babuk | ea95f131bd9b49104d9e7ae83335254549ded9d71d557c6e4746740aecca2c85

General

Target

e_win.exe
Size

79KB
MD5

e5adc80639046a5c69bcfeee458e0833
SHA1

d9e3f9edda5df290b5be6fb1d335b750dd7c6758
SHA256

ea95f131bd9b49104d9e7ae83335254549ded9d71d557c6e4746740aecca2c85
SHA512

c11a24e14ba5fa2b0e2c2b544dd4218ce4c8caae3db7cebd5b0305223f96bde09c9bd237cb8d32768f30118f7be73240971e772f7a89db7c0fba5c6105107e3a

Score

10^/10

babuk ransomware

Babuk Locker
RaaS first seen in 2021 initially called Vasa Locker.
ransomware babuk
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Modifies extensions of user files 4 IoCs

Ransomware generally changes the extension on encrypted files.

Processes:

e_win.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\ConfirmUpdate.raw => C:\Users\Admin\Pictures\ConfirmUpdate.raw.babyk	e_win.exe
File opened for modification	C:\Users\Admin\Pictures\ConfirmUpdate.raw.babyk	e_win.exe
File renamed	C:\Users\Admin\Pictures\MoveRevoke.crw => C:\Users\Admin\Pictures\MoveRevoke.crw.babyk	e_win.exe
File opened for modification	C:\Users\Admin\Pictures\MoveRevoke.crw.babyk	e_win.exe

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

e_win.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation e_win.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	e_win.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

System Information Discovery

Processes:

e_win.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exevssadmin.exe

pid process

1160 vssadmin.exe
5028 vssadmin.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

e_win.exe

pid process

1228 e_win.exe
1228 e_win.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

vssvc.exe

description pid process

Token: SeBackupPrivilege 1472 vssvc.exe
Token: SeRestorePrivilege 1472 vssvc.exe
Token: SeAuditPrivilege 1472 vssvc.exe

pid	process
1160	vssadmin.exe
5028	vssadmin.exe

pid	process
1228	e_win.exe
1228	e_win.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

e_win.execmd.execmd.exe

description	pid	process	target process
PID 1228 wrote to memory of 4068	1228	e_win.exe	cmd.exe
PID 1228 wrote to memory of 4068	1228	e_win.exe	cmd.exe
PID 4068 wrote to memory of 5028	4068	cmd.exe	vssadmin.exe
PID 4068 wrote to memory of 5028	4068	cmd.exe	vssadmin.exe
PID 1228 wrote to memory of 3940	1228	e_win.exe	cmd.exe
PID 1228 wrote to memory of 3940	1228	e_win.exe	cmd.exe
PID 3940 wrote to memory of 1160	3940	cmd.exe	vssadmin.exe
PID 3940 wrote to memory of 1160	3940	cmd.exe	vssadmin.exe

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet
2⤵
- Suspicious use of WriteProcessMemory
PID:4068

C:\Windows\system32\vssadmin.exe
vssadmin.exe delete shadows /all /quiet
3⤵
- Interacts with shadow copies
PID:5028

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet
2⤵
- Suspicious use of WriteProcessMemory
PID:3940