Analysis
-
max time kernel
109s -
max time network
6s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
16-08-2024 13:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b648b7305df49492c44a1280ec2228a0N.exe
Resource
win7-20240729-en
windows7-x64
11 signatures
120 seconds
Behavioral task
behavioral2
Sample
b648b7305df49492c44a1280ec2228a0N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
14 signatures
120 seconds
General
-
Target
b648b7305df49492c44a1280ec2228a0N.exe
-
Size
885KB
-
MD5
b648b7305df49492c44a1280ec2228a0
-
SHA1
ce77bd3224f47ae4b8a04bd4b4be91c3550de294
-
SHA256
d73f6e240766ddd6c3c16eff8db50794ab8ab95c6a616d4ab2bc96780f13464d
-
SHA512
2b2bb13bedbce537f28cd58e23e54ace05f717ac1e4e3e4672768a4604e99ce9f35ee377ecd0677713729d066a1f730050d968f4a8dc3cb3cf6f5aaf86cd9737
-
SSDEEP
24576:pIr/f/LUup7zmMl8tOKnvwYQ62jaeekMEoBmn6o:pMUS2Ml8trnvwYQ62japkMEQS6o
Malware Config
Extracted
Path
C:\Program Files\instructions_read_me.txt
Family
blackbasta
Ransom Note
ATTENTION!
Your network has been breached and all data was encrypted. Please contact us at:
https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Login ID: d87708c4-408b-4b02-97b9-071781f49f9c
*!* To access .onion websites download and install Tor Browser at:
https://www.torproject.org/ (Tor Browser is not related to us)
*!* To restore all your PCs and get your network working again, follow these instructions:
- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.
Please follow these simple rules to avoid data corruption:
- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption.
- Do not hire a recovery company. They can't decrypt without the key.
They also don't care about your business. They believe that they are
good negotiators, but it is not. They usually fail. So speak for yourself.
Waiting you in a chat.
URLs
https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Signatures
-
Black Basta
A ransomware family targeting Windows and Linux ESXi first seen in February 2022.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Run\Skype = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b648b7305df49492c44a1280ec2228a0N.exe" b648b7305df49492c44a1280ec2228a0N.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105412.WMF b648b7305df49492c44a1280ec2228a0N.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BORDERS\MSART2.BDR b648b7305df49492c44a1280ec2228a0N.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe b648b7305df49492c44a1280ec2228a0N.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe b648b7305df49492c44a1280ec2228a0N.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe b648b7305df49492c44a1280ec2228a0N.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0285444.WMF b648b7305df49492c44a1280ec2228a0N.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\shvlzm.exe.mui b648b7305df49492c44a1280ec2228a0N.exe File opened for modification C:\Program Files (x86)\Windows Media Player\Media Renderer\connectionmanager_dmr.xml b648b7305df49492c44a1280ec2228a0N.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui b648b7305df49492c44a1280ec2228a0N.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui b648b7305df49492c44a1280ec2228a0N.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-image-inset.png b648b7305df49492c44a1280ec2228a0N.exe File created C:\Program Files\Windows Mail\en-US\instructions_read_me.txt b648b7305df49492c44a1280ec2228a0N.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0086478.WMF b648b7305df49492c44a1280ec2228a0N.exe File created C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\instructions_read_me.txt b648b7305df49492c44a1280ec2228a0N.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\MSPUB1B.BDR b648b7305df49492c44a1280ec2228a0N.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm b648b7305df49492c44a1280ec2228a0N.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\ONINTL.DLL.IDX_DLL b648b7305df49492c44a1280ec2228a0N.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\PS9CRNRH.POC b648b7305df49492c44a1280ec2228a0N.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Thatch.eftx b648b7305df49492c44a1280ec2228a0N.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00478_.WMF b648b7305df49492c44a1280ec2228a0N.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\currency.html b648b7305df49492c44a1280ec2228a0N.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\es-ES\gadget.xml b648b7305df49492c44a1280ec2228a0N.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckg.dll b648b7305df49492c44a1280ec2228a0N.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD02097_.WMF b648b7305df49492c44a1280ec2228a0N.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe b648b7305df49492c44a1280ec2228a0N.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0200279.WMF b648b7305df49492c44a1280ec2228a0N.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0172035.WMF b648b7305df49492c44a1280ec2228a0N.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02407_.WMF b648b7305df49492c44a1280ec2228a0N.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0300840.WMF b648b7305df49492c44a1280ec2228a0N.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\EAWFINTL.DLL b648b7305df49492c44a1280ec2228a0N.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN020.XML b648b7305df49492c44a1280ec2228a0N.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\FLYER98.POC b648b7305df49492c44a1280ec2228a0N.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01169_.WMF b648b7305df49492c44a1280ec2228a0N.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0198025.WMF b648b7305df49492c44a1280ec2228a0N.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\ShapeCollector.exe.mui b648b7305df49492c44a1280ec2228a0N.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationRight_SelectionSubpicture.png b648b7305df49492c44a1280ec2228a0N.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\MS.JPG b648b7305df49492c44a1280ec2228a0N.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00523_.WMF b648b7305df49492c44a1280ec2228a0N.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BORDERS\MSART10.BDR b648b7305df49492c44a1280ec2228a0N.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105386.WMF b648b7305df49492c44a1280ec2228a0N.exe File opened for modification C:\Program Files (x86)\Common Files\System\it-IT\wab32res.dll.mui b648b7305df49492c44a1280ec2228a0N.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationUp_SelectionSubpicture.png b648b7305df49492c44a1280ec2228a0N.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\librawvideo_plugin.dll b648b7305df49492c44a1280ec2228a0N.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libwav_plugin.dll b648b7305df49492c44a1280ec2228a0N.exe File opened for modification C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw48.bmp b648b7305df49492c44a1280ec2228a0N.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\BIB.dll b648b7305df49492c44a1280ec2228a0N.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Full\full.png b648b7305df49492c44a1280ec2228a0N.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\whitemenu.png b648b7305df49492c44a1280ec2228a0N.exe File created C:\Program Files\Windows Mail\instructions_read_me.txt b648b7305df49492c44a1280ec2228a0N.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Essential.eftx b648b7305df49492c44a1280ec2228a0N.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe b648b7305df49492c44a1280ec2228a0N.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\cpu.html b648b7305df49492c44a1280ec2228a0N.exe File opened for modification C:\Program Files\Windows Media Player\ja-JP\wmplayer.exe.mui b648b7305df49492c44a1280ec2228a0N.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_MCELogo_mouseout.png b648b7305df49492c44a1280ec2228a0N.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0285780.WMF b648b7305df49492c44a1280ec2228a0N.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD00705_.WMF b648b7305df49492c44a1280ec2228a0N.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\WINWORD.DEV_K_COL.HXK b648b7305df49492c44a1280ec2228a0N.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Document Parts\instructions_read_me.txt b648b7305df49492c44a1280ec2228a0N.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\instructions_read_me.txt b648b7305df49492c44a1280ec2228a0N.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipRes.dll.mui b648b7305df49492c44a1280ec2228a0N.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\cronometer_h.png b648b7305df49492c44a1280ec2228a0N.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SAEXT.DLL b648b7305df49492c44a1280ec2228a0N.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GRINTL32.DLL.IDX_DLL b648b7305df49492c44a1280ec2228a0N.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\AdjacencyLetter.dotx b648b7305df49492c44a1280ec2228a0N.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b648b7305df49492c44a1280ec2228a0N.exe -
Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2920 vssadmin.exe -
Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.busrr6agx\DefaultIcon b648b7305df49492c44a1280ec2228a0N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.busrr6agx b648b7305df49492c44a1280ec2228a0N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.busrr6agx\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fkdjsadasd.ico" b648b7305df49492c44a1280ec2228a0N.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1316 b648b7305df49492c44a1280ec2228a0N.exe 1316 b648b7305df49492c44a1280ec2228a0N.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 2696 vssvc.exe Token: SeRestorePrivilege 2696 vssvc.exe Token: SeAuditPrivilege 2696 vssvc.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1316 wrote to memory of 2456 1316 b648b7305df49492c44a1280ec2228a0N.exe 30 PID 1316 wrote to memory of 2456 1316 b648b7305df49492c44a1280ec2228a0N.exe 30 PID 1316 wrote to memory of 2456 1316 b648b7305df49492c44a1280ec2228a0N.exe 30 PID 1316 wrote to memory of 2456 1316 b648b7305df49492c44a1280ec2228a0N.exe 30 PID 2456 wrote to memory of 2920 2456 cmd.exe 32 PID 2456 wrote to memory of 2920 2456 cmd.exe 32 PID 2456 wrote to memory of 2920 2456 cmd.exe 32 PID 2456 wrote to memory of 2920 2456 cmd.exe 32 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\b648b7305df49492c44a1280ec2228a0N.exe"C:\Users\Admin\AppData\Local\Temp\b648b7305df49492c44a1280ec2228a0N.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Windows\system32\vssadmin.exeC:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2920
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2696
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD53ea719301224c4cc13063efa4fd91d8f
SHA1f49feaf562566e94c4eca8c151624e9bf39775bf
SHA2566785977e363ed614f778efc564c6b3c5d28473a8c14c895793d0c9c791374f8d
SHA512ac1db933bc28cc419022ff2bbeb15d8ba860a6a00f6dfd9b1f1774596a1ee2cbb09476ca09a2960f9db4b9b78738953a23cd1d332ff44fffa78e610348eef524