51232836eff8285a5a301be0b4410d34a73d99d4c04b38b0b67b937c1bc5ae6ab2d033a97089b6588c245371dfd8e95c420c8bbd3862a632a828122861e0ec839d3
-
Filesize
1KB
MD50418b5109e0dd206abbab1579e3c9618
SHA140c28fc6d87411ba675abc0e441d74e6ab173b4e
SHA256da44a7bc46672b2187e0ad91c5bbb19fed30e63f7ca4a2f0f6c20f7435f9453f
SHA5129fcb20dec695dde76c6e2e96567f9d1103c81a77c4f1f7e0f7b2702489b448f9bb36cac511e736b53ef3775706ad839e80beb1555e0df6dbd17424f298be531e
-
Filesize
104KB
-
Filesize
100KB
-
Filesize
100KB
-
Filesize
100KB
-
Filesize
216KB
-
Filesize
6.2MB
-
Filesize
136KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
3.3MB
-
Filesize
100KB
-
Filesize
120KB
-
Filesize
304KB
-
Filesize
100KB
-
Filesize
6.5MB
-
Filesize
100KB
-
Filesize
100KB
-
Filesize
100KB
-
Filesize
100KB
-
Filesize
100KB
-
Filesize
32KB
-
Filesize
80KB
-
Filesize
56KB
-
Filesize
104KB
-
Filesize
68KB
-
Filesize
200KB
-
Filesize
304KB
-
Filesize
3.3MB
-
Filesize
120KB
-
Filesize
652KB
-
Filesize
40KB
-
Filesize
600KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
136KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB