Analysis
-
max time kernel
45s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
07-12-2022 11:01
Static task
static1
Behavioral task
behavioral1
Sample
315d992d260498b9757bfedf95e8dec79f934c5e0139c696d5ba581508921a68.exe
Resource
win7-20220901-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
315d992d260498b9757bfedf95e8dec79f934c5e0139c696d5ba581508921a68.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
315d992d260498b9757bfedf95e8dec79f934c5e0139c696d5ba581508921a68.exe
-
Size
79KB
-
MD5
42f5327e3e5a4b238ec51ce0fa5f2e33
-
SHA1
64a39bd9b347a99d9d9bfc54c145ffb076082c26
-
SHA256
315d992d260498b9757bfedf95e8dec79f934c5e0139c696d5ba581508921a68
-
SHA512
528d652bd1900b9e979352f7e4707c0f82fea3260147d3d67cad6bb03b1afa5c95a8b83b820ccacd20c4c93481b0afd4fc73d9dafb6c1beaa7f0ef653e818589
-
SSDEEP
1536:96UhZM4hubesrQLOJgY8ZZP8LHD4XWaNH71dLdG1iiFM2iG2zs4:ZhZ5YesrQLOJgY8Zp8LHD4XWaNH71dLI
Score
10/10
Malware Config
Signatures
-
Babuk Locker
RaaS first seen in 2021 initially called Vasa Locker.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 20 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\DismountOpen.raw.babyk 315d992d260498b9757bfedf95e8dec79f934c5e0139c696d5ba581508921a68.exe File opened for modification C:\Users\Admin\Pictures\InvokeExit.png.babyk 315d992d260498b9757bfedf95e8dec79f934c5e0139c696d5ba581508921a68.exe File renamed C:\Users\Admin\Pictures\ResumeConvertFrom.png => C:\Users\Admin\Pictures\ResumeConvertFrom.png.babyk 315d992d260498b9757bfedf95e8dec79f934c5e0139c696d5ba581508921a68.exe File opened for modification C:\Users\Admin\Pictures\ShowWait.png.babyk 315d992d260498b9757bfedf95e8dec79f934c5e0139c696d5ba581508921a68.exe File opened for modification C:\Users\Admin\Pictures\UnregisterAssert.tif.babyk 315d992d260498b9757bfedf95e8dec79f934c5e0139c696d5ba581508921a68.exe File opened for modification C:\Users\Admin\Pictures\UseAdd.png.babyk 315d992d260498b9757bfedf95e8dec79f934c5e0139c696d5ba581508921a68.exe File opened for modification C:\Users\Admin\Pictures\EnableAssert.tif.babyk 315d992d260498b9757bfedf95e8dec79f934c5e0139c696d5ba581508921a68.exe File opened for modification C:\Users\Admin\Pictures\GrantLimit.raw.babyk 315d992d260498b9757bfedf95e8dec79f934c5e0139c696d5ba581508921a68.exe File renamed C:\Users\Admin\Pictures\ReadClose.crw => C:\Users\Admin\Pictures\ReadClose.crw.babyk 315d992d260498b9757bfedf95e8dec79f934c5e0139c696d5ba581508921a68.exe File opened for modification C:\Users\Admin\Pictures\ResumeConvertFrom.png.babyk 315d992d260498b9757bfedf95e8dec79f934c5e0139c696d5ba581508921a68.exe File renamed C:\Users\Admin\Pictures\ShowWait.png => C:\Users\Admin\Pictures\ShowWait.png.babyk 315d992d260498b9757bfedf95e8dec79f934c5e0139c696d5ba581508921a68.exe File renamed C:\Users\Admin\Pictures\UseAdd.png => C:\Users\Admin\Pictures\UseAdd.png.babyk 315d992d260498b9757bfedf95e8dec79f934c5e0139c696d5ba581508921a68.exe File renamed C:\Users\Admin\Pictures\EnableAssert.tif => C:\Users\Admin\Pictures\EnableAssert.tif.babyk 315d992d260498b9757bfedf95e8dec79f934c5e0139c696d5ba581508921a68.exe File renamed C:\Users\Admin\Pictures\GrantLimit.raw => C:\Users\Admin\Pictures\GrantLimit.raw.babyk 315d992d260498b9757bfedf95e8dec79f934c5e0139c696d5ba581508921a68.exe File renamed C:\Users\Admin\Pictures\InvokeExit.png => C:\Users\Admin\Pictures\InvokeExit.png.babyk 315d992d260498b9757bfedf95e8dec79f934c5e0139c696d5ba581508921a68.exe File opened for modification C:\Users\Admin\Pictures\SplitClear.png.babyk 315d992d260498b9757bfedf95e8dec79f934c5e0139c696d5ba581508921a68.exe File renamed C:\Users\Admin\Pictures\UnregisterAssert.tif => C:\Users\Admin\Pictures\UnregisterAssert.tif.babyk 315d992d260498b9757bfedf95e8dec79f934c5e0139c696d5ba581508921a68.exe File renamed C:\Users\Admin\Pictures\DismountOpen.raw => C:\Users\Admin\Pictures\DismountOpen.raw.babyk 315d992d260498b9757bfedf95e8dec79f934c5e0139c696d5ba581508921a68.exe File opened for modification C:\Users\Admin\Pictures\ReadClose.crw.babyk 315d992d260498b9757bfedf95e8dec79f934c5e0139c696d5ba581508921a68.exe File renamed C:\Users\Admin\Pictures\SplitClear.png => C:\Users\Admin\Pictures\SplitClear.png.babyk 315d992d260498b9757bfedf95e8dec79f934c5e0139c696d5ba581508921a68.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: 315d992d260498b9757bfedf95e8dec79f934c5e0139c696d5ba581508921a68.exe File opened (read-only) \??\H: 315d992d260498b9757bfedf95e8dec79f934c5e0139c696d5ba581508921a68.exe File opened (read-only) \??\J: 315d992d260498b9757bfedf95e8dec79f934c5e0139c696d5ba581508921a68.exe File opened (read-only) \??\X: 315d992d260498b9757bfedf95e8dec79f934c5e0139c696d5ba581508921a68.exe File opened (read-only) \??\V: 315d992d260498b9757bfedf95e8dec79f934c5e0139c696d5ba581508921a68.exe File opened (read-only) \??\W: 315d992d260498b9757bfedf95e8dec79f934c5e0139c696d5ba581508921a68.exe File opened (read-only) \??\E: 315d992d260498b9757bfedf95e8dec79f934c5e0139c696d5ba581508921a68.exe File opened (read-only) \??\R: 315d992d260498b9757bfedf95e8dec79f934c5e0139c696d5ba581508921a68.exe File opened (read-only) \??\N: 315d992d260498b9757bfedf95e8dec79f934c5e0139c696d5ba581508921a68.exe File opened (read-only) \??\U: 315d992d260498b9757bfedf95e8dec79f934c5e0139c696d5ba581508921a68.exe File opened (read-only) \??\O: 315d992d260498b9757bfedf95e8dec79f934c5e0139c696d5ba581508921a68.exe File opened (read-only) \??\B: 315d992d260498b9757bfedf95e8dec79f934c5e0139c696d5ba581508921a68.exe File opened (read-only) \??\K: 315d992d260498b9757bfedf95e8dec79f934c5e0139c696d5ba581508921a68.exe File opened (read-only) \??\L: 315d992d260498b9757bfedf95e8dec79f934c5e0139c696d5ba581508921a68.exe File opened (read-only) \??\Q: 315d992d260498b9757bfedf95e8dec79f934c5e0139c696d5ba581508921a68.exe File opened (read-only) \??\F: 315d992d260498b9757bfedf95e8dec79f934c5e0139c696d5ba581508921a68.exe File opened (read-only) \??\G: 315d992d260498b9757bfedf95e8dec79f934c5e0139c696d5ba581508921a68.exe File opened (read-only) \??\A: 315d992d260498b9757bfedf95e8dec79f934c5e0139c696d5ba581508921a68.exe File opened (read-only) \??\S: 315d992d260498b9757bfedf95e8dec79f934c5e0139c696d5ba581508921a68.exe File opened (read-only) \??\Z: 315d992d260498b9757bfedf95e8dec79f934c5e0139c696d5ba581508921a68.exe File opened (read-only) \??\M: 315d992d260498b9757bfedf95e8dec79f934c5e0139c696d5ba581508921a68.exe File opened (read-only) \??\T: 315d992d260498b9757bfedf95e8dec79f934c5e0139c696d5ba581508921a68.exe File opened (read-only) \??\Y: 315d992d260498b9757bfedf95e8dec79f934c5e0139c696d5ba581508921a68.exe File opened (read-only) \??\P: 315d992d260498b9757bfedf95e8dec79f934c5e0139c696d5ba581508921a68.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1708 vssadmin.exe 1784 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1048 315d992d260498b9757bfedf95e8dec79f934c5e0139c696d5ba581508921a68.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 796 vssvc.exe Token: SeRestorePrivilege 796 vssvc.exe Token: SeAuditPrivilege 796 vssvc.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1048 wrote to memory of 2012 1048 315d992d260498b9757bfedf95e8dec79f934c5e0139c696d5ba581508921a68.exe 27 PID 1048 wrote to memory of 2012 1048 315d992d260498b9757bfedf95e8dec79f934c5e0139c696d5ba581508921a68.exe 27 PID 1048 wrote to memory of 2012 1048 315d992d260498b9757bfedf95e8dec79f934c5e0139c696d5ba581508921a68.exe 27 PID 1048 wrote to memory of 2012 1048 315d992d260498b9757bfedf95e8dec79f934c5e0139c696d5ba581508921a68.exe 27 PID 2012 wrote to memory of 1784 2012 cmd.exe 29 PID 2012 wrote to memory of 1784 2012 cmd.exe 29 PID 2012 wrote to memory of 1784 2012 cmd.exe 29 PID 1048 wrote to memory of 1740 1048 315d992d260498b9757bfedf95e8dec79f934c5e0139c696d5ba581508921a68.exe 33 PID 1048 wrote to memory of 1740 1048 315d992d260498b9757bfedf95e8dec79f934c5e0139c696d5ba581508921a68.exe 33 PID 1048 wrote to memory of 1740 1048 315d992d260498b9757bfedf95e8dec79f934c5e0139c696d5ba581508921a68.exe 33 PID 1048 wrote to memory of 1740 1048 315d992d260498b9757bfedf95e8dec79f934c5e0139c696d5ba581508921a68.exe 33 PID 1740 wrote to memory of 1708 1740 cmd.exe 35 PID 1740 wrote to memory of 1708 1740 cmd.exe 35 PID 1740 wrote to memory of 1708 1740 cmd.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\315d992d260498b9757bfedf95e8dec79f934c5e0139c696d5ba581508921a68.exe"C:\Users\Admin\AppData\Local\Temp\315d992d260498b9757bfedf95e8dec79f934c5e0139c696d5ba581508921a68.exe"1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1784
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1708
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:796