Analysis
-
max time kernel
6s -
max time network
13s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
11-05-2021 01:17
Static task
static1
Behavioral task
behavioral1
Sample
1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe
Resource
win10v20210410
General
-
Target
1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe
-
Size
79KB
-
MD5
f0d4c7d334633a72a3c7bd722e12c378
-
SHA1
5240f71f60c473b5f9ba100d2ce1d6effdbc08c1
-
SHA256
1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1
-
SHA512
780809b5b877b3d693179d7635dadd80b0aa5e2943761b7623d0d923a34979cad363f4b5c2fcca22105a48c4dc34a71af5624cc28aaf0d086559aa206d9e315c
Malware Config
Extracted
C:\How To Restore Your Files.txt
http://wavbeudogz6byhnardd2lkp2jafims3j7tj6k6qnywchn2csngvtffqd.onion/
http://os3xs2l3ftdqeuhxyuo4e6ymxvknp3gx6abordkcjde4coe37k66xyid.onion/4ee7ff7421bcb2ab35c523623ce11174c037e7db0562578b8a245630fc16a047
Signatures
-
Babuk Locker
RaaS first seen in 2021 initially called Vasa Locker.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 2 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\SelectCheckpoint.crw => C:\Users\Admin\Pictures\SelectCheckpoint.crw.babyk 1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe File opened for modification C:\Users\Admin\Pictures\SelectCheckpoint.crw.babyk 1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: 1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe File opened (read-only) \??\G: 1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe File opened (read-only) \??\M: 1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe File opened (read-only) \??\V: 1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe File opened (read-only) \??\U: 1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe File opened (read-only) \??\A: 1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe File opened (read-only) \??\K: 1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe File opened (read-only) \??\L: 1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe File opened (read-only) \??\X: 1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe File opened (read-only) \??\T: 1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe File opened (read-only) \??\Y: 1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe File opened (read-only) \??\P: 1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe File opened (read-only) \??\H: 1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe File opened (read-only) \??\N: 1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe File opened (read-only) \??\S: 1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe File opened (read-only) \??\F: 1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe File opened (read-only) \??\J: 1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe File opened (read-only) \??\Q: 1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe File opened (read-only) \??\W: 1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe File opened (read-only) \??\E: 1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe File opened (read-only) \??\I: 1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe File opened (read-only) \??\O: 1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe File opened (read-only) \??\Z: 1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe File opened (read-only) \??\B: 1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1060 vssadmin.exe 1284 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1200 1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 1780 vssvc.exe Token: SeRestorePrivilege 1780 vssvc.exe Token: SeAuditPrivilege 1780 vssvc.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1200 wrote to memory of 1188 1200 1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe 25 PID 1200 wrote to memory of 1188 1200 1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe 25 PID 1200 wrote to memory of 1188 1200 1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe 25 PID 1200 wrote to memory of 1188 1200 1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe 25 PID 1188 wrote to memory of 1060 1188 cmd.exe 28 PID 1188 wrote to memory of 1060 1188 cmd.exe 28 PID 1188 wrote to memory of 1060 1188 cmd.exe 28 PID 1200 wrote to memory of 1644 1200 1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe 31 PID 1200 wrote to memory of 1644 1200 1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe 31 PID 1200 wrote to memory of 1644 1200 1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe 31 PID 1200 wrote to memory of 1644 1200 1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe 31 PID 1644 wrote to memory of 1284 1644 cmd.exe 36 PID 1644 wrote to memory of 1284 1644 cmd.exe 36 PID 1644 wrote to memory of 1284 1644 cmd.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe"C:\Users\Admin\AppData\Local\Temp\1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe"1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1060
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1284
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1780