Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

cce74c82a7...fa.exe

windows7-x64

10

cce74c82a7...fa.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    29s
  • max time network
    30s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    30/11/2022, 23:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    cce74c82a718be7484abf7c51011793f2717cfb2068c92aa35416a93cbd13cfa.exe

  • Size

    543KB

  • MD5

    f05dac112cd3174c385d10158b6080fb

  • SHA1

    579b245a6609903d804f957083b9e0b2ed145f5a

  • SHA256

    cce74c82a718be7484abf7c51011793f2717cfb2068c92aa35416a93cbd13cfa

  • SHA512

    213891e6f5a16726a86c51eb67e8c4cf8bcf7d2b6a688c13614145445180f5458f808d124e5e398da2335a8c4484709c6124d4268bed1335d6338b733bb51a55

  • SSDEEP

    12288:z1DTMHixr1moQqUiXINDl/m1s6BQio67VlAU:BzmoQqUiXw2s6yiVxR

Score
10/10
blackbastaransomware

Malware Config

Extracted

Path

C:\readme.txt

Ransom Note
Your data are stolen and encrypted The data will be published on TOR website if you do not pay the ransom You can contact us and decrypt one file for free on this TOR site (you should download and install TOR browser first https://torproject.org) https://aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion:80/ Your company id for log in: ba7a7058-3531-4b67-bae6-d602e9110361
URLs

https://aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion:80/

Signatures

  • Black Basta

    A ransomware family targeting Windows and Linux ESXi first seen in February 2022.

    ransomwareblackbasta
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Interacts with shadow copies 2 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies registry class 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cce74c82a718be7484abf7c51011793f2717cfb2068c92aa35416a93cbd13cfa.exe
    "C:\Users\Admin\AppData\Local\Temp\cce74c82a718be7484abf7c51011793f2717cfb2068c92aa35416a93cbd13cfa.exe"
    1⤵
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2020
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:604
      • C:\Windows\system32\vssadmin.exe
        C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet
        3⤵
        • Interacts with shadow copies
        PID:1080
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\System32\vssadmin.exe delete shadows /all /quiet
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:960
      • C:\Windows\SysWOW64\vssadmin.exe
        C:\Windows\System32\vssadmin.exe delete shadows /all /quiet
        3⤵
        • Interacts with shadow copies
        PID:1132
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1776

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2020-54-0x0000000075451000-0x0000000075453000-memory.dmp

    Filesize

    8KB

    Download