Analysis
-
max time kernel
81s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
24/02/2025, 12:06
Behavioral task
behavioral1
Sample
7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe
Resource
win7-20240903-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe
Resource
win10v2004-20250217-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe
-
Size
543KB
-
MD5
998022b70d83c6de68e5bdf94e0f8d71
-
SHA1
b87a947f3e85701fcdadd733e9b055a65a3b1308
-
SHA256
7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a
-
SHA512
2744b77f951bd2bb34b094dd3b54fcf8f7dca76e03c745809edc045749c814c7d88c9ddd69ad684a1c156716afae76b5ebec3f932d0f2a72b242878134f65647
-
SSDEEP
12288:M1DTMHixr1moQqUiXINDl/m1s6BQio67VlA:AzmoQqUiXw2s6yiVx
Malware Config
Extracted
Path
C:\Program Files (x86)\readme.txt
Ransom Note
Your data are stolen and encrypted
The data will be published on TOR website if you do not pay the ransom
You can contact us and decrypt one file for free on this TOR site
(you should download and install TOR browser first https://torproject.org)
https://aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion:80/
Your company id for log in: ba7a7058-3531-4b67-bae6-d602e9110361
URLs
https://aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion:80/
Signatures
-
Black Basta
A ransomware family targeting Windows and Linux ESXi first seen in February 2022.
-
Blackbasta family
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (2483) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dlaksjdoiwq.jpg" 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\RegisterCompare.ppt 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Internet Explorer\it-IT\iexplore.exe.mui 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\deploy.dll 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-pl.xrm-ms 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-ul-phn.xrm-ms 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-pl.xrm-ms 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\PopHide.vsw 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File created C:\Program Files\Common Files\microsoft shared\ink\pl-PL\readme.txt 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-heap-l1-1-0.dll 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-ppd.xrm-ms 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONBttnWD.dll 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Res.dll 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\vstoee.dll 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcr120.dll 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-ppd.xrm-ms 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ppd.xrm-ms 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-ppd.xrm-ms 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-ul-phn.xrm-ms 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-pl.xrm-ms 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File created C:\Program Files\VideoLAN\VLC\plugins\meta_engine\readme.txt 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\osm.x-none.msi.16.x-none.tree.dat 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-file-l2-1-0.dll 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\readme.txt 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-ppd.xrm-ms 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MYSL.ICO 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File created C:\Program Files\VideoLAN\VLC\locale\bg\readme.txt 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File created C:\Program Files\VideoLAN\VLC\locale\et\readme.txt 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\Microsoft Office\root\vreg\office32ww.msi.16.x-none.vreg.dat 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\readme.txt 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\Microsoft Office\root\vreg\onenotemui.msi.16.en-us.vreg.dat 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\readme.txt 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.16.xml 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\edge_feedback\readme.txt 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File created C:\Program Files (x86)\Microsoft.NET\RedistList\readme.txt 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\7-Zip\Lang\fi.txt 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-ul-oob.xrm-ms 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-ul-phn.xrm-ms 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Trial-ul-oob.xrm-ms 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File created C:\Program Files\VideoLAN\VLC\locale\eu\readme.txt 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-ppd.xrm-ms 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_KMS_Client_AE-ul.xrm-ms 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTrial-ul-oob.xrm-ms 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File created C:\Program Files\VideoLAN\VLC\locale\sr\readme.txt 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-localization-l1-2-0.dll 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Trial-ul-oob.xrm-ms 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremDemoR_BypassTrial365-ul-oob.xrm-ms 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-ppd.xrm-ms 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-pl.xrm-ms 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Grace-ppd.xrm-ms 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ul-oob.xrm-ms 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\CopyClear.html 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File created C:\Program Files\Common Files\System\Ole DB\ja-JP\readme.txt 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\j2gss.dll 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription4-ul-oob.xrm-ms 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excel-udf-host.win32.bundle 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1656 vssadmin.exe -
Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.basta\DefaultIcon 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.basta 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.basta\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fkdjsadasd.ico" 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 1512 vssvc.exe Token: SeRestorePrivilege 1512 vssvc.exe Token: SeAuditPrivilege 1512 vssvc.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1840 wrote to memory of 1976 1840 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe 85 PID 1840 wrote to memory of 1976 1840 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe 85 PID 1840 wrote to memory of 1976 1840 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe 85 PID 1976 wrote to memory of 1656 1976 cmd.exe 87 PID 1976 wrote to memory of 1656 1976 cmd.exe 87 PID 1840 wrote to memory of 3000 1840 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe 90 PID 1840 wrote to memory of 3000 1840 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe 90 PID 1840 wrote to memory of 3000 1840 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe 90 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe"C:\Users\Admin\AppData\Local\Temp\7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.exe"1⤵
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\system32\vssadmin.exeC:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1656
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\System32\vssadmin.exe delete shadows /all /quiet2⤵
- System Location Discovery: System Language Discovery
PID:3000
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1512
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
401B
MD5ab8018847c007394feabfa8f14626ebc
SHA1d4669c9e29be5e1f32d7c30bf65ec8bd72566b2f
SHA2562967e1d97d32605fc5ace49a10828800fbbefcc1e010f6004a9c88ef3ecdad88
SHA5120f893ccd2add411ed93cade6519f9d2faf22831c60c279f355355406b72d92670a33b6b04362becb2344f3ff0b6ff979d9c078b24628c9de65cd421cf43402b9