Analysis
-
max time kernel
153s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03/11/2022, 07:55
Behavioral task
behavioral1
Sample
affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe
Resource
win7-20220812-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe
-
Size
546KB
-
MD5
adb3cf03e9be744107e61bd7de4c26bd
-
SHA1
cc7ea6bb6787df664adb69022546c42f5f409653
-
SHA256
affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada
-
SHA512
ba7591375768521bf7497a6c9f3c53a7121824ed352edc043dc24ca23dbd55d8c73e37fd96ce32d45aa16b7955a1fff7bcd31f25d22624bab60d598a4e536927
-
SSDEEP
12288:9+qCsxmzj5xiJn+aJ5REfBFW8ciUt0MV5OcIBpwG01:94riJnvJUfBFW8ciMbOc0b0
Score
10/10
Malware Config
Extracted
Path
C:\odt\readme.txt
Ransom Note
Your data are stolen and encrypted
The data will be published on TOR website if you do not pay the ransom
You can contact us and decrypt one file for free on this TOR site
(you should download and install TOR browser first https://torproject.org)
https://aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion/
Your company id for log in: 05d09847-9593-4dc6-95aa-61587e40e103
URLs
https://aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion/
Signatures
-
Black Basta
A ransomware family targeting Windows and Linux ESXi first seen in February 2022.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 2 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\MoveDisable.crw => C:\Users\Admin\Pictures\MoveDisable.crw.basta affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File renamed C:\Users\Admin\Pictures\SelectClose.crw => C:\Users\Admin\Pictures\SelectClose.crw.basta affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dlaksjdoiwq.jpg" affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-ul-phn.xrm-ms affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000008\readme.txt affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File created C:\Program Files\Microsoft Office 15\readme.txt affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-pl.xrm-ms affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Trial-pl.xrm-ms affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\mscss7es.dll affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.dcfmui.msi.16.en-us.xml affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Grace-ppd.xrm-ms affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-pl.xrm-ms affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTest-pl.xrm-ms affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File created C:\Program Files\Mozilla Firefox\readme.txt affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.cfg affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\omni.ja affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-ppd.xrm-ms affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\Mozilla Firefox\nss3.dll affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O17EnterpriseVL_Bypass30-ul-oob.xrm-ms affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.fr-fr.xml affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-ul-phn.xrm-ms affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Grace-ppd.xrm-ms affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Trial-pl.xrm-ms affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-crt-stdio-l1-1-0.dll affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File created C:\Program Files\Java\jre1.8.0_66\bin\readme.txt affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-localization-l1-2-0.dll affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSZIP.DIC affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPP.HTM affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-ul-oob.xrm-ms affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-pl.xrm-ms affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-pl.xrm-ms affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription2-ul-oob.xrm-ms affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription3-pl.xrm-ms affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ppd.xrm-ms affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Trial-pl.xrm-ms affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.shared.Office.x-none.msi.16.x-none.xml affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-pl.xrm-ms affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremDemoR_BypassTrial365-ul-oob.xrm-ms affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription5-ul-oob.xrm-ms affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-ppd.xrm-ms affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ul-oob.xrm-ms affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-ppd.xrm-ms affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ppd.xrm-ms affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeServiceBypassR_PrepidBypass-ppd.xrm-ms affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019DemoR_BypassTrial180-ppd.xrm-ms affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\Common Files\System\ado\msado27.tlb affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-processthreads-l1-1-1.dll affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File created C:\Program Files\Mozilla Firefox\uninstall\readme.txt affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\7-Zip\Lang\nb.txt affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-GB\readme.txt affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\COPYRIGHT affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-pl.xrm-ms affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-pl.xrm-ms affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ppd.xrm-ms affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ExcelFloatieTextModel.bin affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-pl.xrm-ms affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File created C:\Program Files\Common Files\Services\readme.txt affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\7-Zip\7z.sfx affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File created C:\Program Files\Microsoft Office\root\vfs\readme.txt affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\7-Zip\Lang\an.txt affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1988 vssadmin.exe -
Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.basta\DefaultIcon affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.basta affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.basta\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fkdjsadasd.ico" affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 1092 vssvc.exe Token: SeRestorePrivilege 1092 vssvc.exe Token: SeAuditPrivilege 1092 vssvc.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 740 wrote to memory of 4688 740 affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe 82 PID 740 wrote to memory of 4688 740 affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe 82 PID 740 wrote to memory of 4688 740 affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe 82 PID 4688 wrote to memory of 1988 4688 cmd.exe 84 PID 4688 wrote to memory of 1988 4688 cmd.exe 84 PID 740 wrote to memory of 212 740 affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe 87 PID 740 wrote to memory of 212 740 affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe 87 PID 740 wrote to memory of 212 740 affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe"C:\Users\Admin\AppData\Local\Temp\affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe"1⤵
- Modifies extensions of user files
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Windows\system32\vssadmin.exeC:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1988
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\System32\vssadmin.exe delete shadows /all /quiet2⤵PID:212
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1092