babuk | e7e3bc426f1133900f850fadf1d087086aa4bfd853b107dfa3526bb75f12c52d | Triage

Submit
Reports

Overview

overview

Static

static

e7e3bc426f...2d.exe

windows7-x64

e7e3bc426f...2d.exe

windows10-2004-x64

Sharing

General

Target

e7e3bc426f1133900f850fadf1d087086aa4bfd853b107dfa3526bb75f12c52d
Size

79KB
Sample

221207-mhbvasbg4v
MD5

1f6ea1848c050a59782b67d4516b03a3
SHA1

96d57e583a660c1ea47ba653eb3e3223e97269f7
SHA256

e7e3bc426f1133900f850fadf1d087086aa4bfd853b107dfa3526bb75f12c52d
SHA512

360fde4b699068f35044cc05641072e4715ffea21c70e80f5bb1f90cd3aa1f3f0dd1224ffcc745bf68faec70e46c684a16a6c370facb4b77539a411e690ed54a
SSDEEP

1536:VikWBeG/vEbmsrQLOJgY8ZZP8LHD4XWaNH71dLdG1iiFM2iG2nsf:EBeQsmsrQLOJgY8Zp8LHD4XWaNH71dLc

Score

10^/10

babuk ransomware

Static task

static1

Behavioral task

behavioral1

Sample

e7e3bc426f1133900f850fadf1d087086aa4bfd853b107dfa3526bb75f12c52d.exe

Resource

win7-20220901-en

babuk ransomware

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral2

Sample

e7e3bc426f1133900f850fadf1d087086aa4bfd853b107dfa3526bb75f12c52d.exe

Resource

win10v2004-20220812-en

babuk ransomware

windows10-2004-x64

10 signatures

150 seconds

Malware Config

Targets

- Target
  
  e7e3bc426f1133900f850fadf1d087086aa4bfd853b107dfa3526bb75f12c52d
- Size
  
  79KB
- MD5
  
  1f6ea1848c050a59782b67d4516b03a3
- SHA1
  
  96d57e583a660c1ea47ba653eb3e3223e97269f7
- SHA256
  
  e7e3bc426f1133900f850fadf1d087086aa4bfd853b107dfa3526bb75f12c52d
- SHA512
  
  360fde4b699068f35044cc05641072e4715ffea21c70e80f5bb1f90cd3aa1f3f0dd1224ffcc745bf68faec70e46c684a16a6c370facb4b77539a411e690ed54a
- SSDEEP
  
  1536:VikWBeG/vEbmsrQLOJgY8ZZP8LHD4XWaNH71dLdG1iiFM2iG2nsf:EBeQsmsrQLOJgY8Zp8LHD4XWaNH71dLc
Score

10^/10

babuk ransomware
- Babuk Locker
  RaaS first seen in 2021 initially called Vasa Locker.
  ransomware babuk
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

babukransomware

behavioral2

babukransomware

© 2018-2024

Terms | Privacy