BlackCat

The specific sample from this incident was compiled close to the attack and contains a popular .NET protection named Confuser.

credentials Array of compromised credentials for escalation and propagation [][]string

Processes spawned cmd.exe /c “wmic csproduct get UUID” ... cmd.exe /c “vssadmin.exe Delete Shadows /all /quiet” ... cmd.exe /c “arp -a”

A named pipe whose name contains the current process ID and random bytes generated above is created using CreateNamedPipeW

A named pipe whose name contains the current process ID and random bytes generated above is created using CreateNamedPipeW

The malware tries to stop the Internet Information service (IIS) using IISReset.exe

credentials Array of compromised credentials for escalation and propagation [][]string

The number of network requests the Server Service can make is set to the maximum by modifying “HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\MaxMpxCt” Registry value

Privilege escalation via UAC bypass using CMSTPLUA COM interface ... BlackCat ransomware uses the auto-elevated CMSTPLUA interface {3E5FC7F9-9A51-4367-9063-A120244FBEC7} in order to escalate privileges

credentials Array of compromised credentials for escalation and propagation [][]string

Privilege escalation via UAC bypass using CMSTPLUA COM interface ... BlackCat ransomware uses the auto-elevated CMSTPLUA interface {3E5FC7F9-9A51-4367-9063-A120244FBEC7} in order to escalate privileges

The ransomware tries to clear all event logs ... cmd.exe /c for /F “tokens=*” %1 in (‘wevtutil.exe el’) DO wevtutil.exe cl %1

credentials Array of compromised credentials for escalation and propagation [][]string

The number of network requests the Server Service can make is set to the maximum by modifying “HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\MaxMpxCt” Registry value

All the tactics and techniques observed in this analysis can be mapped with the MITRE ATT&CK knowledge base as follows... T1222.001 File and Directory Permissions Modification: Windows File and Directory Permissions Modification

Brute. Own GPU data center + outsourcing rented facilities, own dictionaries, and rules. Currently is not available. In the future, it will allow adverts to break hashes in the panel.

the configuration field like “credentials” is also used by BlackMatter V1 and Darkside. In this field, it includes the victim’s domain credentials.

The process obtains a list of active services using EnumServicesStatusExW

The malicious process obtains the ARP table using the arp command, as shown below

There is a call to SHTestTokenMembership that verifies whether the user token is a member of the Administrators group

enable_network_discovery Switch to enable/disable network discovery bool

The executable takes a snapshot of all processes and threads in the system ... The processes are enumerated using the Process32FirstW and Process32NextW APIs

The malicious binary obtains information about the current system via a function call to GetSystemInfo

BlackCat traverses the file system using the FindFirstFileW and FindNextFileW APIs

All the tactics and techniques observed in this analysis can be mapped with the MITRE ATT&CK knowledge base as follows... T1087.002 Account Discovery: Domain Account Discovery

The malware retrieves the currently available disk drives by calling the GetLogicalDrives routine

The net use command is utilized to connect to the local computer using different credentials stored in the BlackCat configuration

The binary spawns multiple child processes by adding the “–child” parameter to the command line ... The new processes run in the security context of credentials that were specified in the credentials entry from the BlackCat configuration

The BlackCat configuration is stored in JSON form ... boolean values that indicate network discovery, lateral movement

We try to teach adverts to upload files to our data center immediately or even before the encryption process itself.

The file content is encrypted using the AES-128 algorithm ... The extension of the encrypted files is changed to uhwuvzu by the malware | The ransomware starts scanning the volumes on the local machine using FindFirstVolumeW ... All unmounted volumes are mounted via a function call to SetVolumeMountPointW

BlackCat stops the targeted service using the ControlService function | The ransomware terminates the targeted process by calling the TerminateProcess API

The ransomware deletes all volume shadow copies using the vssadmin.exe utility ... The binary disables Automatic Repair using the bcdedit tool | The ransomware deletes all volume shadow copies using the vssadmin.exe utility ... There is also a second process that is responsible for deleting all volume shadow copies with wmic

The Desktop wallpaper is changed to the above image by calling the SystemParametersInfoW API

DDoS. Own botnet for performing the most powerful DDoS attacks.

enable_esxi_vm_kill Switch to enable/disable VM termination on ESXi Hosts bool enable_esxi_vm_snapshot_kill Switch to enable/disable Snapshot deletion on ESXi Hosts bool

The group has since garnered a reputation for aggressively posting details about its victims publicly—roughly two dozen have been posted on the group's extortion site over the last two months.