Analysis
-
max time kernel
89s -
max time network
113s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
29-04-2021 07:07
Static task
static1
Behavioral task
behavioral1
Sample
a2b5ebfc52a447cde255e1ec1ac8797ad49b156ed427df8c292d6aeb4dad5523.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
a2b5ebfc52a447cde255e1ec1ac8797ad49b156ed427df8c292d6aeb4dad5523.exe
Resource
win10v20210410
General
-
Target
a2b5ebfc52a447cde255e1ec1ac8797ad49b156ed427df8c292d6aeb4dad5523.exe
-
Size
79KB
-
MD5
dfaa9121f4165a9f38a8406d82f0ab71
-
SHA1
b592c787d347287efe410a43555e218e9ccfab10
-
SHA256
a2b5ebfc52a447cde255e1ec1ac8797ad49b156ed427df8c292d6aeb4dad5523
-
SHA512
b00d24e7b38f66bb4ddadc75642d40afa6ba44fdfe832f9c2c4a074281736b0e0d66da512aac22eba3c8cecbdbe49152fab230233d75405e6ce5fbabe776e230
Malware Config
Extracted
C:\How To Restore Your Files.txt
http://wavbeudogz6byhnardd2lkp2jafims3j7tj6k6qnywchn2csngvtffqd.onion/blog/c9daf42fcfa6aca8432ecb7ffeff7f5e4e75f4ddd75f428c629bf6aa6a108a08/
http://wavbeudogz6byhnardd2lkp2jafims3j7tj6k6qnywchn2csngvtffqd.onion/
http://tsu2dpiiv4zjzfyq73eibemit2qyrimbbb6lhpm6n5ihgallom5lhdyd.onion/3eb91fac85bb0db5dde432443e998a3863f0f1c76e3449319178e6b78f5d3f44
Signatures
-
Babuk Locker
RaaS first seen in 2021 initially called Vasa Locker.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 21 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
a2b5ebfc52a447cde255e1ec1ac8797ad49b156ed427df8c292d6aeb4dad5523.exedescription ioc process File renamed C:\Users\Admin\Pictures\SuspendInstall.crw => C:\Users\Admin\Pictures\SuspendInstall.crw.babyk a2b5ebfc52a447cde255e1ec1ac8797ad49b156ed427df8c292d6aeb4dad5523.exe File opened for modification C:\Users\Admin\Pictures\LimitRead.png.babyk a2b5ebfc52a447cde255e1ec1ac8797ad49b156ed427df8c292d6aeb4dad5523.exe File renamed C:\Users\Admin\Pictures\ReadMeasure.tif => C:\Users\Admin\Pictures\ReadMeasure.tif.babyk a2b5ebfc52a447cde255e1ec1ac8797ad49b156ed427df8c292d6aeb4dad5523.exe File opened for modification C:\Users\Admin\Pictures\ConfirmUndo.tiff.babyk a2b5ebfc52a447cde255e1ec1ac8797ad49b156ed427df8c292d6aeb4dad5523.exe File opened for modification C:\Users\Admin\Pictures\EnterRegister.tiff a2b5ebfc52a447cde255e1ec1ac8797ad49b156ed427df8c292d6aeb4dad5523.exe File renamed C:\Users\Admin\Pictures\LimitRead.png => C:\Users\Admin\Pictures\LimitRead.png.babyk a2b5ebfc52a447cde255e1ec1ac8797ad49b156ed427df8c292d6aeb4dad5523.exe File opened for modification C:\Users\Admin\Pictures\NewUnregister.tif.babyk a2b5ebfc52a447cde255e1ec1ac8797ad49b156ed427df8c292d6aeb4dad5523.exe File opened for modification C:\Users\Admin\Pictures\ReceiveTest.tif.babyk a2b5ebfc52a447cde255e1ec1ac8797ad49b156ed427df8c292d6aeb4dad5523.exe File opened for modification C:\Users\Admin\Pictures\CompareCheckpoint.tif.babyk a2b5ebfc52a447cde255e1ec1ac8797ad49b156ed427df8c292d6aeb4dad5523.exe File renamed C:\Users\Admin\Pictures\CompareSend.tiff => C:\Users\Admin\Pictures\CompareSend.tiff.babyk a2b5ebfc52a447cde255e1ec1ac8797ad49b156ed427df8c292d6aeb4dad5523.exe File renamed C:\Users\Admin\Pictures\EnterRegister.tiff => C:\Users\Admin\Pictures\EnterRegister.tiff.babyk a2b5ebfc52a447cde255e1ec1ac8797ad49b156ed427df8c292d6aeb4dad5523.exe File renamed C:\Users\Admin\Pictures\NewUnregister.tif => C:\Users\Admin\Pictures\NewUnregister.tif.babyk a2b5ebfc52a447cde255e1ec1ac8797ad49b156ed427df8c292d6aeb4dad5523.exe File renamed C:\Users\Admin\Pictures\CompareCheckpoint.tif => C:\Users\Admin\Pictures\CompareCheckpoint.tif.babyk a2b5ebfc52a447cde255e1ec1ac8797ad49b156ed427df8c292d6aeb4dad5523.exe File opened for modification C:\Users\Admin\Pictures\ConfirmUndo.tiff a2b5ebfc52a447cde255e1ec1ac8797ad49b156ed427df8c292d6aeb4dad5523.exe File renamed C:\Users\Admin\Pictures\ConfirmUndo.tiff => C:\Users\Admin\Pictures\ConfirmUndo.tiff.babyk a2b5ebfc52a447cde255e1ec1ac8797ad49b156ed427df8c292d6aeb4dad5523.exe File opened for modification C:\Users\Admin\Pictures\EnterRegister.tiff.babyk a2b5ebfc52a447cde255e1ec1ac8797ad49b156ed427df8c292d6aeb4dad5523.exe File opened for modification C:\Users\Admin\Pictures\ReadMeasure.tif.babyk a2b5ebfc52a447cde255e1ec1ac8797ad49b156ed427df8c292d6aeb4dad5523.exe File renamed C:\Users\Admin\Pictures\ReceiveTest.tif => C:\Users\Admin\Pictures\ReceiveTest.tif.babyk a2b5ebfc52a447cde255e1ec1ac8797ad49b156ed427df8c292d6aeb4dad5523.exe File opened for modification C:\Users\Admin\Pictures\SuspendInstall.crw.babyk a2b5ebfc52a447cde255e1ec1ac8797ad49b156ed427df8c292d6aeb4dad5523.exe File opened for modification C:\Users\Admin\Pictures\CompareSend.tiff a2b5ebfc52a447cde255e1ec1ac8797ad49b156ed427df8c292d6aeb4dad5523.exe File opened for modification C:\Users\Admin\Pictures\CompareSend.tiff.babyk a2b5ebfc52a447cde255e1ec1ac8797ad49b156ed427df8c292d6aeb4dad5523.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
a2b5ebfc52a447cde255e1ec1ac8797ad49b156ed427df8c292d6aeb4dad5523.exedescription ioc process File opened (read-only) \??\X: a2b5ebfc52a447cde255e1ec1ac8797ad49b156ed427df8c292d6aeb4dad5523.exe File opened (read-only) \??\M: a2b5ebfc52a447cde255e1ec1ac8797ad49b156ed427df8c292d6aeb4dad5523.exe File opened (read-only) \??\Q: a2b5ebfc52a447cde255e1ec1ac8797ad49b156ed427df8c292d6aeb4dad5523.exe File opened (read-only) \??\U: a2b5ebfc52a447cde255e1ec1ac8797ad49b156ed427df8c292d6aeb4dad5523.exe File opened (read-only) \??\I: a2b5ebfc52a447cde255e1ec1ac8797ad49b156ed427df8c292d6aeb4dad5523.exe File opened (read-only) \??\O: a2b5ebfc52a447cde255e1ec1ac8797ad49b156ed427df8c292d6aeb4dad5523.exe File opened (read-only) \??\A: a2b5ebfc52a447cde255e1ec1ac8797ad49b156ed427df8c292d6aeb4dad5523.exe File opened (read-only) \??\K: a2b5ebfc52a447cde255e1ec1ac8797ad49b156ed427df8c292d6aeb4dad5523.exe File opened (read-only) \??\B: a2b5ebfc52a447cde255e1ec1ac8797ad49b156ed427df8c292d6aeb4dad5523.exe File opened (read-only) \??\R: a2b5ebfc52a447cde255e1ec1ac8797ad49b156ed427df8c292d6aeb4dad5523.exe File opened (read-only) \??\S: a2b5ebfc52a447cde255e1ec1ac8797ad49b156ed427df8c292d6aeb4dad5523.exe File opened (read-only) \??\H: a2b5ebfc52a447cde255e1ec1ac8797ad49b156ed427df8c292d6aeb4dad5523.exe File opened (read-only) \??\J: a2b5ebfc52a447cde255e1ec1ac8797ad49b156ed427df8c292d6aeb4dad5523.exe File opened (read-only) \??\Z: a2b5ebfc52a447cde255e1ec1ac8797ad49b156ed427df8c292d6aeb4dad5523.exe File opened (read-only) \??\V: a2b5ebfc52a447cde255e1ec1ac8797ad49b156ed427df8c292d6aeb4dad5523.exe File opened (read-only) \??\E: a2b5ebfc52a447cde255e1ec1ac8797ad49b156ed427df8c292d6aeb4dad5523.exe File opened (read-only) \??\Y: a2b5ebfc52a447cde255e1ec1ac8797ad49b156ed427df8c292d6aeb4dad5523.exe File opened (read-only) \??\G: a2b5ebfc52a447cde255e1ec1ac8797ad49b156ed427df8c292d6aeb4dad5523.exe File opened (read-only) \??\L: a2b5ebfc52a447cde255e1ec1ac8797ad49b156ed427df8c292d6aeb4dad5523.exe File opened (read-only) \??\N: a2b5ebfc52a447cde255e1ec1ac8797ad49b156ed427df8c292d6aeb4dad5523.exe File opened (read-only) \??\W: a2b5ebfc52a447cde255e1ec1ac8797ad49b156ed427df8c292d6aeb4dad5523.exe File opened (read-only) \??\T: a2b5ebfc52a447cde255e1ec1ac8797ad49b156ed427df8c292d6aeb4dad5523.exe File opened (read-only) \??\P: a2b5ebfc52a447cde255e1ec1ac8797ad49b156ed427df8c292d6aeb4dad5523.exe File opened (read-only) \??\F: a2b5ebfc52a447cde255e1ec1ac8797ad49b156ed427df8c292d6aeb4dad5523.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 196 vssadmin.exe 788 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
a2b5ebfc52a447cde255e1ec1ac8797ad49b156ed427df8c292d6aeb4dad5523.exepid process 2016 a2b5ebfc52a447cde255e1ec1ac8797ad49b156ed427df8c292d6aeb4dad5523.exe 2016 a2b5ebfc52a447cde255e1ec1ac8797ad49b156ed427df8c292d6aeb4dad5523.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 2324 vssvc.exe Token: SeRestorePrivilege 2324 vssvc.exe Token: SeAuditPrivilege 2324 vssvc.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
a2b5ebfc52a447cde255e1ec1ac8797ad49b156ed427df8c292d6aeb4dad5523.execmd.execmd.exedescription pid process target process PID 2016 wrote to memory of 2488 2016 a2b5ebfc52a447cde255e1ec1ac8797ad49b156ed427df8c292d6aeb4dad5523.exe cmd.exe PID 2016 wrote to memory of 2488 2016 a2b5ebfc52a447cde255e1ec1ac8797ad49b156ed427df8c292d6aeb4dad5523.exe cmd.exe PID 2488 wrote to memory of 196 2488 cmd.exe vssadmin.exe PID 2488 wrote to memory of 196 2488 cmd.exe vssadmin.exe PID 2016 wrote to memory of 2208 2016 a2b5ebfc52a447cde255e1ec1ac8797ad49b156ed427df8c292d6aeb4dad5523.exe cmd.exe PID 2016 wrote to memory of 2208 2016 a2b5ebfc52a447cde255e1ec1ac8797ad49b156ed427df8c292d6aeb4dad5523.exe cmd.exe PID 2208 wrote to memory of 788 2208 cmd.exe vssadmin.exe PID 2208 wrote to memory of 788 2208 cmd.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a2b5ebfc52a447cde255e1ec1ac8797ad49b156ed427df8c292d6aeb4dad5523.exe"C:\Users\Admin\AppData\Local\Temp\a2b5ebfc52a447cde255e1ec1ac8797ad49b156ed427df8c292d6aeb4dad5523.exe"1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken