blackbasta | 48976d7bf38cca4e952507e9ab27e3874ca01092eed53d0fde89c5966e9533bb

Reason

Machine shutdown

General

Target

48976d7bf38cca4e952507e9ab27e3874ca01092eed53d0fde89c5966e9533bb.exe
Size

555KB
MD5

eff424376edca5680b90ea9fedad163d
SHA1

3c13c1e54d2d7991c1c3452ae89888a8e7a47763
SHA256

48976d7bf38cca4e952507e9ab27e3874ca01092eed53d0fde89c5966e9533bb
SHA512

5acc904da2b8f3371a5696194b4a6fa7c3e735b0bbe74a507efb56782e6fc604f9bd3abf7a3af5f57325c7115de3ac9cd499086430d0d4fbe81b46a57539f068
SSDEEP

12288:Y4LNVuczF0QdQsJlehKRwYgJcViFYvgNv+5jGbRFhVoj4d:xvn2sJlBRwYgJcVNE+5jU8j4

Score

10^/10

blackbasta evasion ransomware

Malware Config

Signatures

Black Basta
A ransomware family targeting Windows and Linux ESXi first seen in February 2022.
ransomware blackbasta
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Modifies boot configuration data using bcdedit 1 TTPs 1 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
1956	bcdedit.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dlaksjdoiwq.jpg"	48976d7bf38cca4e952507e9ab27e3874ca01092eed53d0fde89c5966e9533bb.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Interacts with shadow copies 2 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

pid	Process
1212	vssadmin.exe
1596	vssadmin.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.basta\DefaultIcon	48976d7bf38cca4e952507e9ab27e3874ca01092eed53d0fde89c5966e9533bb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.basta	48976d7bf38cca4e952507e9ab27e3874ca01092eed53d0fde89c5966e9533bb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.basta\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fkdjsadasd.ico"	48976d7bf38cca4e952507e9ab27e3874ca01092eed53d0fde89c5966e9533bb.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeBackupPrivilege	1056	vssvc.exe
Token: SeRestorePrivilege	1056	vssvc.exe
Token: SeAuditPrivilege	1056	vssvc.exe
Token: SeShutdownPrivilege	952	shutdown.exe
Token: SeRemoteShutdownPrivilege	952	shutdown.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1348 wrote to memory of 1004	1348	48976d7bf38cca4e952507e9ab27e3874ca01092eed53d0fde89c5966e9533bb.exe	29
PID 1348 wrote to memory of 1004	1348	48976d7bf38cca4e952507e9ab27e3874ca01092eed53d0fde89c5966e9533bb.exe	29
PID 1348 wrote to memory of 1004	1348	48976d7bf38cca4e952507e9ab27e3874ca01092eed53d0fde89c5966e9533bb.exe	29
PID 1348 wrote to memory of 1004	1348	48976d7bf38cca4e952507e9ab27e3874ca01092eed53d0fde89c5966e9533bb.exe	29
PID 1004 wrote to memory of 1212	1004	cmd.exe	31
PID 1004 wrote to memory of 1212	1004	cmd.exe	31
PID 1004 wrote to memory of 1212	1004	cmd.exe	31
PID 1004 wrote to memory of 1212	1004	cmd.exe	31
PID 1348 wrote to memory of 536	1348	48976d7bf38cca4e952507e9ab27e3874ca01092eed53d0fde89c5966e9533bb.exe	34
PID 1348 wrote to memory of 536	1348	48976d7bf38cca4e952507e9ab27e3874ca01092eed53d0fde89c5966e9533bb.exe	34
PID 1348 wrote to memory of 536	1348	48976d7bf38cca4e952507e9ab27e3874ca01092eed53d0fde89c5966e9533bb.exe	34
PID 1348 wrote to memory of 536	1348	48976d7bf38cca4e952507e9ab27e3874ca01092eed53d0fde89c5966e9533bb.exe	34
PID 536 wrote to memory of 1596	536	cmd.exe	36
PID 536 wrote to memory of 1596	536	cmd.exe	36
PID 536 wrote to memory of 1596	536	cmd.exe	36
PID 536 wrote to memory of 1596	536	cmd.exe	36
PID 1348 wrote to memory of 1956	1348	48976d7bf38cca4e952507e9ab27e3874ca01092eed53d0fde89c5966e9533bb.exe	38
PID 1348 wrote to memory of 1956	1348	48976d7bf38cca4e952507e9ab27e3874ca01092eed53d0fde89c5966e9533bb.exe	38
PID 1348 wrote to memory of 1956	1348	48976d7bf38cca4e952507e9ab27e3874ca01092eed53d0fde89c5966e9533bb.exe	38
PID 1348 wrote to memory of 1956	1348	48976d7bf38cca4e952507e9ab27e3874ca01092eed53d0fde89c5966e9533bb.exe	38
PID 1348 wrote to memory of 1968	1348	48976d7bf38cca4e952507e9ab27e3874ca01092eed53d0fde89c5966e9533bb.exe	40
PID 1348 wrote to memory of 1968	1348	48976d7bf38cca4e952507e9ab27e3874ca01092eed53d0fde89c5966e9533bb.exe	40
PID 1348 wrote to memory of 1968	1348	48976d7bf38cca4e952507e9ab27e3874ca01092eed53d0fde89c5966e9533bb.exe	40
PID 1348 wrote to memory of 1968	1348	48976d7bf38cca4e952507e9ab27e3874ca01092eed53d0fde89c5966e9533bb.exe	40
PID 1968 wrote to memory of 952	1968	cmd.exe	42
PID 1968 wrote to memory of 952	1968	cmd.exe	42
PID 1968 wrote to memory of 952	1968	cmd.exe	42
PID 1968 wrote to memory of 952	1968	cmd.exe	42

C:\Users\Admin\AppData\Local\Temp\48976d7bf38cca4e952507e9ab27e3874ca01092eed53d0fde89c5966e9533bb.exe
"C:\Users\Admin\AppData\Local\Temp\48976d7bf38cca4e952507e9ab27e3874ca01092eed53d0fde89c5966e9533bb.exe"
1⤵
- Sets desktop wallpaper using registry
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1348
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1004
- - C:\Windows\system32\vssadmin.exe
    C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:1212
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\System32\vssadmin.exe delete shadows /all /quiet
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:536
- - C:\Windows\SysWOW64\vssadmin.exe
    C:\Windows\System32\vssadmin.exe delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:1596
- C:\Windows\system32\bcdedit.exe
  C:\Windows\SysNative\bcdedit.exe /set safeboot network
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1956
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C shutdown -r -f -t 0
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1968
- - C:\Windows\SysWOW64\shutdown.exe
    shutdown -r -f -t 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:952

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1056

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:972

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:1380

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Inhibit System Recovery

3

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

memory/972-62-0x000007FEFBFC1000-0x000007FEFBFC3000-memory.dmp

Filesize
8KB

Download
memory/1348-54-0x0000000075881000-0x0000000075883000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads