Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

9a55f55886...bc.exe

windows7-x64

10

9a55f55886...bc.exe

windows10-2004-x64

10

Resubmissions

16/10/2022, 15:12

221016-sk6qcahfcq 10

09/10/2022, 17:10

221009-vppnqshdhl 10

Analysis

  • max time kernel
    47s
  • max time network
    59s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/10/2022, 17:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe

  • Size

    542KB

  • MD5

    c115bbbdb1a61f8c553d74802bfd78fb

  • SHA1

    1f439569e3c1c14ea9f02235f8f45c49e2764160

  • SHA256

    9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc

  • SHA512

    6ad701415ce5e1f94144a979f7e347499ecd80e4de4705dbe9570ad53a90b58034ea98f2ec9d257a330ec47ffeacdbd420f581ad8a4d76b0c7ad4bb198b1ab84

  • SSDEEP

    12288:trkm8R9qXgmj3d7khtgfpedbKbiTuDZWhswtik5j2w+f:2Ujt7+twpedbKb1dWhse9K

Score
10/10
blackbastaransomware

Malware Config

Extracted

Path

C:\odt\readme.txt

Ransom Note
Your data are stolen and encrypted The data will be published on TOR website if you do not pay the ransom You can contact us and decrypt one file for free on this TOR site (you should download and install TOR browser first https://torproject.org) https://aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion/ Your company id for log in: 5c33d3df-a9bf-4899-a852-b2d2ce9944ec 
URLs

https://aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion/

Signatures

  • Black Basta

    A ransomware family targeting Windows and Linux ESXi first seen in February 2022.

    ransomwareblackbasta
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies extensions of user files 6 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies registry class 3 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe
    "C:\Users\Admin\AppData\Local\Temp\9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe"
    1⤵
    • Modifies extensions of user files
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1932
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4960
      • C:\Windows\system32\vssadmin.exe
        C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet
        3⤵
        • Interacts with shadow copies
        PID:4920
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\System32\vssadmin.exe delete shadows /all /quiet
      2⤵
        PID:5076
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4860
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:4584
      • C:\Windows\system32\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Documents\readme.txt
        1⤵
        • Opens file in notepad (likely ransom note)
        PID:928

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\Documents\readme.txt
        Filesize

        395B

        MD5

        b4a2e3e446d794ab467364956096c047

        SHA1

        7b520a2b0b954a03ffd7fae189f933c94784f1c2

        SHA256

        5c7f7d725ae586b8914eb7e4514a6a52189ca3dc32af6be20d5a404e3f7ff298

        SHA512

        6f7d06b4b8a724372b5e3e6bf0881024bbc7a20a4d7c8b6a588ee65708b2c10a9d1862ae09102aa13eb02f089a1b8152ef87576bc14a953ac004c325594118c1

        Download Submit