34e8530552b1c66cfca7ef676d8db177fc5434b5f3f4267c24ae4d942a8a2669

General

Target
Matcha_Setup.bat
Size 12KB
Sample260706-eavcnshv5s
SHA256 34e8530552b1c66cfca7ef676d8db177fc5434b5f3f4267c24ae4d942a8a2669
MD5 a26b12c14d4bc1ba4aee1de27848a7f5
SHA1 1465a6c52e6d1b0431a0b8fc913d5183cd0400e9
SHA512 1a690b968d15a607f39c7a2d347c571cb7f5e159c1060b2c7378d10c7bd2dec00bf845e5447f5be05a46f9f1497c2d62f8e3cfa61a7b4543e51e03c77a329717
SSDEEP 192:ESFTpw1nPyryTW/wNypcV/TPKlU8tEmm00o2xJhTY:ESFTpw1nW7oopcV/TPpRY
TLSH
T14142A5BBF938CC225682874A8E1682243B1248DF66045E54B0BF9E70078D7D3B7DDEB4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
6140	python_installer.exe
5284	python_installer.exe
4840	python-3.12.0-amd64.exe

Loads dropped DLL 1 IoCs

pid	Process
5284	python_installer.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python-3.12.0-amd64.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000029ca881e338156dd0000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380129ca881e0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410129ca881e000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e329ca881e00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e629ca881e00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeBackupPrivilege	5748	vssvc.exe
Token: SeRestorePrivilege	5748	vssvc.exe
Token: SeAuditPrivilege	5748	vssvc.exe
Token: SeBackupPrivilege	52	srtasks.exe
Token: SeRestorePrivilege	52	srtasks.exe
Token: SeSecurityPrivilege	52	srtasks.exe
Token: SeTakeOwnershipPrivilege	52	srtasks.exe
Token: SeBackupPrivilege	52	srtasks.exe
Token: SeRestorePrivilege	52	srtasks.exe
Token: SeSecurityPrivilege	52	srtasks.exe
Token: SeTakeOwnershipPrivilege	52	srtasks.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1392 wrote to memory of 5948	1392	cmd.exe	89
PID 1392 wrote to memory of 6140	1392	cmd.exe	90
PID 6140 wrote to memory of 5284	6140	python_installer.exe	91
PID 5284 wrote to memory of 4840	5284	python_installer.exe	92

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Matcha_Setup.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1392
- C:\Windows\system32\curl.exe
  curl -o python_installer.exe https://www.python.org/ftp/python/3.12.0/python-3.12.0-amd64.exe
  2⤵
  PID:5948
- C:\Users\Admin\AppData\Local\Temp\python_installer.exe
  python_installer.exe /quiet InstallAllUsers=1 PrependPath=1 Include_test=0
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6140
- - C:\Windows\Temp\{06C2D2D2-C985-4B0A-8D1E-54B5C2E0034C}\.cr\python_installer.exe
    "C:\Windows\Temp\{06C2D2D2-C985-4B0A-8D1E-54B5C2E0034C}\.cr\python_installer.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\python_installer.exe" -burn.filehandle.attached=772 -burn.filehandle.self=776 /quiet InstallAllUsers=1 PrependPath=1 Include_test=0
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5284
  - - C:\Windows\Temp\{48521590-478D-4574-B437-E02D35922D8F}\.be\python-3.12.0-amd64.exe
      "C:\Windows\Temp\{48521590-478D-4574-B437-E02D35922D8F}\.be\python-3.12.0-amd64.exe" -q -burn.elevated BurnPipe.{E245D5D0-C1F6-4659-BA61-B105C10900AB} {1002159A-198F-4892-9E3E-22799D42D029} 5284
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4840

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5748

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:52

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

python_installer.exe

Path C:\Users\Admin\AppData\Local\Temp\python_installer.exe
Size 25.3MB
SHA256 c6bdf93f4b2de6dfa1a3a847e7c24ae10edf7f6318653d452cd4381415700ada
MD5 32ab6a1058dfbde76951b7aa7c2335a6
SHA1 4182a4c9dc2ca685c0fe01e376982f77593abf80
SHA512 0399a452bb565eddbf4cbe9058be6d0d1ed75e61009a85f51130f97bc75f0b97168543881a25874edbba5418ed23153b1d01f71e2b75ecac52ef52c2de0f9d3e
SSDEEP 786432:NBq40lIOkMNg87H2efKh6HJdOfLo++QRphDQBINQIM9O0fgCzH:Ok0g87WefKh6HJwfLiegG6IV07H
TLSH
T19A473333A8D50166EBB11432B630A632AD6CFE145B90C8ACF7C4BB1E3A714D79773196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python_installer.exe

Path C:\Windows\Temp\{06C2D2D2-C985-4B0A-8D1E-54B5C2E0034C}\.cr\python_installer.exe
Size 858KB
SHA256 8b670ed69431d112c0786dc4bf8e44a0b42b9f635ee4fbd46c49976837686dbc
MD5 c2cb26b35a28e60c89496481cf488845
SHA1 52e1808b67c16848a865e8fa60dd698e79ad0739
SHA512 eb28325fe4b37f99796ce18d8ddc3bc2f8be2003a94e844397b4361f2f93f5b287530ab98d7ef6117f86788d12e0798bfcea071bb60915a6b1d5b52096d2f115
SSDEEP 24576:O5mWpI2jFM5sFzfTpiBGoND+cSRK2yKPVWqYf9fyo:O5BjBbTpiBbD+c+jdw
TLSH
T11E15AE3265A14072F7F10173BA28D530BE6CAF28275089AEE3D4BD1D7E7849167FB252
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PythonBA.dll

Path C:\Windows\Temp\{48521590-478D-4574-B437-E02D35922D8F}\.ba\PythonBA.dll
Size 674KB
SHA256 12a0bb777cd7ee658394fc3452ba06e715d9328d7f2c2c3ee5b8fbb5c51e661f
MD5 0a0ccca07cc97cd3b02946469379240e
SHA1 0802d171427bea137afc8aac4d9a4b471c3bd7cb
SHA512 ee877e73b835f8c5af18eb047f66b9d704a1cbd598cd50058617f1b65bc4d9b9f54a30d4b1f8eabf911c2ba0dd15ad6b36cfb092a539961dd8c9002b0d5a22d6
SSDEEP 6144:xEEKaxe1tHVjwLqKmlDGH6NmpHx6mI+BoSbGwizRfucj6GOUes1EpO:Kzaxe13w+XGH62Hx7I+BYfucj7qO
TLSH
T191E48D1174808271FDF620BB46BCB63942ADF4B4077499CF1AC85AEBEA605C29F37547
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SideBar.png

Path C:\Windows\Temp\{48521590-478D-4574-B437-E02D35922D8F}\.ba\SideBar.png
Size 50KB
SHA256 79434bd1368f47f08acf6db66638531d386bf15166d78d9bfea4da164c079067
MD5 888eb713a0095756252058c9727e088a
SHA1 c14f69f2bef6bc3e2162b4dd78e9df702d94cdb4
SHA512 7c59f4ada242b19c2299b6789a65a1f34565fed78730c22c904db16a9872fe6a07035c6d46a64ee94501fbcd96de586a8a5303ca22f33da357d455c014820ca0
SSDEEP 1536:/c/aRsg1fYfJt0Bg74nWPMMCNBaeQzxxj8ckBo:UcsgGfP0yCWTAaeyxxjGBo
TLSH
T1F33302E488115E7BCBE33A0615458CEF4EA9215F976C91886971C7CA5842F0CE3FE9D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads