Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
17s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
03/12/2022, 06:43
Static task
static1
Behavioral task
behavioral1
Sample
653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe
Resource
win7-20220901-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe
-
Size
464KB
-
MD5
1c9880912a1c9229b4c3120dcbfd1322
-
SHA1
0ae047b7fe5d688638b9a33423c754c911d4dbe4
-
SHA256
653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33
-
SHA512
e7df5a6da7ff6d1878bd670e963d80cb060f1e6e5c8c729c0181f1f97ddd0293a0233886e7c8fd6275afc654b99642ba9d756303ebfdee153ba84c024b389fef
-
SSDEEP
6144:GeafQzobGtL9sNP3IlXt4HSS53/7krnpMIg3D/Io5hTvpKqXy2dlFGYOxEpXir7s:SfQ5tLcSf27FFDXRRdf0UPb
Score
10/10
Malware Config
Extracted
Path
C:\MSOCache\readme.txt
Ransom Note
Your data are stolen and encrypted
The data will be published on TOR website if you do not pay the ransom
You can contact us and decrypt one file for free on this TOR site
(you should download and install TOR browser first https://torproject.org)
https://aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion/
Your company id for log in: eeded09d-2ac0-4e69-bf25-875cd524e744
URLs
https://aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion/
Signatures
-
Black Basta
A ransomware family targeting Windows and Linux ESXi first seen in February 2022.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dlaksjdoiwq.jpg" 653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\RepairRequest.cab 653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe File created C:\Program Files (x86)\Google\readme.txt 653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-core-processthreads-l1-1-1.dll 653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe File opened for modification C:\Program Files\Mozilla Firefox\removed-files 653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe File opened for modification C:\Program Files\BackupDisconnect.dxf 653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe File opened for modification C:\Program Files\Internet Explorer\D3DCompiler_47.dll 653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe File opened for modification C:\Program Files\Internet Explorer\Timeline_is.dll 653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe File created C:\Program Files (x86)\Google\Temp\readme.txt 653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe File created C:\Program Files (x86)\Internet Explorer\it-IT\readme.txt 653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe File created C:\Program Files\7-Zip\Lang\readme.txt 653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe File created C:\Program Files\DVD Maker\it-IT\readme.txt 653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe File created C:\Program Files\Internet Explorer\de-DE\readme.txt 653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe File opened for modification C:\Program Files\Internet Explorer\pdm.dll 653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-crt-string-l1-1-0.dll 653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe File opened for modification C:\Program Files\Mozilla Firefox\msvcp140.dll 653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe File opened for modification C:\Program Files\UnpublishConvertTo.lock 653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe File opened for modification C:\Program Files\Internet Explorer\iedvtool.dll 653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe File opened for modification C:\Program Files\Mozilla Firefox\libEGL.dll 653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe File created C:\Program Files (x86)\Microsoft Office\Templates\readme.txt 653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe File opened for modification C:\Program Files (x86)\Internet Explorer\networkinspection.dll 653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe File opened for modification C:\Program Files\DisableConvertTo.ttc 653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe File created C:\Program Files (x86)\Microsoft Analysis Services\readme.txt 653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe File created C:\Program Files (x86)\Uninstall Information\readme.txt 653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe File created C:\Program Files\Microsoft Games\Solitaire\readme.txt 653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe File opened for modification C:\Program Files\Mozilla Firefox\xul.dll.sig 653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\updater.ini 653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe File created C:\Program Files\DVD Maker\es-ES\readme.txt 653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe File opened for modification C:\Program Files\Internet Explorer\Timeline.dll 653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe File created C:\Program Files\Microsoft Office\readme.txt 653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe File opened for modification C:\Program Files\PopWrite.sys 653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe File opened for modification C:\Program Files\7-Zip\7z.sfx 653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-crt-utility-l1-1-0.dll 653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe.sig 653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe File opened for modification C:\Program Files\7-Zip\7-zip.chm 653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe File opened for modification C:\Program Files\Internet Explorer\F12Resources.dll 653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe File opened for modification C:\Program Files\Internet Explorer\ie9props.propdesc 653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe File opened for modification C:\Program Files\Internet Explorer\jsprofilerui.dll 653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe File opened for modification C:\Program Files\Mozilla Firefox\lgpllibs.dll 653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe File opened for modification C:\Program Files\Mozilla Firefox\nssckbi.dll 653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe 653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe File opened for modification C:\Program Files (x86)\Internet Explorer\DiagnosticsTap.dll 653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\readme.txt 653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe File created C:\Program Files (x86)\Common Files\SpeechEngines\readme.txt 653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe File opened for modification C:\Program Files\EnterSave.wmf 653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe File created C:\Program Files (x86)\Microsoft Synchronization Services\readme.txt 653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe File opened for modification C:\Program Files\DVD Maker\WMM2CLIP.dll 653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe File created C:\Program Files\Microsoft Games\Hearts\readme.txt 653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe File opened for modification C:\Program Files\ApproveResume.wax 653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe File opened for modification C:\Program Files\SelectNew.sys 653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe File created C:\Program Files (x86)\MSBuild\readme.txt 653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe File opened for modification C:\Program Files\DVD Maker\SecretST.TTF 653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe File opened for modification C:\Program Files\Internet Explorer\F12Tools.dll 653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe File created C:\Program Files (x86)\Common Files\Services\readme.txt 653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe File opened for modification C:\Program Files\WatchSubmit.emf 653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe File created C:\Program Files\Microsoft Games\FreeCell\readme.txt 653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe File opened for modification C:\Program Files\Mozilla Firefox\AccessibleMarshal.dll 653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-core-synch-l1-2-0.dll 653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe File created C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\readme.txt 653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe File created C:\Program Files\Common Files\readme.txt 653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\readme.txt 653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe -
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 900 vssadmin.exe 1188 vssadmin.exe -
Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.basta\DefaultIcon 653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.basta 653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.basta\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fkdjsadasd.ico" 653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 1504 vssvc.exe Token: SeRestorePrivilege 1504 vssvc.exe Token: SeAuditPrivilege 1504 vssvc.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 852 wrote to memory of 1232 852 653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe 27 PID 852 wrote to memory of 1232 852 653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe 27 PID 852 wrote to memory of 1232 852 653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe 27 PID 852 wrote to memory of 1232 852 653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe 27 PID 1232 wrote to memory of 900 1232 cmd.exe 29 PID 1232 wrote to memory of 900 1232 cmd.exe 29 PID 1232 wrote to memory of 900 1232 cmd.exe 29 PID 1232 wrote to memory of 900 1232 cmd.exe 29 PID 852 wrote to memory of 1560 852 653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe 32 PID 852 wrote to memory of 1560 852 653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe 32 PID 852 wrote to memory of 1560 852 653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe 32 PID 852 wrote to memory of 1560 852 653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe 32 PID 1560 wrote to memory of 1188 1560 cmd.exe 34 PID 1560 wrote to memory of 1188 1560 cmd.exe 34 PID 1560 wrote to memory of 1188 1560 cmd.exe 34 PID 1560 wrote to memory of 1188 1560 cmd.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe"C:\Users\Admin\AppData\Local\Temp\653da5127b0ecbc5c373ce510c0d5191f61f2df912c9b6f4989aa3775933bc33.exe"1⤵
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Windows\system32\vssadmin.exeC:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:900
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\System32\vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Windows\SysWOW64\vssadmin.exeC:\Windows\System32\vssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1188
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1504