Analysis
- max time kernel
100s - max time network
109s - platform
windows11-21h2_x64 - resource
win11-20250619-en - resource tags
- submitted
25/09/2025, 14:56
General
- Target 57f7bfb5b37364563c03ed29228a43e44936edb4ea1f232b6c74c2ecd06cce1d.exe
- Size 3.9MB
- Sample250925-sbdcfabp5y
- SHA256 57f7bfb5b37364563c03ed29228a43e44936edb4ea1f232b6c74c2ecd06cce1d
Malware Config
Extracted
-
C:\Users\Default\Documents\HOW_RETURN_YOUR_DATA.TXT
-
blacklock
- Your files have been stolen and encrypted by Black Lock Ransomware! Due to a security issue on your network, it was possible for us to gain administrator access to your device(s). Your data has been exported to our servers prior to encryption. You can recover your files and we can delete your files from our servers. However, This will cost you money in cryptocurrency. If you chose not to cooperate with us, your files will remain encrypted forever and they will be published for anyone to abuse on our dark web blog. Many will advise you not to pay our fee, but in the end, you will lose more money by ignoring this attack and getting your files leaked on our dark web blog like some clowns. Additionally, we will make it our priority to make it impossible for you to continue conducting business. This includes, but is not limited to : - Constantly receiving phone calls and e-mails from us - Having your business website shut down - Contacting your clients and letting them know of the security breach - Employee data being sold on the dark web and eventually used to make purchases or open bank accounts If you want to pay the fee, follow these steps : --- Client area (use this site to contact us): Install Tor Browser here : https://www.torproject.org/download/ Link for Tor Browser: Link for Tor Browser: http://4ozbomcjurd64vgeblkoqeqirvawi3dddswriw6qespscmequmqlshyd.onion/3581eb15ba202199385ddf5dc5c8d4fb Start Tor Browser and connect to the Tor network. Visit our Blog: http://zdkexsh2e7yihw5uhg5hpsgq3dois2m5je7lzfagij2y6iw5ptl35gyd.onion When logged into the chat, send us any message to notify us. We will tell you about the decryption fee and after receiving payment in cryptocurrency, we will provide you with the following : - Decryption tool to recover your files - Deleting your files from our servers - Information on how we gained access to your network It is in our best interest to respect our part of the deal, because our reputation is on the line. After all, we are only here for profit."#, id); specifically, this part : ``` Additionally, we will make it our priority to make it impossible for you to continue conducting business. This includes, but is not limited to : - Constantly receiving phone calls and e-mails from us - Having your business website shut down - Contacting your clients and letting them know of the security breach - Employee data being sold on the dark web and eventually used to make purchases or open bank accounts ``` The encryption algorithm we used is AES 256 bits, anyone claiming they can decrypt your files without paying our fee is blatantly lying to you.
-
http://4ozbomcjurd64vgeblkoqeqirvawi3dddswriw6qespscmequmqlshyd.onion/3581eb15ba202199385ddf5dc5c8d4fb
-
http://zdkexsh2e7yihw5uhg5hpsgq3dois2m5je7lzfagij2y6iw5ptl35gyd.onion
Signatures
- BlackLock
BlackLock is a Windows ransomware written in Golang.
- Blacklock family
- Deletes itself 1 IoCs
- Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\57f7bfb5b37364563c03ed29228a43e44936edb4ea1f232b6c74c2ecd06cce1d.exe"C:\Users\Admin\AppData\Local\Temp\57f7bfb5b37364563c03ed29228a43e44936edb4ea1f232b6c74c2ecd06cce1d.exe"1⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -c "$f='C:\Users\Admin\AppData\Local\Temp\57f7bfb5b37364563c03ed29228a43e44936edb4ea1f232b6c74c2ecd06cce1d.exe';while(Test-Path -Path $f){$o=new-object byte[] 10485760;(new-object Random).NextBytes($o);[IO.File]::WriteAllBytes($f,$o);Remove-Item -Path $f;Sleep 1;}"2⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
boot.sdi.busy
__PSScriptPolicyTest_aj5smtsy.mhe.ps1
HOW_RETURN_YOUR_DATA.TXT
memory/2324-599-0x000000C000000000-0x000000C000400000-memory.dmp
memory/2324-595-0x000000C000000000-0x000000C000400000-memory.dmp
memory/2324-597-0x000000C000000000-0x000000C000400000-memory.dmp
memory/2324-596-0x000000C000000000-0x000000C000400000-memory.dmp
memory/2324-594-0x000000C000000000-0x000000C000400000-memory.dmp
memory/5760-598-0x0000019DCE52A000-0x0000019DCE52B000-memory.dmp
memory/5760-609-0x0000019DCDD60000-0x0000019DCE822000-memory.dmp
memory/5760-600-0x0000019DE6BA0000-0x0000019DE6BC2000-memory.dmp
memory/5760-610-0x0000019DCDD60000-0x0000019DCE822000-memory.dmp
memory/5760-611-0x0000019DCDD60000-0x0000019DCE822000-memory.dmp
memory/5760-616-0x0000019DCDD60000-0x0000019DCE822000-memory.dmp