Ransomware Spotlight: BlackByte

T1190 - Exploit Public-Facing Application
It has been observed to be using the ProxyShell exploit to deliver China Chopper web shell as its initial arrival.

T1053.005 - Scheduled Task/Job: Scheduled Task
It creates a scheduled task to execute its java script to proceed with its routine on bootup. 
Task Name: Joke
Trigger: Once, at 00:00
Action: wscript.exe

T1134 - Access Token Manipulation
This ransomware modifies the registry to elevate local privilege and enable linked connections.

T1140 - Deobfuscate/Decode Files or Information
It initially arrives as an obfuscated Java Script file which will be decoded upon execution.

T1222 - File and Directory Permissions ModificationIt uses mountvol.exe to mount volume names and icacls.exe to modify the access on the volume to "Everyone."

C:\Windows\System32\icacls.exe" "C:*" /grant Everyone:F /T /C /Q 

It also controlled folder access using PowerShell:

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -EnableControlledFolderAccess Disabled 

It also modifies firewall settings to enable linked connections:

"C:\Windows\System32\netsh.exe" advfirewall firewall set rule group="Network Discovery" new enable=Yes "C:\Windows\System32\netsh.exe" advfirewall firewall set rule group="File and Printer Sharing" new enable=Yes 

T1562.001 - Impair Defenses: Disable or Modify Tools
It disables Raccine, which is an anti-ransomware utility, using these commands:

taskill.exe /F /IM Raccine.exe
taskill.exe /F /IM RaccineSettings.exe
schtasks.exe /DELETE /TN \"Raccine Rules Updater\" /F
Deletes raccine autostart:

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Name = “Raccine Tray”
HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\Raccine

T1083 - File and Directory Discovery
This ransomware discovers files and directories by first enumerating the logical drives. Once enumerated, it then changes the access control of files and directories so that it can have full access over them. It will then go through the directories and traverse it for target files to encrypt.

T1069.002 - Permission Groups Discovery: Domain Groups
It uses the RootDSE entry from the active directory to get a listing of the hostname under that domain in preparation for its propagation in the network. It enumerates 1000 hostname in the domain.

Remote System Discovery
After getting the hostname of the remote systems, it attempts to ping the systems to see if it is alive and accessible. Then it proceeds with the transfer to the public share folder.

T1570 - Lateral Tool Transfer
It checks if this folder is present:
C:\Users\Public\blockator  (infection marker for that system)
It doesnt proceed to propagation if it exist.

It checks the remote system if either of the following folders is accessible:
\C$\Users\Public
\Users\Public

It then creates the infection marker on that system, which are:
\Users\Public\blockator
\C$\Users\Public\blockator

It then copies the initial js file in the remote to Public share and executes it through scheduled task, which was created at the start of routine.

T1560.001 - Archive Collected Data: Archive via Utility
It uses WinRar to archive files before uploading to its cloud storage.

T1567 - Exfiltration Over Web Service 
It uses WinRar to archive files and upload to cloud storage, which are: 
    - anonymfiles[.]com
    - file[.]io

T1071.001 - Application Layer Protocol: Web Protocols
The payload is executed via evaluating an HTTP post through the “Request.Item” commandlet.

For BLACKBYTE v1, it uses the HTTP protocol to communicate with an adversary-controlled server to obtain the key it uses for encryption. The servers are:
- hxxp://45[.]9.148.114/forest.png
- hxxp://185[.]93.6.31/mountain.png

T1486 - Data Encrypted for Impact
This ransomware uses a combination of AES and RSA to encrypt files and protect its key. A noteworthy trait of this ransomware is that the key it uses for file encryption is derived from the C&C which is saved as a PNG file, even though it is not actually a PNG file.

T1489 - Service Stop
This ransomware attempts to stop certain processes using Microsoft Restart Manager
• Smss • anydesk • Chrome • Opera • Msedge • Firefox • Iexplore • Explorer • Winlogon • SearchIndexer • Wininit • SearchApp • SearchUI 

It also stops certain services using sc.exe

•"C:\Windows\System32\sc.exe" config SQLTELEMETRY start= disabled •"C:\Windows\System32\sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled •"C:\Windows\System32\sc.exe" config SQLWriter start= disabled •"C:\Windows\System32\sc.exe" config SstpSvc start= disabled •"C:\Windows\System32\sc.exe" config MBAMService start= disabled •"C:\Windows\System32\sc.exe" config wuauserv start= disabled