Analysis

  • max time kernel
    122s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-en-20211104
  • submitted
    07-11-2021 10:36

General

  • Target

    a499f810c2e52fe9f8adcd5817b2d985.exe

  • Size

    79KB

  • MD5

    a499f810c2e52fe9f8adcd5817b2d985

  • SHA1

    b23523cc4d6092a90aeb4522b21f94c335864090

  • SHA256

    245e191bfe998ad9ef2d6b169af22f3c290e9950234f8ddd0f4a03cb3eebf761

  • SHA512

    16d277a56c8b864b0c22b28305ba442b33ca2e5e0be32d193a19887c4c9193c9e192e9e1638af4e40600508cc38c7004e3a18007f281ad1577e0c6a428a5ea5b

Score
10/10

Malware Config

Signatures

  • Babuk Locker

    RaaS first seen in 2021 initially called Vasa Locker.

  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Modifies extensions of user files 13 IoCs

    Ransomware generally changes the extension on encrypted files.

  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Interacts with shadow copies 2 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a499f810c2e52fe9f8adcd5817b2d985.exe
    "C:\Users\Admin\AppData\Local\Temp\a499f810c2e52fe9f8adcd5817b2d985.exe"
    1⤵
    • Modifies extensions of user files
    • Enumerates connected drives
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1168
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1196
      • C:\Windows\system32\vssadmin.exe
        vssadmin.exe delete shadows /all /quiet
        3⤵
        • Interacts with shadow copies
        PID:1652
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1780
      • C:\Windows\system32\vssadmin.exe
        vssadmin.exe delete shadows /all /quiet
        3⤵
        • Interacts with shadow copies
        PID:1048
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1504

Network

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

File Deletion

2
T1107

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Impact

Inhibit System Recovery

2
T1490

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1048-59-0x0000000000000000-mapping.dmp
  • memory/1168-55-0x00000000760C1000-0x00000000760C3000-memory.dmp
    Filesize

    8KB

  • memory/1196-56-0x0000000000000000-mapping.dmp
  • memory/1652-57-0x0000000000000000-mapping.dmp
  • memory/1780-58-0x0000000000000000-mapping.dmp