Analysis
-
max time kernel
120s -
max time network
35s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
30-03-2023 12:29
Behavioral task
behavioral1
Sample
21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe
Resource
win7-20230220-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe
-
Size
7.0MB
-
MD5
ed891e4fd173700fac93b3dda30517c9
-
SHA1
e05e9cc2f28bcd17f5285a34db2894bad9ccd53a
-
SHA256
21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda
-
SHA512
58d3254bca944cb60450e3ac352a3674ca5a1dea1142112726349931cbed6428e5db03004480d218bf4c63ce6d9847e74dfe9f0da455c9587cf47c5a7089e7fc
-
SSDEEP
98304:wkwtlijhe6cZyFAz5FNZiTfVFScxge3SO9o:wkilvxFNkxpx/19o
Score
10/10
Malware Config
Extracted
Path
C:\ProgramData\readme.txt
Ransom Note
Your data are stolen and encrypted
The data will be published on TOR website if you do not pay the ransom
You can contact us and decrypt one file for free on this TOR site
(you should download and install TOR browser first https://torproject.org)
https://aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion/
Your company id for log in: ea3d3d33-1635-47f7-a1a4-0078267b30bb
URLs
https://aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion/
Signatures
-
Black Basta
A ransomware family targeting Windows and Linux ESXi first seen in February 2022.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 8 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\ClosePop.tif => C:\Users\Admin\Pictures\ClosePop.tif.basta 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe File renamed C:\Users\Admin\Pictures\CompleteMount.tif => C:\Users\Admin\Pictures\CompleteMount.tif.basta 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe File renamed C:\Users\Admin\Pictures\InvokeSync.raw => C:\Users\Admin\Pictures\InvokeSync.raw.basta 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe File renamed C:\Users\Admin\Pictures\RenameHide.png => C:\Users\Admin\Pictures\RenameHide.png.basta 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe File renamed C:\Users\Admin\Pictures\UnregisterSend.raw => C:\Users\Admin\Pictures\UnregisterSend.raw.basta 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe File renamed C:\Users\Admin\Pictures\DismountAssert.raw => C:\Users\Admin\Pictures\DismountAssert.raw.basta 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe File opened for modification C:\Users\Admin\Pictures\BackupWait.tiff 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe File renamed C:\Users\Admin\Pictures\BackupWait.tiff => C:\Users\Admin\Pictures\BackupWait.tiff.basta 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dlaksjdoiwq.jpg" 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\ReadUnblock.wma 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdaterInstallMgr.exe 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\imjplm.dll 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH02166_.WMF 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEES.DLL 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-core-timezone-l1-1-0.dll 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe File opened for modification C:\Program Files\Mozilla Firefox\application.ini 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Oriel.thmx 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPCEXT.DLL 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe File opened for modification C:\Program Files\Common Files\System\ado\adovbs.inc 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_buttongraphic.png 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\readme.txt 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\psuser.dll 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe File created C:\Program Files\Common Files\System\en-US\readme.txt 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe File created C:\Program Files (x86)\Common Files\microsoft shared\VC\readme.txt 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\readme.txt 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSClient.Msg.dll 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SPANISH.LNG 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_SelectionSubpicture.png 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00648_.WMF 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe File created C:\Program Files\Common Files\System\ado\readme.txt 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_photo_Thumbnail.bmp 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmc.ini 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe File created C:\Program Files (x86)\Common Files\Adobe\Help\en_US\readme.txt 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN02559_.WMF 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_pt-BR.dll 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe File created C:\Program Files\Common Files\Microsoft Shared\TextConv\readme.txt 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\README.html 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\THIRDPARTYLICENSEREADME.txt 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwruksh.dat 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\Keywords.HxK 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\WISC30.DLL 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\INDUST\readme.txt 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00602_.WMF 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0106958.WMF 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-crt-conio-l1-1-0.dll 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe File created C:\Program Files\Microsoft Games\Purble Place\it-IT\readme.txt 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\skchobj.dll 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0103262.WMF 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe File opened for modification C:\Program Files\Common Files\System\ado\msadox.dll 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\MS.PNG 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD00234_.WMF 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\readme.txt 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe File opened for modification C:\Program Files\Java\jre7\bin\kcms.dll 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe File opened for modification C:\Program Files\Java\jre7\bin\zip.dll 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe File created C:\Program Files (x86)\Common Files\System\msadc\fr-FR\readme.txt 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe File created C:\Program Files\Common Files\System\ado\fr-FR\readme.txt 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTO\vstoee100.tlb 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099187.JPG 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe File created C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\readme.txt 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe File created C:\Program Files\Common Files\Microsoft Shared\VGX\readme.txt 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe File created C:\Program Files\Microsoft Games\Mahjong\es-ES\readme.txt 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\jvmti.h 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe File created C:\Program Files (x86)\Common Files\microsoft shared\TextConv\es-ES\readme.txt 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe File created C:\Program Files (x86)\Adobe\readme.txt 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe File opened for modification C:\Program Files\7-Zip\Lang\ka.txt 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GRAPH.ICO 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe File opened for modification C:\Program Files\Java\jre7\bin\pack200.exe 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe File opened for modification C:\Program Files\Java\jre7\lib\net.properties 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01015_.WMF 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD02068_.WMF 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CharSetTable.chr 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\NL7Models0011.DLL 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 552 vssadmin.exe -
Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.basta 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.basta\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fkdjsadasd.ico" 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.basta\DefaultIcon 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 2156 NOTEPAD.EXE -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 1164 vssvc.exe Token: SeRestorePrivilege 1164 vssvc.exe Token: SeAuditPrivilege 1164 vssvc.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1536 wrote to memory of 1528 1536 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe 29 PID 1536 wrote to memory of 1528 1536 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe 29 PID 1536 wrote to memory of 1528 1536 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe 29 PID 1536 wrote to memory of 856 1536 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe 31 PID 1536 wrote to memory of 856 1536 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe 31 PID 1536 wrote to memory of 856 1536 21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe 31 PID 856 wrote to memory of 552 856 cmd.exe 33 PID 856 wrote to memory of 552 856 cmd.exe 33 PID 856 wrote to memory of 552 856 cmd.exe 33 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe"C:\Users\Admin\AppData\Local\Temp\21033cd24a9d775d7daa7bbc5c5b007553f205ac0febb6bae3fa35c700676bda.exe"1⤵
- Modifies extensions of user files
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet2⤵PID:1528
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\System32\vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Windows\System32\vssadmin.exeC:\Windows\System32\vssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:552
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1164
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\readme.txt1⤵
- Opens file in notepad (likely ransom note)
PID:2156
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
394B
MD50394335bf42f1f1a1a730ec7eec45b73
SHA1f1d6f7decd3120826b870479f45501acd979df47
SHA256677ddbeefb459f03432a0d2d24f13f0dcec1289722639fb34849aa41a4bac620
SHA512ea61fcecab48e463b2737c35247b30d03e626f3db9bccdce200b818bf52b6c3a32707b4356fbd6ff915b69cac2b5829d44a3f9fa31357dc5cb9ee5381636ddd3
-
Filesize
394B
MD50394335bf42f1f1a1a730ec7eec45b73
SHA1f1d6f7decd3120826b870479f45501acd979df47
SHA256677ddbeefb459f03432a0d2d24f13f0dcec1289722639fb34849aa41a4bac620
SHA512ea61fcecab48e463b2737c35247b30d03e626f3db9bccdce200b818bf52b6c3a32707b4356fbd6ff915b69cac2b5829d44a3f9fa31357dc5cb9ee5381636ddd3