Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
88s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
30/11/2022, 21:06
Behavioral task
behavioral1
Sample
5d2204f3a20e163120f52a2e3595db19890050b2faa96c6cba6b094b0a52b0aa.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
5d2204f3a20e163120f52a2e3595db19890050b2faa96c6cba6b094b0a52b0aa.exe
Resource
win10v2004-20220901-en
General
-
Target
5d2204f3a20e163120f52a2e3595db19890050b2faa96c6cba6b094b0a52b0aa.exe
-
Size
563KB
-
MD5
3f400f30415941348af21d515a2fc6a3
-
SHA1
bd0bf9c987288ca434221d7d81c54a47e913600a
-
SHA256
5d2204f3a20e163120f52a2e3595db19890050b2faa96c6cba6b094b0a52b0aa
-
SHA512
0d4c3ee8807bbbf635ce2d1ce1b747c23cc2724ff999580169e5514c7c97109083bea169bd6a5f8be35f3b679bb8446839fcc7a38f78503658eda306bec69154
-
SSDEEP
12288:TFx0B/O7JxPzW9JPlHKtxYRkG7zLfpXE6SbJ:Rx7zW9JPlGskG1v
Malware Config
Signatures
-
Black Basta
A ransomware family targeting Windows and Linux ESXi first seen in February 2022.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 1 IoCs
pid Process 1584 bcdedit.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dlaksjdoiwq.jpg" 5d2204f3a20e163120f52a2e3595db19890050b2faa96c6cba6b094b0a52b0aa.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 872 vssadmin.exe 580 vssadmin.exe -
Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.basta\DefaultIcon 5d2204f3a20e163120f52a2e3595db19890050b2faa96c6cba6b094b0a52b0aa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.basta 5d2204f3a20e163120f52a2e3595db19890050b2faa96c6cba6b094b0a52b0aa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.basta\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fkdjsadasd.ico" 5d2204f3a20e163120f52a2e3595db19890050b2faa96c6cba6b094b0a52b0aa.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeBackupPrivilege 1152 vssvc.exe Token: SeRestorePrivilege 1152 vssvc.exe Token: SeAuditPrivilege 1152 vssvc.exe Token: SeShutdownPrivilege 332 shutdown.exe Token: SeRemoteShutdownPrivilege 332 shutdown.exe -
Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 1076 wrote to memory of 1736 1076 5d2204f3a20e163120f52a2e3595db19890050b2faa96c6cba6b094b0a52b0aa.exe 29 PID 1076 wrote to memory of 1736 1076 5d2204f3a20e163120f52a2e3595db19890050b2faa96c6cba6b094b0a52b0aa.exe 29 PID 1076 wrote to memory of 1736 1076 5d2204f3a20e163120f52a2e3595db19890050b2faa96c6cba6b094b0a52b0aa.exe 29 PID 1076 wrote to memory of 1736 1076 5d2204f3a20e163120f52a2e3595db19890050b2faa96c6cba6b094b0a52b0aa.exe 29 PID 1736 wrote to memory of 872 1736 cmd.exe 31 PID 1736 wrote to memory of 872 1736 cmd.exe 31 PID 1736 wrote to memory of 872 1736 cmd.exe 31 PID 1736 wrote to memory of 872 1736 cmd.exe 31 PID 1076 wrote to memory of 1828 1076 5d2204f3a20e163120f52a2e3595db19890050b2faa96c6cba6b094b0a52b0aa.exe 34 PID 1076 wrote to memory of 1828 1076 5d2204f3a20e163120f52a2e3595db19890050b2faa96c6cba6b094b0a52b0aa.exe 34 PID 1076 wrote to memory of 1828 1076 5d2204f3a20e163120f52a2e3595db19890050b2faa96c6cba6b094b0a52b0aa.exe 34 PID 1076 wrote to memory of 1828 1076 5d2204f3a20e163120f52a2e3595db19890050b2faa96c6cba6b094b0a52b0aa.exe 34 PID 1828 wrote to memory of 580 1828 cmd.exe 36 PID 1828 wrote to memory of 580 1828 cmd.exe 36 PID 1828 wrote to memory of 580 1828 cmd.exe 36 PID 1828 wrote to memory of 580 1828 cmd.exe 36 PID 1076 wrote to memory of 1880 1076 5d2204f3a20e163120f52a2e3595db19890050b2faa96c6cba6b094b0a52b0aa.exe 38 PID 1076 wrote to memory of 1880 1076 5d2204f3a20e163120f52a2e3595db19890050b2faa96c6cba6b094b0a52b0aa.exe 38 PID 1076 wrote to memory of 1880 1076 5d2204f3a20e163120f52a2e3595db19890050b2faa96c6cba6b094b0a52b0aa.exe 38 PID 1076 wrote to memory of 1880 1076 5d2204f3a20e163120f52a2e3595db19890050b2faa96c6cba6b094b0a52b0aa.exe 38 PID 1076 wrote to memory of 1344 1076 5d2204f3a20e163120f52a2e3595db19890050b2faa96c6cba6b094b0a52b0aa.exe 40 PID 1076 wrote to memory of 1344 1076 5d2204f3a20e163120f52a2e3595db19890050b2faa96c6cba6b094b0a52b0aa.exe 40 PID 1076 wrote to memory of 1344 1076 5d2204f3a20e163120f52a2e3595db19890050b2faa96c6cba6b094b0a52b0aa.exe 40 PID 1076 wrote to memory of 1344 1076 5d2204f3a20e163120f52a2e3595db19890050b2faa96c6cba6b094b0a52b0aa.exe 40 PID 1076 wrote to memory of 1216 1076 5d2204f3a20e163120f52a2e3595db19890050b2faa96c6cba6b094b0a52b0aa.exe 42 PID 1076 wrote to memory of 1216 1076 5d2204f3a20e163120f52a2e3595db19890050b2faa96c6cba6b094b0a52b0aa.exe 42 PID 1076 wrote to memory of 1216 1076 5d2204f3a20e163120f52a2e3595db19890050b2faa96c6cba6b094b0a52b0aa.exe 42 PID 1076 wrote to memory of 1216 1076 5d2204f3a20e163120f52a2e3595db19890050b2faa96c6cba6b094b0a52b0aa.exe 42 PID 1216 wrote to memory of 1584 1216 cmd.exe 44 PID 1216 wrote to memory of 1584 1216 cmd.exe 44 PID 1216 wrote to memory of 1584 1216 cmd.exe 44 PID 1216 wrote to memory of 1584 1216 cmd.exe 44 PID 1076 wrote to memory of 1796 1076 5d2204f3a20e163120f52a2e3595db19890050b2faa96c6cba6b094b0a52b0aa.exe 45 PID 1076 wrote to memory of 1796 1076 5d2204f3a20e163120f52a2e3595db19890050b2faa96c6cba6b094b0a52b0aa.exe 45 PID 1076 wrote to memory of 1796 1076 5d2204f3a20e163120f52a2e3595db19890050b2faa96c6cba6b094b0a52b0aa.exe 45 PID 1076 wrote to memory of 1796 1076 5d2204f3a20e163120f52a2e3595db19890050b2faa96c6cba6b094b0a52b0aa.exe 45 PID 1796 wrote to memory of 332 1796 cmd.exe 47 PID 1796 wrote to memory of 332 1796 cmd.exe 47 PID 1796 wrote to memory of 332 1796 cmd.exe 47 PID 1796 wrote to memory of 332 1796 cmd.exe 47
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d2204f3a20e163120f52a2e3595db19890050b2faa96c6cba6b094b0a52b0aa.exe"C:\Users\Admin\AppData\Local\Temp\5d2204f3a20e163120f52a2e3595db19890050b2faa96c6cba6b094b0a52b0aa.exe"1⤵
- Sets desktop wallpaper using registry
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Windows\system32\vssadmin.exeC:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:872
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\System32\vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Windows\SysWOW64\vssadmin.exeC:\Windows\System32\vssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:580
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c bcdedit /set safeboot network2⤵PID:1880
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\System32\bcdedit.exe /set safeboot network2⤵PID:1344
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\SysNative\bcdedit.exe /set safeboot network2⤵
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Windows\system32\bcdedit.exeC:\Windows\SysNative\bcdedit.exe /set safeboot network3⤵
- Modifies boot configuration data using bcdedit
PID:1584
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C shutdown -r -f -t 02⤵
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Windows\SysWOW64\shutdown.exeshutdown -r -f -t 03⤵
- Suspicious use of AdjustPrivilegeToken
PID:332
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1152
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵PID:1416
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵PID:836