BlackBit

The ransomware creates a Task Scheduler for the " winlogon.exe " file to ensure it is able to execute each time a user logs into the system for persistence.

These include: "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet

The ransomware creates a Task Scheduler for the " winlogon.exe " file to ensure it is able to execute each time a user logs into the system for persistence.

the malware creates a batch file that contains a code of registry modification to disable the task manager.

the attacker takes an additional step by creating a new local user account, assigning it the name ' Microsoft '

the malware makes a copy of its executable in the Startup folder with the filename " winlogon.exe ".

The ransomware creates a Task Scheduler for the " winlogon.exe " file to ensure it is able to execute each time a user logs into the system for persistence.

the malware makes a copy of its executable in the Startup folder with the filename " winlogon.exe ".

if the privilege is not available, the malware will attempt to request administrative access through the User Account Control (UAC).

Disguised as svchost.exe The BlackBit ransomware, which was covered in a previous post, disguised itself as a svchost.exe file. Similarly, the recently discovered LokiLocker ransomware was also found disguised as a svchost.exe file.

Upon execution, the malware initiates a function where it checks for the presence of any existing mutex within the compromised host.

Then the malware set the copied file as hidden to conceal it from the victim or user

the malware creates a batch file that contains a code of registry modification to disable the task manager.

The threat actor initiates the breach by employing a brute force attack, successfully compromising the user " Administrator ".

the malware initiates by retrieving a comprehensive list of all services running on the system.

The ransomware proceeds with the next activity, terminating several processes... The ransomware enumerates all running processes

The malware made POST request communication, with information such as unique-id, disk-size, affiliate username, CPU-name, ram-size, and os-name

The ransomware also has the capability to scan the network for available shares.

Upon execution, the malware initiates a function where it checks for the presence of any existing mutex within the compromised host.

During the initial access phase, the attacker with IP Address 87.251.75.145 started brute-forcing activities targeting the RDP machine and successfully login as a local user named Administrator.

The malware made POST request communication ... to the url path /api/index.php hosted on the command-and-control (C2) server hosted on domain application-api.xyz.

the attacker utilizes the copy-and-paste feature available in the Windows RDP software to place a malicious file named " svchost.exe " directly into the Desktop folder

The ransomware also generates its ransom note before it begins encrypting.

Once the potentially disruptive services are identified, the malware takes action by stopping the services.

"C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet

the ransomware changes the compromised host's wallpaper background, replacing it with their custom wallpaper.

The attacker first added exclusion folders in Windows Defender for " Program Files " and the user folder, allowing malware to execute without being blocked

the ransomware attempts to disable the firewall through the following commands: "C:\Windows\System32\cmd.exe" /C netsh advfirewall set currentprofile state off