Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03/12/2022, 06:19
Static task
static1
Behavioral task
behavioral1
Sample
1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe
-
Size
463KB
-
MD5
5edfa63f8223527b790d7f47ec29ad48
-
SHA1
d4c544274ea89f1d10cb5b4c7ac54ebbb72b2651
-
SHA256
1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c
-
SHA512
d29a03cd0f2f7a114b866ae923d458c96d3653bc104cd640d67a02d5d6a9eb51cd503eec45811b8379e543af9ba561ee9f89c279cbd3233e4d28662c692a6d8b
-
SSDEEP
12288:CegEga9b161lmK0IgvcjTxIn5FV6NFVINaZcR9JXy:CegEFm1wK01vcjannV6NFca49JXy
Score
10/10
Malware Config
Extracted
Path
C:\MSOCache\readme.txt
Ransom Note
Your data are stolen and encrypted
The data will be published on TOR website if you do not pay the ransom
You can contact us and decrypt one file for free on this TOR site
(you should download and install TOR browser first https://torproject.org)
https://aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion/
Your company id for log in: aa6b49d0-713d-46fb-b7ac-fb5605e2ac0a
URLs
https://aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion/
Signatures
-
Black Basta
A ransomware family targeting Windows and Linux ESXi first seen in February 2022.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dlaksjdoiwq.jpg" 1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\updater.ini 1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe File opened for modification C:\Program Files\Internet Explorer\F12Tools.dll 1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe File created C:\Program Files\Mozilla Firefox\fonts\readme.txt 1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe File created C:\Program Files (x86)\Internet Explorer\es-ES\readme.txt 1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe File created C:\Program Files\Microsoft Games\Solitaire\readme.txt 1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe File created C:\Program Files\Microsoft Games\SpiderSolitaire\readme.txt 1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe File opened for modification C:\Program Files (x86)\Internet Explorer\jsdebuggeride.dll 1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe File opened for modification C:\Program Files\Mozilla Firefox\mozavcodec.dll 1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe File opened for modification C:\Program Files\DVD Maker\rtstreamsource.ax 1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe File opened for modification C:\Program Files\Internet Explorer\jsprofilerui.dll 1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe 1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe File opened for modification C:\Program Files\Mozilla Firefox\xul.dll 1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe File opened for modification C:\Program Files (x86)\Internet Explorer\msdbg2.dll 1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe File opened for modification C:\Program Files\DVD Maker\fieldswitch.ax 1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe File created C:\Program Files\Microsoft Games\Mahjong\readme.txt 1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe File created C:\Program Files\Reference Assemblies\Microsoft\readme.txt 1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe File opened for modification C:\Program Files\Internet Explorer\DiagnosticsHub.DataWarehouse.dll 1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe File opened for modification C:\Program Files\Internet Explorer\JSProfilerCore.dll 1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe 1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe File created C:\Program Files (x86)\Microsoft Sync Framework\v1.0\readme.txt 1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\readme.txt 1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe File opened for modification C:\Program Files\ExportTest.mpp 1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe File created C:\Program Files\Internet Explorer\es-ES\readme.txt 1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe File opened for modification C:\Program Files\Mozilla Firefox\update-settings.ini 1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe File opened for modification C:\Program Files\RemoveCopy.7z 1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-core-synch-l1-2-0.dll 1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-crt-filesystem-l1-1-0.dll 1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe File opened for modification C:\Program Files\VideoLAN\VLC\readme.txt 1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe File created C:\Program Files (x86)\Microsoft Office\Templates\readme.txt 1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe File created C:\Program Files\Common Files\readme.txt 1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe File opened for modification C:\Program Files\UseRead.cab 1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe File opened for modification C:\Program Files\DVD Maker\audiodepthconverter.ax 1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe File opened for modification C:\Program Files\Mozilla Firefox\xul.dll.sig 1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe File created C:\Program Files\Mozilla Firefox\readme.txt 1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe File opened for modification C:\Program Files\EnableInitialize.7z 1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe File opened for modification C:\Program Files\SwitchClose.asx 1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe File opened for modification C:\Program Files\7-Zip\License.txt 1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe File opened for modification C:\Program Files\Mozilla Firefox\application.ini 1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe File created C:\Program Files\Internet Explorer\en-US\readme.txt 1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-crt-time-l1-1-0.dll 1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe File opened for modification C:\Program Files\Mozilla Firefox\freebl3.dll 1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\readme.txt 1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe File opened for modification C:\Program Files\DVD Maker\DVDMaker.exe 1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe File opened for modification C:\Program Files\DVD Maker\rtstreamsink.ax 1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-crt-convert-l1-1-0.dll 1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\readme.txt 1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe File opened for modification C:\Program Files\ConnectResume.jpeg 1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe File created C:\Program Files (x86)\Microsoft Sync Framework\readme.txt 1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe File opened for modification C:\Program Files\Internet Explorer\jsdbgui.dll 1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe File created C:\Program Files\MSBuild\Microsoft\readme.txt 1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe File created C:\Program Files (x86)\Google\Update\readme.txt 1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\readme.txt 1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe File created C:\Program Files\Internet Explorer\fr-FR\readme.txt 1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe File created C:\Program Files\Internet Explorer\images\readme.txt 1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe File created C:\Program Files\Java\jdk1.7.0_80\readme.txt 1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe File opened for modification C:\Program Files\Mozilla Firefox\libEGL.dll 1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe File created C:\Program Files (x86)\Common Files\microsoft shared\readme.txt 1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe File created C:\Program Files\Common Files\Services\readme.txt 1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe File opened for modification C:\Program Files\DVD Maker\offset.ax 1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe File created C:\Program Files\Google\Chrome\readme.txt 1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe File opened for modification C:\Program Files (x86)\Internet Explorer\pdmproxy100.dll 1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe File created C:\Program Files (x86)\Microsoft Office\Document Themes 14\readme.txt 1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe -
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 956 vssadmin.exe 1352 vssadmin.exe -
Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.basta\DefaultIcon 1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.basta 1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.basta\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fkdjsadasd.ico" 1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 1692 vssvc.exe Token: SeRestorePrivilege 1692 vssvc.exe Token: SeAuditPrivilege 1692 vssvc.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2020 wrote to memory of 912 2020 1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe 28 PID 2020 wrote to memory of 912 2020 1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe 28 PID 2020 wrote to memory of 912 2020 1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe 28 PID 2020 wrote to memory of 912 2020 1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe 28 PID 912 wrote to memory of 956 912 cmd.exe 30 PID 912 wrote to memory of 956 912 cmd.exe 30 PID 912 wrote to memory of 956 912 cmd.exe 30 PID 912 wrote to memory of 956 912 cmd.exe 30 PID 2020 wrote to memory of 768 2020 1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe 33 PID 2020 wrote to memory of 768 2020 1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe 33 PID 2020 wrote to memory of 768 2020 1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe 33 PID 2020 wrote to memory of 768 2020 1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe 33 PID 768 wrote to memory of 1352 768 cmd.exe 35 PID 768 wrote to memory of 1352 768 cmd.exe 35 PID 768 wrote to memory of 1352 768 cmd.exe 35 PID 768 wrote to memory of 1352 768 cmd.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe"C:\Users\Admin\AppData\Local\Temp\1dd04aab97d6b65ac93ae3e8cfb4d3175d99f5b0395418abeb771d2db364cd3c.exe"1⤵
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Windows\system32\vssadmin.exeC:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:956
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\System32\vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Windows\SysWOW64\vssadmin.exeC:\Windows\System32\vssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1352
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1692