Overview

overview

10

Static

static

3

winprofile

windows7-x64

9

winprofile

windows10-1703-x64

10

Analysis

  • max time kernel
    206s
  • max time network
    303s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    14-05-2024 04:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0a8297b274aeab986d6336b395b39b3af1bb00464cf5735d1ecdb506fef9098e.exe

  • Size

    849KB

  • MD5

    403dee0dd3891459b22a8a37828b66b8

  • SHA1

    919c33adb648ce13ee8bd7c11bffbfd836936c00

  • SHA256

    0a8297b274aeab986d6336b395b39b3af1bb00464cf5735d1ecdb506fef9098e

  • SHA512

    8cab8ca9ff17c404d6e41358804daf0915713ad3e8e690457e2f9aab4014c894fd73e406aad8837ed8409be32315a4a0f3ef41795828d7447fde68c6fe9226f2

  • SSDEEP

    24576:TdxKSvB4i4sSnMIsBadfBZz4kIsPP3q7uL+gB+UtcMT:Jvei4sSEad5Zz4kIsPP34uL+gB++cW

Score
10/10
blackbastadefense_evasionexecutionimpactransomwarespywarestealer

Malware Config

Extracted

Path

C:\Program Files (x86)\instructions_read_me.txt

Family

blackbasta

Ransom Note
ATTENTION! Your network has been breached and all data was encrypted. Please contact us at: https://aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion/ Login ID: 2943b2b6-dc20-44a7-9dc4-94f7cb67f695 *!* To access .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us) *!* To restore all your PCs and get your network working again, follow these instructions: - Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency. Please follow these simple rules to avoid data corruption: - Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - Do not hire a recovery company. They can't decrypt without the key. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. So speak for yourself. Waiting you in a chat.
URLs

https://aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion/

Signatures

  • Black Basta

    A ransomware family targeting Windows and Linux ESXi first seen in February 2022.

    ransomwareblackbasta
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Renames multiple (9479) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies registry class 3 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\0a8297b274aeab986d6336b395b39b3af1bb00464cf5735d1ecdb506fef9098e.exe
    "C:\Users\Admin\AppData\Local\Temp\0a8297b274aeab986d6336b395b39b3af1bb00464cf5735d1ecdb506fef9098e.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2856
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4856
      • C:\Windows\System32\vssadmin.exe
        C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet
        3⤵
        • Interacts with shadow copies
        PID:516
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c start /MAX notepad.exe c:\instructions_read_me.txt
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1148
      • C:\Windows\SysWOW64\notepad.exe
        notepad.exe c:\instructions_read_me.txt
        3⤵
        • Opens file in notepad (likely ransom note)
        PID:1532
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1184

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\instructions_read_me.txt
    Filesize

    1KB

    MD5

    a1a6d0c7e20ae10a8cb242dd863187a5

    SHA1

    edd3eca74ab92940d909e349ae773c59caa49a56

    SHA256

    d50b0df979cb67d1a7f11833bda6c5d4c2cd355e05bf02c420458aaa56d7f9ab

    SHA512

    3e0c90d6d9910411ddc358281a4f776d0b94b923ea9119d4fdb0a6eb6830bcc2aab29abf0019a30008f6d37f50e967739de332a99dad60b7d87c415092982999

    Download Submit