Analysis
-
max time kernel
148s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
04/04/2025, 01:30
Behavioral task
behavioral1
Sample
SuperBlack-0xb.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
21 signatures
150 seconds
General
-
Target
SuperBlack-0xb.exe
-
Size
146KB
-
MD5
c6c371198124b086a547407a7d36fcc6
-
SHA1
1a3108ecb72ca0da0c04bd5c29caebee0ffd795d
-
SHA256
a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c
-
SHA512
568da365e16e806593d5bb9ca335a4b1e7585148b29fe131d3fffb45275962991948de6700c28d3afb4302ebbb8570e20781933bdcfb3685cde325b64efc19d5
-
SSDEEP
1536:szICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDzp6HbSCkHdMBfusRDARJbWUyz:DqJogYkcSNm9V7Dzx19pODObWT
Score
10/10
Malware Config
Extracted
Path
C:\ni8pxbvnx.README.txt
Ransom Note
>>>> Your data are stolen and encrypted!
>>>> Sensitive data on your system was DOWNLOADED and it will be PUBLISHED if you refuse to cooperate. Your competitors or law enforcement may get them on the web.
Data includes:
- Employees personal data, CVs, DL, SSN.
- Complete network map including credentials for local and remote services.
- Financial information including clients data, bills, budgets, annual reports, bank statements.
- Complete datagrams/schemas/drawings for manufacturing in solidworks format
- And more...
You can request the tree of files that we have.
>>>> You need contact us and decrypt one file for free, send a small file for test decryption with your personal DECRYPTION ID to tox chat:
>>>> Your personal DECRYPTION ID: 6791ACA56D6F7E5468516161BFA3F854
1)Download and install TOX chat: https://tox.chat
2)Write to this tox id: DED25DCB2AAAF65A05BEA584A0D1BB1D55DD2D8BB4185FA39B5175C60C8DDD0C0A7F8A8EC815 and wait for the answer, we will always answer you.
>>>> DO NOT MODIFY FILES YOURSELF.
>>>> DO NOT USE THIRD PARTY SOFTWARE TO RESTORE YOUR DATA.
>>>> YOU MAY DAMAGE YOUR FILES, IT WILL RESULT IN PERMANENT DATA LOSS.
>>>> YOUR DATA IS STRONGLY ENCRYPTED, YOU CAN NOT DECRYPT IT WITHOUT CIPHER KEY.
URLs
https://tox.chat
Signatures
-
Renames multiple (653) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation 9EA2.tmp -
Deletes itself 1 IoCs
pid Process 4676 9EA2.tmp -
Executes dropped EXE 1 IoCs
pid Process 4676 9EA2.tmp -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-3920955164-3782810283-1225622749-1000\desktop.ini SuperBlack-0xb.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3920955164-3782810283-1225622749-1000\desktop.ini SuperBlack-0xb.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\system32\spool\PRINTERS\PPn8bixbqh6o7w4c8vyrlg0ay_d.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPn753xx2nu13jv4mlq2wep1bub.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\00002.SPL splwow64.exe File created C:\Windows\system32\spool\PRINTERS\PPwkq30g94s4_7ck2vs7hky8apd.TMP printfilterpipelinesvc.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\ni8pxbvnx.bmp" SuperBlack-0xb.exe Set value (str) \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\ni8pxbvnx.bmp" SuperBlack-0xb.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 4676 9EA2.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SuperBlack-0xb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9EA2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ONENOTE.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ONENOTE.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU ONENOTE.EXE -
Modifies Control Panel 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\Desktop SuperBlack-0xb.exe Set value (str) \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\Desktop\WallpaperStyle = "10" SuperBlack-0xb.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ni8pxbvnx SuperBlack-0xb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ni8pxbvnx\DefaultIcon\ = "C:\\ProgramData\\ni8pxbvnx.ico" SuperBlack-0xb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ni8pxbvnx SuperBlack-0xb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ni8pxbvnx\ = "ni8pxbvnx" SuperBlack-0xb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ni8pxbvnx\DefaultIcon SuperBlack-0xb.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 6120 SuperBlack-0xb.exe 6120 SuperBlack-0xb.exe 6120 SuperBlack-0xb.exe 6120 SuperBlack-0xb.exe 6120 SuperBlack-0xb.exe 6120 SuperBlack-0xb.exe 6120 SuperBlack-0xb.exe 6120 SuperBlack-0xb.exe 6120 SuperBlack-0xb.exe 6120 SuperBlack-0xb.exe 6120 SuperBlack-0xb.exe 6120 SuperBlack-0xb.exe 6120 SuperBlack-0xb.exe 6120 SuperBlack-0xb.exe 6120 SuperBlack-0xb.exe 6120 SuperBlack-0xb.exe 6120 SuperBlack-0xb.exe 6120 SuperBlack-0xb.exe 6120 SuperBlack-0xb.exe 6120 SuperBlack-0xb.exe 6120 SuperBlack-0xb.exe 6120 SuperBlack-0xb.exe 6120 SuperBlack-0xb.exe 6120 SuperBlack-0xb.exe 6120 SuperBlack-0xb.exe 6120 SuperBlack-0xb.exe 6120 SuperBlack-0xb.exe 6120 SuperBlack-0xb.exe 6120 SuperBlack-0xb.exe 6120 SuperBlack-0xb.exe 6120 SuperBlack-0xb.exe 6120 SuperBlack-0xb.exe 6120 SuperBlack-0xb.exe 6120 SuperBlack-0xb.exe 6120 SuperBlack-0xb.exe 6120 SuperBlack-0xb.exe 6120 SuperBlack-0xb.exe 6120 SuperBlack-0xb.exe 6120 SuperBlack-0xb.exe 6120 SuperBlack-0xb.exe 6120 SuperBlack-0xb.exe 6120 SuperBlack-0xb.exe 6120 SuperBlack-0xb.exe 6120 SuperBlack-0xb.exe 6120 SuperBlack-0xb.exe 6120 SuperBlack-0xb.exe 6120 SuperBlack-0xb.exe 6120 SuperBlack-0xb.exe 6120 SuperBlack-0xb.exe 6120 SuperBlack-0xb.exe 6120 SuperBlack-0xb.exe 6120 SuperBlack-0xb.exe 6120 SuperBlack-0xb.exe 6120 SuperBlack-0xb.exe 6120 SuperBlack-0xb.exe 6120 SuperBlack-0xb.exe 6120 SuperBlack-0xb.exe 6120 SuperBlack-0xb.exe 6120 SuperBlack-0xb.exe 6120 SuperBlack-0xb.exe 6120 SuperBlack-0xb.exe 6120 SuperBlack-0xb.exe 6120 SuperBlack-0xb.exe 6120 SuperBlack-0xb.exe -
Suspicious behavior: RenamesItself 26 IoCs
pid Process 4676 9EA2.tmp 4676 9EA2.tmp 4676 9EA2.tmp 4676 9EA2.tmp 4676 9EA2.tmp 4676 9EA2.tmp 4676 9EA2.tmp 4676 9EA2.tmp 4676 9EA2.tmp 4676 9EA2.tmp 4676 9EA2.tmp 4676 9EA2.tmp 4676 9EA2.tmp 4676 9EA2.tmp 4676 9EA2.tmp 4676 9EA2.tmp 4676 9EA2.tmp 4676 9EA2.tmp 4676 9EA2.tmp 4676 9EA2.tmp 4676 9EA2.tmp 4676 9EA2.tmp 4676 9EA2.tmp 4676 9EA2.tmp 4676 9EA2.tmp 4676 9EA2.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 6120 SuperBlack-0xb.exe Token: SeBackupPrivilege 6120 SuperBlack-0xb.exe Token: SeDebugPrivilege 6120 SuperBlack-0xb.exe Token: 36 6120 SuperBlack-0xb.exe Token: SeImpersonatePrivilege 6120 SuperBlack-0xb.exe Token: SeIncBasePriorityPrivilege 6120 SuperBlack-0xb.exe Token: SeIncreaseQuotaPrivilege 6120 SuperBlack-0xb.exe Token: 33 6120 SuperBlack-0xb.exe Token: SeManageVolumePrivilege 6120 SuperBlack-0xb.exe Token: SeProfSingleProcessPrivilege 6120 SuperBlack-0xb.exe Token: SeRestorePrivilege 6120 SuperBlack-0xb.exe Token: SeSecurityPrivilege 6120 SuperBlack-0xb.exe Token: SeSystemProfilePrivilege 6120 SuperBlack-0xb.exe Token: SeTakeOwnershipPrivilege 6120 SuperBlack-0xb.exe Token: SeShutdownPrivilege 6120 SuperBlack-0xb.exe Token: SeDebugPrivilege 6120 SuperBlack-0xb.exe Token: SeBackupPrivilege 6120 SuperBlack-0xb.exe Token: SeBackupPrivilege 6120 SuperBlack-0xb.exe Token: SeSecurityPrivilege 6120 SuperBlack-0xb.exe Token: SeSecurityPrivilege 6120 SuperBlack-0xb.exe Token: SeBackupPrivilege 6120 SuperBlack-0xb.exe Token: SeBackupPrivilege 6120 SuperBlack-0xb.exe Token: SeSecurityPrivilege 6120 SuperBlack-0xb.exe Token: SeSecurityPrivilege 6120 SuperBlack-0xb.exe Token: SeBackupPrivilege 6120 SuperBlack-0xb.exe Token: SeBackupPrivilege 6120 SuperBlack-0xb.exe Token: SeSecurityPrivilege 6120 SuperBlack-0xb.exe Token: SeSecurityPrivilege 6120 SuperBlack-0xb.exe Token: SeBackupPrivilege 6120 SuperBlack-0xb.exe Token: SeBackupPrivilege 6120 SuperBlack-0xb.exe Token: SeSecurityPrivilege 6120 SuperBlack-0xb.exe Token: SeSecurityPrivilege 6120 SuperBlack-0xb.exe Token: SeBackupPrivilege 6120 SuperBlack-0xb.exe Token: SeBackupPrivilege 6120 SuperBlack-0xb.exe Token: SeSecurityPrivilege 6120 SuperBlack-0xb.exe Token: SeSecurityPrivilege 6120 SuperBlack-0xb.exe Token: SeBackupPrivilege 6120 SuperBlack-0xb.exe Token: SeBackupPrivilege 6120 SuperBlack-0xb.exe Token: SeSecurityPrivilege 6120 SuperBlack-0xb.exe Token: SeSecurityPrivilege 6120 SuperBlack-0xb.exe Token: SeBackupPrivilege 6120 SuperBlack-0xb.exe Token: SeBackupPrivilege 6120 SuperBlack-0xb.exe Token: SeSecurityPrivilege 6120 SuperBlack-0xb.exe Token: SeSecurityPrivilege 6120 SuperBlack-0xb.exe Token: SeBackupPrivilege 6120 SuperBlack-0xb.exe Token: SeBackupPrivilege 6120 SuperBlack-0xb.exe Token: SeSecurityPrivilege 6120 SuperBlack-0xb.exe Token: SeSecurityPrivilege 6120 SuperBlack-0xb.exe Token: SeBackupPrivilege 6120 SuperBlack-0xb.exe Token: SeBackupPrivilege 6120 SuperBlack-0xb.exe Token: SeSecurityPrivilege 6120 SuperBlack-0xb.exe Token: SeSecurityPrivilege 6120 SuperBlack-0xb.exe Token: SeBackupPrivilege 6120 SuperBlack-0xb.exe Token: SeBackupPrivilege 6120 SuperBlack-0xb.exe Token: SeSecurityPrivilege 6120 SuperBlack-0xb.exe Token: SeSecurityPrivilege 6120 SuperBlack-0xb.exe Token: SeBackupPrivilege 6120 SuperBlack-0xb.exe Token: SeBackupPrivilege 6120 SuperBlack-0xb.exe Token: SeSecurityPrivilege 6120 SuperBlack-0xb.exe Token: SeSecurityPrivilege 6120 SuperBlack-0xb.exe Token: SeBackupPrivilege 6120 SuperBlack-0xb.exe Token: SeBackupPrivilege 6120 SuperBlack-0xb.exe Token: SeSecurityPrivilege 6120 SuperBlack-0xb.exe Token: SeSecurityPrivilege 6120 SuperBlack-0xb.exe -
Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 6020 ONENOTE.EXE 6020 ONENOTE.EXE 6020 ONENOTE.EXE 6020 ONENOTE.EXE 6020 ONENOTE.EXE 6020 ONENOTE.EXE 6020 ONENOTE.EXE 6020 ONENOTE.EXE 6020 ONENOTE.EXE 6020 ONENOTE.EXE 6020 ONENOTE.EXE 6020 ONENOTE.EXE 6020 ONENOTE.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 6120 wrote to memory of 3852 6120 SuperBlack-0xb.exe 96 PID 6120 wrote to memory of 3852 6120 SuperBlack-0xb.exe 96 PID 2920 wrote to memory of 6020 2920 printfilterpipelinesvc.exe 101 PID 2920 wrote to memory of 6020 2920 printfilterpipelinesvc.exe 101 PID 6120 wrote to memory of 4676 6120 SuperBlack-0xb.exe 102 PID 6120 wrote to memory of 4676 6120 SuperBlack-0xb.exe 102 PID 6120 wrote to memory of 4676 6120 SuperBlack-0xb.exe 102 PID 6120 wrote to memory of 4676 6120 SuperBlack-0xb.exe 102 PID 4676 wrote to memory of 2332 4676 9EA2.tmp 103 PID 4676 wrote to memory of 2332 4676 9EA2.tmp 103 PID 4676 wrote to memory of 2332 4676 9EA2.tmp 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\SuperBlack-0xb.exe"C:\Users\Admin\AppData\Local\Temp\SuperBlack-0xb.exe"1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6120 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
PID:3852
-
-
C:\ProgramData\9EA2.tmp"C:\ProgramData\9EA2.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\9EA2.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
PID:2332
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:32
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{FF07F21D-F21F-47D6-BEE5-3A7C631292F4}.xps" 1338820382551000002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:6020
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5296d08c1626ecd85d39adc2db71d6bf8
SHA1b560b1fb2d3a4d263f31eb91d76288634564206e
SHA256c36f1cd1fa6531aace95d7904cbd6ba20eaf9a3db2401dc4001b221623a8f60e
SHA512fc68acde26b3e515ba63b6b50d1ca630356de8d6c4d6d7884f2a53c4f14476cfe9f9b515c3cd3c8b6decdd11f110032e631e314466bb987709162dc06ed24f09
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
146KB
MD5cb8c22d32c8155d8788d034eb82c062a
SHA18a269688a7eeafa790653a53a300129ecf597dbd
SHA2561c9cfc1efbc288e2e345e21c66204e53faf2313c488baa9259a8ed9304c94d29
SHA512d8f3979b1a75d623af218b96e9d887c5dc9a765c812672c37a2d6e2d50cb4920f625f68799f4e8400282bfa2f5217d729e4a357b7213f7f587b355b7c29dc035
-
Filesize
4KB
MD51fcf3f2b6fc320c7fcb1b1f17f85f606
SHA18c1a40c89b0eb2f8962cc1ddac46a8a4ea2bb749
SHA2565e3798d64c6ba373cf2cf25844ba3dd1832accdc8df299ee3b6717b00e151511
SHA512a83f7077e39af82ad88ed74d89726d4dbd25a6a2bde47da46521f168414e993ea2b6cc6365d8536dbadff7c7473d6ea5279860c94e91dbf6ccbece5126ed35ab
-
Filesize
4KB
MD5ab52805c75386bb70c8d2e470e553337
SHA12f6038909cc3540c0f8fc07d6bf9004bef2ec9bd
SHA2566994ce9395493c19e2c7cee6cb1f1960ccb3636dda19cc456d438b78fd033425
SHA512dfee565a452e635913a3234a2d2d17dc401a7a01bba30d7cd5987bf184fb7e7e71f48a334b2db53a873576f4cadd083e40aa236639500fb4a266771f8df5f2ad
-
Filesize
1KB
MD572a8197d7a3ec98ba34f1fd45b6354dd
SHA1d982f42dfd13c1bce580bcd2d1ce6c760f30785e
SHA256d03f8918752e500d86edf01246b30d8a9af5ac872a01c2da3890479bb0915212
SHA5127942b10297adc30f1fecdb934914500f3f584b571dbd8ef7149a47d1cfa725cab5e5f50f479cb4a3ca586d4a103a94830dde5b3fdb538a9ff536cdd861aef95a
-
Filesize
129B
MD5b8377041fb6d3724ce30de1360cdfc45
SHA1220c938587f88ee41d153094a81d9d9edae2cf42
SHA2561f355a2876038391d8fc73435a9f9f2a8124d74cf9b97ab86526edb8514add0e
SHA512e8ce2bf2724e4143f0c8a3a3066f1d6296090ed122c920815cb7ab3ca063e3da2030ac011f593e79c924370a41b28875783d06493d2789cb3f1b16f414bd459e