Analysis
-
max time kernel
205s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
14-05-2024 05:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
86a4dd6be867846b251460d2a0874e6413589878d27f2c4482b54cec134cc737.dll
Resource
win7-20240508-en
windows7-x64
8 signatures
300 seconds
Behavioral task
behavioral2
Sample
86a4dd6be867846b251460d2a0874e6413589878d27f2c4482b54cec134cc737.dll
Resource
win10-20240404-en
windows10-1703-x64
8 signatures
300 seconds
General
-
Target
86a4dd6be867846b251460d2a0874e6413589878d27f2c4482b54cec134cc737.dll
-
Size
1010KB
-
MD5
e4d9351749d5b713b3838ba7b1fe8060
-
SHA1
e1caf6484d899e7bb4d0c72e8bea8ff718ff073a
-
SHA256
86a4dd6be867846b251460d2a0874e6413589878d27f2c4482b54cec134cc737
-
SHA512
ed422a357fa7bb4b03914490ec2a698854430296804218257c6be82982b3e8f0f405d8a0ad825deb40459a6043773da8bf3178125a1080846d257bff6efb2932
-
SSDEEP
12288:6cQgkNceVMcpWYgeWYg955/155/DEbdit4+1WJm5nN0gJHrGx5w/A0z+TMJjAolK:6cDkNcAV5KOgZrGXw/AHTwjA6M
Score
10/10
Malware Config
Extracted
Path
C:\Program Files\instructions_read_me.txt
Family
blackbasta
Ransom Note
ATTENTION!
Your network has been breached and all data was encrypted. Please contact us at:
https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Login ID: 334f1075-0c66-416a-8435-6e56232d7290
*!* To access .onion websites download and install Tor Browser at:
https://www.torproject.org/ (Tor Browser is not related to us)
*!* To restore all your PCs and get your network working again, follow these instructions:
- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.
Please follow these simple rules to avoid data corruption:
- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption.
- Do not hire a recovery company. They can't decrypt without the key.
They also don't care about your business. They believe that they are
good negotiators, but it is not. They usually fail. So speak for yourself.
Waiting you in a chat.
URLs
https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Signatures
-
Black Basta
A ransomware family targeting Windows and Linux ESXi first seen in February 2022.
-
Renames multiple (9728) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI rundll32.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PrivateAssemblies\Microsoft.VisualStudio.Tools.Applications.Project.dll rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00671_.WMF rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21533_.GIF rundll32.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\vlc.mo rundll32.exe File opened for modification C:\Program Files\Windows Journal\Templates\To_Do_List.jtp rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0252629.WMF rundll32.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\v8_context_snapshot.bin rundll32.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\hxds.dll rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS01635_.WMF rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\RCLRPT.CFG rundll32.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\rss_headline_glow_floating.png rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21309_.GIF rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00452_.WMF rundll32.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\instructions_read_me.txt rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\form_edit.js rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS01080_.WMF rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382961.JPG rundll32.exe File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\instructions_read_me.txt rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD10219_.GIF rundll32.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\de-DE\mip.exe.mui rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR33F.GIF rundll32.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Filters\odffilt.dll rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\OrielMergeLetter.Dotx rundll32.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\square_m.png rundll32.exe File created C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\instructions_read_me.txt rundll32.exe File created C:\Program Files\VideoLAN\VLC\locale\vi\instructions_read_me.txt rundll32.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_cycle_plugin.dll rundll32.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\gadget.xml rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsBlankPage.html rundll32.exe File opened for modification C:\Program Files\Microsoft Games\More Games\it-IT\MoreGames.dll.mui rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02423_.WMF rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21377_.GIF rundll32.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\offset_window.html rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_ContactLow.jpg rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONLNTCOMLIB.DLL rundll32.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEXBE.DLL rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\Fancy\MINUS.GIF rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME23.CSS rundll32.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\1.png rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\button_mid.gif rundll32.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\instructions_read_me.txt rundll32.exe File opened for modification C:\Program Files\Windows Media Player\it-IT\mpvis.dll.mui rundll32.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightOrange\instructions_read_me.txt rundll32.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\css\instructions_read_me.txt rundll32.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\instructions_read_me.txt rundll32.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\js\localizedStrings.js rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ProjectStatusReport.potx rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOnNotificationInTray.gif rundll32.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\trad_settings.png rundll32.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOLoaderUI.dll rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-host-views.xml rundll32.exe File opened for modification C:\Program Files\Windows Media Player\Media Renderer\avtransport.xml rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GROOVE_COL.HXT rundll32.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\instructions_read_me.txt rundll32.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\js\instructions_read_me.txt rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Nicosia rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\DELIMDOS.FAE rundll32.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\ACEINTL.DLL rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Wallis rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\VelvetRose.css rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\STSUPLD.DLL rundll32.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\msoshext.dll rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\WITHCOMP.XML rundll32.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Guam rundll32.exe -
Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.8bv6hf5ft\DefaultIcon rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.8bv6hf5ft rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.8bv6hf5ft\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fkdjsadasd.ico" rundll32.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 1012 notepad.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2904 wrote to memory of 2984 2904 rundll32.exe 32 PID 2904 wrote to memory of 2984 2904 rundll32.exe 32 PID 2904 wrote to memory of 2984 2904 rundll32.exe 32 PID 2984 wrote to memory of 1012 2984 cmd.exe 34 PID 2984 wrote to memory of 1012 2984 cmd.exe 34 PID 2984 wrote to memory of 1012 2984 cmd.exe 34
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\86a4dd6be867846b251460d2a0874e6413589878d27f2c4482b54cec134cc737.dll,#11⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\system32\cmd.execmd.exe /c start /MAX notepad.exe c:\instructions_read_me.txt2⤵
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Windows\system32\notepad.exenotepad.exe c:\instructions_read_me.txt3⤵
- Opens file in notepad (likely ransom note)
PID:1012
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD524485a77d11efa73de3cb981551e8e71
SHA132e83b02fe79d231cd55f123572c7aa4fb63e54a
SHA256b020df52b2fc523619d30a74184ed7a8b00d1a27c9f53637f0b60366aaac53aa
SHA512f787ba16a52df121bda0f18f90516c1e9350db68419890a86a8263ff59402c726b91c5b1dad11a551b0ad9ba670c134efdead6b7a0b08471bd2f409a33dff876