Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
22s -
max time network
44s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03/12/2022, 06:22
Static task
static1
Behavioral task
behavioral1
Sample
81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe
Resource
win7-20221111-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe
-
Size
454KB
-
MD5
30e360b69234e2f71a80a301ed582400
-
SHA1
318d227272b198311ef9eb8e6721237c0f90fcd2
-
SHA256
81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9
-
SHA512
c5faea951492771eb9847536c03e0287e20d89f3c691861de78ae897ef2aed1c81fe4a4ab80ee49e9c46df516aa99babdae96aedecf94f0ada84681631048e40
-
SSDEEP
6144:+ZyHOgf1NEoVAtlu8PN8yOqbXaDlnNahH7g5llqocky89guv7J/hSNcPMK7Codus:+vIgtlu8Pcail6bg53LRvuNcVG+GK
Score
10/10
Malware Config
Extracted
Path
C:\odt\readme.txt
Ransom Note
Your data are stolen and encrypted
The data will be published on TOR website if you do not pay the ransom
You can contact us and decrypt one file for free on this TOR site
(you should download and install TOR browser first https://torproject.org)
https://aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion/
Your company id for log in: aa6b49d0-713d-46fb-b7ac-fb5605e2ac0a
URLs
https://aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion/
Signatures
-
Black Basta
A ransomware family targeting Windows and Linux ESXi first seen in February 2022.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dlaksjdoiwq.jpg" 81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\Microsoft Shared\readme.txt 81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe File opened for modification C:\Program Files\7-Zip\Lang\kab.txt 81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe File created C:\Program Files (x86)\Common Files\System\es-ES\readme.txt 81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe File opened for modification C:\Program Files\UnregisterSave.jpg 81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-crt-heap-l1-1-0.dll 81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe File opened for modification C:\Program Files\VideoLAN\VLC\readme.txt 81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe File opened for modification C:\Program Files\Internet Explorer\ja-JP\iexplore.exe.mui 81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml 81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe File created C:\Program Files (x86)\MSBuild\readme.txt 81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe File created C:\Program Files (x86)\Internet Explorer\it-IT\readme.txt 81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe File created C:\Program Files\VideoLAN\VLC\skins\readme.txt 81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-crt-conio-l1-1-0.dll 81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe File opened for modification C:\Program Files\7-Zip\Lang\mng.txt 81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-tw.txt 81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe File created C:\Program Files (x86)\Common Files\System\ja-JP\readme.txt 81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe File created C:\Program Files (x86)\Google\Update\readme.txt 81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe File created C:\Program Files\Microsoft Office\Updates\Download\readme.txt 81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe File opened for modification C:\Program Files\SendAssert.html 81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml 81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe File opened for modification C:\Program Files\Mozilla Firefox\freebl3.dll 81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe File opened for modification C:\Program Files\Mozilla Firefox\msvcp140.dll 81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe File opened for modification C:\Program Files\7-Zip\Lang\pt-br.txt 81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.16.en-us.xml 81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe File opened for modification C:\Program Files\7-Zip\Lang\es.txt 81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe File opened for modification C:\Program Files\7-Zip\Lang\gu.txt 81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-core-processthreads-l1-1-1.dll 81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-crt-multibyte-l1-1-0.dll 81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe File opened for modification C:\Program Files\7-Zip\Lang\br.txt 81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe File opened for modification C:\Program Files\7-Zip\Lang\kk.txt 81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\release 81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.16.xml 81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe File opened for modification C:\Program Files\ShowCheckpoint.html 81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe File opened for modification C:\Program Files\Mozilla Firefox\mozglue.dll 81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe File opened for modification C:\Program Files\7-Zip\Lang\cy.txt 81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe File opened for modification C:\Program Files\Internet Explorer\it-IT\iexplore.exe.mui 81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe File created C:\Program Files (x86)\Common Files\System\en-US\readme.txt 81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe File opened for modification C:\Program Files\UnregisterRename.wm 81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe File opened for modification C:\Program Files\Mozilla Firefox\IA2Marshal.dll 81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe File opened for modification C:\Program Files\7-Zip\Lang\id.txt 81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe File created C:\Program Files\Common Files\microsoft shared\VC\readme.txt 81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe File opened for modification C:\Program Files\EditEnable.ex_ 81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-crt-filesystem-l1-1-0.dll 81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-crt-locale-l1-1-0.dll 81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe File created C:\Program Files\Google\Chrome\readme.txt 81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe File created C:\Program Files\Mozilla Firefox\browser\VisualElements\readme.txt 81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\readme.txt 81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-cn.txt 81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe File opened for modification C:\Program Files\Internet Explorer\es-ES\iexplore.exe.mui 81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe File opened for modification C:\Program Files\Internet Explorer\ja-JP\ieinstal.exe.mui 81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe File opened for modification C:\Program Files\EditImport.xps 81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe File opened for modification C:\Program Files\7-Zip\Lang\is.txt 81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\readme.txt 81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe File opened for modification C:\Program Files\Mozilla Firefox\omni.ja 81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe File opened for modification C:\Program Files\7-Zip\Lang\mng2.txt 81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe File created C:\Program Files (x86)\Common Files\Adobe\HelpCfg\readme.txt 81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe File opened for modification C:\Program Files\7-Zip\7-zip32.dll 81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe File opened for modification C:\Program Files\7-Zip\7z.sfx 81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe File created C:\Program Files (x86)\Google\readme.txt 81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe File created C:\Program Files\Internet Explorer\SIGNUP\readme.txt 81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe File opened for modification C:\Program Files\7-Zip\Lang\hu.txt 81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe File created C:\Program Files\Internet Explorer\de-DE\readme.txt 81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe File opened for modification C:\Program Files\7-Zip\License.txt 81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2848 vssadmin.exe -
Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.basta\DefaultIcon 81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.basta 81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.basta\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fkdjsadasd.ico" 81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 2840 vssvc.exe Token: SeRestorePrivilege 2840 vssvc.exe Token: SeAuditPrivilege 2840 vssvc.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4384 wrote to memory of 4260 4384 81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe 81 PID 4384 wrote to memory of 4260 4384 81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe 81 PID 4384 wrote to memory of 4260 4384 81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe 81 PID 4260 wrote to memory of 2848 4260 cmd.exe 83 PID 4260 wrote to memory of 2848 4260 cmd.exe 83 PID 4384 wrote to memory of 3208 4384 81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe 86 PID 4384 wrote to memory of 3208 4384 81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe 86 PID 4384 wrote to memory of 3208 4384 81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe"C:\Users\Admin\AppData\Local\Temp\81515e1c72fadae2c4bb15883e0c1d8979b49fd52d8c65ca03e05a75ca6683c9.exe"1⤵
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Windows\system32\vssadmin.exeC:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2848
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\System32\vssadmin.exe delete shadows /all /quiet2⤵PID:3208
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2840