Overview
overview
10Static
static
10a083060d38...96.exe
windows10-2004-x64
10a083060d38...96.exe
windows11-ltsc_2024-x64
10a130125a49...09.elf
ubuntu-18.04-amd64
3a4337294dc...0f.exe
windows10-2004-x64
9a4337294dc...0f.exe
windows11-ltsc_2024-x64
9a87658cd12...85.exe
windows10-2004-x64
a87658cd12...85.exe
windows11-ltsc_2024-x64
aa503ddb16...eb.exe
windows10-2004-x64
10aa503ddb16...eb.exe
windows11-ltsc_2024-x64
10aa7ef4bb8d...d2.exe
windows10-2004-x64
aa7ef4bb8d...d2.exe
windows11-ltsc_2024-x64
aae8f44136...00.exe
windows10-2004-x64
10aae8f44136...00.exe
windows11-ltsc_2024-x64
1ab04ff1b0d...6d.exe
windows10-2004-x64
ab04ff1b0d...6d.exe
windows11-ltsc_2024-x64
ab14f46214...e9.exe
windows10-2004-x64
6ab14f46214...e9.exe
windows11-ltsc_2024-x64
6ab24df3877...95.dll
windows10-2004-x64
10ab24df3877...95.dll
windows11-ltsc_2024-x64
10ab62ae9f4f...58.exe
windows10-2004-x64
10ab62ae9f4f...58.exe
windows11-ltsc_2024-x64
10ab8d097bd5...7b.exe
windows10-2004-x64
10ab8d097bd5...7b.exe
windows11-ltsc_2024-x64
10ab8eee432f...d2.exe
windows10-2004-x64
10ab8eee432f...d2.exe
windows11-ltsc_2024-x64
10abbac1d240...3f.exe
windows10-2004-x64
10abbac1d240...3f.exe
windows11-ltsc_2024-x64
7abd49fd6f5...14.exe
windows10-2004-x64
10abd49fd6f5...14.exe
windows11-ltsc_2024-x64
10ac73e3c9e7...5f.exe
windows10-2004-x64
10ac73e3c9e7...5f.exe
windows11-ltsc_2024-x64
10ac7a0aaa0e...bd.exe
windows10-2004-x64
10Resubmissions
14/11/2026, 11:15
261114-nclyrafz8y1014/11/2026, 11:03
261114-m5nsdads2q1011/10/2026, 17:40
261011-v816wavsht10Analysis
- max time kernel
150s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/11/2026, 11:03
Static task
static1
Behavioral task
behavioral1
Sample
a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
a130125a498a358b75cd9a1256ea873baeacd81f77c3d2ea475f3e547f899509.elf
Resource
ubuntu1804-amd64-20261019-en
ubuntu-18.04-amd64
Behavioral task
behavioral4
Sample
a4337294dc51518284641982a28df585ede9b5f0e3f86be3c2c6bb5ad766a50f.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
a4337294dc51518284641982a28df585ede9b5f0e3f86be3c2c6bb5ad766a50f.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral6
Sample
a87658cd123b8352396116b4ee5fb36cfaf83493d30aefc01bd2aacc4d1c1885.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
a87658cd123b8352396116b4ee5fb36cfaf83493d30aefc01bd2aacc4d1c1885.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral8
Sample
aa503ddb166aff5790a44dc1cf64840fb7251d2b509f7b3eeb072f59b5cc7aeb.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
aa503ddb166aff5790a44dc1cf64840fb7251d2b509f7b3eeb072f59b5cc7aeb.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral10
Sample
aa7ef4bb8d0eab74af36162fe42056008d7e19e62ff1b50b870e72140a7b5bd2.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
aa7ef4bb8d0eab74af36162fe42056008d7e19e62ff1b50b870e72140a7b5bd2.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral12
Sample
aae8f441367e5b86a5f46bfd062c42886c6df0cff410a2a91c5334e321e54200.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
aae8f441367e5b86a5f46bfd062c42886c6df0cff410a2a91c5334e321e54200.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral14
Sample
ab04ff1b0d5f70c43a0985f3b0b3b8bc1150ab9e74d56f3b1c4043a51aabf76d.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
ab04ff1b0d5f70c43a0985f3b0b3b8bc1150ab9e74d56f3b1c4043a51aabf76d.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral16
Sample
ab14f462141fd6d559fcf50dd92e7c7571a6ecf8986c9be7af85baf8f025bbe9.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
ab14f462141fd6d559fcf50dd92e7c7571a6ecf8986c9be7af85baf8f025bbe9.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral18
Sample
ab24df3877345cfab2c946d8a714f1ef17fe18c6744034b44ec0c83a3b613195.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
ab24df3877345cfab2c946d8a714f1ef17fe18c6744034b44ec0c83a3b613195.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral20
Sample
ab62ae9f4f7e797648fd4de6633357f704d4799f77844a0368a17ad21d2a2958.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
ab62ae9f4f7e797648fd4de6633357f704d4799f77844a0368a17ad21d2a2958.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral22
Sample
ab8d097bd5fb7fe03f5e40abd77652210e635b0a253c578db76d2cf844e9147b.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
ab8d097bd5fb7fe03f5e40abd77652210e635b0a253c578db76d2cf844e9147b.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral24
Sample
ab8eee432fa636360b3c6724fe6851e9cf8eeae1ee9da6fc576bee1cd5d7fad2.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
ab8eee432fa636360b3c6724fe6851e9cf8eeae1ee9da6fc576bee1cd5d7fad2.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral26
Sample
abbac1d240758fe349c6765e118ff6a5e34e080d10542593a154ca32b222b83f.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
abbac1d240758fe349c6765e118ff6a5e34e080d10542593a154ca32b222b83f.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral28
Sample
abd49fd6f57d4f0ffef794257692c61b2089ee412ae27fe36a9ffee41f9d5e14.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
abd49fd6f57d4f0ffef794257692c61b2089ee412ae27fe36a9ffee41f9d5e14.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral30
Sample
ac73e3c9e7ee62be2d2138fa5f8ef28679c0a191882b7a30e35ce7b89786935f.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
ac73e3c9e7ee62be2d2138fa5f8ef28679c0a191882b7a30e35ce7b89786935f.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral32
Sample
ac7a0aaa0e361b368d88b60fe956e5f492e7c89135c0f3b8294a176ada5de2bd.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
General
- Target a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe
- Size 720KB
- Sample261114-m5nsdads2q
- SHA256 a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96
- MD5 0c69e91c2f54978ae3103b26686b2610
- SHA1 3e3b113a5ab64e03ffe86e0fa9a2163816f9ecdf
- SHA512 7f4be495be8d9bc4bf825a2846d1888e93f137820c172488febfba13e06f83eb5ce7d0873d752cc9627e6a613dc137c2e8b8d9519f2339c1a6dd7f6c82b66212
- SSDEEP 12288:9yufBWp/QcYqt+QxxbxgU532BjZak//A6/NLaBCfwYkijMsZ2rEIaOtZBQipEen7:9yufBWpW3/k6M7tZBLpEelW3it
- TLSH T12DF46D2A769841F8E16792798CD64642F7F17C0613715ACFC3A04ABA1F2F6B41E7E390
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
-
C:\ProgramData\readme.txt
- Your data are stolen and encrypted The data will be published on TOR website if you do not pay the ransom You can contact us and decrypt one file for free on this TOR site (you should download and install TOR browser first https://torproject.org) https://aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion/ Your company id for log in: ea3d3d33-1635-47f7-a1a4-0078267b30bb
-
https://aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion/
Signatures
- Family: Black Basta
A ransomware family targeting Windows and Linux ESXi first seen in February 2022.
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Renames multiple (2386) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dlaksjdoiwq.jpg" a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Mozilla Firefox\installation_telemetry.json a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe File opened for modification C:\Program Files\Mozilla Firefox\softokn3.dll a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe File created C:\Program Files\Common Files\System\ado\readme.txt a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe File opened for modification C:\Program Files\7-Zip\Lang\he.txt a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvSubsystemController.dll a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-locale-l1-1-0.dll a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-private-l1-1-0.dll a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe File created C:\Program Files (x86)\Common Files\Adobe\Acrobat\readme.txt a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ppd.xrm-ms a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Grace-ppd.xrm-ms a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription3-ul-oob.xrm-ms a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-pl.xrm-ms a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-ppd.xrm-ms a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Resources.pri a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe File opened for modification C:\Program Files\VideoLAN\VLC\THANKS.txt a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\fontconfig.bfc a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-utility-l1-1-0.dll a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-pl.xrm-ms a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Trial-ul-oob.xrm-ms a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\WordVL_MAK-ppd.xrm-ms a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\mset7tkjp.dll a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe File opened for modification C:\Program Files\Common Files\System\wab32res.dll a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-stdio-l1-1-0.dll a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-ul-phn.xrm-ms a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ppd.xrm-ms a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe File created C:\Program Files\Microsoft Office\readme.txt a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe File opened for modification C:\Program Files\7-Zip\Lang\id.txt a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.de-de.dll a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\QFE31927.msp a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-ul-oob.xrm-ms a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-root.xrm-ms a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial1-ul-oob.xrm-ms a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe File created C:\Program Files\Mozilla Firefox\readme.txt a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe File opened for modification C:\Program Files\Internet Explorer\it-IT\iexplore.exe.mui a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-ppd.xrm-ms a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_KMS_ClientC2R-ul.xrm-ms a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excel.exe.manifest a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe File opened for modification C:\Program Files\SwitchDebug.clr a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe File created C:\Program Files\Common Files\System\ado\es-ES\readme.txt a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\RECALL.DLL a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_splitter\readme.txt a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe File opened for modification C:\Program Files (x86)\Internet Explorer\uk-UA\iexplore.exe.mui a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019DemoR_BypassTrial180-ppd.xrm-ms a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ul-phn.xrm-ms a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-ppd.xrm-ms a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ul-oob.xrm-ms a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe File created C:\Program Files\Microsoft Office\root\Office16\CONVERT\readme.txt a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTrial-ul-oob.xrm-ms a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe File created C:\Program Files\Common Files\microsoft shared\ink\hr-HR\readme.txt a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-ul-oob.xrm-ms a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-ppd.xrm-ms a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_KMS_Client-ul.xrm-ms a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SHAREPOINTPROVIDER.DLL a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe File created C:\Program Files\Microsoft Office\root\Licenses16\readme.txt a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME.txt a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial2-pl.xrm-ms a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ul-phn.xrm-ms a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-ul-oob.xrm-ms a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLPH.DLL a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe - Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3104 cmd.exe 3448 cmd.exe - Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1684 vssadmin.exe - Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.basta\DefaultIcon a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.basta a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.basta\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fkdjsadasd.ico" a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 712 vssvc.exe Token: SeRestorePrivilege 712 vssvc.exe Token: SeAuditPrivilege 712 vssvc.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3304 wrote to memory of 3104 3304 a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe 89 PID 3304 wrote to memory of 3448 3304 a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe 91 PID 3448 wrote to memory of 1684 3448 cmd.exe 93 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe"C:\Users\Admin\AppData\Local\Temp\a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe"1⤵
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet2⤵
- Executes a command shell one-liner
PID:3104
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\System32\vssadmin.exe delete shadows /all /quiet2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Windows\System32\vssadmin.exeC:\Windows\System32\vssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1684
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:712
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Java\jre-1.8\README.txt.basta
- Size 910B
- SHA256 6df8c570a758ca8fcc534a044eb0c76a3bbc68bb270dc5c3b2d6a2f74e31fd72
- MD5 3b34257dc70fbe13f10c3b21a0fbbae2
- SHA1 6d1e9aca1c82e6d3a12c57f1c0f5bb6ae3f8a690
- SHA512 263890cdb23d6066c43be1e735d6a473c3d2a7ec29b3dc4cce8365706152334f62d65b8ed485215c407d855d5196fc612401f128c71f8853107c35a63d685234
- TLSH T11211B72C0A0A4D9E2DFE014B41A82726314B32476DF55B2F91734FBA1A6374018EA3DC
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\VideoLAN\VLC\README.txt.basta
- Size 910B
- SHA256 bc6d5174f7e2f2d8a862e58d23ba23e17c7b19d2bb0465a4143ad872010d6984
- MD5 2c9fa8ae3ab5f49785839b16786b2e03
- SHA1 6d98ba09e559af7cb870d3b01841a27f81d2645d
- SHA512 848db9280a79fed13d3b1ef9a956c406fbbf5e0943cbf493ba3a034b62a293b03fbde8d209ee6e6f01e339644d3089e35decdc7d5574850595eb86f8f03f6485
- TLSH T17811EB041D9188F99FC79AF610D4D05D38878588A0FE194F3FB10871734375EB121E5C
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\UpdateLock-308046B0AF4A39CB.basta
- Size 516B
- SHA256 ba51d70d85e2c9f58bc080eb82326f1c03cce2fce88e64d3ec14aaffe4d0648c
- MD5 ff6c781d19da182f0ba4bd9ba35feb21
- SHA1 86df493c4c0d032928d32b17540d952414c6f255
- SHA512 d21a10683dfd03066a30a885c35d7f75e17f391ab98c7e8ea99d2de88dac1cae2feb9e0681e584fe65bbcf96180287f67f119a31e2daa1fb314f186b5bf92ac0
- TLSH T13FF07532E8F4A86E0F208F8007F8CB1185DB340FE380A6F094012D325E4D4092603299
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\readme.txt
- Size 394B
- SHA256 677ddbeefb459f03432a0d2d24f13f0dcec1289722639fb34849aa41a4bac620
- MD5 0394335bf42f1f1a1a730ec7eec45b73
- SHA1 f1d6f7decd3120826b870479f45501acd979df47
- SHA512 ea61fcecab48e463b2737c35247b30d03e626f3db9bccdce200b818bf52b6c3a32707b4356fbd6ff915b69cac2b5829d44a3f9fa31357dc5cb9ee5381636ddd3
- TLSH T164E02BCE3B4D445B8A542992638A6590E2A32229A6B603247E95559817101E622A129B
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag.basta
- Size 1KB
- SHA256 a7b32748f7cf5cf6b46e38d9bd4fc33b86c347e2f9f414c3243ee576c2bce16b
- MD5 1ae2d4c211c7ec51d8b56b4a069b11be
- SHA1 de65bb77abf294e1b672d49853e8c86fe1cd1847
- SHA512 71eafb2f0dbf3cc8f2ef85b1ef99743dc46da53c310d546df3e67ad598ffe78f17bd513e536c2472a6ff52f8443204212dfd89c0cdeab6b4c8205857acf34a23
- TLSH T17D31C598E02CD313228B5362D8F4B7D8E36EA7F1E5C848C5EEA4C848A2E13854393B05
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag.basta
- Size 1KB
- SHA256 a963e8814918efe0c2d76797101fdd6636b650f1aaedf1f16704728eb637cc4c
- MD5 c360a4fb9f137fc84eb8b1d5a60df7fe
- SHA1 859aa7c85f33ee7bf1eee81745358d1b394a21b3
- SHA512 57feb048d6533afac0aa4e8446005078b58f881a554d87ce27cdbfa0967131bbd52fa1fa673d0620e8faea23f5df8ac4bdb4147067344e2eb41126d7d34c9c71
- TLSH T19C3195ADB01CE35392575B9CA15421A8E295B2F7EECC41A7F7A4C0C4B1B12CAB347701
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag.basta
- Size 1KB
- SHA256 5ad30d110905784f47e37d8e415ed9a7db5c35883cfc7b6ca3623d500e47ada9
- MD5 1f47acb52618ba268153c10febd11e22
- SHA1 2ccaba1b30dd06e8424225aa6d1a87902c12db72
- SHA512 2df5558f874f4e45126fd455e157bbf5a98fc64a7e2b15eb8e5db0cffa05db005cd62e33fb77922d8a611cd309790f0f9d054afe21003a1369b0caa735a0924e
- TLSH T15431D78DD62EBB33D55F6B2C94A170E0A1DFB2FBE8C8154BEA50C66472E31894303309
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Downloads\ClosePush.snd
- Size 403KB
- SHA256 f93bd80a8e476620f75afc2358a9e89b1a625f0c5ea42716830314c8be771d8a
- MD5 c85052adbec1a1d160096feebd94e005
- SHA1 7d7e0070d25f02621ff1619947995d3209524c0c
- SHA512 f25e558aeaf916d54339303b88bbb79cee7c75b7d6be5a78acafad22cda182408ef7421567c3590c8531e3727b4e5c63c7a916deeaee20c0521f980037fbbca4
- SSDEEP 6144:X6jB0GrMEGscqMAbNnGgeR6vA/rrFi4eo+xQHXjpzs4cHb4MHIGkl3NHpz3cybF:q9NMEWrA5nGLkvuRAKlDmrVeRpzMybF
- TLSH T12D942330B8BBA513D25BAA4133E783BE959898BA4C167D35707DC8D7094E0F51CB78CA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\ConvertToInitialize.dot
- Size 275KB
- SHA256 177710ec2444e980e7dd685637d8500da310b4d6521a13a42e023907bf31891e
- MD5 1bd053074ae1bfa17f431b8214e9b707
- SHA1 ca02ba4dc1e81c4bc70d1f22ba281b2511e788bd
- SHA512 920a7a0eb4ac0c6c912909a272a5612f852a5c8c1053b1acd8c6f9ef9d2d77af74d66d363b2f01f7a2b6ec11ecb4ce6953f9aba0a7a93fd6f2e32239d4a51ceb
- SSDEEP 6144:wYYq75WqAMu1gx/H6vToGMeJfpJuewhfiRveWn9S2GW3CXMWhHXl0ZtR:wYYQ5Wnj+tH6vUGMApJuXfinS2ZsM418
- TLSH T13B5423403FA99AF92D3F799914A8C03CC2B57245CC684F9ABDC71BEDE42B1395B13065
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\readme.txt
- Size 394B
- SHA256 677ddbeefb459f03432a0d2d24f13f0dcec1289722639fb34849aa41a4bac620
- MD5 0394335bf42f1f1a1a730ec7eec45b73
- SHA1 f1d6f7decd3120826b870479f45501acd979df47
- SHA512 ea61fcecab48e463b2737c35247b30d03e626f3db9bccdce200b818bf52b6c3a32707b4356fbd6ff915b69cac2b5829d44a3f9fa31357dc5cb9ee5381636ddd3
- TLSH T164E02BCE3B4D445B8A542992638A6590E2A32229A6B603247E95559817101E622A129B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Public\Desktop\Acrobat Reader DC.lnk.basta
- Size 2KB
- SHA256 71d14a5ce1818f440b14d74f98a13261563a1f3a08398bda31a7a22d478ba4f3
- MD5 fd486a536e9cadef1735b0b23de6c848
- SHA1 840f38211caeed4a00d3cdf536b7042e4f3ef38d
- SHA512 524e579134d96ac9137906249c7e31b13aaf7162fbddcee86a97ed9449a611b6b146e4ea08ae673baa4b0819bf42c003a1cdfb801dfcdce15fe96534e6ed7dc1
- TLSH T10751D8D12FFA035BE23B8EF78FF10566AA62BD48A551491E446843170EE1F00E580F6A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Public\Desktop\Firefox.lnk.basta
- Size 1KB
- SHA256 a7c871156bb5b7690a37b8f989ebaf9ca51a89f98f504b55c4e2e094ccf78094
- MD5 5adc35535fcbff4b204ea9c01b78cf0b
- SHA1 84445e4980e2e10e3612f08d9f1b629b377b2f61
- SHA512 530f544d2f1da2d373ebb1cc25375c812971f5558f6eaafc4fe43aee9d3c6bf53ba2cd3f9fbc43f58fa0efb53ae1d4737d99196d36451447fefd7372b8aee5a4
- TLSH T1CF31964117E753B7F0AF583E69B212A3B273FD42B57A42ADC04412A4097B03459DEF83
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Public\Desktop\Google Chrome.lnk.basta
- Size 2KB
- SHA256 c27ae39368c1c0b639ce6dbe622cc5a993aa284c4b52322aa96813cc8542416b
- MD5 89a8f28b66e562f4a10868b825c9e70a
- SHA1 51d41e8a0e8766e39fadad88adf4fc1f24206851
- SHA512 9eff986bdead348d776f5265741f3f5f0f660799e4a57b5ad156a3500a3981abb0a1c0d50add9ac4af7ce2668984ea53558c6bc9c12e8d0f4169e2431083d38f
- TLSH T1D051B78937F01A8AF67386725D923E714FABBC29C514873A30CA553448FA8080ADCF73
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Public\Desktop\VLC media player.lnk.basta
- Size 1KB
- SHA256 51322889af21f7bc67b41169c7bf238dd40e4287e2345483cb618333b6813744
- MD5 e2581b902ca6635e56b6de05c64f8ed8
- SHA1 ffd519305a4f384ef44238cf8c760f218401508c
- SHA512 5e5f0f7dfa7f210e34a9886a4f62923daff156c55ff1314bba61aa2242f20f1a0360fde26cdbc7ad3a8164f1835f23a0221187f61e5a53e226fcab2ca28df124
- TLSH T1D621B6262BE67751F492D8F0DAF532D1573BB3ACA741034E41D501A708241898A25F6B
- MD5 SHA1 SHA512 TLSH