1b5e877cff6ddce77dfefc453175b2a742c7b536b8e19515b3f0f49a90123e43

General

Target
BlackSuit.bat
Size 22KB
Sample260826-aep7asfl8z
SHA256 1b5e877cff6ddce77dfefc453175b2a742c7b536b8e19515b3f0f49a90123e43
MD5 32429973c407ab66d33d0fb174c79464
SHA1 e9963b768cacc5d0a940fd6d7f7b89d56effe68d
SHA512 0203a49dd61feec340f51810de0bbb97f8aa958b935529222ca7906112c611a3b3c743d43f09145760b3301386aec2344d42777fbe218c65017ee6cbd99291e0
SSDEEP 384:mDLi1CwsBY0xoGoPOQ/YGUBoBj+h+UhmuhFbmhmS6bFbihlR6EWqeO7hPdQKbdNQ:7KkM+6m8Fo76Rb4lR6zqN7ZdQeN+Iu7t
TLSH
T117A24A35DA34FDD0037C72801EA62E9621351B22CBF59A74DA410DA578A475EEF3BB8C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  BlackSuit.bat
- Size 22KB
- SHA256 1b5e877cff6ddce77dfefc453175b2a742c7b536b8e19515b3f0f49a90123e43
- MD5 32429973c407ab66d33d0fb174c79464
- SHA1 e9963b768cacc5d0a940fd6d7f7b89d56effe68d
- SHA512 0203a49dd61feec340f51810de0bbb97f8aa958b935529222ca7906112c611a3b3c743d43f09145760b3301386aec2344d42777fbe218c65017ee6cbd99291e0
- SSDEEP 384:mDLi1CwsBY0xoGoPOQ/YGUBoBj+h+UhmuhFbmhmS6bFbihlR6EWqeO7hPdQKbdNQ:7KkM+6m8Fo76Rb4lR6zqN7ZdQeN+Iu7t
- TLSH
  T117A24A35DA34FDD0037C72801EA62E9621351B22CBF59A74DA410DA578A475EEF3BB8C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution impact persistence privilege_escalation ransomware
- Clears Windows event logs
  defense_evasion ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Disables RegEdit via registry modification
  defense_evasion
- Disables Task Manager via registry modification
  defense_evasion
- Disables cmd.exe use via registry modification
  defense_evasion
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1