Analysis
-
max time kernel
115s -
max time network
165s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
06-03-2022 05:47
Static task
static1
Behavioral task
behavioral1
Sample
58ccba4fb2b3ed8b5f92adddd6ee331a6afdedfc755145e0432a7cb324c28053.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
58ccba4fb2b3ed8b5f92adddd6ee331a6afdedfc755145e0432a7cb324c28053.exe
Resource
win10v2004-en-20220112
General
-
Target
58ccba4fb2b3ed8b5f92adddd6ee331a6afdedfc755145e0432a7cb324c28053.exe
-
Size
29KB
-
MD5
67e49cfcd12103b5ef2f9f331f092dbe
-
SHA1
72cad5a81ce546b42844b5b8fc2ab55e99f2b5d4
-
SHA256
58ccba4fb2b3ed8b5f92adddd6ee331a6afdedfc755145e0432a7cb324c28053
-
SHA512
21fa0d1be0d5be2da8c4c68357e1e294503d87c21a304c5811669eaa9aba29b6cfcd077d083547e2f41269b12c6a8da5ad2ea0f1613d9a96917ea01c69fcb087
Malware Config
Extracted
C:\odt\How To Restore Your Files.txt
http://babukq4e2p4wu4iq.onion/login.php?id=dKK7wnOiVHoXdqSrVcb1gxKpC9JICQ
http://gtmx56k4hutn3ikv.onion/?dUIel0o8kfjZf4zUHDbm
https://temp.sh/fVAxj/1.png
https://temp.sh/VZRcj/2.png
https://temp.sh/qpkLy/3.png
https://temp.sh/hPkTt/4.png
https://temp.sh/ENvac/5.png
https://temp.sh/YzAJd/6.png
https://temp.sh/eBGdx/7.png
https://temp.sh/KAXUW/8.png
Signatures
-
Babuk Locker
RaaS first seen in 2021 initially called Vasa Locker.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 13 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
58ccba4fb2b3ed8b5f92adddd6ee331a6afdedfc755145e0432a7cb324c28053.exedescription ioc process File renamed C:\Users\Admin\Pictures\WatchExport.tiff => C:\Users\Admin\Pictures\WatchExport.tiff.babyk 58ccba4fb2b3ed8b5f92adddd6ee331a6afdedfc755145e0432a7cb324c28053.exe File opened for modification C:\Users\Admin\Pictures\WatchExport.tiff.babyk 58ccba4fb2b3ed8b5f92adddd6ee331a6afdedfc755145e0432a7cb324c28053.exe File opened for modification C:\Users\Admin\Pictures\CompressBackup.crw.babyk 58ccba4fb2b3ed8b5f92adddd6ee331a6afdedfc755145e0432a7cb324c28053.exe File renamed C:\Users\Admin\Pictures\InitializeOut.tif => C:\Users\Admin\Pictures\InitializeOut.tif.babyk 58ccba4fb2b3ed8b5f92adddd6ee331a6afdedfc755145e0432a7cb324c28053.exe File opened for modification C:\Users\Admin\Pictures\RequestSuspend.crw.babyk 58ccba4fb2b3ed8b5f92adddd6ee331a6afdedfc755145e0432a7cb324c28053.exe File opened for modification C:\Users\Admin\Pictures\ResetStart.crw.babyk 58ccba4fb2b3ed8b5f92adddd6ee331a6afdedfc755145e0432a7cb324c28053.exe File renamed C:\Users\Admin\Pictures\TraceGet.crw => C:\Users\Admin\Pictures\TraceGet.crw.babyk 58ccba4fb2b3ed8b5f92adddd6ee331a6afdedfc755145e0432a7cb324c28053.exe File opened for modification C:\Users\Admin\Pictures\WatchExport.tiff 58ccba4fb2b3ed8b5f92adddd6ee331a6afdedfc755145e0432a7cb324c28053.exe File renamed C:\Users\Admin\Pictures\CompressBackup.crw => C:\Users\Admin\Pictures\CompressBackup.crw.babyk 58ccba4fb2b3ed8b5f92adddd6ee331a6afdedfc755145e0432a7cb324c28053.exe File opened for modification C:\Users\Admin\Pictures\InitializeOut.tif.babyk 58ccba4fb2b3ed8b5f92adddd6ee331a6afdedfc755145e0432a7cb324c28053.exe File renamed C:\Users\Admin\Pictures\RequestSuspend.crw => C:\Users\Admin\Pictures\RequestSuspend.crw.babyk 58ccba4fb2b3ed8b5f92adddd6ee331a6afdedfc755145e0432a7cb324c28053.exe File renamed C:\Users\Admin\Pictures\ResetStart.crw => C:\Users\Admin\Pictures\ResetStart.crw.babyk 58ccba4fb2b3ed8b5f92adddd6ee331a6afdedfc755145e0432a7cb324c28053.exe File opened for modification C:\Users\Admin\Pictures\TraceGet.crw.babyk 58ccba4fb2b3ed8b5f92adddd6ee331a6afdedfc755145e0432a7cb324c28053.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
58ccba4fb2b3ed8b5f92adddd6ee331a6afdedfc755145e0432a7cb324c28053.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation 58ccba4fb2b3ed8b5f92adddd6ee331a6afdedfc755145e0432a7cb324c28053.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
58ccba4fb2b3ed8b5f92adddd6ee331a6afdedfc755145e0432a7cb324c28053.exedescription ioc process File opened (read-only) \??\N: 58ccba4fb2b3ed8b5f92adddd6ee331a6afdedfc755145e0432a7cb324c28053.exe File opened (read-only) \??\I: 58ccba4fb2b3ed8b5f92adddd6ee331a6afdedfc755145e0432a7cb324c28053.exe File opened (read-only) \??\O: 58ccba4fb2b3ed8b5f92adddd6ee331a6afdedfc755145e0432a7cb324c28053.exe File opened (read-only) \??\H: 58ccba4fb2b3ed8b5f92adddd6ee331a6afdedfc755145e0432a7cb324c28053.exe File opened (read-only) \??\J: 58ccba4fb2b3ed8b5f92adddd6ee331a6afdedfc755145e0432a7cb324c28053.exe File opened (read-only) \??\X: 58ccba4fb2b3ed8b5f92adddd6ee331a6afdedfc755145e0432a7cb324c28053.exe File opened (read-only) \??\V: 58ccba4fb2b3ed8b5f92adddd6ee331a6afdedfc755145e0432a7cb324c28053.exe File opened (read-only) \??\M: 58ccba4fb2b3ed8b5f92adddd6ee331a6afdedfc755145e0432a7cb324c28053.exe File opened (read-only) \??\E: 58ccba4fb2b3ed8b5f92adddd6ee331a6afdedfc755145e0432a7cb324c28053.exe File opened (read-only) \??\T: 58ccba4fb2b3ed8b5f92adddd6ee331a6afdedfc755145e0432a7cb324c28053.exe File opened (read-only) \??\P: 58ccba4fb2b3ed8b5f92adddd6ee331a6afdedfc755145e0432a7cb324c28053.exe File opened (read-only) \??\S: 58ccba4fb2b3ed8b5f92adddd6ee331a6afdedfc755145e0432a7cb324c28053.exe File opened (read-only) \??\A: 58ccba4fb2b3ed8b5f92adddd6ee331a6afdedfc755145e0432a7cb324c28053.exe File opened (read-only) \??\B: 58ccba4fb2b3ed8b5f92adddd6ee331a6afdedfc755145e0432a7cb324c28053.exe File opened (read-only) \??\Q: 58ccba4fb2b3ed8b5f92adddd6ee331a6afdedfc755145e0432a7cb324c28053.exe File opened (read-only) \??\W: 58ccba4fb2b3ed8b5f92adddd6ee331a6afdedfc755145e0432a7cb324c28053.exe File opened (read-only) \??\Y: 58ccba4fb2b3ed8b5f92adddd6ee331a6afdedfc755145e0432a7cb324c28053.exe File opened (read-only) \??\U: 58ccba4fb2b3ed8b5f92adddd6ee331a6afdedfc755145e0432a7cb324c28053.exe File opened (read-only) \??\L: 58ccba4fb2b3ed8b5f92adddd6ee331a6afdedfc755145e0432a7cb324c28053.exe File opened (read-only) \??\Z: 58ccba4fb2b3ed8b5f92adddd6ee331a6afdedfc755145e0432a7cb324c28053.exe File opened (read-only) \??\R: 58ccba4fb2b3ed8b5f92adddd6ee331a6afdedfc755145e0432a7cb324c28053.exe File opened (read-only) \??\F: 58ccba4fb2b3ed8b5f92adddd6ee331a6afdedfc755145e0432a7cb324c28053.exe File opened (read-only) \??\G: 58ccba4fb2b3ed8b5f92adddd6ee331a6afdedfc755145e0432a7cb324c28053.exe File opened (read-only) \??\K: 58ccba4fb2b3ed8b5f92adddd6ee331a6afdedfc755145e0432a7cb324c28053.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 2548 vssadmin.exe 3244 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
58ccba4fb2b3ed8b5f92adddd6ee331a6afdedfc755145e0432a7cb324c28053.exepid process 3676 58ccba4fb2b3ed8b5f92adddd6ee331a6afdedfc755145e0432a7cb324c28053.exe 3676 58ccba4fb2b3ed8b5f92adddd6ee331a6afdedfc755145e0432a7cb324c28053.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 1940 vssvc.exe Token: SeRestorePrivilege 1940 vssvc.exe Token: SeAuditPrivilege 1940 vssvc.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
58ccba4fb2b3ed8b5f92adddd6ee331a6afdedfc755145e0432a7cb324c28053.execmd.execmd.exedescription pid process target process PID 3676 wrote to memory of 1616 3676 58ccba4fb2b3ed8b5f92adddd6ee331a6afdedfc755145e0432a7cb324c28053.exe cmd.exe PID 3676 wrote to memory of 1616 3676 58ccba4fb2b3ed8b5f92adddd6ee331a6afdedfc755145e0432a7cb324c28053.exe cmd.exe PID 1616 wrote to memory of 2548 1616 cmd.exe vssadmin.exe PID 1616 wrote to memory of 2548 1616 cmd.exe vssadmin.exe PID 3676 wrote to memory of 3888 3676 58ccba4fb2b3ed8b5f92adddd6ee331a6afdedfc755145e0432a7cb324c28053.exe cmd.exe PID 3676 wrote to memory of 3888 3676 58ccba4fb2b3ed8b5f92adddd6ee331a6afdedfc755145e0432a7cb324c28053.exe cmd.exe PID 3888 wrote to memory of 3244 3888 cmd.exe vssadmin.exe PID 3888 wrote to memory of 3244 3888 cmd.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\58ccba4fb2b3ed8b5f92adddd6ee331a6afdedfc755145e0432a7cb324c28053.exe"C:\Users\Admin\AppData\Local\Temp\58ccba4fb2b3ed8b5f92adddd6ee331a6afdedfc755145e0432a7cb324c28053.exe"1⤵
- Modifies extensions of user files
- Checks computer location settings
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2548 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:3244
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1940