Overview

overview

10

Static

static

10

7883f01096...8a.exe

windows10-2004-x64

10

Resubmissions

09/10/2022, 11:18

221009-neebpahaep10

27/04/2022, 22:34

220427-2g3nysegfq10

Analysis

  • max time kernel
    80s
  • max time network
    89s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/10/2022, 11:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe
  • Size 543KB
  • Sample221009-neebpahaep
  • SHA256 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
blackbastaransomware

Malware Config

Extracted

Path

  • C:\readme.txt

Ransom Note
  • Your data are stolen and encrypted The data will be published on TOR website if you do not pay the ransom You can contact us and decrypt one file for free on this TOR site (you should download and install TOR browser first https://torproject.org) https://aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion:80/ Your company id for log in: ba7a7058-3531-4b67-bae6-d602e9110361
URLs

  • https://aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion:80/

Signatures

  • Black Basta

    A ransomware family targeting Windows and Linux ESXi first seen in February 2022.

    ransomwareblackbasta
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies extensions of user files 5 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Drops file in System32 directory 11 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies registry class 3 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe
    "C:\Users\Admin\AppData\Local\Temp\7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe"
    1⤵
    • Modifies extensions of user files
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:5024
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:456
      • C:\Windows\system32\vssadmin.exe
        C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet
        3⤵
        • Interacts with shadow copies
        PID:2356
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\System32\vssadmin.exe delete shadows /all /quiet
      2⤵
        PID:3096
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3508
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:3416
      • C:\Windows\system32\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\readme.txt
        1⤵
        • Opens file in notepad (likely ransom note)
        PID:1560
      • C:\Windows\system32\mspaint.exe
        "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\dlaksjdoiwq.jpg" /ForceBootstrapPaint3D
        1⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:1460
      • C:\Windows\System32\svchost.exe
        C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
        1⤵
        • Drops file in System32 directory
        PID:3940
      • C:\Windows\system32\mspaint.exe
        "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\dlaksjdoiwq.jpg" /ForceBootstrapPaint3D
        1⤵
          PID:376
        • C:\Windows\system32\OpenWith.exe
          C:\Windows\system32\OpenWith.exe -Embedding
          1⤵
            PID:3796
          • C:\Windows\system32\OpenWith.exe
            C:\Windows\system32\OpenWith.exe -Embedding
            1⤵
              PID:4084

            Network

                  MITRE ATT&CK Enterprise v6

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  dlaksjdoiwq.jpg
                  • Path C:\Users\Admin\AppData\Local\Temp\dlaksjdoiwq.jpg
                  • Size 24KB
                  • SHA256 397a78de041380082c5778818843ee9c2b65a9647fbc0d251244e6cac76e170c
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  readme.txt
                  • Path C:\Users\Admin\Desktop\readme.txt
                  • Size 401B
                  • SHA256 2967e1d97d32605fc5ace49a10828800fbbefcc1e010f6004a9c88ef3ecdad88
                  • MD5 SHA1 SHA512
                  Submit Download

                  memory/3940-136-0x000002592EBA0000-0x000002592EBB0000-memory.dmp
                  Download

                  memory/3940-137-0x000002592F360000-0x000002592F370000-memory.dmp
                  Download