34e8530552b1c66cfca7ef676d8db177fc5434b5f3f4267c24ae4d942a8a2669

General

Target
Matcha_Setup.bat
Size 12KB
Sample260706-eavcnshv5s
SHA256 34e8530552b1c66cfca7ef676d8db177fc5434b5f3f4267c24ae4d942a8a2669
MD5 a26b12c14d4bc1ba4aee1de27848a7f5
SHA1 1465a6c52e6d1b0431a0b8fc913d5183cd0400e9
SHA512 1a690b968d15a607f39c7a2d347c571cb7f5e159c1060b2c7378d10c7bd2dec00bf845e5447f5be05a46f9f1497c2d62f8e3cfa61a7b4543e51e03c77a329717
SSDEEP 192:ESFTpw1nPyryTW/wNypcV/TPKlU8tEmm00o2xJhTY:ESFTpw1nW7oopcV/TPpRY
TLSH
T14142A5BBF938CC225682874A8E1682243B1248DF66045E54B0BF9E70078D7D3B7DDEB4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
4	3900	curl.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	python_installer.exe

Executes dropped EXE 3 IoCs

pid	Process
1664	python_installer.exe
1512	python_installer.exe
3664	python-3.12.0-amd64.exe

Loads dropped DLL 1 IoCs

pid	Process
1512	python_installer.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python-3.12.0-amd64.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000524fef632b0bf5150000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000524fef630000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900524fef63000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a524fef63000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d524fef63000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeBackupPrivilege	1980	vssvc.exe
Token: SeRestorePrivilege	1980	vssvc.exe
Token: SeAuditPrivilege	1980	vssvc.exe
Token: SeBackupPrivilege	2964	srtasks.exe
Token: SeRestorePrivilege	2964	srtasks.exe
Token: SeSecurityPrivilege	2964	srtasks.exe
Token: SeTakeOwnershipPrivilege	2964	srtasks.exe
Token: SeBackupPrivilege	2964	srtasks.exe
Token: SeRestorePrivilege	2964	srtasks.exe
Token: SeSecurityPrivilege	2964	srtasks.exe
Token: SeTakeOwnershipPrivilege	2964	srtasks.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4740 wrote to memory of 3900	4740	cmd.exe	86
PID 4740 wrote to memory of 1664	4740	cmd.exe	87
PID 1664 wrote to memory of 1512	1664	python_installer.exe	90
PID 1512 wrote to memory of 3664	1512	python_installer.exe	93

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Matcha_Setup.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Windows\system32\curl.exe
  curl -o python_installer.exe https://www.python.org/ftp/python/3.12.0/python-3.12.0-amd64.exe
  2⤵
  - Downloads MZ/PE file
  PID:3900
- C:\Users\Admin\AppData\Local\Temp\python_installer.exe
  python_installer.exe /quiet InstallAllUsers=1 PrependPath=1 Include_test=0
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1664
- - C:\Windows\Temp\{84A61F47-25C1-45A4-B1D2-139D605A95C9}\.cr\python_installer.exe
    "C:\Windows\Temp\{84A61F47-25C1-45A4-B1D2-139D605A95C9}\.cr\python_installer.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\python_installer.exe" -burn.filehandle.attached=560 -burn.filehandle.self=568 /quiet InstallAllUsers=1 PrependPath=1 Include_test=0
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1512
  - - C:\Windows\Temp\{36CCB281-27BA-4D3A-979C-62F614D1075A}\.be\python-3.12.0-amd64.exe
      "C:\Windows\Temp\{36CCB281-27BA-4D3A-979C-62F614D1075A}\.be\python-3.12.0-amd64.exe" -q -burn.elevated BurnPipe.{268405BC-F7C7-4D43-8615-967478539253} {D963A5A6-B5B0-4381-860C-A6A13AD99139} 1512
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3664

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1980

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

python_installer.exe

Path C:\Users\Admin\AppData\Local\Temp\python_installer.exe
Size 25.3MB
SHA256 c6bdf93f4b2de6dfa1a3a847e7c24ae10edf7f6318653d452cd4381415700ada
MD5 32ab6a1058dfbde76951b7aa7c2335a6
SHA1 4182a4c9dc2ca685c0fe01e376982f77593abf80
SHA512 0399a452bb565eddbf4cbe9058be6d0d1ed75e61009a85f51130f97bc75f0b97168543881a25874edbba5418ed23153b1d01f71e2b75ecac52ef52c2de0f9d3e
SSDEEP 786432:NBq40lIOkMNg87H2efKh6HJdOfLo++QRphDQBINQIM9O0fgCzH:Ok0g87WefKh6HJwfLiegG6IV07H
TLSH
T19A473333A8D50166EBB11432B630A632AD6CFE145B90C8ACF7C4BB1E3A714D79773196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PythonBA.dll

Path C:\Windows\Temp\{36CCB281-27BA-4D3A-979C-62F614D1075A}\.ba\PythonBA.dll
Size 674KB
SHA256 12a0bb777cd7ee658394fc3452ba06e715d9328d7f2c2c3ee5b8fbb5c51e661f
MD5 0a0ccca07cc97cd3b02946469379240e
SHA1 0802d171427bea137afc8aac4d9a4b471c3bd7cb
SHA512 ee877e73b835f8c5af18eb047f66b9d704a1cbd598cd50058617f1b65bc4d9b9f54a30d4b1f8eabf911c2ba0dd15ad6b36cfb092a539961dd8c9002b0d5a22d6
SSDEEP 6144:xEEKaxe1tHVjwLqKmlDGH6NmpHx6mI+BoSbGwizRfucj6GOUes1EpO:Kzaxe13w+XGH62Hx7I+BYfucj7qO
TLSH
T191E48D1174808271FDF620BB46BCB63942ADF4B4077499CF1AC85AEBEA605C29F37547
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SideBar.png

Path C:\Windows\Temp\{36CCB281-27BA-4D3A-979C-62F614D1075A}\.ba\SideBar.png
Size 50KB
SHA256 79434bd1368f47f08acf6db66638531d386bf15166d78d9bfea4da164c079067
MD5 888eb713a0095756252058c9727e088a
SHA1 c14f69f2bef6bc3e2162b4dd78e9df702d94cdb4
SHA512 7c59f4ada242b19c2299b6789a65a1f34565fed78730c22c904db16a9872fe6a07035c6d46a64ee94501fbcd96de586a8a5303ca22f33da357d455c014820ca0
SSDEEP 1536:/c/aRsg1fYfJt0Bg74nWPMMCNBaeQzxxj8ckBo:UcsgGfP0yCWTAaeyxxjGBo
TLSH
T1F33302E488115E7BCBE33A0615458CEF4EA9215F976C91886971C7CA5842F0CE3FE9D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python_installer.exe

Path C:\Windows\Temp\{84A61F47-25C1-45A4-B1D2-139D605A95C9}\.cr\python_installer.exe
Size 858KB
SHA256 8b670ed69431d112c0786dc4bf8e44a0b42b9f635ee4fbd46c49976837686dbc
MD5 c2cb26b35a28e60c89496481cf488845
SHA1 52e1808b67c16848a865e8fa60dd698e79ad0739
SHA512 eb28325fe4b37f99796ce18d8ddc3bc2f8be2003a94e844397b4361f2f93f5b287530ab98d7ef6117f86788d12e0798bfcea071bb60915a6b1d5b52096d2f115
SSDEEP 24576:O5mWpI2jFM5sFzfTpiBGoND+cSRK2yKPVWqYf9fyo:O5BjBbTpiBbD+c+jdw
TLSH
T11E15AE3265A14072F7F10173BA28D530BE6CAF28275089AEE3D4BD1D7E7849167FB252
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads