Overview
overview
10Static
static
1003309c90e6...69.exe
windows10-2004-x64
1003309c90e6...69.exe
windows11-ltsc_2024-x64
1005072a7ec4...7f.exe
windows10-2004-x64
1005072a7ec4...7f.exe
windows11-ltsc_2024-x64
1007117c02a0...99.dll
windows10-2004-x64
307117c02a0...99.dll
windows11-ltsc_2024-x64
32624a0becf...b5.exe
windows10-2004-x64
102624a0becf...b5.exe
windows11-ltsc_2024-x64
102756b78e9d...21.exe
windows10-2004-x64
102756b78e9d...21.exe
windows11-ltsc_2024-x64
102790fbc25d...cb.exe
windows10-2004-x64
12790fbc25d...cb.exe
windows11-ltsc_2024-x64
13107e64c2b...d8.exe
windows10-2004-x64
103107e64c2b...d8.exe
windows11-ltsc_2024-x64
103123adc3a2...0a.exe
windows10-2004-x64
103123adc3a2...0a.exe
windows11-ltsc_2024-x64
13424a8c9c9...0e.exe
windows10-2004-x64
103424a8c9c9...0e.exe
windows11-ltsc_2024-x64
10Antivirus_...f2.dll
windows10-2004-x64
10Antivirus_...f2.dll
windows11-ltsc_2024-x64
104481b936a2...c4.exe
windows10-2004-x64
104481b936a2...c4.exe
windows11-ltsc_2024-x64
105165cd6115...bc.exe
windows10-2004-x64
105165cd6115...bc.exe
windows11-ltsc_2024-x64
105211ad8427...aa.dll
windows10-2004-x64
105211ad8427...aa.dll
windows11-ltsc_2024-x64
105221cbfcd9...97.exe
windows10-2004-x64
105221cbfcd9...97.exe
windows11-ltsc_2024-x64
75339c1fc00...e2.exe
windows10-2004-x64
105339c1fc00...e2.exe
windows11-ltsc_2024-x64
15458f18e36...fc.exe
windows10-2004-x64
105458f18e36...fc.exe
windows11-ltsc_2024-x64
10Analysis
- max time kernel
150s - max time network
131s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/10/2026, 17:32
Static task
static1
Behavioral task
behavioral1
Sample
03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
05072a7ec455fdf0977f69d49dcaaf012c403c9d39861fa2216eae19c160527f.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
05072a7ec455fdf0977f69d49dcaaf012c403c9d39861fa2216eae19c160527f.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
07117c02a09410f47a326b52c7f17407e63ba5e6ff97277446efc75b862d2799.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
07117c02a09410f47a326b52c7f17407e63ba5e6ff97277446efc75b862d2799.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
2624a0becfcbe1ab95c8ecefb37b74c67eef218502c11b5e6446937c7ba31fb5.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
2624a0becfcbe1ab95c8ecefb37b74c67eef218502c11b5e6446937c7ba31fb5.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral9
Sample
2756b78e9d72257067b63018ed3de4524812c60c72211288698ec78dcfc08921.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
2756b78e9d72257067b63018ed3de4524812c60c72211288698ec78dcfc08921.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral11
Sample
2790fbc25dae73ea4526ea5e39baf5bc9e44947258b05f43a01ec71f118e9bcb.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
2790fbc25dae73ea4526ea5e39baf5bc9e44947258b05f43a01ec71f118e9bcb.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral13
Sample
3107e64c2b546d829cfb6be5abda66534fc08553669126ac31f2ded1c4cd97d8.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
3107e64c2b546d829cfb6be5abda66534fc08553669126ac31f2ded1c4cd97d8.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral15
Sample
3123adc3a214dc483cbc17c9fa4342a549f7dc7d7dd700bd87f48d2831efc50a.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
3123adc3a214dc483cbc17c9fa4342a549f7dc7d7dd700bd87f48d2831efc50a.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral17
Sample
3424a8c9c995896f9d6fe3bb4a164d0d8675a781f9f9c32286a5472ce8e9e50e.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
3424a8c9c995896f9d6fe3bb4a164d0d8675a781f9f9c32286a5472ce8e9e50e.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral19
Sample
Antivirus_Upgrade_Cloud.1d094d24ac37f2.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
Antivirus_Upgrade_Cloud.1d094d24ac37f2.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral21
Sample
4481b936a2246a640be36f9a37a15b4f89b3493f705c7fdb8af7df5445e8bcc4.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
4481b936a2246a640be36f9a37a15b4f89b3493f705c7fdb8af7df5445e8bcc4.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral23
Sample
5165cd61158a14ba2f90c275d29d8271b1f0c5669ebcdc620edd86ee90474dbc.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
5165cd61158a14ba2f90c275d29d8271b1f0c5669ebcdc620edd86ee90474dbc.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral25
Sample
5211ad84270862e68026ce8e6c15c1f8499551e19d2967c349b46d3f8cfcdcaa.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
5211ad84270862e68026ce8e6c15c1f8499551e19d2967c349b46d3f8cfcdcaa.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral27
Sample
5221cbfcd9be738e23a42dd9cda8aa1a9b085c05bf3e0f43b593e2f1e6909597.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
5221cbfcd9be738e23a42dd9cda8aa1a9b085c05bf3e0f43b593e2f1e6909597.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral29
Sample
5339c1fc009133bdcb1f004710538a3ed3885c7474108d3e0fa6fe2624d6f2e2.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
5339c1fc009133bdcb1f004710538a3ed3885c7474108d3e0fa6fe2624d6f2e2.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral31
Sample
5458f18e36de21d20b713f7acd8575fc8a86330c466e1b9dc6f41bc81f3e79fc.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
5458f18e36de21d20b713f7acd8575fc8a86330c466e1b9dc6f41bc81f3e79fc.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
General
- Target 03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe
- Size 716KB
- Sample261011-v4fdlsbv7x
- SHA256 03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969
- MD5 ac625552601c190656dcb8cf4c21cd1d
- SHA1 acad7a91c2812a0652d62f252774454c217666e9
- SHA512 9e04dbbc624e808a678e64648dbc12deb286341876ea4590d50f996732dde2b91c6b7defbffcbdd3883c74a98488a0ad26540b364942d3117625770bc4e5e6d3
- SSDEEP 12288:nB6xrkyoUKbidQN0M2TNK36YPiCuL1+jZ5tXdAD6x/NJxaZUzrd9gW6PdrO5SAou:nwrkyoUGJJgWQrOUAua
- TLSH T100F47C2A779C01F8E177D2798C954646F7F17C0613615BCF83A04AAA2F2F6B41E7A390
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
-
C:\ProgramData\readme.txt
- Your data are stolen and encrypted The data will be published on TOR website if you do not pay the ransom You can contact us and decrypt one file for free on this TOR site (you should download and install TOR browser first https://torproject.org) https://aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion/ Your company id for log in: 5f19e2b1-ca23-4d1d-b642-de2543c02742
-
https://aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion/
Signatures
- Family: Black Basta
A ransomware family targeting Windows and Linux ESXi first seen in February 2022.
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Renames multiple (2405) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dlaksjdoiwq.jpg" 03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_SubTrial-pl.xrm-ms 03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTest-ppd.xrm-ms 03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-ul-oob.xrm-ms 03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll 03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-time-l1-1-0.dll 03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-string-l1-1-0.dll 03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-runtime-l1-1-0.dll 03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ul.xrm-ms 03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-ul-oob.xrm-ms 03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ppd.xrm-ms 03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\RECALL.DLL 03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll 03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\tpcps.dll 03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe File opened for modification C:\Program Files\Common Files\System\ado\msadomd.dll 03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial2-ul-oob.xrm-ms 03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ul-phn.xrm-ms 03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial1-ul-oob.xrm-ms 03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe File opened for modification C:\Program Files (x86)\Common Files\System\wab32res.dll 03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ppd.xrm-ms 03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll 03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lv-lv.dll 03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-sysinfo-l1-1-0.dll 03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-pl.xrm-ms 03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-ul-oob.xrm-ms 03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-ul-oob.xrm-ms 03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SEQCHK10.DLL 03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe File opened for modification C:\Program Files\Mozilla Firefox\osclientcerts.dll 03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe File opened for modification C:\Program Files (x86)\Internet Explorer\hmmapi.dll 03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe File created C:\Program Files\Common Files\System\ado\readme.txt 03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe File created C:\Program Files\Mozilla Firefox\browser\features\readme.txt 03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\uninstall.log 03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Interceptor.dll 03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe File created C:\Program Files\VideoLAN\VLC\lua\extensions\readme.txt 03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe File opened for modification C:\Program Files\7-Zip\Lang\co.txt 03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Grace-ul-oob.xrm-ms 03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ul-oob.xrm-ms 03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXSEC32.DLL 03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\vccorlib140.dll 03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-profile-l1-1-0.dll 03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-ul-oob.xrm-ms 03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-pl.xrm-ms 03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe File created C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\readme.txt 03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe File opened for modification C:\Program Files\AssertInstall.xlt 03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe File created C:\Program Files\Common Files\microsoft shared\ink\fa-IR\readme.txt 03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-pl.xrm-ms 03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-ul-phn.xrm-ms 03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_Grace-ppd.xrm-ms 03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ppd.xrm-ms 03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\readme.txt 03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\readme.txt 03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-heap-l1-1-0.dll 03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\dt_shmem.dll 03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.excelmui.msi.16.en-us.xml 03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_PrepidBypass-ul-oob.xrm-ms 03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms 03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-pl.xrm-ms 03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial2-ppd.xrm-ms 03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Grace-ppd.xrm-ms 03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-ppd.xrm-ms 03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-ul-oob.xrm-ms 03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe - Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5104 cmd.exe 1720 cmd.exe - Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2592 vssadmin.exe - Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.basta\DefaultIcon 03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.basta 03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.basta\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fkdjsadasd.ico" 03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 2696 vssvc.exe Token: SeRestorePrivilege 2696 vssvc.exe Token: SeAuditPrivilege 2696 vssvc.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4656 wrote to memory of 5104 4656 03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe 91 PID 4656 wrote to memory of 1720 4656 03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe 93 PID 1720 wrote to memory of 2592 1720 cmd.exe 95 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe"C:\Users\Admin\AppData\Local\Temp\03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe"1⤵
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet2⤵
- Executes a command shell one-liner
PID:5104
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\System32\vssadmin.exe delete shadows /all /quiet2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\System32\vssadmin.exeC:\Windows\System32\vssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2592
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2696
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Java\jdk-1.8\jre\README.txt.basta
- Size 911B
- SHA256 f0defc980d561415cb8d2bf0f475c0740a937a168cc6801b21102feb47df215a
- MD5 0a19d7647930217399945f179a7b4d85
- SHA1 3c8cea110976e73a91179c7719b5c28bc597c12a
- SHA512 daddbe0182bb08473ec2d9026f559f5fd243c75b7dfb9a96fa336d94febe1a0d1bb9fd51abf4aedb2965ee0ef44d6b67a005b688f51f6d23b194c65f12302dd2
- TLSH T1461184B2FD8A3DA2C0F264605636D4168D9EE88183D3C415438A3C4C9B01692AB732AC
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Java\jre-1.8\README.txt.basta
- Size 911B
- SHA256 6b87c117bb3cf9d063610660a9063f4fb866bdefdb92dde5f42286b6e3c24eb6
- MD5 6ba704bfde43d88320570f23bce86bec
- SHA1 0f893529e7b469a15500ada9ea512168eb69ce31
- SHA512 932580ee59a40b17bc9d24ac330805e566440b83e45001f70f53fd89c4e995d649384f39bf6069103b679d78e21ea763119937b1f39c35a7b2a6f8e4ebe79a38
- TLSH T1CC11B7465D9B370BC8256067898B2B44F76075AD6203041CB83235CFB0565EC8F4061D
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\VideoLAN\VLC\README.txt.basta
- Size 911B
- SHA256 7a37a3d99f4ae7fc2ccff12b218a022286edef643e624396edffdb3680106f09
- MD5 970702f0ae2cde671dfb8b15737e42b2
- SHA1 b1bf91f34adbd7651ac224d5b6ad6e9f1d959a9a
- SHA512 a3ed2d5aad21b8a0f413927a9434c657d9aff39a3308705bf9acbfdf6898d8a8aa44834be0a5112f0eb2330a0d4063c57dfd7634f47488430797a44d185bdcde
- TLSH T1FB11EB7C27209C7769187054E0F7E539FE6166464907B8B621E14ECEB00D388DF5AC27
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\UpdateLock-308046B0AF4A39CB.basta
- Size 516B
- SHA256 f2b32a4818d08066ac24f8a68a8c39b078f608083f4bbbf0a6a1e340fadd63d1
- MD5 db4083b491f2bcf81d0e2aaef944af7a
- SHA1 fa05fe1a257ade5595963a2e329902d974844edc
- SHA512 b0f0d3a0c29cb1a32078ffcd8733ebc03d4c30fc8194a90010425724994319c5e61fe0988bc648bf6f3accfd625485fc9f57e189c0e659e6bdd0807c3c50ea5a
- TLSH T13FF0C0775A8C012950B45DB7022503468E8ED10476A5445D28E9FE1577B21616F8B96A
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\readme.txt
- Size 395B
- SHA256 88cdaa00b27e88a0fb1851cbe59d1365ac7b625ff535e1e68451ecf48928da8e
- MD5 ff661a42071a777d8fed3b587d062834
- SHA1 b252a1ec08506c23ff99ba343daf15e5ff69e6b9
- SHA512 11c582f053ec64e4e398a8d3c7c5c36fc76deb4a3b9c569ae7475e8c7b1f1673779fac8dfa84eae6bb4f8efee2cde16d186686afa1c4dd5a472366789ec9d6a1
- TLSH T148E0F1CF3B4D041B8E442AD2634B76C0F393122DE17703107EE0529427102F622511CB
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag.basta
- Size 1KB
- SHA256 0cd67713245337d9f235a4513a138105729c9f3a4eca7fa499fa8468fa3ecc1a
- MD5 1d87a2403a8245c09afd55582d796ff0
- SHA1 ff7a4287ceb43fe30ab11f36fd3e5e33588e3c97
- SHA512 27406425d92d56f5b872f4a00ee6926c9d1673b681cd1e2eb9d1f1a2c1c864e8125f993a14574ef1bf9102535e88a60c98a1c004af7ee5484c052c9acc23a339
- TLSH T16731B7E8E05C95239A4689A1A04133E1D26E6DDFC6CC41CFEB94D39891A70CD9743F85
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag.basta
- Size 1KB
- SHA256 aef89a3a47f0434816e0eb5dbdf08e51aaa0877fd6e50dbb2018ee0b380b253b
- MD5 34ef052fea75fd019cd1ed75b67235c5
- SHA1 a0e17160be38dd03471a8552aa0a89c8dd716be7
- SHA512 22dae1a40c832934af38ff92c4844e42ba71211ad46a576a86b38b5cadeacc2d6da4ba44293bff3f704a449a64da181cf9de8e6b25bc594eec55bb57e8e2ae3a
- TLSH T12531E75CE8986323F26BA74668403144DA9DF1DBE8CC9558F2A4C64092D21CD936A300
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag.basta
- Size 1KB
- SHA256 28524f152108085a8550f12b1199f1951b49dbd96950b7b7721a02ac0fbc5f68
- MD5 39f1ea60c112fa635c5b2bb3479a938a
- SHA1 931baaddb83c76b7c69fb726b57a1745ef547a37
- SHA512 04fdf03e1ee1d90e647b3cac2ee41f5e5150e752dfbd4345390c1c97241520a32d19056c196545d0aead6ed7fe53f881621d6c203095cd68671ae0f0c5f67ecb
- TLSH T10C31C5ACD1AE9353D60BBE85A480718055EE77DAD9D88ACFEF80C64CB0532CA5303702
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Downloads\ApproveNew.mpa
- Size 576KB
- SHA256 ce29585d35193885c9b1579b8568eead7ba4f17a74fc2780c00ca92abb198b28
- MD5 7251749474342669f04757006649aed6
- SHA1 d8d6c1747d6dabe2f34f06249903b4b6111b9bcd
- SHA512 e363156c23e2868fe47dd7b1581d13ba33d08c7bb84382299ff3a1a2a3335bcd99f896ab62e65f0664023ae31fb6eb5c0626fb60886309f8394ea996b1a876d2
- SSDEEP 12288:jmfz42J+ZUIsHP6kIiX2JIW9Uw1itDft/LsQpHltJzVE/JGl:52nHP6mS9Uw1eVjs8tFVEhm
- TLSH T1E0C423BDBC6BA4C76126693A690E5DC3AC21E14BB5257FD2A316BFD2429731CE034930
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\CloseEnable.ps1
- Size 462KB
- SHA256 3d8b50ffbeb567e97c4122c14e517f3873f4f53f8259222a2b0c4ff2bae988d0
- MD5 d4a71f2cd0fd82c154686fe53a071355
- SHA1 e8c17e4a230cd837d5087470d077ca32ae624c70
- SHA512 60bc5eeee2fdf844509222bee62344030701af7207c8a535048acbb09a16760456e054cd76e2fbb8c06d7570386221dac99ac572bddc156e403042f73564a54b
- SSDEEP 6144:HCaSq8jjC7mSjLhsLzET7YpVvguJkkkKQmqXlWe5svdIcsmn0PHnQWhCBYSAcbvm:iaS67muLaLYvK3JkkkKmqIcl0KccXrG
- TLSH T1D2A423ED398B75D47A8FDA17223F84FF9E0B126D86CC282D9059812385B90F98F671D1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\Desktop\Acrobat Reader DC.lnk.basta
- Size 2KB
- SHA256 19f67624aac64eba6fed4d3a67cf0bbb10a4ebfb5a3e45eec02db88ab85c6661
- MD5 bd32e3c1e35a41284104c180a5b08a16
- SHA1 a245ed355486117bf949d0967ca38320f4ffb950
- SHA512 4d3602730e4604b4842bca3d9063a537c21a0633651ba15510fbbf233d3bd2c00272b3135114925d0647deb60a33f170fc51025900d8cd8c7d3c9f26cc438ca5
- TLSH T15D51C9052EE70206F27B96FBDEF10D12CB61BEA972094D1F291A460E5CF5A049946F3B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Public\Desktop\Firefox.lnk.basta
- Size 1KB
- SHA256 c918d5148f6f4c717d2b906b184abab70d16029fc41166dbb5161a09024d59b9
- MD5 4585fd3099ed59ee5e1234fac4cf8514
- SHA1 1dad3ac041eee2da593c7a36da8e593ebc82728d
- SHA512 fa4fe125f42d3717931b48aab233dc2dafe35e15f2ce614dad46e423a1472db2c02ab559e59b4a83322e99443107dc1c755608430c9359614b7bbf83040cebb3
- TLSH T11A31A2090BBB12A1F0F78772AD742373077BF402F97A976EC44862400F3606C8AA6F90
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Public\Desktop\Google Chrome.lnk.basta
- Size 2KB
- SHA256 ad14fcd7873acaa062244f39fded3ba26ec5cd163648207fade3ffac873bf2cf
- MD5 0ad5b4d460e2489e7bae9e13f43635c4
- SHA1 6b22dac645c19101bac2f77cfa53ea35daa097f0
- SHA512 a2ace034b095449fbf4271e41a2d79c2d228d1e7575f6384a7c457d0d645cadadb37ff7268a42803520a16e9a8d70087350447126c04c281784f7f77e24b3ba3
- TLSH T19551A4107BE9A19CF7BBB773887276021FBEB822C619890A50C11A850C95B4C18D6F77
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Public\Desktop\VLC media player.lnk.basta
- Size 1KB
- SHA256 45b57b05e3ea5103db9427bfc0cb8f0d18893273fafe9bb546ae41f701b83092
- MD5 a27c2325c89cf0336d65767ed25cdd13
- SHA1 6690f6636db19e050a2f7b36e39751e500ca1da2
- SHA512 11850073b82ee85641e77671835f46153803fb289f0986f4bdea6af6e5b50ec94a178c1aedae68ed02735df0059b80bc8967d5ade9eaaec0c2f57db1164f22a7
- TLSH T1C121865A77E11396E3F764F2167120310767F910DB01136A9B5A87D52834700632FEAB
- MD5 SHA1 SHA512 TLSH