Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
185s -
max time network
258s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
30/11/2022, 23:37
Behavioral task
behavioral1
Sample
affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe
Resource
win7-20221111-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe
-
Size
546KB
-
MD5
adb3cf03e9be744107e61bd7de4c26bd
-
SHA1
cc7ea6bb6787df664adb69022546c42f5f409653
-
SHA256
affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada
-
SHA512
ba7591375768521bf7497a6c9f3c53a7121824ed352edc043dc24ca23dbd55d8c73e37fd96ce32d45aa16b7955a1fff7bcd31f25d22624bab60d598a4e536927
-
SSDEEP
12288:9+qCsxmzj5xiJn+aJ5REfBFW8ciUt0MV5OcIBpwG01:94riJnvJUfBFW8ciMbOc0b0
Score
10/10
Malware Config
Extracted
Path
C:\MSOCache\readme.txt
Ransom Note
Your data are stolen and encrypted
The data will be published on TOR website if you do not pay the ransom
You can contact us and decrypt one file for free on this TOR site
(you should download and install TOR browser first https://torproject.org)
https://aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion/
Your company id for log in: 05d09847-9593-4dc6-95aa-61587e40e103
URLs
https://aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion/
Signatures
-
Black Basta
A ransomware family targeting Windows and Linux ESXi first seen in February 2022.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dlaksjdoiwq.jpg" affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Internet Explorer\DiagnosticsHub_is.dll affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\Internet Explorer\F12.dll affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\ClearUnregister.hta affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File created C:\Program Files (x86)\MSBuild\readme.txt affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\DVD Maker\rtstreamsink.ax affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\Internet Explorer\F12Tools.dll affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\Internet Explorer\pdm.dll affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\BlockMount.vdx affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File created C:\Program Files (x86)\Reference Assemblies\readme.txt affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File created C:\Program Files\DVD Maker\it-IT\readme.txt affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\Internet Explorer\Timeline.dll affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File created C:\Program Files\Google\readme.txt affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\StartComplete.tmp affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\Internet Explorer\D3DCompiler_47.dll affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File created C:\Program Files\Microsoft Games\FreeCell\readme.txt affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File created C:\Program Files\Microsoft Games\Mahjong\readme.txt affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File created C:\Program Files\Microsoft Office\readme.txt affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\DVD Maker\OmdBase.dll affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\ConvertToUse.xml affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File created C:\Program Files\Common Files\System\readme.txt affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File created C:\Program Files\Internet Explorer\it-IT\readme.txt affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\DVD Maker\SecretST.TTF affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\Internet Explorer\ie9props.propdesc affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File created C:\Program Files\Common Files\readme.txt affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\CompareEdit.pps affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\CompressRestart.jpeg affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\ResetInstall.xhtml affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\7-Zip\7-zip.chm affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File created C:\Program Files\Internet Explorer\es-ES\readme.txt affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File created C:\Program Files (x86)\readme.txt affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File created C:\Program Files\Java\readme.txt affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File created C:\Program Files\Common Files\SpeechEngines\readme.txt affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\StepPop.tif affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File created C:\Program Files (x86)\Google\readme.txt affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File created C:\Program Files\Internet Explorer\en-US\readme.txt affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\ConvertFromEnter.avi affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\EnterSend.txt affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\Internet Explorer\Timeline_is.dll affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File created C:\Program Files\DVD Maker\de-DE\readme.txt affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\Internet Explorer\jsprofilerui.dll affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\SelectRename.wax affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\WriteCompress.dotm affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\readme.txt affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\DVD Maker\bod_r.TTF affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\ApproveSubmit.ps1 affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\CopyUninstall.jpe affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\CompressDismount.vssm affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\ImportReset.css affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\DVD Maker\sonicsptransform.ax affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\7-Zip\readme.txt affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File created C:\Program Files\Microsoft Games\readme.txt affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File created C:\Program Files\7-Zip\Lang\readme.txt affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File created C:\Program Files\Common Files\Services\readme.txt affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\7-Zip\History.txt affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\DVD Maker\PipeTran.dll affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File created C:\Program Files\Microsoft Games\Chess\readme.txt affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\MountGroup.avi affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File created C:\Program Files (x86)\Uninstall Information\readme.txt affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File created C:\Program Files\DVD Maker\ja-JP\readme.txt affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\7-Zip\7z.sfx affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe File opened for modification C:\Program Files\DVD Maker\Eurosti.TTF affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe -
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1872 vssadmin.exe 972 vssadmin.exe -
Modifies registry class 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.basta\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fkdjsadasd.ico" affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.basta\DefaultIcon affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.basta affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 776 vssvc.exe Token: SeRestorePrivilege 776 vssvc.exe Token: SeAuditPrivilege 776 vssvc.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 572 wrote to memory of 772 572 affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe 29 PID 572 wrote to memory of 772 572 affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe 29 PID 572 wrote to memory of 772 572 affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe 29 PID 572 wrote to memory of 772 572 affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe 29 PID 772 wrote to memory of 1872 772 cmd.exe 31 PID 772 wrote to memory of 1872 772 cmd.exe 31 PID 772 wrote to memory of 1872 772 cmd.exe 31 PID 772 wrote to memory of 1872 772 cmd.exe 31 PID 572 wrote to memory of 808 572 affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe 34 PID 572 wrote to memory of 808 572 affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe 34 PID 572 wrote to memory of 808 572 affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe 34 PID 572 wrote to memory of 808 572 affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe 34 PID 808 wrote to memory of 972 808 cmd.exe 36 PID 808 wrote to memory of 972 808 cmd.exe 36 PID 808 wrote to memory of 972 808 cmd.exe 36 PID 808 wrote to memory of 972 808 cmd.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe"C:\Users\Admin\AppData\Local\Temp\affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe"1⤵
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Windows\system32\vssadmin.exeC:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1872
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\System32\vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Windows\SysWOW64\vssadmin.exeC:\Windows\System32\vssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:972
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:776