Analysis
-
max time kernel
92s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
16-10-2022 15:12
Static task
static1
Behavioral task
behavioral1
Sample
9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe
Resource
win7-20220812-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe
-
Size
542KB
-
MD5
c115bbbdb1a61f8c553d74802bfd78fb
-
SHA1
1f439569e3c1c14ea9f02235f8f45c49e2764160
-
SHA256
9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc
-
SHA512
6ad701415ce5e1f94144a979f7e347499ecd80e4de4705dbe9570ad53a90b58034ea98f2ec9d257a330ec47ffeacdbd420f581ad8a4d76b0c7ad4bb198b1ab84
-
SSDEEP
12288:trkm8R9qXgmj3d7khtgfpedbKbiTuDZWhswtik5j2w+f:2Ujt7+twpedbKb1dWhse9K
Score
10/10
Malware Config
Extracted
Path
C:\MSOCache\readme.txt
Ransom Note
Your data are stolen and encrypted
The data will be published on TOR website if you do not pay the ransom
You can contact us and decrypt one file for free on this TOR site
(you should download and install TOR browser first https://torproject.org)
https://aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion/
Your company id for log in: 5c33d3df-a9bf-4899-a852-b2d2ce9944ec
URLs
https://aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion/
Signatures
-
Black Basta
A ransomware family targeting Windows and Linux ESXi first seen in February 2022.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 11 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\NewSuspend.tiff => C:\Users\Admin\Pictures\NewSuspend.tiff.basta 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe File renamed C:\Users\Admin\Pictures\RestoreClear.raw => C:\Users\Admin\Pictures\RestoreClear.raw.basta 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe File renamed C:\Users\Admin\Pictures\RestoreFind.crw => C:\Users\Admin\Pictures\RestoreFind.crw.basta 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe File opened for modification C:\Users\Admin\Pictures\ConfirmCompress.tiff 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe File renamed C:\Users\Admin\Pictures\ConfirmCompress.tiff => C:\Users\Admin\Pictures\ConfirmCompress.tiff.basta 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe File renamed C:\Users\Admin\Pictures\ConvertFromDisconnect.png => C:\Users\Admin\Pictures\ConvertFromDisconnect.png.basta 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe File opened for modification C:\Users\Admin\Pictures\NewSuspend.tiff 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe File renamed C:\Users\Admin\Pictures\NewBackup.tif => C:\Users\Admin\Pictures\NewBackup.tif.basta 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe File renamed C:\Users\Admin\Pictures\TestWait.crw => C:\Users\Admin\Pictures\TestWait.crw.basta 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe File renamed C:\Users\Admin\Pictures\AssertConvert.png => C:\Users\Admin\Pictures\AssertConvert.png.basta 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe File renamed C:\Users\Admin\Pictures\UnregisterConnect.png => C:\Users\Admin\Pictures\UnregisterConnect.png.basta 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dlaksjdoiwq.jpg" 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Internet Explorer\en-US\ieinstal.exe.mui 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe File created C:\Program Files (x86)\Google\Update\Install\readme.txt 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\mscss7cm_es.dub 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\mset7tkjp.dll 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\STSCOPY.DLL 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\readme.txt 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\readme.txt 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Microsoft.Office.BusinessApplications.Runtime.dll 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe File created C:\Program Files\Internet Explorer\fr-FR\readme.txt 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe File opened for modification C:\Program Files\DVD Maker\Pipeline.dll 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe File opened for modification C:\Program Files (x86)\Internet Explorer\JSProfilerCore.dll 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe File opened for modification C:\Program Files\7-Zip\Lang\pt.txt 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe File created C:\Program Files\Microsoft Games\Mahjong\it-IT\readme.txt 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe File opened for modification C:\Program Files\Internet Explorer\F12Resources.dll 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe File created C:\Program Files (x86)\Common Files\microsoft shared\MSClientDataMgr\readme.txt 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe File created C:\Program Files (x86)\Google\Update\Offline\readme.txt 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OUTLFLTR.DAT 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\readme.txt 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Filters\offfiltx.dll 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsen.xml 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe File opened for modification C:\Program Files\7-Zip\Lang\pt-br.txt 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Adjacency.thmx 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ADVTEL.DIC 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\mset7fr.kic 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OLMAPI32.DLL 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe File opened for modification C:\Program Files\7-Zip\Lang\ms.txt 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsplk.xml 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\THIRDPARTYLICENSEREADME.txt 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GRAPH.ICO 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MML2OMML.XSL 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\readme.txt 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONWordAddin.dll 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrcatlm.dat 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\tipresx.dll 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe File opened for modification C:\Program Files\DVD Maker\de-DE\OmdProject.dll.mui 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Thatch.thmx 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\mscss7wre_en.dub 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\STSLIST.DLL 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe File created C:\Program Files\Common Files\Microsoft Shared\VGX\readme.txt 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MSOHTMED.EXE 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe File opened for modification C:\Program Files (x86)\Common Files\System\DirectDB.dll 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Technic.thmx 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\mshwjpnr.dll 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe File created C:\Program Files (x86)\Google\Policies\readme.txt 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Library\readme.txt 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\EMSMDB32.DLL 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSPUB.TLB 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OLKIRMV.XML 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe File created C:\Program Files (x86)\Microsoft Office\Office14\SAMPLES\readme.txt 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\mscss7cm_en.dub 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSPPT.OLB 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-crt-filesystem-l1-1-0.dll 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe File opened for modification C:\Program Files\7-Zip\Lang\ku.txt 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe File created C:\Program Files\VideoLAN\VLC\locale\readme.txt 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MSOHEVI.DLL 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe File created C:\Program Files (x86)\Microsoft Office\Office14\FORMS\readme.txt 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORM.DLL 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\mscss7wre_fr.dub 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe File created C:\Program Files\Microsoft Office\readme.txt 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-crt-stdio-l1-1-0.dll 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe File created C:\Program Files (x86)\Internet Explorer\de-DE\readme.txt 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe -
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1680 vssadmin.exe 1364 vssadmin.exe -
Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.basta\DefaultIcon 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.basta 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.basta\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fkdjsadasd.ico" 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 972 vssvc.exe Token: SeRestorePrivilege 972 vssvc.exe Token: SeAuditPrivilege 972 vssvc.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1948 wrote to memory of 944 1948 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe 29 PID 1948 wrote to memory of 944 1948 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe 29 PID 1948 wrote to memory of 944 1948 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe 29 PID 1948 wrote to memory of 944 1948 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe 29 PID 944 wrote to memory of 1680 944 cmd.exe 31 PID 944 wrote to memory of 1680 944 cmd.exe 31 PID 944 wrote to memory of 1680 944 cmd.exe 31 PID 944 wrote to memory of 1680 944 cmd.exe 31 PID 1948 wrote to memory of 1840 1948 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe 34 PID 1948 wrote to memory of 1840 1948 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe 34 PID 1948 wrote to memory of 1840 1948 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe 34 PID 1948 wrote to memory of 1840 1948 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe 34 PID 1840 wrote to memory of 1364 1840 cmd.exe 36 PID 1840 wrote to memory of 1364 1840 cmd.exe 36 PID 1840 wrote to memory of 1364 1840 cmd.exe 36 PID 1840 wrote to memory of 1364 1840 cmd.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe"C:\Users\Admin\AppData\Local\Temp\9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc.exe"1⤵
- Modifies extensions of user files
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Windows\system32\vssadmin.exeC:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1680
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\System32\vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Windows\SysWOW64\vssadmin.exeC:\Windows\System32\vssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1364
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:972