babuk | cb7cd5de34353ff74b8e1f829cffc8d9532b2652fe2d832fa5e57c30c5bde2a8

General

Target

e_win.bin.exe
Size

79KB
MD5

6ce7f33dc923d162788aa3236483701c
SHA1

97395d6f9474638c0d97596a0613aaea04daa547
SHA256

e2dc8fb92ff49643931fe736d002d42f2fb86ba5642ebf44ecbec674a77d8227
SHA512

0d5ac1d3e3e1ee34c94af6288f82ae663f32fb1383aa6b85f16a6691a139743e16f5a25cfcabbc8428d564cb297d90a381a2863c162a01876779c017ae2141df

Score

10^/10

babuk ransomware

Babuk Locker
RaaS first seen in 2021 initially called Vasa Locker.
ransomware babuk
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Modifies extensions of user files 7 IoCs

Ransomware generally changes the extension on encrypted files.

Processes:

e_win.bin.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\ImportSync.png => C:\Users\Admin\Pictures\ImportSync.png.babyk	e_win.bin.exe
File opened for modification	C:\Users\Admin\Pictures\ImportSync.png.babyk	e_win.bin.exe
File opened for modification	C:\Users\Admin\Pictures\InitializeFormat.tiff	e_win.bin.exe
File renamed	C:\Users\Admin\Pictures\InitializeFormat.tiff => C:\Users\Admin\Pictures\InitializeFormat.tiff.babyk	e_win.bin.exe
File opened for modification	C:\Users\Admin\Pictures\InitializeFormat.tiff.babyk	e_win.bin.exe
File renamed	C:\Users\Admin\Pictures\RestoreMove.png => C:\Users\Admin\Pictures\RestoreMove.png.babyk	e_win.bin.exe
File opened for modification	C:\Users\Admin\Pictures\RestoreMove.png.babyk	e_win.bin.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

System Information Discovery

Processes:

e_win.bin.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exevssadmin.exe

pid process

3560 vssadmin.exe
4008 vssadmin.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

e_win.bin.exe

pid process

3492 e_win.bin.exe
3492 e_win.bin.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

vssvc.exe

description pid process

Token: SeBackupPrivilege 200 vssvc.exe
Token: SeRestorePrivilege 200 vssvc.exe
Token: SeAuditPrivilege 200 vssvc.exe

pid	process
3560	vssadmin.exe
4008	vssadmin.exe

pid	process
3492	e_win.bin.exe
3492	e_win.bin.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

e_win.bin.execmd.execmd.exe

description	pid	process	target process
PID 3492 wrote to memory of 2560	3492	e_win.bin.exe	cmd.exe
PID 3492 wrote to memory of 2560	3492	e_win.bin.exe	cmd.exe
PID 2560 wrote to memory of 3560	2560	cmd.exe	vssadmin.exe
PID 2560 wrote to memory of 3560	2560	cmd.exe	vssadmin.exe
PID 3492 wrote to memory of 3760	3492	e_win.bin.exe	cmd.exe
PID 3492 wrote to memory of 3760	3492	e_win.bin.exe	cmd.exe
PID 3760 wrote to memory of 4008	3760	cmd.exe	vssadmin.exe
PID 3760 wrote to memory of 4008	3760	cmd.exe	vssadmin.exe

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet
2⤵
- Suspicious use of WriteProcessMemory
PID:2560

C:\Windows\system32\vssadmin.exe
vssadmin.exe delete shadows /all /quiet
3⤵
- Interacts with shadow copies
PID:3560

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet
2⤵
- Suspicious use of WriteProcessMemory
PID:3760