a48207df9082919639d992e5c210c771b4c5a41b6d7b7c50aa9a483849934134

General

Target
BlackSuit.bat
Size 570KB
Sample260826-cle11s1fmc
SHA256 a48207df9082919639d992e5c210c771b4c5a41b6d7b7c50aa9a483849934134
MD5 fb350aa7f488ba16bc446c169b8aaf0b
SHA1 1489ce5456c6064de06650d760feaecaa4af5368
SHA512 aaac9d3379cb4bf2b65c151974ca1729ecd73c2698bcc6d289e98c349c2c1246718d2c810e4e49ae5d4d71ce969d3a0c37d48dbed249031634e30f2ebc0bd5b6
SSDEEP 12288:Yoy6dobjHn/IH8IJqt9WzoopVVxjQdIeeFa5QIAKyirYKDEPmPh8V0oW:GHQH87zWfxUKeXPA/FmPh8Sd
TLSH
T145C412365A1BFC860F7D2994D06A1A940D783E57C338A894FFC106E471EB646FF1D8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  BlackSuit.bat
- Size 570KB
- SHA256 a48207df9082919639d992e5c210c771b4c5a41b6d7b7c50aa9a483849934134
- MD5 fb350aa7f488ba16bc446c169b8aaf0b
- SHA1 1489ce5456c6064de06650d760feaecaa4af5368
- SHA512 aaac9d3379cb4bf2b65c151974ca1729ecd73c2698bcc6d289e98c349c2c1246718d2c810e4e49ae5d4d71ce969d3a0c37d48dbed249031634e30f2ebc0bd5b6
- SSDEEP 12288:Yoy6dobjHn/IH8IJqt9WzoopVVxjQdIeeFa5QIAKyirYKDEPmPh8V0oW:GHQH87zWfxUKeXPA/FmPh8Sd
- TLSH
  T145C412365A1BFC860F7D2994D06A1A940D783E57C338A894FFC106E471EB646FF1D8A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery evasion execution impact persistence ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (9289) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Disables RegEdit via registry modification
  defense_evasion
- Disables Task Manager via registry modification
  defense_evasion
- Disables cmd.exe use via registry modification
  defense_evasion
- Creates new service(s)
  persistence execution
- Stops running service(s)
  defense_evasion execution
- Drops desktop.ini file(s)
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1