General

  • Target

    https://bastains.com/click.php?key=5ethf9grt8e5728e381w&cid=1734754266100010TUSTV62601R284R8204Reb90Rd317Re354Rc5f5Rc4396Ve1&cost=0.001236819&zone=8999102-1356418374-4269441498&campaign=418400220

  • Sample

    241224-fcjvds1pey

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Family

blackbasta

Ransom Note
{"account_id_migration_state":2,"account_tracker_service_last_update":"13379489325731208","alternate_error_pages":{"backup":true},"autocomplete":{"retention_policy_last_version":92},"autofill":{"orphan_rows_removed":true},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"window_placement":{"bottom":670,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":680,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":609,"browser_content_container_width":1280,"browser_content_container_x":0,"browser_content_container_y":71,"countryid_at_install":21843,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","1918"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","1918"],"last_update_date":"13372732800000000","this_week_number":2868,"this_week_services_downstream_foreground_kb":{"112189210":1,"67541500":3}},"default_apps_install_state":3,"domain_diversity":{"last_reporting_timestamp":"13379489325731208"},"download":{"directory_upgrade":true},"dual_engine":{"consumer_sitelist_location":"","consumer_sitelist_version":"","profile_id":"FZ3AMVMR","shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_version":""},"edge":{"profile_sso_info":{"aad_sso_algo_state":1,"is_first_profile":true},"profile_sso_option":1,"services":{"signin_scoped_device_id":"838d42f1-3787-4c16-b9fb-b94c578733b5"}},"extensions":{"alerts":{"initialized":true},"chrome_url_overrides":{},"last_chrome_version":"92.0.902.67","pinned_extension_migration":true,"pinned_extensions":[]},"family_safety":{"activity_reporting_enabled":false,"web_filtering_enabled":false},"http_original_content_length":"1918","http_received_content_length":"1918","intl":{"selected_languages":"en-US,en"},"language_model_counters":{"en":1},"media":{"device_id_salt":"F469084D7FE702753CCA7CE230A4B955","engagement":{"schema_version":4}},"media_router":{"receiver_id_hash_token":"9oX1fm0c5pIwiRHg0rxRIkMCaVHUkMins08jD1JhwnthBTrySZ6Q4lDCSAzwVrMp4ZPvQFnlqKCH1Y9YdmD2Dg=="},"ntp":{"num_personal_suggestions":1},"nurturing":{"recommended_settings_variants":-1},"plugins":{"plugins_list":[]},"privacy_sandbox":{"preferences_reconciled":true},"profile":{"avatar_bubble_tutorial_shown":2,"avatar_index":20,"content_settings":{"enable_quiet_permission_ui_enabling_method":{"notifications":2},"exceptions":{"accessibility_events":{},"app_banner":{},"ar":{},"auto_select_certificate":{},"automatic_downloads":{},"autoplay":{},"background_sync":{},"bluetooth_chooser_data":{},"bluetooth_guard":{},"bluetooth_scanning":{},"camera_pan_tilt_zoom":{},"clear_browsing_data_cookies_exceptions":{},"client_hints":{},"clipboard":{},"cookies":{},"durable_storage":{},"file_handling":{},"file_system_access_chooser_data":{},"file_system_last_picked_directory":{},"file_system_read_guard":{},"file_system_write_guard":{},"font_access":{},"geolocation":{},"hid_chooser_data":{},"hid_guard":{},"idle_detection":{},"images":{},"important_site_info":{},"insecure_private_network":{},"installed_web_app_metadata":{},"intent_picker_auto_display":{},"javascript":{},"legacy_cookie_access":{},"media_engagement":{},"media_stream_camera":{},"media_stream_mic":{},"midi_sysex":{},"mixed_script":{},"nfc":{},"notifications":{},"password_protection":{},"payment_handler":{},"permission_autoblocking_data":{},"permission_autorevocation_data":{},"popups":{},"ppapi_broker":{},"protected_media_identifier":{},"protocol_handler":{},"safe_browsing_url_check_data":{},"sensors":{},"serial_chooser_data":{},"serial_guard":{},"site_engagement":{"https://bastains.com:443,*":{"expiration":"0","last_modified":"13379489326983208","model":0,"setting":{"decayModifiedScore":3.0,"lastEngagementTime":1.3379489326983208e+16,"lastShortcutLaunchTime":0.0,"pointsAddedToday":3.0,"rawScore":3.0}}},"sleeping_tabs":{},"sound":{},"ssl_cert_decisions":{},"storage_access":{},"subresource_filter":{},"subresource_filter_data":{},"token_binding":{},"trackers":{},"trackers_data":{},"tracking_org_exceptions":{},"tracking_org_relationships":{},"usb_chooser_data":{},"usb_guard":{},"vr":{},"webid_request":{},"webid_share":{},"window_placement":{}},"pref_version":1},"created_by_version":"92.0.902.67","creation_time":"13372766137324229","edge_profile_id":"623ef47b-3b19-49de-a895-b24db9349e5d","exit_type":"Crashed","has_seen_signin_fre":false,"icon_version":15,"last_engagement_time":"13379489326983208","managed_user_id":"","name":"Profile 1","observed_session_time":{"feedback_rating_in_product_help_observed_session_time_key_92.0.902.67":4.0}},"reset_prepopulated_engines":false,"safebrowsing":{"event_timestamps":{},"metrics_last_log_time":"13379489325"},"sessions":{"event_log":[{"tab_count":0,"time":"13372766137527229","type":2,"window_count":0},{"crashed":false,"time":"13372769247256571","type":0},{"tab_count":1,"time":"13372769251833112","type":2,"window_count":1},{"crashed":false,"time":"13379489325636631","type":0}],"session_data_status":1},"settings":{"a11y":{"caretbrowsing":{"enabled":false}}},"signin":{"DiceMigrationComplete":true,"allowed":true},"spellcheck":{"dictionaries":["en-US"]},"sync":{"autofill":true,"bookmarks":true,"collections":true,"collections_edge_re_evaluated":true,"collections_edge_supported":true,"edge_account_type":0,"extensions":true,"extensions_edge_supported":true,"history_edge_supported":true,"keep_everything_synced":false,"passwords":true,"preferences":true,"requested":false,"tabs":false,"tabs_edge_supported":true,"typed_urls":false},"translate_site_blacklist_with_time":{},"unified_consent":{"migration_state":10},"user_experience_metrics":{"personalization_data_consent_enabled_last_known_value":false},"web_apps":{"did_migrate_default_chrome_apps":[],"last_preinstall_synchronize_version":"92","system_web_app_failure_count":0,"system_web_app_last_attempted_language":"en-US","system_web_app_last_attempted_update":"92.0.902.67","system_web_app_last_installed_language":"en-US","system_web_app_last_update":"92.0.902.67"}}

Targets

    • Target

      https://bastains.com/click.php?key=5ethf9grt8e5728e381w&cid=1734754266100010TUSTV62601R284R8204Reb90Rd317Re354Rc5f5Rc4396Ve1&cost=0.001236819&zone=8999102-1356418374-4269441498&campaign=418400220

MITRE ATT&CK Enterprise v15

Tasks