blackbasta | 699aaea1598a034cde7ed88cd8a8a36fd59447e09bddef566357061774c48a76

General

Target
699aaea1598a034cde7ed88cd8a8a36fd59447e09bddef566357061774c48a76.exe
Size 555KB
Sample221130-2gs5hsbc78
SHA256 699aaea1598a034cde7ed88cd8a8a36fd59447e09bddef566357061774c48a76
MD5 6d5b9675b68bac95b885b4bb294134a1
SHA1 74dbf463be3139a28d9851b3b80c2ecac3e56304
SHA512 5bc03425855057dd1f7cd9d5b61c3c895eb1ac48401aa4bd807e56560b149aefe1d9f2c7c73225f0e705923e5e2dd2d65490e1ba668dc788852ebc51f63bbe00
SSDEEP 12288:SW0nwOZKGC9FGKRTyBQPqPgrSrMGu4fGxzWjQ9dGB3K4d:ShwVGKR+BQPqPgKM2GxzMyGhK4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

blackbasta evasion ransomware

Malware Config

Signatures

Black Basta
A ransomware family targeting Windows and Linux ESXi first seen in February 2022.
ransomware blackbasta
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Modifies boot configuration data using bcdedit 1 TTPs 1 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
2212	bcdedit.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	699aaea1598a034cde7ed88cd8a8a36fd59447e09bddef566357061774c48a76.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dlaksjdoiwq.jpg"	699aaea1598a034cde7ed88cd8a8a36fd59447e09bddef566357061774c48a76.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

pid	Process
5032	vssadmin.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "174"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe

Modifies registry class 3 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.basta\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fkdjsadasd.ico"	699aaea1598a034cde7ed88cd8a8a36fd59447e09bddef566357061774c48a76.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.basta\DefaultIcon	699aaea1598a034cde7ed88cd8a8a36fd59447e09bddef566357061774c48a76.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.basta	699aaea1598a034cde7ed88cd8a8a36fd59447e09bddef566357061774c48a76.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeBackupPrivilege	2252	vssvc.exe
Token: SeRestorePrivilege	2252	vssvc.exe
Token: SeAuditPrivilege	2252	vssvc.exe
Token: SeShutdownPrivilege	3624	shutdown.exe
Token: SeRemoteShutdownPrivilege	3624	shutdown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1856	LogonUI.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4412 wrote to memory of 3972	4412	699aaea1598a034cde7ed88cd8a8a36fd59447e09bddef566357061774c48a76.exe	84
PID 4412 wrote to memory of 3972	4412	699aaea1598a034cde7ed88cd8a8a36fd59447e09bddef566357061774c48a76.exe	84
PID 4412 wrote to memory of 3972	4412	699aaea1598a034cde7ed88cd8a8a36fd59447e09bddef566357061774c48a76.exe	84
PID 3972 wrote to memory of 5032	3972	cmd.exe	86
PID 3972 wrote to memory of 5032	3972	cmd.exe	86
PID 4412 wrote to memory of 2336	4412	699aaea1598a034cde7ed88cd8a8a36fd59447e09bddef566357061774c48a76.exe	89
PID 4412 wrote to memory of 2336	4412	699aaea1598a034cde7ed88cd8a8a36fd59447e09bddef566357061774c48a76.exe	89
PID 4412 wrote to memory of 2336	4412	699aaea1598a034cde7ed88cd8a8a36fd59447e09bddef566357061774c48a76.exe	89
PID 4412 wrote to memory of 2212	4412	699aaea1598a034cde7ed88cd8a8a36fd59447e09bddef566357061774c48a76.exe	92
PID 4412 wrote to memory of 2212	4412	699aaea1598a034cde7ed88cd8a8a36fd59447e09bddef566357061774c48a76.exe	92
PID 4412 wrote to memory of 3768	4412	699aaea1598a034cde7ed88cd8a8a36fd59447e09bddef566357061774c48a76.exe	94
PID 4412 wrote to memory of 3768	4412	699aaea1598a034cde7ed88cd8a8a36fd59447e09bddef566357061774c48a76.exe	94
PID 4412 wrote to memory of 3768	4412	699aaea1598a034cde7ed88cd8a8a36fd59447e09bddef566357061774c48a76.exe	94
PID 3768 wrote to memory of 3624	3768	cmd.exe	96
PID 3768 wrote to memory of 3624	3768	cmd.exe	96
PID 3768 wrote to memory of 3624	3768	cmd.exe	96

C:\Users\Admin\AppData\Local\Temp\699aaea1598a034cde7ed88cd8a8a36fd59447e09bddef566357061774c48a76.exe
"C:\Users\Admin\AppData\Local\Temp\699aaea1598a034cde7ed88cd8a8a36fd59447e09bddef566357061774c48a76.exe"
1⤵
- Checks computer location settings
- Sets desktop wallpaper using registry
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4412
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3972
- - C:\Windows\system32\vssadmin.exe
    C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:5032
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\System32\vssadmin.exe delete shadows /all /quiet
  2⤵
  PID:2336
- C:\Windows\system32\bcdedit.exe
  C:\Windows\SysNative\bcdedit.exe /set safeboot network
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2212
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C shutdown -r -f -t 0
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3768
- - C:\Windows\SysWOW64\shutdown.exe
    shutdown -r -f -t 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3624

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2252

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39d5055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1856