blackbasta | 69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944

Analysis

max time kernel
191s
max time network
124s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
14/05/2024, 05:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe
Size

550KB
MD5

e52aa8e50c0ccf883b7ab7f0c36bb878
SHA1

f0ae322f5067b20ee89d9826dc806abdd610fb60
SHA256

69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944
SHA512

65e6b735a88a3ab6e4dad015c5de020756d9e60c38e48f71f7fa72a66586b172dccae79e9470d2424639d4ae2307acb187f2c8ae72c782ac5acce02fd9442c78
SSDEEP

12288:lzymiDGnYdnieNfazSqBZg+30ki1+zB8NOUx:lBveNfazSshNi1UK

Score

10^/10

blackbasta defense_evasion execution impact ransomware spyware stealer

Malware Config

Extracted

Path

C:\Program Files (x86)\readme.txt

Ransom Note

Your data are stolen and encrypted The data will be published on TOR website if you do not pay the ransom You can contact us and decrypt one file for free on this TOR site (you should download and install TOR browser first https://torproject.org) https://aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion/ Your company id for log in: 460c3c4c-c19d-4567-b16a-a28e49949214 @>B

URLs

https://aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion/

Signatures

Black Basta
A ransomware family targeting Windows and Linux ESXi first seen in February 2022.
ransomware blackbasta
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (9752) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dlaksjdoiwq.jpg"	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-annotations-common.xml	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe
File opened for modification	C:\Program Files\Java\jre7\bin\klist.exe	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libripple_plugin.dll	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-Bold.otf	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD15185_.GIF	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR40F.GIF	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Ushuaia	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0287018.WMF	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\NEWS.DPV	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\msadc\de-DE\msdaremr.dll.mui	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0153087.WMF	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\email_initiator.gif	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Juneau	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ICELAND.TXT	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe
File opened for modification	C:\Program Files\Mozilla Firefox\Accessible.tlb	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\ct.sym	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.mbeanbrowser.zh_CN_5.5.0.165303.jar	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152898.WMF	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Angles.eftx	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationRight_ButtonGraphic.png	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe
File opened for modification	C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN04323_.WMF	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-oql.xml	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe
File created	C:\Program Files\Google\Chrome\readme.txt	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe
File created	C:\Program Files\Internet Explorer\SIGNUP\readme.txt	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107490.WMF	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\ja-JP\msinfo32.exe.mui	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoBeta.png	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Porto_Velho	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_ContactLow.jpg	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\readme.txt	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Thatch.xml	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL103.XML	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help_3.6.0.v20130326-1254.jar	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-spi-actions.xml	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightRegular.ttf	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\UIAutomationProvider.resources.dll	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\readme.txt	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-javahelp.xml	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe
File created	C:\Program Files\MSBuild\Microsoft\readme.txt	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02039U.BMP	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Contacts.accdt	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Thimphu	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\msadc\msdaremr.dll	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0175428.JPG	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0090386.WMF	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\fr-FR\msdaprsr.dll.mui	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\whiteband.png	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\readme.txt	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPBluTSFrame.png	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe
File created	C:\Program Files\DVD Maker\Shared\readme.txt	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\readme.txt	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152628.WMF	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Rangoon	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\CharSetTable.chr	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382962.JPG	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi422_i420_plugin.dll	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Equity.xml	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\PassportMask_PAL.wmv	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages.properties	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\Oslo	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-multiview.xml	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe

Interacts with shadow copies 2 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
2036	vssadmin.exe
2556	vssadmin.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.basta\DefaultIcon	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.basta	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.basta\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fkdjsadasd.ico"	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeBackupPrivilege	2100	vssvc.exe
Token: SeRestorePrivilege	2100	vssvc.exe
Token: SeAuditPrivilege	2100	vssvc.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1300 wrote to memory of 2032	1300	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe	29
PID 1300 wrote to memory of 2032	1300	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe	29
PID 1300 wrote to memory of 2032	1300	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe	29
PID 1300 wrote to memory of 2032	1300	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe	29
PID 2032 wrote to memory of 2036	2032	cmd.exe	31
PID 2032 wrote to memory of 2036	2032	cmd.exe	31
PID 2032 wrote to memory of 2036	2032	cmd.exe	31
PID 2032 wrote to memory of 2036	2032	cmd.exe	31
PID 1300 wrote to memory of 2688	1300	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe	34
PID 1300 wrote to memory of 2688	1300	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe	34
PID 1300 wrote to memory of 2688	1300	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe	34
PID 1300 wrote to memory of 2688	1300	69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe	34
PID 2688 wrote to memory of 2556	2688	cmd.exe	36
PID 2688 wrote to memory of 2556	2688	cmd.exe	36
PID 2688 wrote to memory of 2556	2688	cmd.exe	36
PID 2688 wrote to memory of 2556	2688	cmd.exe	36

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe
"C:\Users\Admin\AppData\Local\Temp\69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944.exe"
1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1300
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2032
- - C:\Windows\system32\vssadmin.exe
    C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:2036
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\System32\vssadmin.exe delete shadows /all /quiet
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2688
- - C:\Windows\SysWOW64\vssadmin.exe
    C:\Windows\System32\vssadmin.exe delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:2556

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact