Overview
overview
10Static
static
1Desktop.zip
windows7-x64
1Desktop.zip
windows10-2004-x64
1babyk/babyk.exe
windows7-x64
10babyk/babyk.exe
windows10-2004-x64
10babyk/builder.exe
windows7-x64
1babyk/builder.exe
windows10-2004-x64
1babyk/decryptor.exe
windows7-x64
3babyk/decryptor.exe
windows10-2004-x64
3conti/decryptor.exe
windows7-x64
1conti/decryptor.exe
windows10-2004-x64
1conti/locker.exe
windows7-x64
7conti/locker.exe
windows10-2004-x64
7Analysis
-
max time kernel
92s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
11-03-2023 13:56
Static task
static1
Behavioral task
behavioral1
Sample
Desktop.zip
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Desktop.zip
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
babyk/babyk.exe
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
babyk/babyk.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
babyk/builder.exe
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
babyk/builder.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
babyk/decryptor.exe
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
babyk/decryptor.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
conti/decryptor.exe
Resource
win7-20230220-en
Behavioral task
behavioral10
Sample
conti/decryptor.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral11
Sample
conti/locker.exe
Resource
win7-20230220-en
General
-
Target
babyk/babyk.exe
-
Size
79KB
-
MD5
dd82341bde54c2d34496523a463d2771
-
SHA1
a193b2770d17a6405e92f6e28840e1b87db45356
-
SHA256
4b5438ad0818c9fe1e9aa6d43bca9ef0bced418365e71340e44dd3cc5a2ad54a
-
SHA512
c027bcc7ecd1761c6c4cbb32d528f40b123f80c6aa498c22e35aeddd064d4533fbf31fc93915bb29d5f3fc72811452fe988b9524ae01b3d630f5ccffc98525f8
-
SSDEEP
1536:rKkWBeG/vEbmsrQLOJgY8ZZP8LHD4XWaNH71dLdG1iiFM2iG2nsf:yBeQsmsrQLOJgY8Zp8LHD4XWaNH71dLc
Malware Config
Signatures
-
Babuk Locker
RaaS first seen in 2021 initially called Vasa Locker.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 19 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
babyk.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\ReadExit.crw.babyk babyk.exe File renamed C:\Users\Admin\Pictures\ReceiveFormat.crw => C:\Users\Admin\Pictures\ReceiveFormat.crw.babyk babyk.exe File renamed C:\Users\Admin\Pictures\ResumeSet.png => C:\Users\Admin\Pictures\ResumeSet.png.babyk babyk.exe File opened for modification C:\Users\Admin\Pictures\StopCompress.png.babyk babyk.exe File renamed C:\Users\Admin\Pictures\WriteRevoke.crw => C:\Users\Admin\Pictures\WriteRevoke.crw.babyk babyk.exe File renamed C:\Users\Admin\Pictures\ResetLock.raw => C:\Users\Admin\Pictures\ResetLock.raw.babyk babyk.exe File opened for modification C:\Users\Admin\Pictures\ReceiveFormat.crw.babyk babyk.exe File opened for modification C:\Users\Admin\Pictures\ResumeSet.png.babyk babyk.exe File opened for modification C:\Users\Admin\Pictures\DisableCopy.tiff babyk.exe File renamed C:\Users\Admin\Pictures\DisableCopy.tiff => C:\Users\Admin\Pictures\DisableCopy.tiff.babyk babyk.exe File opened for modification C:\Users\Admin\Pictures\DisableCopy.tiff.babyk babyk.exe File opened for modification C:\Users\Admin\Pictures\OpenComplete.crw.babyk babyk.exe File opened for modification C:\Users\Admin\Pictures\ReadConfirm.raw.babyk babyk.exe File renamed C:\Users\Admin\Pictures\StopCompress.png => C:\Users\Admin\Pictures\StopCompress.png.babyk babyk.exe File opened for modification C:\Users\Admin\Pictures\WriteRevoke.crw.babyk babyk.exe File renamed C:\Users\Admin\Pictures\OpenComplete.crw => C:\Users\Admin\Pictures\OpenComplete.crw.babyk babyk.exe File renamed C:\Users\Admin\Pictures\ReadConfirm.raw => C:\Users\Admin\Pictures\ReadConfirm.raw.babyk babyk.exe File renamed C:\Users\Admin\Pictures\ReadExit.crw => C:\Users\Admin\Pictures\ReadExit.crw.babyk babyk.exe File opened for modification C:\Users\Admin\Pictures\ResetLock.raw.babyk babyk.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
babyk.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation babyk.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
babyk.exedescription ioc process File opened (read-only) \??\M: babyk.exe File opened (read-only) \??\W: babyk.exe File opened (read-only) \??\T: babyk.exe File opened (read-only) \??\V: babyk.exe File opened (read-only) \??\P: babyk.exe File opened (read-only) \??\F: babyk.exe File opened (read-only) \??\G: babyk.exe File opened (read-only) \??\H: babyk.exe File opened (read-only) \??\J: babyk.exe File opened (read-only) \??\Q: babyk.exe File opened (read-only) \??\R: babyk.exe File opened (read-only) \??\U: babyk.exe File opened (read-only) \??\A: babyk.exe File opened (read-only) \??\K: babyk.exe File opened (read-only) \??\L: babyk.exe File opened (read-only) \??\X: babyk.exe File opened (read-only) \??\N: babyk.exe File opened (read-only) \??\E: babyk.exe File opened (read-only) \??\Y: babyk.exe File opened (read-only) \??\I: babyk.exe File opened (read-only) \??\B: babyk.exe File opened (read-only) \??\O: babyk.exe File opened (read-only) \??\S: babyk.exe File opened (read-only) \??\Z: babyk.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 2592 vssadmin.exe 208 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
babyk.exepid process 3872 babyk.exe 3872 babyk.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 836 vssvc.exe Token: SeRestorePrivilege 836 vssvc.exe Token: SeAuditPrivilege 836 vssvc.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
babyk.execmd.execmd.exedescription pid process target process PID 3872 wrote to memory of 1972 3872 babyk.exe cmd.exe PID 3872 wrote to memory of 1972 3872 babyk.exe cmd.exe PID 1972 wrote to memory of 2592 1972 cmd.exe vssadmin.exe PID 1972 wrote to memory of 2592 1972 cmd.exe vssadmin.exe PID 3872 wrote to memory of 4772 3872 babyk.exe cmd.exe PID 3872 wrote to memory of 4772 3872 babyk.exe cmd.exe PID 4772 wrote to memory of 208 4772 cmd.exe vssadmin.exe PID 4772 wrote to memory of 208 4772 cmd.exe vssadmin.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\babyk\babyk.exe"C:\Users\Admin\AppData\Local\Temp\babyk\babyk.exe"1⤵
- Modifies extensions of user files
- Checks computer location settings
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2592 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:208
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:836
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD52af817219bb1d24a11ab839b9453b5f3
SHA1f9ff9075f9472c41aeb93df2e439fe624dc143b0
SHA2566a16454cad4534d51025f65277abaec0ff4a30082840154a35889445bb3ad0a0
SHA512d443e149d8b097cc64b0bbbf65e3d660de43943a4b36ac4c41bfbdfe814fb895d7ba97128aa1235b85d2292b79afc451fbcb89cc6a56d33ecff7d93e18a15c30