Analysis
-
max time kernel
4294182s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20220311-en -
submitted
10-04-2022 03:42
Static task
static1
Behavioral task
behavioral1
Sample
c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.exe
Resource
win7-20220311-en
Behavioral task
behavioral2
Sample
c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.exe
Resource
win10v2004-20220310-en
General
-
Target
c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.exe
-
Size
308KB
-
MD5
75a6690d9a4a89bd0cf6ceebcffd3c41
-
SHA1
678ddaaaa14fcd7b90bfa2b673221378e032fdbf
-
SHA256
c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24
-
SHA512
37273a97459d3624e77c8b586acbed6836a88d9c4975625a654f55eccdabeb9d4dcd55598779ec7bfe3e682e725597468ef59fee9e18263a3a00c86bf962e526
Malware Config
Extracted
C:\How To Restore Your Files.txt
1E6cvG6iEbufvYspsDa3XQ3WJgEMvRTm9i
Signatures
-
Babuk Locker
RaaS first seen in 2021 initially called Vasa Locker.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 6 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.exedescription ioc process File renamed C:\Users\Admin\Pictures\InitializeMount.crw => C:\Users\Admin\Pictures\InitializeMount.crw.babyk c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.exe File opened for modification C:\Users\Admin\Pictures\InitializeMount.crw.babyk c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.exe File renamed C:\Users\Admin\Pictures\ExitRestore.png => C:\Users\Admin\Pictures\ExitRestore.png.babyk c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.exe File opened for modification C:\Users\Admin\Pictures\ExitRestore.png.babyk c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.exe File renamed C:\Users\Admin\Pictures\InvokeGrant.raw => C:\Users\Admin\Pictures\InvokeGrant.raw.babyk c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.exe File opened for modification C:\Users\Admin\Pictures\InvokeGrant.raw.babyk c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.exedescription ioc process File opened (read-only) \??\H: c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.exe File opened (read-only) \??\J: c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.exe File opened (read-only) \??\N: c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.exe File opened (read-only) \??\E: c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.exe File opened (read-only) \??\T: c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.exe File opened (read-only) \??\F: c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.exe File opened (read-only) \??\G: c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.exe File opened (read-only) \??\V: c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.exe File opened (read-only) \??\B: c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.exe File opened (read-only) \??\M: c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.exe File opened (read-only) \??\Q: c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.exe File opened (read-only) \??\R: c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.exe File opened (read-only) \??\P: c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.exe File opened (read-only) \??\O: c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.exe File opened (read-only) \??\S: c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.exe File opened (read-only) \??\Z: c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.exe File opened (read-only) \??\X: c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.exe File opened (read-only) \??\W: c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.exe File opened (read-only) \??\Y: c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.exe File opened (read-only) \??\I: c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.exe File opened (read-only) \??\L: c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.exe File opened (read-only) \??\U: c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.exe File opened (read-only) \??\A: c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.exe File opened (read-only) \??\K: c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 892 vssadmin.exe 1800 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.exepid process 1968 c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 792 vssvc.exe Token: SeRestorePrivilege 792 vssvc.exe Token: SeAuditPrivilege 792 vssvc.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.execmd.execmd.exedescription pid process target process PID 1968 wrote to memory of 1992 1968 c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.exe cmd.exe PID 1968 wrote to memory of 1992 1968 c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.exe cmd.exe PID 1968 wrote to memory of 1992 1968 c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.exe cmd.exe PID 1968 wrote to memory of 1992 1968 c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.exe cmd.exe PID 1992 wrote to memory of 892 1992 cmd.exe vssadmin.exe PID 1992 wrote to memory of 892 1992 cmd.exe vssadmin.exe PID 1992 wrote to memory of 892 1992 cmd.exe vssadmin.exe PID 1968 wrote to memory of 1836 1968 c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.exe cmd.exe PID 1968 wrote to memory of 1836 1968 c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.exe cmd.exe PID 1968 wrote to memory of 1836 1968 c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.exe cmd.exe PID 1968 wrote to memory of 1836 1968 c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.exe cmd.exe PID 1836 wrote to memory of 1800 1836 cmd.exe vssadmin.exe PID 1836 wrote to memory of 1800 1836 cmd.exe vssadmin.exe PID 1836 wrote to memory of 1800 1836 cmd.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.exe"C:\Users\Admin\AppData\Local\Temp\c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.exe"1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:892 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1800
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:792