blackbasta | b8463c09f968d938c4722febb7342f2e9babc2deba004f0945892ad297214b31

Analysis

max time kernel
114s
max time network
132s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241211-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
21-12-2024 15:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b.zip
Size

446KB
MD5

985b24da5760a2acb663944336ac96fa
SHA1

5750ff42866f4ebf885c4eba2d346e656c19b1d0
SHA256

b8463c09f968d938c4722febb7342f2e9babc2deba004f0945892ad297214b31
SHA512

b1c1248390de5c847033fe3b098bfe257c296add90ad0ec2d885ccc7545ee9799e0cbf6e48402b87d361070af1c71ee13c0e90900f2679f99c2ba17cd4ea7009
SSDEEP

12288:boutuJQIn872o78fwwHqo5C8nDDCLu/ou7I0ngv0Y:bhsJQo87QfUo5CkDOLr8bBY

Score

10^/10

blackbasta ransomware

Malware Config

Extracted

Path

C:\Program Files (x86)\instructions_read_me.txt

Family

blackbasta

Ransom Note

ATTENTION! Your network has been breached and all data was encrypted. Please contact us at: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ Login ID: 3dd718a3-db04-485f-b882-250349c8a4de *!* To access .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us) *!* To restore all your PCs and get your network working again, follow these instructions: - Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency. Please follow these simple rules to avoid data corruption: - Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - Do not hire a recovery company. They can't decrypt without the key. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. So speak for yourself. Waiting you in a chat.

URLs

https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/

Signatures

Black Basta
A ransomware family targeting Windows and Linux ESXi first seen in February 2022.
ransomware blackbasta
Blackbasta family
blackbasta
Renames multiple (3444) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Loads dropped DLL 1 IoCs

pid	Process
2632	rundll32.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nl-nl.dll	rundll32.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-processthreads-l1-1-1.dll	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Grace-ul-oob.xrm-ms	rundll32.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-multibyte-l1-1-0.dll	rundll32.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\THANKS.txt	rundll32.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mshwLatin.dll	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-ul-oob.xrm-ms	rundll32.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\instructions_read_me.txt	rundll32.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClientIsv.man	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-pl.xrm-ms	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\NPSPWRAP.DLL	rundll32.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\et-EE\instructions_read_me.txt	rundll32.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Data.DataSetExtensions.dll	rundll32.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe	rundll32.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\README.txt	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-ul-oob.xrm-ms	rundll32.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\goopdateres_ar.dll	rundll32.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\pl-PL\tipresx.dll.mui	rundll32.exe
File opened for modification	C:\Program Files\dotnet\host\fxr\6.0.27\hostfxr.dll	rundll32.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnscfg.exe	rundll32.exe
File created	C:\Program Files\Common Files\System\uk-UA\instructions_read_me.txt	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\flat_officeFontsPreview.ttf	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019DemoR_BypassTrial180-ul-oob.xrm-ms	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONBttnIE.dll	rundll32.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.CoreLib.dll	rundll32.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Expressions.dll	rundll32.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	rundll32.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\Content.xml	rundll32.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsrom.xml	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Grace-ul-oob.xrm-ms	rundll32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	rundll32.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.Lightweight.dll	rundll32.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encoding.CodePages.dll	rundll32.exe
File opened for modification	C:\Program Files\ExitNew.html	rundll32.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseAPToast.exe	rundll32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	rundll32.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\Microsoft.mshtml.dll	rundll32.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\es-ES\MpAsDesc.dll.mui	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_KMS_Client_AE-ul.xrm-ms	rundll32.exe
File created	C:\Program Files\Windows Media Player\ja-JP\instructions_read_me.txt	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\powerview.x-none.msi.16.x-none.tree.dat	rundll32.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\goopdateres_en.dll	rundll32.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\mshwLatin.dll.mui	rundll32.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.Watcher.dll	rundll32.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dt_shmem.dll	rundll32.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\Classification\Dprt\Microsoft.Ceres.DocParsing.FormatHandlers.Common.Interop.dll	rundll32.exe
File created	C:\Program Files (x86)\Windows Media Player\instructions_read_me.txt	rundll32.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sl-si.dll	rundll32.exe
File opened for modification	C:\Program Files\Common Files\System\ado\msado15.dll	rundll32.exe
File opened for modification	C:\Program Files\Mozilla Firefox\platform.ini	rundll32.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fr-fr.dll	rundll32.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe	rundll32.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.CompilerServices.Unsafe.dll	rundll32.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc	rundll32.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\vcruntime140.dll	rundll32.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Claims.dll	rundll32.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	rundll32.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	rundll32.exe
File created	C:\Program Files\Windows Photo Viewer\instructions_read_me.txt	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial1-ul-oob.xrm-ms	rundll32.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\Ole DB\msdatt.dll	rundll32.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Requests.dll	rundll32.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.AeroLite.dll	rundll32.exe
File opened for modification	C:\Program Files\WriteReceive.jpe	rundll32.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.7wdojib58\DefaultIcon	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.7wdojib58	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.7wdojib58\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fkdjsadasd.ico"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	7zFM.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1644	NOTEPAD.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4156	7zFM.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	4156	7zFM.exe
Token: 35	4156	7zFM.exe
Token: SeSecurityPrivilege	4156	7zFM.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4156	7zFM.exe
4156	7zFM.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4716 wrote to memory of 2632	4716	cmd.exe	95
PID 4716 wrote to memory of 2632	4716	cmd.exe	95

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\b.zip"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4156

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2708

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\basta\start.bat" "
1⤵
- Suspicious use of WriteProcessMemory
PID:4716
- C:\Windows\system32\rundll32.exe
  rundll32 basta.dll,#1
  2⤵
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Modifies registry class
  PID:2632

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\instructions_read_me.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:1644

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:1716

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\instructions_read_me.txt

Filesize
1KB

MD5
4ba06d41a13bc5f4ddc71cf6a48cf231

SHA1
d83c4640b36339549130fcb008c6f5c8a6d67676

SHA256
8e29eb9f02be51cbdc99f8ec9b90fb29f47806f9ca804590de548d5e06f47db5

SHA512
9fe3e0546ece1c74b2b3f188fafb024309bb1048ce997c334a6fed9b9638f11aa0dc99784546241fc28893b207a239ed21f8189a51bd801bc65334bd082da88c

Download Submit
C:\Users\Admin\Desktop\basta\basta.dll

Filesize
1023KB

MD5
08378cd36fdbf69dba24d14393ad564d

SHA1
c698e08ff114499e9fecf39fcbf23f652f1cdad8

SHA256
764b1117262d33f0a69b4f4c72fad607b7c71c262f60b9b2b35a21e7f4967786

SHA512
ef831fc12ad4831e180c9e5e9babbf1a2d8675a918992fc6f5306447b30e12de63e5034124e31a2d9517db4322e7aaf4a01cecf3239f2c6f6d459358849ef197

Download Submit
C:\Users\Admin\Desktop\basta\blank.docx

Filesize
97KB

MD5
891e3c7a06345ebab055018e8e1db4cd

SHA1
dea5c9a337fbf317a86950379b13390ad5db8276

SHA256
6f9e46f3296724de2d0a3770ed515aef04b7cb05e7c327108b404db110d6b1ad

SHA512
fef7e6387dacff36f720149811559c5f4bf637ceebf02263a792d319e0428670d8ec3aabfd0174b47f1d5605289fd0285ee1466d47ec2e338181a5dc9bfcabfc

Download Submit
C:\Users\Admin\Desktop\basta\blank2.docx

Filesize
97KB

MD5
d1aeba7da7bfd4a4cf48c6ca8157bac4

SHA1
fa63cc0f362fea62f8247013d5faf5f432134297

SHA256
3a2aada6f0b6cdc0642c11129d67e409b0b77583eec1b04ae8e365046acd47bf

SHA512
4c6ee02f19a7320d156a5cd5f18281cc45f1874c1694c8d89c8620d9b1237ba94bbdee73da361699ba97645ebd42729a6ac8d62bcc53481ad8a0bcb55eb4eb1f

Download Submit
C:\Users\Admin\Desktop\basta\start.bat

Filesize
33B

MD5
34eee3ee267d4f5e0ec60e5ad8fac9e1

SHA1
d522e7e32849c1bc5e6f7665aa59e642f8fdcda0

SHA256
9eebdef38366ca977bf24574af2c996ccfb19ace6f317bf52c91aacaebe1a090

SHA512
6587491e3d725e8fad82ef3b9b915694cf54227d37d3be735f71a67c1710969c68ced5b9baf5cd877baf6d54312b386c077ed691ec769d4f74acb054a8967b93

Download Submit
memory/1716-7507-0x000001A9A37E0000-0x000001A9A3800000-memory.dmp

Filesize
128KB

Download
memory/1716-7527-0x000001A9A3B70000-0x000001A9A3B90000-memory.dmp

Filesize
128KB

Download
memory/1716-7523-0x000001A9A3D10000-0x000001A9A3D30000-memory.dmp

Filesize
128KB

Download
memory/1716-7541-0x000001A9B5DE0000-0x000001A9B5EE0000-memory.dmp

Filesize
1024KB

Download
memory/1716-7494-0x000001A9A1040000-0x000001A9A1140000-memory.dmp

Filesize
1024KB

Download
memory/1716-7651-0x000001A9B7B30000-0x000001A9B7C30000-memory.dmp

Filesize
1024KB

Download