356509751efd62fec782153948c0d1c69b2f08b976c562c5bc6e8216a7e6f689

General

Target
BlackSuit.bat
Size 568KB
Sample260826-b9vwpsbd59
SHA256 356509751efd62fec782153948c0d1c69b2f08b976c562c5bc6e8216a7e6f689
MD5 0b692a2d9b4e2aee2fe80cca61eafc63
SHA1 0295f6972a56293af33ce13ebb5819bb89ca4181
SHA512 01619e79e13d93ea227afec651693362f7064bd221c5dfb69061b5aab1cacb6271c950f688061b8450c5feb95f0c382ab648a1d2ebd3cff58db0fea10298d8a0
SSDEEP 12288:Soy6doY33IY/IH8IJqt9WzoopVVxjQdIeeFa5QIAKyirYKDEPmPh8V0oW:EH87zWfxUKeXPA/FmPh8Sd
TLSH
T1E5C422365B0BFCCA0B7D6994D0A61A940D783E57C368A494FFC106E470AB749FF1D8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  BlackSuit.bat
- Size 568KB
- SHA256 356509751efd62fec782153948c0d1c69b2f08b976c562c5bc6e8216a7e6f689
- MD5 0b692a2d9b4e2aee2fe80cca61eafc63
- SHA1 0295f6972a56293af33ce13ebb5819bb89ca4181
- SHA512 01619e79e13d93ea227afec651693362f7064bd221c5dfb69061b5aab1cacb6271c950f688061b8450c5feb95f0c382ab648a1d2ebd3cff58db0fea10298d8a0
- SSDEEP 12288:Soy6doY33IY/IH8IJqt9WzoopVVxjQdIeeFa5QIAKyirYKDEPmPh8V0oW:EH87zWfxUKeXPA/FmPh8Sd
- TLSH
  T1E5C422365B0BFCCA0B7D6994D0A61A940D783E57C368A494FFC106E470AB749FF1D8A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery evasion execution impact persistence ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (10052) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Disables RegEdit via registry modification
  defense_evasion
- Disables Task Manager via registry modification
  defense_evasion
- Disables cmd.exe use via registry modification
  defense_evasion
- Creates new service(s)
  persistence execution
- Stops running service(s)
  defense_evasion execution
- Drops desktop.ini file(s)
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1