Overview

overview

10

Static

static

3

file.exe

windows7-x64

10

file.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    131s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250129-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-02-2025 16:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    file.exe

  • Size

    885KB

  • MD5

    2f90cd68e4a92c5151c6e43902397a13

  • SHA1

    2084ae47dcdda6161c8697e995512448facba37c

  • SHA256

    acb60f0dd19a9a26aaaefd3326db8c28f546b6b0182ed2dcc23170bcb0af6d8f

  • SHA512

    7bd69feea8c2251fb6ad0edf69cf46ea32c316ac1133af7bd1cc87936c4968bf059dcdc7abaf7241a9b7ff4a6b106ba93a90981a5d9ba5104266628a1e1030fc

  • SSDEEP

    24576:WstUpRlem5dWzsj9c959552tdPsq0EmXMHro:V+YmKzsj9c959552td0q0Eq4ro

Score
10/10
blackbastadefense_evasiondiscoveryexecutionimpactpersistenceransomware

Malware Config

Extracted

Path

C:\Program Files (x86)\instructions_read_me.txt

Family

blackbasta

Ransom Note
ATTENTION! Your network has been breached and all data was encrypted. Please contact us at: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ Login ID: 9064b39a-4d26-4a57-828c-c2e1a49ffc8c *!* To access .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us) *!* To restore all your PCs and get your network working again, follow these instructions: - Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency. Please follow these simple rules to avoid data corruption: - Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - Do not hire a recovery company. They can't decrypt without the key. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. So speak for yourself. Waiting you in a chat.
URLs

https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/

Signatures

  • Black Basta

    A ransomware family targeting Windows and Linux ESXi first seen in February 2022.

    ransomwareblackbasta
  • Blackbasta family
    blackbasta
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Loads dropped DLL 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5024
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4008
      • C:\Windows\system32\vssadmin.exe
        C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet
        3⤵
        • Interacts with shadow copies
        PID:3940
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2376
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1480
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2364

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\instructions_read_me.txt
    Filesize

    1KB

    MD5

    15e24104e437778892cd657b78a3b60b

    SHA1

    80eff05bf1d077b61515f42dceb0b5f7d0151743

    SHA256

    80d676ea1d2fcc8ec7d928a6b7c349a0e324096a5ec23068756509c85f6b3741

    SHA512

    d6639407bcad99ea9e530d644f259ea8c953c9c0fb3e3f625ac7e04f29b4764c304a1c3da07e59c220508fda25fb821ee2b5f4fe970627e8a949e2787fd9577b

    Download Submit

  • C:\Program Files\Microsoft Office\root\Office16\VISSHE.DLL
    Filesize

    279KB

    MD5

    7efcf0111eb7a22aec8410d6a427b328

    SHA1

    d6828e7c4fb2789da55899e69c6197eaf4017b88

    SHA256

    7a83319f41c626818556e406b5b664aa4c102cb851269e9becbe3041bde4368a

    SHA512

    c1526e7bfe3c9f5d9ea9ab0f18d555e01f107ec56123ab83b8677ac24da57e206fb02a0148d2ae08ceba6ec4c10f42a46b0093e2324c0d723f09ec1fd4f43d97

    Download Submit

  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133832483373013055.txt
    Filesize

    74KB

    MD5

    9b3f052c7deb22869c609c80a4927b90

    SHA1

    1048cd0261cad1a901b2b2c12d86a041e0ebe8d4

    SHA256

    9752f9f930a960e13e7022b3f1ad343bf82c0711f49627d90b4cd49b7e256bef

    SHA512

    6037640ba573282c1d3fef67047ed08d5c8988ae5d958ca1e3e3b91b1b8bbdb01092613fa3a19cb4fa53464b450ce25ae881a53ac95e1fd28e7dbf9c288fe221

    Download Submit

  • memory/2364-562-0x0000021542AE0000-0x0000021542B00000-memory.dmp

    Filesize

    128KB

    Download

  • memory/2364-557-0x0000021541B00000-0x0000021541C00000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/2364-609-0x0000021543130000-0x0000021543150000-memory.dmp

    Filesize

    128KB

    Download

  • memory/2364-608-0x0000021542AC0000-0x0000021542AE0000-memory.dmp

    Filesize

    128KB

    Download