Analysis
-
max time kernel
15s -
max time network
113s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
11-05-2021 01:17
Static task
static1
Behavioral task
behavioral1
Sample
1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe
Resource
win10v20210410
General
-
Target
1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe
-
Size
79KB
-
MD5
f0d4c7d334633a72a3c7bd722e12c378
-
SHA1
5240f71f60c473b5f9ba100d2ce1d6effdbc08c1
-
SHA256
1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1
-
SHA512
780809b5b877b3d693179d7635dadd80b0aa5e2943761b7623d0d923a34979cad363f4b5c2fcca22105a48c4dc34a71af5624cc28aaf0d086559aa206d9e315c
Malware Config
Extracted
C:\How To Restore Your Files.txt
http://wavbeudogz6byhnardd2lkp2jafims3j7tj6k6qnywchn2csngvtffqd.onion/
http://os3xs2l3ftdqeuhxyuo4e6ymxvknp3gx6abordkcjde4coe37k66xyid.onion/4ee7ff7421bcb2ab35c523623ce11174c037e7db0562578b8a245630fc16a047
Signatures
-
Babuk Locker
RaaS first seen in 2021 initially called Vasa Locker.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 11 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exedescription ioc process File renamed C:\Users\Admin\Pictures\TraceExport.tif => C:\Users\Admin\Pictures\TraceExport.tif.babyk 1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe File renamed C:\Users\Admin\Pictures\UpdateComplete.png => C:\Users\Admin\Pictures\UpdateComplete.png.babyk 1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe File opened for modification C:\Users\Admin\Pictures\UpdateComplete.png.babyk 1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe File renamed C:\Users\Admin\Pictures\WaitBackup.tif => C:\Users\Admin\Pictures\WaitBackup.tif.babyk 1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe File opened for modification C:\Users\Admin\Pictures\WaitBackup.tif.babyk 1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe File renamed C:\Users\Admin\Pictures\StartUninstall.tif => C:\Users\Admin\Pictures\StartUninstall.tif.babyk 1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe File renamed C:\Users\Admin\Pictures\ResolveHide.tiff => C:\Users\Admin\Pictures\ResolveHide.tiff.babyk 1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe File opened for modification C:\Users\Admin\Pictures\ResolveHide.tiff.babyk 1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe File opened for modification C:\Users\Admin\Pictures\StartUninstall.tif.babyk 1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe File opened for modification C:\Users\Admin\Pictures\TraceExport.tif.babyk 1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe File opened for modification C:\Users\Admin\Pictures\ResolveHide.tiff 1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exedescription ioc process File opened (read-only) \??\I: 1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe File opened (read-only) \??\P: 1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe File opened (read-only) \??\F: 1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe File opened (read-only) \??\K: 1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe File opened (read-only) \??\L: 1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe File opened (read-only) \??\W: 1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe File opened (read-only) \??\E: 1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe File opened (read-only) \??\Y: 1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe File opened (read-only) \??\A: 1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe File opened (read-only) \??\X: 1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe File opened (read-only) \??\B: 1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe File opened (read-only) \??\U: 1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe File opened (read-only) \??\S: 1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe File opened (read-only) \??\G: 1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe File opened (read-only) \??\N: 1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe File opened (read-only) \??\M: 1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe File opened (read-only) \??\Q: 1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe File opened (read-only) \??\R: 1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe File opened (read-only) \??\T: 1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe File opened (read-only) \??\Z: 1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe File opened (read-only) \??\V: 1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe File opened (read-only) \??\O: 1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe File opened (read-only) \??\H: 1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe File opened (read-only) \??\J: 1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 2612 vssadmin.exe 692 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exepid process 3400 1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe 3400 1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 188 vssvc.exe Token: SeRestorePrivilege 188 vssvc.exe Token: SeAuditPrivilege 188 vssvc.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.execmd.execmd.exedescription pid process target process PID 3400 wrote to memory of 1032 3400 1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe cmd.exe PID 3400 wrote to memory of 1032 3400 1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe cmd.exe PID 1032 wrote to memory of 2612 1032 cmd.exe vssadmin.exe PID 1032 wrote to memory of 2612 1032 cmd.exe vssadmin.exe PID 3400 wrote to memory of 4004 3400 1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe cmd.exe PID 3400 wrote to memory of 4004 3400 1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe cmd.exe PID 4004 wrote to memory of 692 4004 cmd.exe vssadmin.exe PID 4004 wrote to memory of 692 4004 cmd.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe"C:\Users\Admin\AppData\Local\Temp\1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1.exe"1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2612
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:692
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:188