blackbasta | 764b1117262d33f0a69b4f4c72fad607b7c71c262f60b9b2b35a21e7f4967786

Analysis

max time kernel
7s
max time network
18s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18/12/2024, 12:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

764b1117262d33f0a69b4f4c72fad607b7c71c262f60b9b2b35a21e7f4967786.bin.dll
Size

1023KB
MD5

08378cd36fdbf69dba24d14393ad564d
SHA1

c698e08ff114499e9fecf39fcbf23f652f1cdad8
SHA256

764b1117262d33f0a69b4f4c72fad607b7c71c262f60b9b2b35a21e7f4967786
SHA512

ef831fc12ad4831e180c9e5e9babbf1a2d8675a918992fc6f5306447b30e12de63e5034124e31a2d9517db4322e7aaf4a01cecf3239f2c6f6d459358849ef197
SSDEEP

12288:jbXTgrBCnMCz5WYgeWYg955/155/UqgFUHx2lvyRJbhLvTcT+sqnhDik2BBD+/rF:jbTgrBCnjzgsKrd7m4+OmMlaT2BZSP2

Score

10^/10

blackbasta ransomware

Malware Config

Extracted

Path

C:\Program Files (x86)\instructions_read_me.txt

Family

blackbasta

Ransom Note

ATTENTION! Your network has been breached and all data was encrypted. Please contact us at: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ Login ID: 3dd718a3-db04-485f-b882-250349c8a4de *!* To access .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us) *!* To restore all your PCs and get your network working again, follow these instructions: - Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency. Please follow these simple rules to avoid data corruption: - Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - Do not hire a recovery company. They can't decrypt without the key. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. So speak for yourself. Waiting you in a chat.

URLs

https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/

Signatures

Black Basta
A ransomware family targeting Windows and Linux ESXi first seen in February 2022.
ransomware blackbasta
Blackbasta family
blackbasta
Renames multiple (289) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Media Player\wmpshare.exe	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\SuperSlowMotionCheckbox.xbf	rundll32.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_neutral_~_8wekyb3d8bbwe\instructions_read_me.txt	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\VoiceCommands.xml	rundll32.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\release	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxSignature.p7x	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Configuration.winmd	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_neutral_~_8wekyb3d8bbwe\AppxSignature.p7x	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\MediaInkToolbar.xbf	rundll32.exe
File opened for modification	C:\Program Files\Windows Defender\en-US\MpEvMsg.dll.mui	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe	rundll32.exe
File opened for modification	C:\Program Files\Mozilla Firefox\postSigningData	rundll32.exe
File opened for modification	C:\Program Files\Mozilla Firefox\AccessibleMarshal.dll	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onresim.dll	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\PaintStudio.ViewElements.dll	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Lumia.Imaging.dll	rundll32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ta.txt	rundll32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ug.txt	rundll32.exe
File opened for modification	C:\Program Files\Windows Media Player\Media Renderer\DMR_48.png	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.NET.Native.Framework.1.7_1.7.25531.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\ScreenSketchAppService.winmd	rundll32.exe
File opened for modification	C:\Program Files\Crashpad\settings.dat	rundll32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\si.txt	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Microsoft.Graphics.Canvas.winmd	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Services.Store.Engagement_10.0.18101.0_x64__8wekyb3d8bbwe\AppxManifest.xml	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\VideoEditor.Common.Native.dll	rundll32.exe
File created	C:\Program Files\Windows Multimedia Platform\instructions_read_me.txt	rundll32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	rundll32.exe
File created	C:\Program Files\Windows Defender\es-ES\instructions_read_me.txt	rundll32.exe
File created	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-100_8wekyb3d8bbwe\instructions_read_me.txt	rundll32.exe
File created	C:\Program Files\Windows Security\instructions_read_me.txt	rundll32.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\uk-UA\ImagingDevices.exe.mui	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\AriaWrapper.winmd	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-100_kzf8qxf38zg5c\AppxManifest.xml	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\Office.UI.Xaml.Oart.dll	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftEdge.Stable_92.0.902.67_neutral__8wekyb3d8bbwe\SmallLogo.png	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\AppxSignature.p7x	rundll32.exe
File opened for modification	C:\Program Files\dotnet\ThirdPartyNotices.txt	rundll32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	rundll32.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\ProtectionManagement.dll.mui	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\System.Runtime.Numerics.dll	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\System.Security.Principal.dll	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\ChartIm.dll	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_2019.716.2313.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml	rundll32.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmlaunch.exe	rundll32.exe
File opened for modification	C:\Program Files\Windows Media Player\Network Sharing\MediaReceiverRegistrar.xml	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\System.Linq.Queryable.dll	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\AppxSignature.p7x	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-100_kzf8qxf38zg5c\AppxSignature.p7x	rundll32.exe
File opened for modification	C:\Program Files\Windows Media Player\mpvis.DLL	rundll32.exe
File opened for modification	C:\Program Files\Windows Media Player\wmlaunch.exe	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\AppxSignature.p7x	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\VariableFrameRateVideoPlayer.xbf	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxSignature.p7x	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\AppxManifest.xml	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\CsiImm.dll	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\mmsogdiplusim.dll	rundll32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tg.txt	rundll32.exe
File opened for modification	C:\Program Files\Internet Explorer\ja-JP\iexplore.exe.mui	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\System.Net.Sockets.dll	rundll32.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.7wdojib58\DefaultIcon	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.7wdojib58	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.7wdojib58\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fkdjsadasd.ico"	rundll32.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
740	NOTEPAD.EXE

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\764b1117262d33f0a69b4f4c72fad607b7c71c262f60b9b2b35a21e7f4967786.bin.dll,#1
1⤵
- Drops file in Program Files directory
- Modifies registry class
PID:4656

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\instructions_read_me.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:740

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\instructions_read_me.txt

Filesize
1KB

MD5
4ba06d41a13bc5f4ddc71cf6a48cf231

SHA1
d83c4640b36339549130fcb008c6f5c8a6d67676

SHA256
8e29eb9f02be51cbdc99f8ec9b90fb29f47806f9ca804590de548d5e06f47db5

SHA512
9fe3e0546ece1c74b2b3f188fafb024309bb1048ce997c334a6fed9b9638f11aa0dc99784546241fc28893b207a239ed21f8189a51bd801bc65334bd082da88c

Download Submit