Analysis
-
max time kernel
137s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
24/02/2025, 12:06 UTC
Behavioral task
behavioral1
Sample
7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe
Resource
win7-20240903-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe
Resource
win10v2004-20250217-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe
-
Size
543KB
-
MD5
998022b70d83c6de68e5bdf94e0f8d71
-
SHA1
b87a947f3e85701fcdadd733e9b055a65a3b1308
-
SHA256
7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a
-
SHA512
2744b77f951bd2bb34b094dd3b54fcf8f7dca76e03c745809edc045749c814c7d88c9ddd69ad684a1c156716afae76b5ebec3f932d0f2a72b242878134f65647
-
SSDEEP
12288:M1DTMHixr1moQqUiXINDl/m1s6BQio67VlA:AzmoQqUiXw2s6yiVx
Malware Config
Extracted
Path
C:\Program Files\readme.txt
Ransom Note
Your data are stolen and encrypted
The data will be published on TOR website if you do not pay the ransom
You can contact us and decrypt one file for free on this TOR site
(you should download and install TOR browser first https://torproject.org)
https://aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion:80/
Your company id for log in: ba7a7058-3531-4b67-bae6-d602e9110361
URLs
https://aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion:80/
Signatures
-
Black Basta
A ransomware family targeting Windows and Linux ESXi first seen in February 2022.
-
Blackbasta family
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (9569) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\readme.txt 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dlaksjdoiwq.jpg" 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert.css 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Composite.thmx 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01358_.WMF 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\mainimage-mask.png 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.DirectoryServices.AccountManagement.dll 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\7-Zip\Lang\an.txt 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derby.war 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy.jar 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\gui\libskins2_plugin.dll 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.databinding_1.6.200.v20140528-1422.jar 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt.fca 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\7-Zip\Lang\pa-in.txt 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File created C:\Program Files\VideoLAN\VLC\locale\cy\readme.txt 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00068_.WMF 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\PULLQUOTEBB.DPV 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationLeft_SelectionSubpicture.png 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\203x8subpicture.png 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB00673L.GIF 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\1033\OLTASKR.FAE 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL096.XML 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\spu\libremoteosd_plugin.dll 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR5F.GIF 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dushanbe 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_choosecolor.gif 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00142_.GIF 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_notes-txt-background.png 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATERMAR\THMBNAIL.PNG 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Shades of Blue.htm 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00693_.WMF 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107750.WMF 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\tipresx.dll.mui 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR45B.GIF 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR46B.GIF 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.zh_CN_5.5.0.165303.jar 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\am_ET\LC_MESSAGES\vlc.mo 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\it.pak 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-util.xml 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-jmx.xml 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\com-sun-tools-visualvm-modules-startup_zh_CN.jar 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01186_.WMF 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Framework.dll 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.felix.gogo.shell_0.10.0.v201212101605.jar 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\PresentationFramework.resources.dll 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\ja-JP\Mahjong.exe.mui 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105506.WMF 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0286068.WMF 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PSRCHKEY.DAT 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\CalendarToolIconImages.jpg 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\FORMCTL.POC 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\dt_socket.dll 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ARCTIC\PREVIEW.GIF 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMV12\Microsoft.Office.Infopath.dll 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\Microsoft.Build.Engine.resources.dll 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\readme.txt 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_th.dll 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0196354.WMF 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SL01565_.WMF 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0300520.GIF 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME33.CSS 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR00.GIF 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Godthab 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssadmin.exe -
Interacts with shadow copies 3 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2524 vssadmin.exe 2612 vssadmin.exe -
Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.basta 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.basta\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fkdjsadasd.ico" 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.basta\DefaultIcon 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 2580 vssvc.exe Token: SeRestorePrivilege 2580 vssvc.exe Token: SeAuditPrivilege 2580 vssvc.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1920 wrote to memory of 1924 1920 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe 31 PID 1920 wrote to memory of 1924 1920 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe 31 PID 1920 wrote to memory of 1924 1920 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe 31 PID 1920 wrote to memory of 1924 1920 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe 31 PID 1924 wrote to memory of 2524 1924 cmd.exe 33 PID 1924 wrote to memory of 2524 1924 cmd.exe 33 PID 1924 wrote to memory of 2524 1924 cmd.exe 33 PID 1924 wrote to memory of 2524 1924 cmd.exe 33 PID 1920 wrote to memory of 1592 1920 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe 36 PID 1920 wrote to memory of 1592 1920 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe 36 PID 1920 wrote to memory of 1592 1920 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe 36 PID 1920 wrote to memory of 1592 1920 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe 36 PID 1592 wrote to memory of 2612 1592 cmd.exe 38 PID 1592 wrote to memory of 2612 1592 cmd.exe 38 PID 1592 wrote to memory of 2612 1592 cmd.exe 38 PID 1592 wrote to memory of 2612 1592 cmd.exe 38 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe"C:\Users\Admin\AppData\Local\Temp\7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe"1⤵
- Drops startup file
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Windows\system32\vssadmin.exeC:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2524
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\System32\vssadmin.exe delete shadows /all /quiet2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Windows\SysWOW64\vssadmin.exeC:\Windows\System32\vssadmin.exe delete shadows /all /quiet3⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
PID:2612
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2580
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Direct Volume Access
1Indicator Removal
2File Deletion
2Modify Registry
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
401B
MD5ab8018847c007394feabfa8f14626ebc
SHA1d4669c9e29be5e1f32d7c30bf65ec8bd72566b2f
SHA2562967e1d97d32605fc5ace49a10828800fbbefcc1e010f6004a9c88ef3ecdad88
SHA5120f893ccd2add411ed93cade6519f9d2faf22831c60c279f355355406b72d92670a33b6b04362becb2344f3ff0b6ff979d9c078b24628c9de65cd421cf43402b9