Analysis
-
max time kernel
150s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
27-04-2022 22:34
Static task
static1
Behavioral task
behavioral1
Sample
7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe
-
Size
543KB
-
MD5
998022b70d83c6de68e5bdf94e0f8d71
-
SHA1
b87a947f3e85701fcdadd733e9b055a65a3b1308
-
SHA256
7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a
-
SHA512
2744b77f951bd2bb34b094dd3b54fcf8f7dca76e03c745809edc045749c814c7d88c9ddd69ad684a1c156716afae76b5ebec3f932d0f2a72b242878134f65647
Score
10/10
Malware Config
Extracted
Path
C:\readme.txt
Ransom Note
Your data are stolen and encrypted
The data will be published on TOR website if you do not pay the ransom
You can contact us and decrypt one file for free on this TOR site
(you should download and install TOR browser first https://torproject.org)
https://aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion:80/
Your company id for log in: ba7a7058-3531-4b67-bae6-d602e9110361
URLs
https://aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion:80/
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 3 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\GroupUnregister.raw => C:\Users\Admin\Pictures\GroupUnregister.raw.basta 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File renamed C:\Users\Admin\Pictures\CompleteRename.png => C:\Users\Admin\Pictures\CompleteRename.png.basta 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File renamed C:\Users\Admin\Pictures\StopConnect.crw => C:\Users\Admin\Pictures\StopConnect.crw.basta 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dlaksjdoiwq.jpg" 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\EXCEL_K_COL.HXK 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\BillingStatement.xltx 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-delete.avi 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Composite.thmx 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\msdasql.dll 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\it-IT\Hearts.exe.mui 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SY01252_.WMF 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Urban.xml 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\CHECKER.POC 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-core-timezone-l1-1-0.dll 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107134.WMF 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\QP.XML 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_INTRO_BG.wmv 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOSTYLE.DLL 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0198113.WMF 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\7-Zip\Lang\mn.txt 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE.MANIFEST 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD00414_.WMF 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099154.JPG 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGZIPC.XML 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00168_.WMF 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\ENVELOPR.DLL.IDX_DLL 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\INVITE.DPV 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File created C:\Program Files\Microsoft Games\More Games\ja-JP\readme.txt 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File created C:\Program Files\VideoLAN\VLC\locale\ks_IN\readme.txt 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\PICTIM32.FLT 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00438_.WMF 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00199_.WMF 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipskor.xml 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Common Files\System\msadc\msdaremr.dll 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00077_.WMF 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382925.JPG 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\SIDEBARBB.DPV 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0384900.JPG 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\EXCEL_COL.HXT 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipBand.dll.mui 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01586_.WMF 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00212_.WMF 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Apothecary.eftx 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00267_.WMF 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00668_.WMF 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\ENVELOPE.XML 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\it-IT\sqlxmlx.rll.mui 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File created C:\Program Files\Microsoft Games\Multiplayer\readme.txt 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\VideoLAN\VLC\skins\default.vlt 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Office Classic 2.xml 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MUAUTH.CAB 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107328.WMF 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00820_.WMF 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationUp_ButtonGraphic.png 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00443_.WMF 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGPICCAP.XML 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOHEV.DLL 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\readme.txt 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File created C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\readme.txt 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\goopdateres_fil.dll 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS01637_.WMF 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Equity.eftx 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Newsprint.xml 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Library\SOLVER\readme.txt 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\ReceiveResolve.ods 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE02296_.WMF 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe -
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 944 vssadmin.exe 2000 vssadmin.exe -
Modifies registry class 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.basta\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fkdjsadasd.ico" 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.basta\DefaultIcon 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.basta 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 1716 vssvc.exe Token: SeRestorePrivilege 1716 vssvc.exe Token: SeAuditPrivilege 1716 vssvc.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1080 wrote to memory of 908 1080 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe 29 PID 1080 wrote to memory of 908 1080 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe 29 PID 1080 wrote to memory of 908 1080 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe 29 PID 1080 wrote to memory of 908 1080 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe 29 PID 908 wrote to memory of 944 908 cmd.exe 31 PID 908 wrote to memory of 944 908 cmd.exe 31 PID 908 wrote to memory of 944 908 cmd.exe 31 PID 908 wrote to memory of 944 908 cmd.exe 31 PID 1080 wrote to memory of 1152 1080 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe 34 PID 1080 wrote to memory of 1152 1080 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe 34 PID 1080 wrote to memory of 1152 1080 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe 34 PID 1080 wrote to memory of 1152 1080 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe 34 PID 1152 wrote to memory of 2000 1152 cmd.exe 36 PID 1152 wrote to memory of 2000 1152 cmd.exe 36 PID 1152 wrote to memory of 2000 1152 cmd.exe 36 PID 1152 wrote to memory of 2000 1152 cmd.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe"C:\Users\Admin\AppData\Local\Temp\7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe"1⤵
- Modifies extensions of user files
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Windows\system32\vssadmin.exeC:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:944
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\System32\vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Windows\SysWOW64\vssadmin.exeC:\Windows\System32\vssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2000
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1716