Analysis
- max time kernel
149s - max time network
156s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
24/05/2026, 01:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
sub_9a55f5588628.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
sub_9a55f5588628.exe
Resource
win11-20260513-en
windows11-21h2-x64
12 signatures
150 seconds
General
- Target sub_9a55f5588628.exe
- Size 542KB
- Sample260524-b3dzlsd14m
- SHA256 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc
- MD5 c115bbbdb1a61f8c553d74802bfd78fb
- SHA1 1f439569e3c1c14ea9f02235f8f45c49e2764160
- SHA512 6ad701415ce5e1f94144a979f7e347499ecd80e4de4705dbe9570ad53a90b58034ea98f2ec9d257a330ec47ffeacdbd420f581ad8a4d76b0c7ad4bb198b1ab84
- SSDEEP 12288:trkm8R9qXgmj3d7khtgfpedbKbiTuDZWhswtik5j2w+f:2Ujt7+twpedbKb1dWhse9K
- TLSH T13DC47D217491C07AD67243F14DACDB9135BEEC300F621ACBE3C45A6D177C9E16A329BA
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Path
-
C:\Recovery\readme.txt
Ransom Note
- Your data are stolen and encrypted The data will be published on TOR website if you do not pay the ransom You can contact us and decrypt one file for free on this TOR site (you should download and install TOR browser first https://torproject.org) https://aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion/ Your company id for log in: 5c33d3df-a9bf-4899-a852-b2d2ce9944ec
URLs
-
https://aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion/
Signatures
- Family: Black Basta
A ransomware family targeting Windows and Linux ESXi first seen in February 2022.
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Renames multiple (4609) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
- Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dlaksjdoiwq.jpg" sub_9a55f5588628.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONBttnWD.dll sub_9a55f5588628.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe sub_9a55f5588628.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\cmm\sRGB.pf sub_9a55f5588628.exe File created C:\Program Files\VideoLAN\VLC\locale\sw\LC_MESSAGES\readme.txt sub_9a55f5588628.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-180.png sub_9a55f5588628.exe File created C:\Program Files\VideoLAN\VLC\locale\zh_CN\LC_MESSAGES\readme.txt sub_9a55f5588628.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe sub_9a55f5588628.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ul-oob.xrm-ms sub_9a55f5588628.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\msedgeupdateres_sr-Cyrl-RS.dll sub_9a55f5588628.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\JAWTAccessBridge-64.dll sub_9a55f5588628.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\security\trusted.libraries sub_9a55f5588628.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-140.png sub_9a55f5588628.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OutlookAutoDiscover\PRODIGY.NET.XML sub_9a55f5588628.exe File opened for modification C:\Program Files\7-Zip\7-zip.chm sub_9a55f5588628.exe File created C:\Program Files (x86)\Common Files\Adobe\Acrobat\readme.txt sub_9a55f5588628.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice-install.log sub_9a55f5588628.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription4-ul-oob.xrm-ms sub_9a55f5588628.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Trial-pl.xrm-ms sub_9a55f5588628.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MEDIA\WHOOSH.WAV sub_9a55f5588628.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-ppd.xrm-ms sub_9a55f5588628.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\mscss7wre_es.dub sub_9a55f5588628.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONBttnIE.dll sub_9a55f5588628.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\msedgeupdateres_nl.dll sub_9a55f5588628.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.Linq.dll sub_9a55f5588628.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-100.png sub_9a55f5588628.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OneNote\SendToOneNote.gpd sub_9a55f5588628.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OutlookAutoDiscover\YAHOO.COM.CN.XML sub_9a55f5588628.exe File opened for modification C:\Program Files\7-Zip\7zCon.sfx sub_9a55f5588628.exe File created C:\Program Files\Microsoft Office\root\vreg\readme.txt sub_9a55f5588628.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml sub_9a55f5588628.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial-ppd.xrm-ms sub_9a55f5588628.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-ppd.xrm-ms sub_9a55f5588628.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-ppd.xrm-ms sub_9a55f5588628.exe File opened for modification C:\Program Files\Microsoft Office\root\Stationery\1033\PINELUMB.HTM sub_9a55f5588628.exe File created C:\Program Files\Microsoft Office\root\readme.txt sub_9a55f5588628.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lt-lt.dll sub_9a55f5588628.exe File created C:\Program Files\Microsoft Office\root\Office16\FORMS\readme.txt sub_9a55f5588628.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.Xml.dll sub_9a55f5588628.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN002.XML sub_9a55f5588628.exe File opened for modification C:\Program Files\7-Zip\7z.sfx sub_9a55f5588628.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\readme.txt sub_9a55f5588628.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Grace-ul-oob.xrm-ms sub_9a55f5588628.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\OutlookMeetingReqReadNaiveBayesCommandRanker.txt sub_9a55f5588628.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\OutlookLogoSmall.scale-180.png sub_9a55f5588628.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\jdk\asm.md sub_9a55f5588628.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_COL.HXC sub_9a55f5588628.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\readme.txt sub_9a55f5588628.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTest-ppd.xrm-ms sub_9a55f5588628.exe File created C:\Program Files\VideoLAN\VLC\locale\oc\readme.txt sub_9a55f5588628.exe File created C:\Program Files\VideoLAN\VLC\plugins\stream_out\readme.txt sub_9a55f5588628.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\hu-HU\tipresx.dll.mui sub_9a55f5588628.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\msinfo32.exe.mui sub_9a55f5588628.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\dtplugin\npdeployJava1.dll sub_9a55f5588628.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\sk\readme.txt sub_9a55f5588628.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javafx_iio.dll sub_9a55f5588628.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ppd.xrm-ms sub_9a55f5588628.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ppd.xrm-ms sub_9a55f5588628.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml sub_9a55f5588628.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-80.png sub_9a55f5588628.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN075.XML sub_9a55f5588628.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\Presentation Designs\Maple.gif sub_9a55f5588628.exe File opened for modification C:\Program Files\Java\jdk-1.8\lib\javafx-mx.jar sub_9a55f5588628.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ppd.xrm-ms sub_9a55f5588628.exe File created C:\Program Files\VideoLAN\VLC\plugins\control\readme.txt sub_9a55f5588628.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sub_9a55f5588628.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 3720 vssadmin.exe - Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.basta\DefaultIcon sub_9a55f5588628.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.basta sub_9a55f5588628.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.basta\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fkdjsadasd.ico" sub_9a55f5588628.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 4408 vssvc.exe Token: SeRestorePrivilege 4408 vssvc.exe Token: SeAuditPrivilege 4408 vssvc.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2404 wrote to memory of 3804 2404 sub_9a55f5588628.exe 83 PID 3804 wrote to memory of 3720 3804 cmd.exe 85 PID 2404 wrote to memory of 1044 2404 sub_9a55f5588628.exe 88 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\sub_9a55f5588628.exe"C:\Users\Admin\AppData\Local\Temp\sub_9a55f5588628.exe"1⤵
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Windows\system32\vssadmin.exeC:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:3720
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\System32\vssadmin.exe delete shadows /all /quiet2⤵
- System Location Discovery: System Language Discovery
PID:1044
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4408
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Recovery\readme.txt
- Size 395B
- SHA256 5c7f7d725ae586b8914eb7e4514a6a52189ca3dc32af6be20d5a404e3f7ff298
- MD5 b4a2e3e446d794ab467364956096c047
- SHA1 7b520a2b0b954a03ffd7fae189f933c94784f1c2
- SHA512 6f7d06b4b8a724372b5e3e6bf0881024bbc7a20a4d7c8b6a588ee65708b2c10a9d1862ae09102aa13eb02f089a1b8152ef87576bc14a953ac004c325594118c1
- TLSH T174E0F1CF775E441F8F943DC2634B7580E3531219B1720310BE90518813100F611621CB
- MD5 SHA1 SHA512 TLSH