Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

file.exe

windows7-x64

10

file.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    file

  • Size

    885KB

  • Sample

    250205-vgxdlsxmhk

  • MD5

    80ab6a4d16c8137308dea1dc7922bd47

  • SHA1

    796531afd0e828f451786c485f95c4c04084f461

  • SHA256

    3337a7a9ccdd06acdd6e3cf4af40d871172d0a0e96fc48787b574ac93689622a

  • SHA512

    4ccdf3049a7e4de8c63d5c37602eecdc97e727022c4b2bf0a582ab4aae9ee7e42f24b339cd46eb820baea5593fe19ef0806246f0dd3f8bc1560423fe512f6485

  • SSDEEP

    24576:TP3urAYzBZm8R6pMQig/6203QAxUET69nkyjGjR:TPjYzq8R6pMQig/6203VxUEuhzGjR

Score
10/10
blackbastadefense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\Program Files\instructions_read_me.txt

Family

blackbasta

Ransom Note
ATTENTION! Your network has been breached and all data was encrypted. Please contact us at: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ Login ID: 29b5e50f-69a3-48f0-9648-450b2cbfaab4 *!* To access .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us) *!* To restore all your PCs and get your network working again, follow these instructions: - Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency. Please follow these simple rules to avoid data corruption: - Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - Do not hire a recovery company. They can't decrypt without the key. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. So speak for yourself. Waiting you in a chat.
URLs

https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/

Targets

    • Target

      file

    • Size

      885KB

    • MD5

      80ab6a4d16c8137308dea1dc7922bd47

    • SHA1

      796531afd0e828f451786c485f95c4c04084f461

    • SHA256

      3337a7a9ccdd06acdd6e3cf4af40d871172d0a0e96fc48787b574ac93689622a

    • SHA512

      4ccdf3049a7e4de8c63d5c37602eecdc97e727022c4b2bf0a582ab4aae9ee7e42f24b339cd46eb820baea5593fe19ef0806246f0dd3f8bc1560423fe512f6485

    • SSDEEP

      24576:TP3urAYzBZm8R6pMQig/6203QAxUET69nkyjGjR:TPjYzq8R6pMQig/6203VxUEuhzGjR

    Score
    10/10
    blackbastadefense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealer

    • Black Basta

      A ransomware family targeting Windows and Linux ESXi first seen in February 2022.

      ransomwareblackbasta

    • Blackbasta family

      blackbasta

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks