Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
27s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system -
submitted
05/02/2025, 16:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240903-en
windows7-x64
21 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20250129-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
file.exe
-
Size
545KB
-
MD5
6a202e9a95f58938d02385e31d43ed87
-
SHA1
53628c7a155ccb7af1135140083939018d3587f1
-
SHA256
15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4
-
SHA512
c6684838b84499dc97c75f33c1d3be29c654b90d2f0293c33af6a986facc8a673275a0f33a82f43aa1a8e67684b07092e462b1e2c309450a9ec0486ec7b4a7d1
-
SSDEEP
12288:tM9fIMGezCq1kWOgb/VPFAQxSNJ4krheZfIVWRkn8oXdd6:hbq1kWJb9PFAQxgJheZfY8gdI
Malware Config
Extracted
Path
C:\Recovery\readme.txt
Ransom Note
Your data are stolen and encrypted
The data will be published on TOR website if you do not pay the ransom
You can contact us and decrypt one file for free on this TOR site
(you should download and install TOR browser first https://torproject.org)
https://aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion/
Your company id for log in: ea3d3d33-1635-47f7-a1a4-0078267b30bb
URLs
https://aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion/
Signatures
-
Black Basta
A ransomware family targeting Windows and Linux ESXi first seen in February 2022.
-
Blackbasta family
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (1727) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dlaksjdoiwq.jpg" file.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Lang\ast.txt file.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\readme.txt file.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe file.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ppd.xrm-ms file.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ppd.xrm-ms file.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\readme.txt file.exe File opened for modification C:\Program Files\Mozilla Firefox\vcruntime140_1.dll file.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Trial-pl.xrm-ms file.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial2-ul-oob.xrm-ms file.exe File opened for modification C:\Program Files\7-Zip\Lang\sa.txt file.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.common.16.xml file.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-pl.xrm-ms file.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-tw.txt file.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\offreg.dll file.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTest-pl.xrm-ms file.exe File opened for modification C:\Program Files\Internet Explorer\images\bing.ico file.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-pl.xrm-ms file.exe File created C:\Program Files\Common Files\microsoft shared\ink\zh-CN\readme.txt file.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-convert-l1-1-0.dll file.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\resource.dll file.exe File opened for modification C:\Program Files\Microsoft Office\root\fre\StartMenu_Win7.wmv file.exe File opened for modification C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME.txt file.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.log file.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-ul-phn.xrm-ms file.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-ppd.xrm-ms file.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-pl.xrm-ms file.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ul-phn.xrm-ms file.exe File opened for modification C:\Program Files\SendSelect.svgz file.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc file.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll file.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\verify.dll file.exe File opened for modification C:\Program Files\Mozilla Firefox\defaultagent.ini file.exe File opened for modification C:\Program Files\7-Zip\Lang\be.txt file.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-ul-oob.xrm-ms file.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mshwjpnr.dll file.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTrial-pl.xrm-ms file.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-ppd.xrm-ms file.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-ul-oob.xrm-ms file.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\SPPRedist.msi file.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-ul-oob.xrm-ms file.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Grace-ul-oob.xrm-ms file.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription4-ul-oob.xrm-ms file.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ppd.xrm-ms file.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-pl.xrm-ms file.exe File opened for modification C:\Program Files\SyncPop.eprtx file.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\readme.txt file.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe file.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ul-oob.xrm-ms file.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-ppd.xrm-ms file.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ul-phn.xrm-ms file.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_Subscription-ul-oob.xrm-ms file.exe File opened for modification C:\Program Files\Mozilla Firefox\mozglue.dll file.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\JAWTAccessBridge-64.dll file.exe File created C:\Program Files\Microsoft Office\root\Client\AppvIsvSubsystems64.dll\readme.txt file.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.office32ww.msi.16.x-none.xml file.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Grace-ul-oob.xrm-ms file.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms file.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial-ppd.xrm-ms file.exe File created C:\Program Files\Microsoft Office\root\fre\readme.txt file.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mshwLatin.dll file.exe File created C:\Program Files\Common Files\microsoft shared\ink\nb-NO\readme.txt file.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\msvcp140_1.dll file.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ppd.xrm-ms file.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-ppd.xrm-ms file.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 3320 vssadmin.exe -
Modifies registry class 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.basta\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fkdjsadasd.ico" file.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.basta\DefaultIcon file.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.basta file.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 5064 vssvc.exe Token: SeRestorePrivilege 5064 vssvc.exe Token: SeAuditPrivilege 5064 vssvc.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2184 wrote to memory of 4056 2184 file.exe 84 PID 2184 wrote to memory of 4056 2184 file.exe 84 PID 2184 wrote to memory of 4056 2184 file.exe 84 PID 4056 wrote to memory of 3320 4056 cmd.exe 86 PID 4056 wrote to memory of 3320 4056 cmd.exe 86 PID 2184 wrote to memory of 3208 2184 file.exe 90 PID 2184 wrote to memory of 3208 2184 file.exe 90 PID 2184 wrote to memory of 3208 2184 file.exe 90 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Windows\system32\vssadmin.exeC:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:3320
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\System32\vssadmin.exe delete shadows /all /quiet2⤵
- System Location Discovery: System Language Discovery
PID:3208
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5064
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
394B
MD50394335bf42f1f1a1a730ec7eec45b73
SHA1f1d6f7decd3120826b870479f45501acd979df47
SHA256677ddbeefb459f03432a0d2d24f13f0dcec1289722639fb34849aa41a4bac620
SHA512ea61fcecab48e463b2737c35247b30d03e626f3db9bccdce200b818bf52b6c3a32707b4356fbd6ff915b69cac2b5829d44a3f9fa31357dc5cb9ee5381636ddd3