Analysis
-
max time kernel
24s -
max time network
120s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
30-04-2021 17:57
Static task
static1
Behavioral task
behavioral1
Sample
plast.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
plast.exe
Resource
win10v20210410
General
-
Target
plast.exe
-
Size
79KB
-
MD5
cafe07d8c34108007372bd8df42d9ef9
-
SHA1
f137ab4384d071ab51c746f9de976aeea81fb2e6
-
SHA256
6103e26f6f9d5fd895d9c06e1f5e141ce74d8ebda999cda6a58a4393de5ed094
-
SHA512
acf2184efdb981e164028c0caf7fe5173db9f17a035c9d4c0c1cd78dfb819312b34f653ef83c718aa2b73646824cbed2d29d2edc6b2f21c9329b890fecfea90f
Malware Config
Extracted
C:\How To Restore Your Files.txt
http://wavbeudogz6byhnardd2lkp2jafims3j7tj6k6qnywchn2csngvtffqd.onion/blog/d5c28d496f8ae8618894df9b4e142cf3e21ac9fc204f5ebb9ce0392e7bd43d89/
http://wavbeudogz6byhnardd2lkp2jafims3j7tj6k6qnywchn2csngvtffqd.onion/
http://xrf3jd6k3eqcuhpewtfm52bt7tptc2swiskphdoa4tu4d2jl44osorad.onion/aaa778e6648e85918b5eac8fd16d80521957ba67ba61673f526398d33b702228
Signatures
-
Babuk Locker
RaaS first seen in 2021 initially called Vasa Locker.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 15 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
plast.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\ExpandInitialize.tif.babyk plast.exe File renamed C:\Users\Admin\Pictures\ReadEnable.tif => C:\Users\Admin\Pictures\ReadEnable.tif.babyk plast.exe File opened for modification C:\Users\Admin\Pictures\ReceiveWait.tiff.babyk plast.exe File renamed C:\Users\Admin\Pictures\ExpandInitialize.tif => C:\Users\Admin\Pictures\ExpandInitialize.tif.babyk plast.exe File opened for modification C:\Users\Admin\Pictures\ReceiveWait.tiff plast.exe File renamed C:\Users\Admin\Pictures\CompareMerge.raw => C:\Users\Admin\Pictures\CompareMerge.raw.babyk plast.exe File opened for modification C:\Users\Admin\Pictures\HideResize.raw.babyk plast.exe File renamed C:\Users\Admin\Pictures\RestartComplete.tif => C:\Users\Admin\Pictures\RestartComplete.tif.babyk plast.exe File renamed C:\Users\Admin\Pictures\UnblockStep.png => C:\Users\Admin\Pictures\UnblockStep.png.babyk plast.exe File opened for modification C:\Users\Admin\Pictures\UnblockStep.png.babyk plast.exe File opened for modification C:\Users\Admin\Pictures\CompareMerge.raw.babyk plast.exe File renamed C:\Users\Admin\Pictures\HideResize.raw => C:\Users\Admin\Pictures\HideResize.raw.babyk plast.exe File opened for modification C:\Users\Admin\Pictures\ReadEnable.tif.babyk plast.exe File renamed C:\Users\Admin\Pictures\ReceiveWait.tiff => C:\Users\Admin\Pictures\ReceiveWait.tiff.babyk plast.exe File opened for modification C:\Users\Admin\Pictures\RestartComplete.tif.babyk plast.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
plast.exedescription ioc process File opened (read-only) \??\E: plast.exe File opened (read-only) \??\U: plast.exe File opened (read-only) \??\X: plast.exe File opened (read-only) \??\R: plast.exe File opened (read-only) \??\A: plast.exe File opened (read-only) \??\B: plast.exe File opened (read-only) \??\M: plast.exe File opened (read-only) \??\Y: plast.exe File opened (read-only) \??\O: plast.exe File opened (read-only) \??\F: plast.exe File opened (read-only) \??\J: plast.exe File opened (read-only) \??\L: plast.exe File opened (read-only) \??\N: plast.exe File opened (read-only) \??\G: plast.exe File opened (read-only) \??\H: plast.exe File opened (read-only) \??\Q: plast.exe File opened (read-only) \??\W: plast.exe File opened (read-only) \??\T: plast.exe File opened (read-only) \??\I: plast.exe File opened (read-only) \??\P: plast.exe File opened (read-only) \??\S: plast.exe File opened (read-only) \??\K: plast.exe File opened (read-only) \??\Z: plast.exe File opened (read-only) \??\V: plast.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 1456 vssadmin.exe 2148 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
plast.exepid process 1892 plast.exe 1892 plast.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 2812 vssvc.exe Token: SeRestorePrivilege 2812 vssvc.exe Token: SeAuditPrivilege 2812 vssvc.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
plast.execmd.execmd.exedescription pid process target process PID 1892 wrote to memory of 1116 1892 plast.exe cmd.exe PID 1892 wrote to memory of 1116 1892 plast.exe cmd.exe PID 1116 wrote to memory of 1456 1116 cmd.exe vssadmin.exe PID 1116 wrote to memory of 1456 1116 cmd.exe vssadmin.exe PID 1892 wrote to memory of 3600 1892 plast.exe cmd.exe PID 1892 wrote to memory of 3600 1892 plast.exe cmd.exe PID 3600 wrote to memory of 2148 3600 cmd.exe vssadmin.exe PID 3600 wrote to memory of 2148 3600 cmd.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\plast.exe"C:\Users\Admin\AppData\Local\Temp\plast.exe"1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1456
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2148
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2812