blackbasta

T1566.001Phishing: Spear phishing Attachment

Victims receive spear phishing emails with attached malicious zip files - typically password protected. That contains malicious doc including .doc, .pdf, .xls

T1047Windows Management Instrumentation

Utilizes Invoke-TotalExec to push out the ransomware binary.

T1059.001Command and Scripting Interpreter: PowerShell

Black Basta has encoded PowerShell scripts to download additional scripts.

T1569.002System Services: Service Execution

Black Basta has installed and used PsExec to execute payloads on remote hosts.

T1098Account Manipulation

Added newly created accounts to the administrators' group to maintain elevated access.

T1136Create Account

Black Basta threat actors created accounts with names such as temp, r, or admin.

T1543.003Create or Modify System Process: Windows Service

Creates benign-looking services for the ransomware binary.

T1574.001Hijack Execution Flow: DLL Search Order Hijacking

Black Basta used Qakbot, which has the ability to exploit Windows 7 Calculator to execute malicious payloads.

T1484.001Domain Policy Modification: Group Policy Modification

Black Basta can modify group policy for privilege escalation and defense evasion.

T1543.003Create or Modify System Process: Windows Service

Creates benign-looking services for the ransomware binary.

T1574.001Hijack Execution Flow: DLL Search Order Hijacking

Black Basta used Qakbot, which has the ability to exploit Windows 7 Calculator to execute malicious payloads.