Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
89s -
max time network
111s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
30/11/2022, 23:19
Behavioral task
behavioral1
Sample
a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe
Resource
win7-20220812-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe
-
Size
830KB
-
MD5
a2086f41bc06adc69517bc0d9c07bf6e
-
SHA1
1d30388c1235da56a2f17d645f0a66ead7b59159
-
SHA256
a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625
-
SHA512
10432474743e46dda5e9247aae8b8c7c474fd4a0521e30d5be09942f88c2cd6ce7bde89b7858dd9f28b63bb3b515817a4ca4a6f82c5998d5e482645bb8d6fc30
-
SSDEEP
24576:qPCxmUtjDcK/IhU06NZim3gG8jq+wh+A:stUtfcANY/m
Score
10/10
Malware Config
Extracted
Path
C:\readme.txt
Ransom Note
Your data are stolen and encrypted
The data will be published on TOR website if you do not pay the ransom
You can contact us and decrypt one file for free on this TOR site
(you should download and install TOR browser first https://torproject.org)
https://aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion/
Your company id for log in: 460c3c4c-c19d-4567-b16a-a28e49949214
@>B
URLs
https://aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion/
Signatures
-
Black Basta
A ransomware family targeting Windows and Linux ESXi first seen in February 2022.
-
Black Basta payload 3 IoCs
resource yara_rule behavioral2/memory/724-134-0x00000000004F0000-0x000000000057E000-memory.dmp family_blackbasta behavioral2/memory/724-140-0x00000000004F0000-0x000000000057E000-memory.dmp family_blackbasta behavioral2/memory/724-145-0x00000000004F0000-0x000000000057E000-memory.dmp family_blackbasta -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
resource yara_rule behavioral2/memory/4180-132-0x0000000000400000-0x00000000004EC000-memory.dmp upx behavioral2/memory/4180-136-0x0000000000400000-0x00000000004EC000-memory.dmp upx behavioral2/memory/724-142-0x0000000000400000-0x00000000004EC000-memory.dmp upx -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dlaksjdoiwq.jpg" a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4180 set thread context of 724 4180 a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe 80 -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\SubmitReceive.mpeg a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe File created C:\Program Files\Common Files\microsoft shared\TextConv\readme.txt a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe File created C:\Program Files (x86)\Common Files\System\es-ES\readme.txt a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe File opened for modification C:\Program Files\7-Zip\Lang\ro.txt a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe File opened for modification C:\Program Files\Internet Explorer\images\bing.ico a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\THIRDPARTYLICENSEREADME-JAVAFX.txt a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe File created C:\Program Files (x86)\Common Files\System\Ole DB\readme.txt a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe File created C:\Program Files (x86)\Internet Explorer\ja-JP\readme.txt a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe File opened for modification C:\Program Files\Internet Explorer\es-ES\iexplore.exe.mui a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-crt-heap-l1-1-0.dll a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spl.txt a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe File created C:\Program Files (x86)\Microsoft\Edge\readme.txt a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\readme.txt a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe File opened for modification C:\Program Files\Mozilla Firefox\msvcp140.dll a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe File created C:\Program Files (x86)\Google\Update\Install\readme.txt a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe File opened for modification C:\Program Files (x86)\Common Files\Services\verisign.bmp a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe File created C:\Program Files\Microsoft Office\readme.txt a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe File created C:\Program Files (x86)\Adobe\readme.txt a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe File created C:\Program Files\Java\jdk1.8.0_66\db\readme.txt a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe File created C:\Program Files\Mozilla Firefox\browser\features\readme.txt a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe File opened for modification C:\Program Files (x86)\Internet Explorer\en-US\iexplore.exe.mui a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe File opened for modification C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\msdatasrc.dll a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe File created C:\Program Files\Internet Explorer\de-DE\readme.txt a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\THIRDPARTYLICENSEREADME.txt a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe File created C:\Program Files\Microsoft Office\root\Office15\readme.txt a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe File opened for modification C:\Program Files\Microsoft Office\Office16\SLERROR.XML a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\readme.txt a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe File opened for modification C:\Program Files\7-Zip\Lang\el.txt a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe File opened for modification C:\Program Files\7-Zip\descript.ion a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe File opened for modification C:\Program Files\Mozilla Firefox\IA2Marshal.dll a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\readme.txt a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe File opened for modification C:\Program Files (x86)\Microsoft.NET\RedistList\AssemblyList_4_client.xml a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe File created C:\Program Files (x86)\readme.txt a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-core-file-l1-2-0.dll a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe File created C:\Program Files (x86)\Internet Explorer\de-DE\readme.txt a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe File opened for modification C:\Program Files\7-Zip\Lang\si.txt a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe File opened for modification C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe File opened for modification C:\Program Files\7-Zip\Lang\kaa.txt a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe File created C:\Program Files\Common Files\System\ado\readme.txt a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe File created C:\Program Files\Mozilla Firefox\readme.txt a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-crt-environment-l1-1-0.dll a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe File created C:\Program Files (x86)\Microsoft.NET\RedistList\readme.txt a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe File opened for modification C:\Program Files\Internet Explorer\de-DE\iexplore.exe.mui a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe File opened for modification C:\Program Files (x86)\Microsoft.NET\RedistList\AssemblyList_4_extended.xml a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe File opened for modification C:\Program Files\RedoReset.ico a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe File opened for modification C:\Program Files\7-Zip\Lang\br.txt a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe File opened for modification C:\Program Files\7-Zip\Lang\id.txt a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe File opened for modification C:\Program Files\7-Zip\Lang\ms.txt a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe File created C:\Program Files\Java\jdk1.8.0_66\include\readme.txt a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe File opened for modification C:\Program Files\OutInvoke.rm a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\readme.txt a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe File created C:\Program Files (x86)\Common Files\readme.txt a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe File created C:\Program Files\Mozilla Firefox\browser\readme.txt a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\readme.txt a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe File created C:\Program Files (x86)\Internet Explorer\images\readme.txt a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 4740 vssadmin.exe -
Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.basta\DefaultIcon a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.basta a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.basta\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fkdjsadasd.ico" a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 4748 vssvc.exe Token: SeRestorePrivilege 4748 vssvc.exe Token: SeAuditPrivilege 4748 vssvc.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 4180 wrote to memory of 724 4180 a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe 80 PID 4180 wrote to memory of 724 4180 a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe 80 PID 4180 wrote to memory of 724 4180 a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe 80 PID 4180 wrote to memory of 724 4180 a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe 80 PID 4180 wrote to memory of 724 4180 a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe 80 PID 4180 wrote to memory of 724 4180 a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe 80 PID 4180 wrote to memory of 724 4180 a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe 80 PID 4180 wrote to memory of 724 4180 a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe 80 PID 4180 wrote to memory of 724 4180 a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe 80 PID 4180 wrote to memory of 724 4180 a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe 80 PID 724 wrote to memory of 4264 724 a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe 82 PID 724 wrote to memory of 4264 724 a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe 82 PID 724 wrote to memory of 4264 724 a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe 82 PID 4264 wrote to memory of 4740 4264 cmd.exe 84 PID 4264 wrote to memory of 4740 4264 cmd.exe 84 PID 724 wrote to memory of 4164 724 a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe 87 PID 724 wrote to memory of 4164 724 a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe 87 PID 724 wrote to memory of 4164 724 a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe"C:\Users\Admin\AppData\Local\Temp\a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\a9503a3d998e705c37d3bec7fea0ff188bcf7e753833c8b4b195e590c4ed9625.exeOMC_BC2⤵
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet3⤵
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Windows\system32\vssadmin.exeC:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet4⤵
- Interacts with shadow copies
PID:4740
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\System32\vssadmin.exe delete shadows /all /quiet3⤵PID:4164
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4748