blackbasta | 15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4

Analysis

max time kernel
141s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05-02-2025 16:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

545KB
MD5

6a202e9a95f58938d02385e31d43ed87
SHA1

53628c7a155ccb7af1135140083939018d3587f1
SHA256

15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4
SHA512

c6684838b84499dc97c75f33c1d3be29c654b90d2f0293c33af6a986facc8a673275a0f33a82f43aa1a8e67684b07092e462b1e2c309450a9ec0486ec7b4a7d1
SSDEEP

12288:tM9fIMGezCq1kWOgb/VPFAQxSNJ4krheZfIVWRkn8oXdd6:hbq1kWJb9PFAQxgJheZfY8gdI

Score

10^/10

blackbasta credential_access defense_evasion discovery execution impact ransomware spyware stealer

Malware Config

Extracted

Path

C:\ProgramData\readme.txt

Ransom Note

Your data are stolen and encrypted The data will be published on TOR website if you do not pay the ransom You can contact us and decrypt one file for free on this TOR site (you should download and install TOR browser first https://torproject.org) https://aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion/ Your company id for log in: ea3d3d33-1635-47f7-a1a4-0078267b30bb

URLs

https://aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion/

Signatures

Black Basta
A ransomware family targeting Windows and Linux ESXi first seen in February 2022.
ransomware blackbasta
Blackbasta family
blackbasta
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (9760) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\readme.txt	file.exe

Loads dropped DLL 8 IoCs

pid	Process
3116	MsiExec.exe
3116	MsiExec.exe
3116	MsiExec.exe
3116	MsiExec.exe
3116	MsiExec.exe
3116	MsiExec.exe
3116	MsiExec.exe
3132	MsiExec.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI	file.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dlaksjdoiwq.jpg"	file.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Metro.eftx	file.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR51B.GIF	file.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Xml.Linq.Resources.dll	file.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+4	file.exe
File created	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\readme.txt	file.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\tipresx.dll.mui	file.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PROFILE\THMBNAIL.PNG	file.exe
File created	C:\Program Files (x86)\Common Files\System\ado\en-US\readme.txt	file.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\decorative_rule.png	file.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\libhttp_plugin.dll	file.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libcaf_plugin.dll	file.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21366_.GIF	file.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-text.xml	file.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libt140_plugin.dll	file.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\REPORT.CFG	file.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SHARING.CFG	file.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\sunjce_provider.jar	file.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Recife	file.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Pacific\Kosrae	file.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.Speech.resources.dll	file.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\DESIGNER.ONE	file.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GreenTea.css	file.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HM00005_.WMF	file.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME46.CSS	file.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh88	file.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\acro20.lng	file.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ja\readme.txt	file.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd.otf	file.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.win32.x86_64.nl_ja_4.4.0.v20140623020002.jar	file.exe
File created	C:\Program Files\MSBuild\Microsoft\readme.txt	file.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\TASK.CFG	file.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Help\readme.txt	file.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ka\readme.txt	file.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01167_.WMF	file.exe
File created	C:\Program Files\Internet Explorer\it-IT\readme.txt	file.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00799_.WMF	file.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14833_.GIF	file.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui_5.5.0.165303.jar	file.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\readme.txt	file.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MSPST32.DLL	file.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\msinfo32.exe	file.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01354_.WMF	file.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\libbluray-j2se-1.3.2.jar	file.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libx265_plugin.dll	file.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_a52_plugin.dll	file.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.commands.nl_zh_4.4.0.v20140623020002.jar	file.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\TAB_ON.GIF	file.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\authplay.dll	file.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00478_.WMF	file.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00423_.WMF	file.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_distributed.gif	file.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EVRGREEN\EVRGREEN.INF	file.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\MSMAPI\1033\MSMAPI32.DLL	file.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-8	file.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler-charts.xml	file.exe
File created	C:\Program Files (x86)\Common Files\System\Ole DB\de-DE\readme.txt	file.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00158_.GIF	file.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099172.WMF	file.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\AMERITECH.NET.XML	file.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\README.TXT	file.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Pacific\Guam	file.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\UIAutomationClientsideProviders.resources.dll	file.exe
File created	C:\Program Files\Microsoft Games\Chess\ja-JP\readme.txt	file.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OCRVC.DAT	file.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI5E8A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6178.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8BC4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAD50.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3C39.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5B1F.tmp	msiexec.exe
File created	C:\Windows\Installer\f7755b1.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5F17.tmp	msiexec.exe
File created	C:\Windows\Installer\f7755ae.mst	msiexec.exe
File opened for modification	C:\Windows\Installer\f7755ae.mst	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7B48.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC6CA.tmp	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Interacts with shadow copies 3 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
2392	vssadmin.exe
2432	vssadmin.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\DefaultIcon	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\shell\open	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\shell\edit\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.basta\DefaultIcon	file.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.basta	file.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.basta\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fkdjsadasd.ico"	file.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\ShellEx\IconHandler	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\ShellEx	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\shell\open\command	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\shell\edit	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
676	msiexec.exe
676	msiexec.exe

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeBackupPrivilege	2060	vssvc.exe
Token: SeRestorePrivilege	2060	vssvc.exe
Token: SeAuditPrivilege	2060	vssvc.exe
Token: SeRestorePrivilege	676	msiexec.exe
Token: SeTakeOwnershipPrivilege	676	msiexec.exe
Token: SeSecurityPrivilege	676	msiexec.exe
Token: SeRestorePrivilege	676	msiexec.exe
Token: SeTakeOwnershipPrivilege	676	msiexec.exe
Token: SeRestorePrivilege	676	msiexec.exe
Token: SeTakeOwnershipPrivilege	676	msiexec.exe
Token: SeRestorePrivilege	676	msiexec.exe
Token: SeTakeOwnershipPrivilege	676	msiexec.exe
Token: SeRestorePrivilege	676	msiexec.exe
Token: SeTakeOwnershipPrivilege	676	msiexec.exe
Token: SeRestorePrivilege	676	msiexec.exe
Token: SeTakeOwnershipPrivilege	676	msiexec.exe
Token: SeRestorePrivilege	676	msiexec.exe
Token: SeTakeOwnershipPrivilege	676	msiexec.exe
Token: SeRestorePrivilege	676	msiexec.exe
Token: SeTakeOwnershipPrivilege	676	msiexec.exe
Token: SeRestorePrivilege	676	msiexec.exe
Token: SeTakeOwnershipPrivilege	676	msiexec.exe
Token: SeRestorePrivilege	676	msiexec.exe
Token: SeTakeOwnershipPrivilege	676	msiexec.exe
Token: SeRestorePrivilege	676	msiexec.exe
Token: SeTakeOwnershipPrivilege	676	msiexec.exe
Token: SeRestorePrivilege	676	msiexec.exe
Token: SeTakeOwnershipPrivilege	676	msiexec.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 768 wrote to memory of 2008	768	file.exe	31
PID 768 wrote to memory of 2008	768	file.exe	31
PID 768 wrote to memory of 2008	768	file.exe	31
PID 768 wrote to memory of 2008	768	file.exe	31
PID 2008 wrote to memory of 2392	2008	cmd.exe	33
PID 2008 wrote to memory of 2392	2008	cmd.exe	33
PID 2008 wrote to memory of 2392	2008	cmd.exe	33
PID 2008 wrote to memory of 2392	2008	cmd.exe	33
PID 768 wrote to memory of 2892	768	file.exe	36
PID 768 wrote to memory of 2892	768	file.exe	36
PID 768 wrote to memory of 2892	768	file.exe	36
PID 768 wrote to memory of 2892	768	file.exe	36
PID 2892 wrote to memory of 2432	2892	cmd.exe	38
PID 2892 wrote to memory of 2432	2892	cmd.exe	38
PID 2892 wrote to memory of 2432	2892	cmd.exe	38
PID 2892 wrote to memory of 2432	2892	cmd.exe	38
PID 676 wrote to memory of 3116	676	msiexec.exe	43
PID 676 wrote to memory of 3116	676	msiexec.exe	43
PID 676 wrote to memory of 3116	676	msiexec.exe	43
PID 676 wrote to memory of 3116	676	msiexec.exe	43
PID 676 wrote to memory of 3116	676	msiexec.exe	43
PID 676 wrote to memory of 3116	676	msiexec.exe	43
PID 676 wrote to memory of 3116	676	msiexec.exe	43
PID 676 wrote to memory of 3132	676	msiexec.exe	44
PID 676 wrote to memory of 3132	676	msiexec.exe	44
PID 676 wrote to memory of 3132	676	msiexec.exe	44
PID 676 wrote to memory of 3132	676	msiexec.exe	44
PID 676 wrote to memory of 3132	676	msiexec.exe	44

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Drops startup file
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:768
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2008
- - C:\Windows\system32\vssadmin.exe
    C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:2392
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\System32\vssadmin.exe delete shadows /all /quiet
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2892
- - C:\Windows\SysWOW64\vssadmin.exe
    C:\Windows\System32\vssadmin.exe delete shadows /all /quiet
    3⤵
    - System Location Discovery: System Language Discovery
    - Interacts with shadow copies
    PID:2432

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2060

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:676
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding DC81F896DCA0B1D50FCF870ECE812249
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3116
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding 6BA78C27D931AD24DEBBC0E6DBA5B693
  2⤵
  - Loads dropped DLL
  PID:3132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\readme.txt

Filesize
394B

MD5
0394335bf42f1f1a1a730ec7eec45b73

SHA1
f1d6f7decd3120826b870479f45501acd979df47

SHA256
677ddbeefb459f03432a0d2d24f13f0dcec1289722639fb34849aa41a4bac620

SHA512
ea61fcecab48e463b2737c35247b30d03e626f3db9bccdce200b818bf52b6c3a32707b4356fbd6ff915b69cac2b5829d44a3f9fa31357dc5cb9ee5381636ddd3

Download Submit
C:\Users\Public\Music\Sample Music\Kalimba.mp3.basta

Filesize
8.0MB

MD5
5a03e647f6021e1d36052271138ead4c

SHA1
8babf1d9b05a93c12c26d0994e550d933a86b0cc

SHA256
9a4e8ec3c3f3014e37c8f6d6c5aff28c9c8beb33bad197b9453a3d6de0697c42

SHA512
058d483b0c38cb0e4d46a599eb3762050aede15cba56155d00cebfc9c92b07ef74d34015bed8f8f7f13762119c07eb4f56efba13ea90ba38200025ca47d9a8bc

Download Submit
C:\Users\Public\Music\Sample Music\Sleep Away.mp3.basta

Filesize
4.6MB

MD5
0e258c7566b6d64918fecad3c92dec79

SHA1
6b3863981fe2ee491cd59e5e798ada224f89e3a2

SHA256
e67f5c20f3c899986958737014cf36a26442a1490d9050fb78deb31a3963edd9

SHA512
1ab4ad20b4fb159fc2d64ce96467a80df71356ac9259dfbedbd5d3a21f38e18fa30feae4fc1b7dc7d8e7f4c360851f15095633f94a6d8a47e3e831de44c74e3f

Download Submit
C:\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg.basta

Filesize
859KB

MD5
b486d1c74f40b894d353177e103ca971

SHA1
8e2fbc13487a8a704aee090a2d27a2069ececb3e

SHA256
da20fd731c8fa4b341302605878e6c8f647747bcf111adbf981140a0055bab5b

SHA512
38a873f7093e3a508b8dbdc3f2061dacbe71a48cf735479394148a2b88fe29314c85c018a1472176b33164e4452eae4c7e7f9ba94136875e37a150d7c5dee897

Download Submit
C:\Users\Public\Pictures\Sample Pictures\Desert.jpg.basta

Filesize
826KB

MD5
e60b5671616109ce033fe6fb73b0bd93

SHA1
114e4df2c081e34161e341c0126309308e55a567

SHA256
dd22e62f26ebdd563bdce4cebc847c18364d547587f759c7c582ce93a340848f

SHA512
57218315e29c7c0db9b5eec8b2cf77765e2445157e620c384d82ca89722ce68511adc6c42e7619c3174c2dff4d0c19bddc7ed9b56e6160e3daab7f80abf9b20d

Download Submit
C:\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg.basta

Filesize
581KB

MD5
3b27c142d20a5b571430ae7462c1c67f

SHA1
00b4aa09b1dedad75867c6f963117a8e0c211e73

SHA256
3ecb7b24de4b065018c840e47c224836394dbd53748b72f3d08bda8988b36e81

SHA512
4b2171579c3214fe241f789455f328597a4d1ca9b6d32d498589f0790858f629db7bb5d82dcd13afde40eff1517c8b641e03b5c20368d29f6a0321febc020730

Download Submit
C:\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg.basta

Filesize
758KB

MD5
9dd7e06c3f159e4e24fcf98796de4248

SHA1
429271076a77c3c95da5c033173a96f2abb9dc79

SHA256
3b3534fa37b0c7a758b38567946f06cce357c7281a44aad92b6238247b3f577f

SHA512
639c21b46ecb92d83021a080d9e9bdb3909af2f94dab40f2d48ec8ed8e7752cba8695bb186dac7f811a170e87c36b1028e14ed78b6ceb43717cec3eefe31ee6c

Download Submit
C:\Users\Public\Pictures\Sample Pictures\Koala.jpg.basta

Filesize
763KB

MD5
3099b537b5d7c725f7a50abfc97dc536

SHA1
af5ab3d62058d72556942d00967e357b7a44049b

SHA256
f572515d4f0114117733565e72679d71f248d88618ed5e8b09e86584c106a59c

SHA512
c89f1a820593c56d0ff8e0b011d042c318810612a00cbf691c8fbbbfb55d45fb2847182bc9aad019dcbbd7f6f25779d742b92194810aa315f212cdd51bf44bdf

Download Submit
C:\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg.basta

Filesize
548KB

MD5
4a074392138f7d345575b4658c9b35a4

SHA1
6b94d1332ee733a018f2b511d77f219895122586

SHA256
a347a95bcc70efea8e94d015afe2accf888efca3687f15b3bcfede4e5cbffde6

SHA512
a68a6f9c9c25c7a35a7126de6728c55009ee212e769c25cc44bd5225b0e524081de818fe5364be2e5bc0c41e0f27a8681f39e1c682388e62727061a26abcc77c

Download Submit
C:\Users\Public\Pictures\Sample Pictures\Penguins.jpg.basta

Filesize
760KB

MD5
8f21f2eb83c922b2e70493b21e99d4b1

SHA1
d218d8e40fef0c3d8332d090b62f792b5be34063

SHA256
ce9f65be88a78abb7d1fd27ed64be2af01d21c427fea347046b541d6337ec7ea

SHA512
356fa4762f381dfcca2cb41ff1dc9739e29e2d78dc091b3b589125acf6fde7bface7a377c44a6267316f7f10271966abab9cb0dcb60980691a68f22524cd8aa4

Download Submit
C:\Users\Public\Pictures\Sample Pictures\Tulips.jpg.basta

Filesize
606KB

MD5
4afbf4b44db73294c31e6471bd400b51

SHA1
5dac0e95d8fcc856e6a953d369d761b7a20b72a7

SHA256
6eb3cfd8ecfbf857d31077920a5faf298a713b6b2c53a37b6085d91140a5a991

SHA512
72bd9d50bbfdcc2bdff06e221acfbfcbdebe9e6f43d6b7963da43408cab350547a640eaa5dbff506f262ba6fed4e65f3f12504bc98d40dc718fc659984640c37

Download Submit
C:\Users\Public\Videos\Sample Videos\Wildlife.wmv.basta

Filesize
25.0MB

MD5
e6fa12e296327063757a116132892e24

SHA1
b0acd22896c7d0b302bde3f359dc384a6163aa88

SHA256
e84bde15f4aa3157ae72fd10f7663ef303320c0ac72d2b3f5bafa8dd12fcea27

SHA512
d035f2ab85caafbc68fcdeb72f8f1a1c0a26dc39e713db1eda8f163930b6486f6e0a7f0d2e7c041ac3cb53aefda231320755e948e7cb91647a564d65f7178fff

Download Submit
C:\Windows\Installer\MSI8BC4.tmp

Filesize
86KB

MD5
ff58cd07bf4913ef899efd2dfb112553

SHA1
f14c1681de808543071602f17a6299f8b4ba2ae8

SHA256
1afafe9157ff5670bbec8ce622f45d1ce51b3ee77b7348d3a237e232f06c5391

SHA512
23e27444b6cdc17fe56f3a80d6325c2be61ae84213bc7cdaad7bb96daa7e8d2d3defc1b96c3cee4a3f32dc464b0e05720bcf1c0e99626bf83de1b6d5aac000a3

Download Submit
\Windows\Installer\MSI5B1F.tmp

Filesize
28KB

MD5
85221b3bcba8dbe4b4a46581aa49f760

SHA1
746645c92594bfc739f77812d67cfd85f4b92474

SHA256
f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f

SHA512
060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d

Download Submit
\Windows\Installer\MSI5F17.tmp

Filesize
148KB

MD5
33908aa43ac0aaabc06a58d51b1c2cca

SHA1
0a0d1ce3435abe2eed635481bac69e1999031291

SHA256
4447faacefaba8f040822101e2a4103031660de9139e70ecff9aa3a89455a783

SHA512
d5216a53df9cfbe1a78629c103286eb17042f639149c46b6a1cd76498531ae82afd265462fbe0ba9baaff275fc95c66504804f107c449f3fc5833b1ed9c3da46

Download Submit
\Windows\Installer\MSI7B48.tmp

Filesize
257KB

MD5
d1f5ce6b23351677e54a245f46a9f8d2

SHA1
0d5c6749401248284767f16df92b726e727718ca

SHA256
57cb8f01cf553c3886760180d1a74839f2f676640115504485aca9692f577acc

SHA512
960e90894e7bedcc89894e77e57e8ee0c99dd2c530d02665e8bbd3a1793eccc1e295c5923d1f37c757fa1158097fbaae70898c16052882d3d210c29ea801b3ba

Download Submit
\Windows\Installer\MSIAD50.tmp

Filesize
363KB

MD5
4a843a97ae51c310b573a02ffd2a0e8e

SHA1
063fa914ccb07249123c0d5f4595935487635b20

SHA256
727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086

SHA512
905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2

Download Submit