Overview

overview

10

Static

static

3

a6fbdbf8ef...c7.exe

windows7-x64

9

a6fbdbf8ef...c7.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    76s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-05-2024 11:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a6fbdbf8efe0ea129636bb5b3d6d6faec298272a2afded7e7516f2491844abc7.exe

  • Size

    623KB

  • MD5

    9dbd19323b253a9758195c8efa72f329

  • SHA1

    1661ae91f105b6854ebfbaa47563fce45660cc79

  • SHA256

    a6fbdbf8efe0ea129636bb5b3d6d6faec298272a2afded7e7516f2491844abc7

  • SHA512

    2e34266b691a8041e525037ae67cf65142523c45f01b6da2008a50b452b9664697f86011cdb0daf0510cfea33bd786560bb2d147b06b00779f89199d32552e01

  • SSDEEP

    12288:DIkz+rSP5VV3VG7rYyPT+p/VYXMJ8oD536bGIqs7GBvw0QygfmHH:DISj3IXYETQV1XD5VIZ7GOg1n

Score
10/10
blackbastadefense_evasionexecutionimpactransomware

Malware Config

Extracted

Path

C:\Program Files (x86)\instructions_read_me.txt

Family

blackbasta

Ransom Note
ATTENTION! Your network has been breached and all data was encrypted. Please contact us at: https://aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion/ Login ID: ae31fac0-5ef2-4d58-8434-0c644b47d85c *!* To access .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us) *!* To restore all your PCs and get your network working again, follow these instructions: - Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency. Please follow these simple rules to avoid data corruption: - Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - Do not hire a recovery company. They can't decrypt without the key. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. So speak for yourself. Waiting you in a chat.
URLs

https://aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion/

Signatures

  • Black Basta

    A ransomware family targeting Windows and Linux ESXi first seen in February 2022.

    ransomwareblackbasta
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Renames multiple (3765) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies registry class 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\a6fbdbf8efe0ea129636bb5b3d6d6faec298272a2afded7e7516f2491844abc7.exe
    "C:\Users\Admin\AppData\Local\Temp\a6fbdbf8efe0ea129636bb5b3d6d6faec298272a2afded7e7516f2491844abc7.exe"
    1⤵
    • Drops file in Program Files directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:448
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4584
      • C:\Windows\system32\vssadmin.exe
        C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet
        3⤵
        • Interacts with shadow copies
        PID:4392
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2924
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4440,i,16710585221322798697,8586257254049248207,262144 --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:8
    1⤵
      PID:5988

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\instructions_read_me.txt
      Filesize

      1KB

      MD5

      6eeca8554c5aa30e98d49e968ec2dafc

      SHA1

      75c5e5da3954945846b098ea2ac994d480491096

      SHA256

      9ea25a44f97ac86387c8b29a6a519c8e66250d826aa3cdffb8742e871106b319

      SHA512

      562315532e831b4b7abe70ad05c09e4f0d4b6a5ded9d0285aa6342e7ad3c35085f8d62608e2a77fd44711c2cc5574047bfc90e4b3de41ea9d0b748f8800f0670

      Download Submit

    • memory/448-0-0x0000000000120000-0x00000000001FB000-memory.dmp

      Filesize

      876KB

      Download

    • memory/448-4-0x0000000000120000-0x00000000001FA000-memory.dmp

      Filesize

      872KB

      Download

    • memory/448-3-0x0000000003170000-0x0000000003202000-memory.dmp

      Filesize

      584KB

      Download

    • memory/448-2-0x0000000002FF0000-0x0000000002FF1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/448-5304-0x0000000000120000-0x00000000001FB000-memory.dmp

      Filesize

      876KB

      Download

    • memory/448-10546-0x0000000000120000-0x00000000001FB000-memory.dmp

      Filesize

      876KB

      Download