Trustwave BlackByte 2021

BlackByte Ransomware enumerates the Registry, specifically the `HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options` key.

BlackByte Ransomware uses mapped shared folders to transfer ransomware payloads via SMB.

BlackByte Ransomware is distributed as an encrypted payload.

BlackByte Ransomware identifies remote systems via active directory queries for hostnames prior to launching remote ransomware payloads.

BlackByte Ransomware creates a schedule task to execute remotely deployed ransomware payloads.

BlackByte Ransomware is distributed as a JavaScript launcher file.

BlackByte Ransomware gathers victim system information to generate a unique victim identifier.

BlackByte Ransomware uses the `SetThreadExecutionState` API to prevent the victim system from entering sleep.

BlackByte Ransomware modifies the victim Registry to prevent system recovery.

BlackByte Ransomware can identify network shares connected to the victim machine.

BlackByte Ransomware is distributed as an obfuscated JavaScript launcher file.

BlackByte Ransomware uses the `mountvol.exe` command to mount volume names and leverages the Microsoft Discretionary Access Control List tool, `icacls.exe`, to grant the group to “Everyone” full access to the root of the drive.

BlackByte Ransomware creates a mutex value with a hard-coded name, and terminates if that mutex already exists on the victim system. BlackByte Ransomware checks the system language to see if it matches one of a list of hard-coded values; if a match is found, the malware will terminate.

BlackByte Ransomware is ransomware using a shared key across victims for encryption.

BlackByte Ransomware deletes all volume shadow copies and restore points among other actions to inhibit system recovery following ransomware deployment.

BlackByte Ransomware checks for files related to known sandboxes.

BlackByte Ransomware looks for security software products prior to full execution.

BlackByte Ransomware spreads itself laterally by writing the JavaScript launcher file to mapped shared folders.

BlackByte Ransomware identifies the language on the victim system.

BlackByte Ransomware adds .JS and .EXE extensions to the Microsoft Defender exclusion list. BlackByte Ransomware terminates and removes the Raccine anti-ransomware utility.

BlackByte Ransomware enables SMBv1 during execution.