Analysis

  • max time kernel
    44s
  • max time network
    48s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    25-05-2022 15:53

General

  • Target

    admin-panel.exe

  • Size

    79KB

  • MD5

    566b19ddc6c735e6b8bd24d766b27d95

  • SHA1

    18cf7b695f958a48fb54fe8faca8c72e9709bc40

  • SHA256

    1a8cc49359906456588745440b5378bcaeaf606b1fe52128d46aacb2658985f8

  • SHA512

    570f1ae1e156965dbad7f37afe05b6f5db55e716964452f73cc5f3fef81e5e90e8d55b1539ab6545462a05dbef47b9b7bf0d319eecd1414666d3ae8563fa38c6

Score
10/10

Malware Config

Signatures 10

  • Babuk Locker

    RaaS first seen in 2021 initially called Vasa Locker.

  • Deletes shadow copies ⋅ 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Modifies extensions of user files ⋅ 13 IoCs

    Ransomware generally changes the extension on encrypted files.

  • Enumerates connected drives ⋅ 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices ⋅ 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Interacts with shadow copies ⋅ 2 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

  • Suspicious behavior: EnumeratesProcesses ⋅ 1 IoCs
  • Suspicious use of AdjustPrivilegeToken ⋅ 3 IoCs
  • Suspicious use of FindShellTrayWindow ⋅ 1 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 14 IoCs

Processes 7

  • C:\Users\Admin\AppData\Local\Temp\admin-panel.exe
    "C:\Users\Admin\AppData\Local\Temp\admin-panel.exe"
    Modifies extensions of user files
    Enumerates connected drives
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of WriteProcessMemory
    PID:1100
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet
      Suspicious use of WriteProcessMemory
      PID:1952
      • C:\Windows\system32\vssadmin.exe
        vssadmin.exe delete shadows /all /quiet
        Interacts with shadow copies
        PID:988
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet
      Suspicious use of WriteProcessMemory
      PID:1200
      • C:\Windows\system32\vssadmin.exe
        vssadmin.exe delete shadows /all /quiet
        Interacts with shadow copies
        PID:1624
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    Suspicious use of AdjustPrivilegeToken
    PID:1988
  • C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\How To Restore Your Files.txt
    Suspicious use of FindShellTrayWindow
    PID:1552

Network

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

        Execution

          Exfiltration

            Initial Access

              Lateral Movement

                Persistence

                  Privilege Escalation

                    Replay Monitor

                    00:00 00:00

                    Downloads

                    • C:\Users\Admin\Desktop\How To Restore Your Files.txt
                      MD5

                      ccfcc9e6a60392ec2f832db0b01ce791

                      SHA1

                      c8423c7eafad174cab1b9c9483d6e65fb7166f98

                      SHA256

                      a1b838ccba717c1e8689a626aace8df78aa683c0b18393a865df804729688f22

                      SHA512

                      2f3a2d2b8ff4f72b73aeb6bf2935d7e4fbee9c71f56e0c79537e5c56d321af795cc8ab9b478161c5979b0d2c9637206ff42d9c461e45d0c75b2cb4d6c554680e

                    • memory/988-56-0x0000000000000000-mapping.dmp
                    • memory/1100-54-0x0000000074B51000-0x0000000074B53000-memory.dmp
                    • memory/1200-57-0x0000000000000000-mapping.dmp
                    • memory/1552-59-0x000007FEFB5D1000-0x000007FEFB5D3000-memory.dmp
                    • memory/1624-58-0x0000000000000000-mapping.dmp
                    • memory/1952-55-0x0000000000000000-mapping.dmp