Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
24/01/2025, 20:35
Static task
static1
Behavioral task
behavioral1
Sample
ENCRYPT_C_VISIBLEENTRY.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
ENCRYPT_C_VISIBLEENTRY.exe
Resource
win10v2004-20241007-en
General
-
Target
ENCRYPT_C_VISIBLEENTRY.exe
-
Size
391KB
-
MD5
4be7c8cdc4eb344bc3bce1e9d2bf4b6d
-
SHA1
5c18b5a920917420dfba267853769ce0e11ef57f
-
SHA256
6aabcc25ae4ca7804b2f70fdf4b9fd17ca8cfd70bb0c9903a8d537570ebb9405
-
SHA512
46492322b2392ab8ce9bde3f8ad62bd95e62de1d8c0a0c284ef58334a2e3e7a38ad193c2f69a0f6a5d769d12f6bc9fe815cb9699aa256dd474836c8d8bd7395c
-
SSDEEP
12288:SUyh8ETAbg65kkZ7oZXu6PWHzXzroCvczjCo:3dDbgerajCo
Malware Config
Extracted
C:\Program Files\instructions_read_me.txt
blackbasta
https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Signatures
-
Black Basta
A ransomware family targeting Windows and Linux ESXi first seen in February 2022.
-
Blackbasta family
-
Renames multiple (9485) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI ENCRYPT_C_VISIBLEENTRY.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\33.png ENCRYPT_C_VISIBLEENTRY.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.common_3.6.200.v20130402-1505.jar ENCRYPT_C_VISIBLEENTRY.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Port_Moresby ENCRYPT_C_VISIBLEENTRY.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Slate\TAB_OFF.GIF ENCRYPT_C_VISIBLEENTRY.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\icon.png ENCRYPT_C_VISIBLEENTRY.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Port_Moresby ENCRYPT_C_VISIBLEENTRY.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME43.CSS ENCRYPT_C_VISIBLEENTRY.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\OutlineToolIconImagesMask.bmp ENCRYPT_C_VISIBLEENTRY.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0151061.WMF ENCRYPT_C_VISIBLEENTRY.exe File opened for modification C:\Program Files (x86)\Common Files\System\msadc\es-ES\msadcor.dll.mui ENCRYPT_C_VISIBLEENTRY.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsptb.xml ENCRYPT_C_VISIBLEENTRY.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\IPSEventLogMsg.dll.mui ENCRYPT_C_VISIBLEENTRY.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_box_left.png ENCRYPT_C_VISIBLEENTRY.exe File created C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\instructions_read_me.txt ENCRYPT_C_VISIBLEENTRY.exe File opened for modification C:\Program Files\Windows Photo Viewer\de-DE\PhotoAcq.dll.mui ENCRYPT_C_VISIBLEENTRY.exe File opened for modification C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\Microsoft.Synchronization.dll ENCRYPT_C_VISIBLEENTRY.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\js\instructions_read_me.txt ENCRYPT_C_VISIBLEENTRY.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\IMAGE.JPG ENCRYPT_C_VISIBLEENTRY.exe File opened for modification C:\Program Files\Windows Media Player\en-US\wmpnssci.dll.mui ENCRYPT_C_VISIBLEENTRY.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02126_.WMF ENCRYPT_C_VISIBLEENTRY.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR25F.GIF ENCRYPT_C_VISIBLEENTRY.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\WebToolImages16x16.jpg ENCRYPT_C_VISIBLEENTRY.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STUDIO\PREVIEW.GIF ENCRYPT_C_VISIBLEENTRY.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\gadget.xml ENCRYPT_C_VISIBLEENTRY.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\STS2\background.gif ENCRYPT_C_VISIBLEENTRY.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\symbase.xml ENCRYPT_C_VISIBLEENTRY.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-annotations-common_zh_CN.jar ENCRYPT_C_VISIBLEENTRY.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGREPFRM.XML ENCRYPT_C_VISIBLEENTRY.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationRight_SelectionSubpicture.png ENCRYPT_C_VISIBLEENTRY.exe File created C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\1033\instructions_read_me.txt ENCRYPT_C_VISIBLEENTRY.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN04332_.WMF ENCRYPT_C_VISIBLEENTRY.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02041_.WMF ENCRYPT_C_VISIBLEENTRY.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GRINTL32.DLL.IDX_DLL ENCRYPT_C_VISIBLEENTRY.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\TRANSMGR.DLL ENCRYPT_C_VISIBLEENTRY.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\RTF_BOLD.GIF ENCRYPT_C_VISIBLEENTRY.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Pohnpei ENCRYPT_C_VISIBLEENTRY.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\settings.html ENCRYPT_C_VISIBLEENTRY.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\vlc.mo ENCRYPT_C_VISIBLEENTRY.exe File opened for modification C:\Program Files (x86)\Common Files\System\ado\msado21.tlb ENCRYPT_C_VISIBLEENTRY.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\instructions_read_me.txt ENCRYPT_C_VISIBLEENTRY.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PROFILE\PROFILE.ELM ENCRYPT_C_VISIBLEENTRY.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll ENCRYPT_C_VISIBLEENTRY.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-profiler.xml ENCRYPT_C_VISIBLEENTRY.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-uisupport_ja.jar ENCRYPT_C_VISIBLEENTRY.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_gray_foggy.png ENCRYPT_C_VISIBLEENTRY.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.services_1.1.0.v20140328-1925.jar ENCRYPT_C_VISIBLEENTRY.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\TALK21.COM.XML ENCRYPT_C_VISIBLEENTRY.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\SystemV\MST7 ENCRYPT_C_VISIBLEENTRY.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\NPAUTHZ.DLL ENCRYPT_C_VISIBLEENTRY.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0213243.WMF ENCRYPT_C_VISIBLEENTRY.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01299_.GIF ENCRYPT_C_VISIBLEENTRY.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD07804_.WMF ENCRYPT_C_VISIBLEENTRY.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152716.WMF ENCRYPT_C_VISIBLEENTRY.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\instructions_read_me.txt ENCRYPT_C_VISIBLEENTRY.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\instructions_read_me.txt ENCRYPT_C_VISIBLEENTRY.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\core_visualvm.jar ENCRYPT_C_VISIBLEENTRY.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_box_bottom.png ENCRYPT_C_VISIBLEENTRY.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0282126.WMF ENCRYPT_C_VISIBLEENTRY.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02028_.WMF ENCRYPT_C_VISIBLEENTRY.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\OriginReport.Dotx ENCRYPT_C_VISIBLEENTRY.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-outline_zh_CN.jar ENCRYPT_C_VISIBLEENTRY.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-selector-api.xml ENCRYPT_C_VISIBLEENTRY.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\shuffle_up.png ENCRYPT_C_VISIBLEENTRY.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\WhiteDot.png ENCRYPT_C_VISIBLEENTRY.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ENCRYPT_C_VISIBLEENTRY.exe -
Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.dnvp3n30n\DefaultIcon ENCRYPT_C_VISIBLEENTRY.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.dnvp3n30n ENCRYPT_C_VISIBLEENTRY.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.dnvp3n30n\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fkdjsadasd.ico" ENCRYPT_C_VISIBLEENTRY.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD583d5be091b05aaa39eee00429dbb0c8b
SHA1c31ebdaf3d8522e9053ca12e04cc4af783c450ca
SHA25672317b27324006c389c928d2575beb77c18b3f0a61343040dddc6f3c7edfa195
SHA512c411d4266951553f9bbb9803b0e13334381eca18381ec5412e23ffed2c3a1b8c73f3fed6ca43e580b3cb9da94c6eeb6ec76cc12cfff546062fa490f0bd712285