Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
80s -
max time network
87s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
30/11/2022, 22:30
Static task
static1
Behavioral task
behavioral1
Sample
15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe
-
Size
545KB
-
MD5
6a202e9a95f58938d02385e31d43ed87
-
SHA1
53628c7a155ccb7af1135140083939018d3587f1
-
SHA256
15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4
-
SHA512
c6684838b84499dc97c75f33c1d3be29c654b90d2f0293c33af6a986facc8a673275a0f33a82f43aa1a8e67684b07092e462b1e2c309450a9ec0486ec7b4a7d1
-
SSDEEP
12288:tM9fIMGezCq1kWOgb/VPFAQxSNJ4krheZfIVWRkn8oXdd6:hbq1kWJb9PFAQxgJheZfY8gdI
Score
10/10
Malware Config
Extracted
Path
C:\odt\readme.txt
Ransom Note
Your data are stolen and encrypted
The data will be published on TOR website if you do not pay the ransom
You can contact us and decrypt one file for free on this TOR site
(you should download and install TOR browser first https://torproject.org)
https://aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion/
Your company id for log in: ea3d3d33-1635-47f7-a1a4-0078267b30bb
URLs
https://aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion/
Signatures
-
Black Basta
A ransomware family targeting Windows and Linux ESXi first seen in February 2022.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dlaksjdoiwq.jpg" 15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\readme.txt 15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe File created C:\Program Files\Java\readme.txt 15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-crt-math-l1-1-0.dll 15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\THIRDPARTYLICENSEREADME-JAVAFX.txt 15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe File opened for modification C:\Program Files\VideoLAN\VLC\libvlccore.dll 15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\bci.dll 15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\cpprestsdk.dll 15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\readme.txt 15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nb-no.dll 15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipssrb.xml 15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jhat.exe 15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll 15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe File created C:\Program Files\Common Files\microsoft shared\ink\ro-RO\readme.txt 15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe File created C:\Program Files\Common Files\microsoft shared\ink\th-TH\readme.txt 15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\readme.txt 15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\readme.txt 15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\include\jni.h 15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe File opened for modification C:\Program Files\7-Zip\Lang\is.txt 15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe File opened for modification C:\Program Files\VideoLAN\VLC\New_Skins.url 15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe File created C:\Program Files\Common Files\microsoft shared\ink\da-DK\readme.txt 15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe File opened for modification C:\Program Files\7-Zip\Lang\fur.txt 15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe File opened for modification C:\Program Files\Common Files\System\msadc\msdaremr.dll 15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.et-ee.dll 15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe File opened for modification C:\Program Files\7-Zip\Lang\an.txt 15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe File opened for modification C:\Program Files\7-Zip\Lang\de.txt 15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\offreg.dll 15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll 15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\README-JDK.html 15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe File created C:\Program Files\Google\Chrome\Application\89.0.4389.114\readme.txt 15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe File created C:\Program Files\Java\jre1.8.0_66\bin\dtplugin\readme.txt 15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe File opened for modification C:\Program Files\Mozilla Firefox\removed-files 15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe File created C:\Program Files\Common Files\System\en-US\readme.txt 15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe File created C:\Program Files\VideoLAN\VLC\plugins\readme.txt 15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\omni.ja 15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\FrequentOfficeUpdateSchedule.xml 15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe File opened for modification C:\Program Files\ApproveRemove.odt 15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe File opened for modification C:\Program Files\Mozilla Firefox\update-settings.ini 15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml 15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe File created C:\Program Files (x86)\Common Files\Adobe\HelpCfg\readme.txt 15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\wsimport.exe 15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\dcpr.dll 15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe File opened for modification C:\Program Files (x86)\Microsoft.NET\RedistList\AssemblyList_4_extended.xml 15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Edge.dat 15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\oledb32r.dll 15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ru-ru.dll 15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe File created C:\Program Files\Common Files\microsoft shared\ink\el-GR\readme.txt 15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe File created C:\Program Files\Common Files\microsoft shared\ink\ko-KR\readme.txt 15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe File opened for modification C:\Program Files\Common Files\System\ado\msador15.dll 15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe File created C:\Program Files (x86)\Google\Update\readme.txt 15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml 15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe File opened for modification C:\Program Files\7-Zip\Lang\cy.txt 15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe File opened for modification C:\Program Files\7-Zip\Lang\ru.txt 15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\readme.txt 15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\xjc.exe 15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe File opened for modification C:\Program Files\7-Zip\Lang\ext.txt 15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\release 15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe File opened for modification C:\Program Files\VideoLAN\VLC\THANKS.txt 15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VGX\VGX.dll 15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\glib-lite.dll 15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe File created C:\Program Files\Common Files\DESIGNER\readme.txt 15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe File opened for modification C:\Program Files\7-Zip\Lang\eo.txt 15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe File opened for modification C:\Program Files\Common Files\System\ado\msado20.tlb 15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe File opened for modification C:\Program Files\Mozilla Firefox\IA2Marshal.dll 15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 4932 vssadmin.exe -
Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.basta\DefaultIcon 15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.basta 15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.basta\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fkdjsadasd.ico" 15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 3404 vssvc.exe Token: SeRestorePrivilege 3404 vssvc.exe Token: SeAuditPrivilege 3404 vssvc.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1848 wrote to memory of 4784 1848 15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe 82 PID 1848 wrote to memory of 4784 1848 15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe 82 PID 1848 wrote to memory of 4784 1848 15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe 82 PID 4784 wrote to memory of 4932 4784 cmd.exe 84 PID 4784 wrote to memory of 4932 4784 cmd.exe 84 PID 1848 wrote to memory of 2860 1848 15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe 87 PID 1848 wrote to memory of 2860 1848 15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe 87 PID 1848 wrote to memory of 2860 1848 15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe"C:\Users\Admin\AppData\Local\Temp\15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4.exe"1⤵
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Windows\system32\vssadmin.exeC:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:4932
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\System32\vssadmin.exe delete shadows /all /quiet2⤵PID:2860
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3404