Threat Analysis Unit - Threat Intelligence Notification

Title: BlackCat Ransomware

Summary

A newly discovered BlackCat ransomware threatens to leak victim’s data if they do not pay the demanded amount of ransom to the attacker. It also deletes the volume shadow copies, preventing victims from recovering their data. BlackCat also has the ability to propagate in networks for infecting more machines.

Behavioral Summary

BlackCat Ransomware may append extensions like “.sykffle” to each of the encrypted files.Other than that, it will also create a ransom note in every folder named “RECOVER-sykffle-FILES.txt” as shown in Figure 1.

Figure 1. Ransom note of BlackCat ransomware

BlackCat also replaces the user’s wallpaper with the image shown in Figure 2.

Figure 2. Screenshot of the ransom note set as wallpaper

It tries to delete shadow copies with vssadmin with below command line:

vssadmin.exe delete shadows /all /quiet

BlackCat also runs the below command to retrieve the  unique ID for a victims machine,  for identifying data when paying the ransom:             

wmic csproduct get UUID

For network propagation BlackCat uses PsExec with embedded administrative credentials to mount the hidden partitions.

Below, in Table 1, is the list of directories it excludes from encryption.

Table 1. List of directories excluded

The list of filenames BlackCat excluded while encrypting is shown in Table 2.

Table 2. List of filenames excluded

The list of extensions BlackCat excluded while encrypting is shown in Table 3.

Table 3. List of extensions excluded

In addition, BlackCat ransomware would terminate several processes listed in Table 4:

Table 4. List of processes terminated before encryption

BlackCat ransomware also stops several services listed in Table 5.

Table 5. List of services stopped before encryption

Customer Protection

BlackCat Ransomware is blocked and detected by existing policies within VMware Carbon Black products. To learn more about further ransomware behaviour, detection and protection capabilities within the VMware Carbon Black suite of products against BlackCat Ransomware, you may refer to the following blog post:

TAU-TIN - Ransomware Threats

MITRE ATT&CK TIDs

Table 6. MITRE ATT&CK TIDs

Indicators of Compromise (IOCs)

Table 7. Indicator of compromise

About TAU-TIN

TAU-TIN (Threat Analysis Unit - Threat Intelligence Notification) is a report by Carbon Black's TAU (Threat Analysis Unit) to help customers detect and prevent emerging threats.

To receive future notifications, navigate to the TAU-TIN label on UeX and then click Subscribe.