Overview

overview

10

Static

static

3

15d891d682...39.exe

windows7-x64

10

15d891d682...39.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    136s
  • max time network
    136s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-12-2024 16:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    15d891d682d73514401f65f0bd769d27f777462c31c7815e1a0fe119a41ea739.exe

  • Size

    649KB

  • MD5

    90e69700399e2b75d7e09b84185640c7

  • SHA1

    cce479af71b73f1d0c5226b87894aeb5c24aeed2

  • SHA256

    15d891d682d73514401f65f0bd769d27f777462c31c7815e1a0fe119a41ea739

  • SHA512

    5bdcecad4af71631278e7d00fd9056a6b62be6212e7f7e00d75e08207ca41fbe3e075ca0699cc963039deb5190225bde16a5522b5ca6c7d943e3b5df80750ceb

  • SSDEEP

    12288:4ofNGhJvRjVUWEFvScnf316z/OF/NqDxf4qLO1BhwTkwJcqea4VOF:4ofNGhJvRJGf3oJ9f4qLqBhsJveg

Score
10/10
blackbastadiscoverypersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\Program Files (x86)\instructions_read_me.txt

Family

blackbasta

Ransom Note
Hello! If you are reading this, it means we have encrypted your data and took your files. DO NOT PANIC! Yes, this is bad news, but we will have a good ones as well. YES, this is entirely fixable! Our name is BlackBasta Syndicate, and we are the largest, most advanced, and most prolific organized group currently existing. We are the ultimate cyber tradecraft with a credential record of taking down the most advanced, high-profile, and defended companies one can ever imagine. You can Google us later; what you need to know now is that we are business people just like you. We have your data and encrypted your files, but in less than an hour, we can put things back on track: if you pay for our recovery services, you get a decryptor, the data will be deleted from all of our systems and returned to you, and we will give you a security report explaining how we got you. Please contact us at: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ Login: 94351e51-1b7a-4b52-8170-a8c42c418cac This is a link to a secure chat. We will talk there. Inside that chat, we will share a second designated link that only your special team will be able to see. For now, think about the following. This incident hits your network and is stopping you from operating properly. The sooner you get back on track, the better it is. See you in the secure chat.
URLs

https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/

Signatures

  • Black Basta

    A ransomware family targeting Windows and Linux ESXi first seen in February 2022.

    ransomwareblackbasta
  • Blackbasta family
    blackbasta
  • Renames multiple (10715) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\15d891d682d73514401f65f0bd769d27f777462c31c7815e1a0fe119a41ea739.exe
    "C:\Users\Admin\AppData\Local\Temp\15d891d682d73514401f65f0bd769d27f777462c31c7815e1a0fe119a41ea739.exe"
    1⤵
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3272
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet
      2⤵
        PID:3380
      • C:\Windows\SYSTEM32\cmd.exe
        cmd.exe /c start /MAX notepad.exe c:\instructions_read_me.txt
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3928
        • C:\Windows\system32\notepad.exe
          notepad.exe c:\instructions_read_me.txt
          3⤵
          • Opens file in notepad (likely ransom note)
          PID:3756
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:3968
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2916

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\instructions_read_me.txt
      Filesize

      1KB

      MD5

      474f9f8e33d15810aeae38d13b7022f2

      SHA1

      855c8e02a569de0af43349ebf8709f9085f7e1a4

      SHA256

      a2d05305ced99c19bcf8ee2b9bf0de7436738efa4c5113a1fba4157ab3360c66

      SHA512

      5aea1d996d13359c8a9b17c5c2b43e3443daed6d66774dbc3cfe6324b17dee74725df67c92b5e97c98a3c2b9a0e4a014f6eec7e028ae60c7daed9c53883f923a

      Download Submit

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{A5E73466-E220-8EF4-B956-A582187356D9}
      Filesize

      36KB

      MD5

      8aaad0f4eb7d3c65f81c6e6b496ba889

      SHA1

      231237a501b9433c292991e4ec200b25c1589050

      SHA256

      813c66ce7dec4cff9c55fb6f809eab909421e37f69ff30e4acaa502365a32bd1

      SHA512

      1a83ce732dc47853bf6e8f4249054f41b0dea8505cda73433b37dfa16114f27bfed3b4b3ba580aa9d53c3dcc8d48bf571a45f7c0468e6a0f2a227a7e59e17d62

      Download Submit

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_ControlPanel
      Filesize

      36KB

      MD5

      fb5f8866e1f4c9c1c7f4d377934ff4b2

      SHA1

      d0a329e387fb7bcba205364938417a67dbb4118a

      SHA256

      1649ec9493be27f76ae7304927d383f8a53dd3e41ea1678bacaff33120ea4170

      SHA512

      0fbe2843dfeab7373cde0643b20c073fdc2fcbefc5ae581fd1656c253dfa94e8bba4d348e95cc40d1e872456ecca894b462860aeac8b92cedb11a7cad634798c

      Download Submit

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{6D809377-6AF0-444B-8957-A3773F02200E}_VideoLAN_VLC_NEWS_txt
      Filesize

      36KB

      MD5

      968e7d1aa993ef1052b35a95c51946d5

      SHA1

      c67817521eb4f70d692d3d29b32676b1871e3d40

      SHA256

      719fb4e7016e1c4fff64166a8809a6ffe5d16ba0a40e4e8593ba7f664337e239

      SHA512

      3382a01b518c38859c1ffc8799aacb941fd7bedd2cecaab4fc8e7fe8e44aeb6acf3997b844b9b5d8ddf4e72331e33972606cab1e9d8b527bf80ef7a9a0136022

      Download Submit

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{cccfab3a-470b-4a13-a304-42a93feb45d3}\0.0.filtertrie.intermediate.txt
      Filesize

      28KB

      MD5

      cdcc5d435b8d95f75493af717920f404

      SHA1

      793455d2c7471848f459c91d33d457db3028a3a4

      SHA256

      976b74dd2882fe30c86ed675e6117e63714d86c0aafab45983ddfc4d92a04dde

      SHA512

      281b77d1f6be1a5ed060942d96b0b17923205e0a9c824ea2a74ecdc0cd2c2ef1d2b69b652cb92d3a7a038dd9d9b1cec80c79340c193e2640cb5b25c368b31376

      Download Submit

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{cccfab3a-470b-4a13-a304-42a93feb45d3}\0.1.filtertrie.intermediate.txt
      Filesize

      332B

      MD5

      3c1658698913ee39ff8686c6a4674142

      SHA1

      252bdb90f5a338078cbc7e42e5abdabac20be612

      SHA256

      d5ca825ed80bc1bed90603613559d42fc52529d4b5a4af92fd411a7634b67449

      SHA512

      c90d39c156bc2fb424ae14d16fa6c56bc7fef4ad8d9563ddb75d926b6134c0fd3be7361b4fdaaf61ddc7becbc42064a5e67950ac7b27c2a8ff189c959b5fdd80

      Download Submit

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{cccfab3a-470b-4a13-a304-42a93feb45d3}\0.2.filtertrie.intermediate.txt
      Filesize

      332B

      MD5

      d9193dff3dda264d5d66386ad3290276

      SHA1

      bdeef876c9f16abf17bb5912ff70a138ca8918c5

      SHA256

      a8c07c5f5a968129964514138db307f50f04cd51d0670353c2249cada948c53d

      SHA512

      f11677be7cafacd810a0d8d9aab641b040129b30123eedb4539e4055ea722e2eba39404f089cd2acc266b571704944fb638810700fb8a9e424dcab209a7133f2

      Download Submit

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{cccfab3a-470b-4a13-a304-42a93feb45d3}\Apps.ft
      Filesize

      38KB

      MD5

      cb304f7d41bb230e280404249a3a7445

      SHA1

      c1e475a40c5cbabcd213f3eea63ee7164fda494d

      SHA256

      2b87bd5350ee2795f6e87278b770c74899c34996f532f76c663cc55a0e276c8e

      SHA512

      0ead8a059301fb95601bc2ea66ba1e5d922d7a3ade329b491d076817545d82899c0f1b2237df95f3ddfac1d5441c8ed1c9ac70be9ff85a378b0d277fba7599ef

      Download Submit

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{cccfab3a-470b-4a13-a304-42a93feb45d3}\Apps.index
      Filesize

      1.0MB

      MD5

      dde620565eac6fedadb2d9100ad8a96a

      SHA1

      98386d1aca65d285ddd445f7060621dc9e7b5454

      SHA256

      0d88bc3f123edbe8a9da048e6820b85d62598612d5582e4c15bb797ec5ea0b65

      SHA512

      4d828fa52a2ca909ed49247ea016308d1f0457d59ab89e0d30c0013e685b5a8c642db8b56529bcb0d1a4b080a0a67d6c84985c3d71288131f78f3582bb94e8e1

      Download Submit

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133792704489860042.txt
      Filesize

      75KB

      MD5

      8cccd6b11f1de6cd6ebfe1fe40893876

      SHA1

      7c8270c6be9efc883fc9386411544f9d2e1b9f82

      SHA256

      7f64236ca9426335596a3579cfb563b7f9b6c720475ada47a5395a5102ecfa0a

      SHA512

      01a65257201c254ca07caa4ca97ef5d9fa801b65a77b84f45ef63611a307f4cefdd9b462c29b0bfe52baa8d8dd4bee45824bdf9e2790dfee508cb6ef62f7eb42

      Download Submit

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133792704489860042.txt
      Filesize

      74KB

      MD5

      3a9cb78222aafefb89542bb9d047482a

      SHA1

      8305539da7f9ff71e656855eb3ab8d3802b0c976

      SHA256

      bf3693f096d236b8b574523565cda1759136d949fbe0faed5630224a887d1822

      SHA512

      09b73cf50105ac2b3eefd4ac932855cf56a96abef00a8a4cb7373fe1bf0ba8b2eebd28770831989aa675fde238c580b93144f3ba185f53acd5367a23bdb5df72

      Download Submit

    • memory/2916-2082-0x000002D674300000-0x000002D674320000-memory.dmp

      Filesize

      128KB

      Download

    • memory/2916-2047-0x000002D673C40000-0x000002D673C60000-memory.dmp

      Filesize

      128KB

      Download

    • memory/2916-2018-0x000002D672D00000-0x000002D672E00000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/2916-2023-0x000002D673C80000-0x000002D673CA0000-memory.dmp

      Filesize

      128KB

      Download