Analysis
-
max time kernel
153s -
max time network
129s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
26-08-2021 07:15
Static task
static1
Behavioral task
behavioral1
Sample
d30f4f3ab220d45783b08baec0e322ee10841beed00dc6ff00569ac5d02709fd.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
-
Target
d30f4f3ab220d45783b08baec0e322ee10841beed00dc6ff00569ac5d02709fd.exe
-
Size
172KB
-
MD5
a8d41cdb1096e641af72ae7dfa954433
-
SHA1
492971020433977d73baa18080c5615fc28f6e9a
-
SHA256
d30f4f3ab220d45783b08baec0e322ee10841beed00dc6ff00569ac5d02709fd
-
SHA512
875f98193a106c6f241f1eda58e720dd2351a7dae1abe5dd312bb9127866d0e11c4a9130177dfaf197750f4eace1367489eb50515b3bac6c944ae39609b875a8
Malware Config
Extracted
Path
C:\Documents and Settings\How To Restore Your Files.txt
Ransom Note
Hi, friend.
Your files are encrypted. And you can't do anything with them. If you want to restore them, contact us via telegram @username312321
Price - 350 $
You can pay with BTC - bc1qd53hpk76zutapw8tsgnnkeuuuhuk4ecr2wrd93
Wallets
bc1qd53hpk76zutapw8tsgnnkeuuuhuk4ecr2wrd93
Extracted
Family
smokeloader
Version
2020
C2
http://aucmoney.com/upload/
http://thegymmum.com/upload/
http://atvcampingtrips.com/upload/
http://kuapakualaman.com/upload/
http://renatazarazua.com/upload/
http://nasufmutlu.com/upload/
rc4.i32
rc4.i32
Signatures
-
Babuk Locker
RaaS first seen in 2021 initially called Vasa Locker.
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
pid Process 1236 685F.exe 2336 AudioB.exe 3576 AudioB.exe -
Modifies extensions of user files 27 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\GrantMount.tif.babyk AudioB.exe File renamed C:\Users\Admin\Pictures\MoveSave.crw => C:\Users\Admin\Pictures\MoveSave.crw.babyk AudioB.exe File opened for modification C:\Users\Admin\Pictures\ResetRead.raw.babyk AudioB.exe File opened for modification C:\Users\Admin\Pictures\DebugTrace.tif.babyk AudioB.exe File renamed C:\Users\Admin\Pictures\GrantMount.tif => C:\Users\Admin\Pictures\GrantMount.tif.babyk AudioB.exe File renamed C:\Users\Admin\Pictures\UseExport.png => C:\Users\Admin\Pictures\UseExport.png.babyk AudioB.exe File renamed C:\Users\Admin\Pictures\SetDisconnect.png => C:\Users\Admin\Pictures\SetDisconnect.png.babyk AudioB.exe File renamed C:\Users\Admin\Pictures\RenameGroup.raw => C:\Users\Admin\Pictures\RenameGroup.raw.babyk AudioB.exe File opened for modification C:\Users\Admin\Pictures\InstallClear.crw.babyk AudioB.exe File renamed C:\Users\Admin\Pictures\ImportEnter.raw => C:\Users\Admin\Pictures\ImportEnter.raw.babyk AudioB.exe File opened for modification C:\Users\Admin\Pictures\SearchSelect.tif.babyk AudioB.exe File opened for modification C:\Users\Admin\Pictures\BlockImport.tiff.babyk AudioB.exe File renamed C:\Users\Admin\Pictures\ResetGroup.png => C:\Users\Admin\Pictures\ResetGroup.png.babyk AudioB.exe File renamed C:\Users\Admin\Pictures\SearchSelect.tif => C:\Users\Admin\Pictures\SearchSelect.tif.babyk AudioB.exe File opened for modification C:\Users\Admin\Pictures\SetDisconnect.png.babyk AudioB.exe File opened for modification C:\Users\Admin\Pictures\RenameGroup.raw.babyk AudioB.exe File opened for modification C:\Users\Admin\Pictures\UpdateStart.png.babyk AudioB.exe File renamed C:\Users\Admin\Pictures\ResetRead.raw => C:\Users\Admin\Pictures\ResetRead.raw.babyk AudioB.exe File opened for modification C:\Users\Admin\Pictures\ResetGroup.png.babyk AudioB.exe File opened for modification C:\Users\Admin\Pictures\UseExport.png.babyk AudioB.exe File opened for modification C:\Users\Admin\Pictures\BlockImport.tiff AudioB.exe File renamed C:\Users\Admin\Pictures\BlockImport.tiff => C:\Users\Admin\Pictures\BlockImport.tiff.babyk AudioB.exe File renamed C:\Users\Admin\Pictures\InstallClear.crw => C:\Users\Admin\Pictures\InstallClear.crw.babyk AudioB.exe File opened for modification C:\Users\Admin\Pictures\MoveSave.crw.babyk AudioB.exe File opened for modification C:\Users\Admin\Pictures\ImportEnter.raw.babyk AudioB.exe File renamed C:\Users\Admin\Pictures\DebugTrace.tif => C:\Users\Admin\Pictures\DebugTrace.tif.babyk AudioB.exe File renamed C:\Users\Admin\Pictures\UpdateStart.png => C:\Users\Admin\Pictures\UpdateStart.png.babyk AudioB.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 685F.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 685F.exe -
Deletes itself 1 IoCs
pid Process 3024 Process not Found -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/files/0x000500000001ab56-118.dat themida behavioral1/files/0x000500000001ab56-119.dat themida behavioral1/memory/1236-122-0x0000000000970000-0x0000000000971000-memory.dmp themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 685F.exe -
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: AudioB.exe File opened (read-only) \??\I: AudioB.exe File opened (read-only) \??\O: AudioB.exe File opened (read-only) \??\P: AudioB.exe File opened (read-only) \??\S: AudioB.exe File opened (read-only) \??\V: AudioB.exe File opened (read-only) \??\W: AudioB.exe File opened (read-only) \??\T: AudioB.exe File opened (read-only) \??\G: AudioB.exe File opened (read-only) \??\H: AudioB.exe File opened (read-only) \??\Z: AudioB.exe File opened (read-only) \??\N: AudioB.exe File opened (read-only) \??\R: AudioB.exe File opened (read-only) \??\A: AudioB.exe File opened (read-only) \??\J: AudioB.exe File opened (read-only) \??\L: AudioB.exe File opened (read-only) \??\B: AudioB.exe File opened (read-only) \??\M: AudioB.exe File opened (read-only) \??\M: Process not Found File opened (read-only) \??\Q: AudioB.exe File opened (read-only) \??\F: AudioB.exe File opened (read-only) \??\K: AudioB.exe File opened (read-only) \??\X: AudioB.exe File opened (read-only) \??\E: AudioB.exe File opened (read-only) \??\Y: AudioB.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 1236 685F.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2336 set thread context of 3576 2336 AudioB.exe 82 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI d30f4f3ab220d45783b08baec0e322ee10841beed00dc6ff00569ac5d02709fd.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI d30f4f3ab220d45783b08baec0e322ee10841beed00dc6ff00569ac5d02709fd.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI d30f4f3ab220d45783b08baec0e322ee10841beed00dc6ff00569ac5d02709fd.exe -
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2368 vssadmin.exe 1712 vssadmin.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance Process not Found Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance Process not Found -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 664 d30f4f3ab220d45783b08baec0e322ee10841beed00dc6ff00569ac5d02709fd.exe 664 d30f4f3ab220d45783b08baec0e322ee10841beed00dc6ff00569ac5d02709fd.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3024 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 664 d30f4f3ab220d45783b08baec0e322ee10841beed00dc6ff00569ac5d02709fd.exe -
Suspicious use of AdjustPrivilegeToken 37 IoCs
description pid Process Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeDebugPrivilege 1236 685F.exe Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeDebugPrivilege 2336 AudioB.exe Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeBackupPrivilege 1884 vssvc.exe Token: SeRestorePrivilege 1884 vssvc.exe Token: SeAuditPrivilege 1884 vssvc.exe Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 3024 Process not Found 3024 Process not Found 3024 Process not Found -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 3024 Process not Found -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3024 Process not Found -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 3024 wrote to memory of 1236 3024 Process not Found 78 PID 3024 wrote to memory of 1236 3024 Process not Found 78 PID 3024 wrote to memory of 1236 3024 Process not Found 78 PID 1236 wrote to memory of 2336 1236 685F.exe 81 PID 1236 wrote to memory of 2336 1236 685F.exe 81 PID 1236 wrote to memory of 2336 1236 685F.exe 81 PID 2336 wrote to memory of 3576 2336 AudioB.exe 82 PID 2336 wrote to memory of 3576 2336 AudioB.exe 82 PID 2336 wrote to memory of 3576 2336 AudioB.exe 82 PID 2336 wrote to memory of 3576 2336 AudioB.exe 82 PID 2336 wrote to memory of 3576 2336 AudioB.exe 82 PID 2336 wrote to memory of 3576 2336 AudioB.exe 82 PID 2336 wrote to memory of 3576 2336 AudioB.exe 82 PID 2336 wrote to memory of 3576 2336 AudioB.exe 82 PID 2336 wrote to memory of 3576 2336 AudioB.exe 82 PID 2336 wrote to memory of 3576 2336 AudioB.exe 82 PID 3576 wrote to memory of 1404 3576 AudioB.exe 83 PID 3576 wrote to memory of 1404 3576 AudioB.exe 83 PID 1404 wrote to memory of 2368 1404 cmd.exe 85 PID 1404 wrote to memory of 2368 1404 cmd.exe 85 PID 3576 wrote to memory of 1720 3576 AudioB.exe 89 PID 3576 wrote to memory of 1720 3576 AudioB.exe 89 PID 1720 wrote to memory of 1712 1720 cmd.exe 91 PID 1720 wrote to memory of 1712 1720 cmd.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\d30f4f3ab220d45783b08baec0e322ee10841beed00dc6ff00569ac5d02709fd.exe"C:\Users\Admin\AppData\Local\Temp\d30f4f3ab220d45783b08baec0e322ee10841beed00dc6ff00569ac5d02709fd.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:664
-
C:\Users\Admin\AppData\Local\Temp\685F.exeC:\Users\Admin\AppData\Local\Temp\685F.exe1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\AudioB.exe"C:\Users\Admin\AppData\Local\Temp\AudioB.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\AudioB.exe"C:\Users\Admin\AppData\Local\Temp\AudioB.exe"3⤵
- Executes dropped EXE
- Modifies extensions of user files
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet4⤵
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet5⤵
- Interacts with shadow copies
PID:2368
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet4⤵
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet5⤵
- Interacts with shadow copies
PID:1712
-
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1884