Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
16-08-2023 18:55
Static task
static1
Behavioral task
behavioral1
Sample
0f3df6ef2a93f1a2a7265293bd7ce8b6_babuk_destroyer_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
0f3df6ef2a93f1a2a7265293bd7ce8b6_babuk_destroyer_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
0f3df6ef2a93f1a2a7265293bd7ce8b6_babuk_destroyer_JC.exe
-
Size
78KB
-
MD5
0f3df6ef2a93f1a2a7265293bd7ce8b6
-
SHA1
38d58c66ec0d18d333b885e2b4aa788c7a22e384
-
SHA256
cba23155d05b468264b2724cdbd198c2724bab46426018c3342adae25d6e2b1d
-
SHA512
d8700914a4e1f516b9a3d7a7d0e61ed3564230a9676e1a2bee04d1396aea5bb45ded5cfad9b7814133f500012961b58058d1446cc9884c62b482977df9ea881a
-
SSDEEP
1536:RnphiBMAMnL+by+PGuMsrQLOJgY8ZZP8LHD4XWaNH71dLdG1iiFM2iG2es4:RnPiBMAqeyXBsrQLOJgY8Zp8LHD4XWah
Malware Config
Extracted
C:\Recovery\909558a2-20ee-11ee-b7b1-d66763f08456\How To Restore Your Files.txt
http://wavbeudogz6byhnardd2lkp2jafims3j7tj6k6qnywchn2csngvtffqd.onion/
http://os3xs2l3ftdqeuhxyuo4e6ymxvknp3gx6abordkcjde4coe37k66xyid.onion/4ee7ff7421bcb2ab35c523623ce11174c037e7db0562578b8a245630fc16a047
Signatures
-
Babuk Locker
RaaS first seen in 2021 initially called Vasa Locker.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (213) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
0f3df6ef2a93f1a2a7265293bd7ce8b6_babuk_destroyer_JC.exedescription ioc process File opened (read-only) \??\G: 0f3df6ef2a93f1a2a7265293bd7ce8b6_babuk_destroyer_JC.exe File opened (read-only) \??\L: 0f3df6ef2a93f1a2a7265293bd7ce8b6_babuk_destroyer_JC.exe File opened (read-only) \??\M: 0f3df6ef2a93f1a2a7265293bd7ce8b6_babuk_destroyer_JC.exe File opened (read-only) \??\I: 0f3df6ef2a93f1a2a7265293bd7ce8b6_babuk_destroyer_JC.exe File opened (read-only) \??\A: 0f3df6ef2a93f1a2a7265293bd7ce8b6_babuk_destroyer_JC.exe File opened (read-only) \??\J: 0f3df6ef2a93f1a2a7265293bd7ce8b6_babuk_destroyer_JC.exe File opened (read-only) \??\X: 0f3df6ef2a93f1a2a7265293bd7ce8b6_babuk_destroyer_JC.exe File opened (read-only) \??\Z: 0f3df6ef2a93f1a2a7265293bd7ce8b6_babuk_destroyer_JC.exe File opened (read-only) \??\B: 0f3df6ef2a93f1a2a7265293bd7ce8b6_babuk_destroyer_JC.exe File opened (read-only) \??\Q: 0f3df6ef2a93f1a2a7265293bd7ce8b6_babuk_destroyer_JC.exe File opened (read-only) \??\W: 0f3df6ef2a93f1a2a7265293bd7ce8b6_babuk_destroyer_JC.exe File opened (read-only) \??\R: 0f3df6ef2a93f1a2a7265293bd7ce8b6_babuk_destroyer_JC.exe File opened (read-only) \??\T: 0f3df6ef2a93f1a2a7265293bd7ce8b6_babuk_destroyer_JC.exe File opened (read-only) \??\U: 0f3df6ef2a93f1a2a7265293bd7ce8b6_babuk_destroyer_JC.exe File opened (read-only) \??\K: 0f3df6ef2a93f1a2a7265293bd7ce8b6_babuk_destroyer_JC.exe File opened (read-only) \??\V: 0f3df6ef2a93f1a2a7265293bd7ce8b6_babuk_destroyer_JC.exe File opened (read-only) \??\N: 0f3df6ef2a93f1a2a7265293bd7ce8b6_babuk_destroyer_JC.exe File opened (read-only) \??\E: 0f3df6ef2a93f1a2a7265293bd7ce8b6_babuk_destroyer_JC.exe File opened (read-only) \??\Y: 0f3df6ef2a93f1a2a7265293bd7ce8b6_babuk_destroyer_JC.exe File opened (read-only) \??\O: 0f3df6ef2a93f1a2a7265293bd7ce8b6_babuk_destroyer_JC.exe File opened (read-only) \??\P: 0f3df6ef2a93f1a2a7265293bd7ce8b6_babuk_destroyer_JC.exe File opened (read-only) \??\S: 0f3df6ef2a93f1a2a7265293bd7ce8b6_babuk_destroyer_JC.exe File opened (read-only) \??\H: 0f3df6ef2a93f1a2a7265293bd7ce8b6_babuk_destroyer_JC.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 2676 vssadmin.exe 1592 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
0f3df6ef2a93f1a2a7265293bd7ce8b6_babuk_destroyer_JC.exepid process 2212 0f3df6ef2a93f1a2a7265293bd7ce8b6_babuk_destroyer_JC.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 1688 vssvc.exe Token: SeRestorePrivilege 1688 vssvc.exe Token: SeAuditPrivilege 1688 vssvc.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
0f3df6ef2a93f1a2a7265293bd7ce8b6_babuk_destroyer_JC.execmd.execmd.exedescription pid process target process PID 2212 wrote to memory of 1968 2212 0f3df6ef2a93f1a2a7265293bd7ce8b6_babuk_destroyer_JC.exe cmd.exe PID 2212 wrote to memory of 1968 2212 0f3df6ef2a93f1a2a7265293bd7ce8b6_babuk_destroyer_JC.exe cmd.exe PID 2212 wrote to memory of 1968 2212 0f3df6ef2a93f1a2a7265293bd7ce8b6_babuk_destroyer_JC.exe cmd.exe PID 2212 wrote to memory of 1968 2212 0f3df6ef2a93f1a2a7265293bd7ce8b6_babuk_destroyer_JC.exe cmd.exe PID 1968 wrote to memory of 2676 1968 cmd.exe vssadmin.exe PID 1968 wrote to memory of 2676 1968 cmd.exe vssadmin.exe PID 1968 wrote to memory of 2676 1968 cmd.exe vssadmin.exe PID 2212 wrote to memory of 2368 2212 0f3df6ef2a93f1a2a7265293bd7ce8b6_babuk_destroyer_JC.exe cmd.exe PID 2212 wrote to memory of 2368 2212 0f3df6ef2a93f1a2a7265293bd7ce8b6_babuk_destroyer_JC.exe cmd.exe PID 2212 wrote to memory of 2368 2212 0f3df6ef2a93f1a2a7265293bd7ce8b6_babuk_destroyer_JC.exe cmd.exe PID 2212 wrote to memory of 2368 2212 0f3df6ef2a93f1a2a7265293bd7ce8b6_babuk_destroyer_JC.exe cmd.exe PID 2368 wrote to memory of 1592 2368 cmd.exe vssadmin.exe PID 2368 wrote to memory of 1592 2368 cmd.exe vssadmin.exe PID 2368 wrote to memory of 1592 2368 cmd.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f3df6ef2a93f1a2a7265293bd7ce8b6_babuk_destroyer_JC.exe"C:\Users\Admin\AppData\Local\Temp\0f3df6ef2a93f1a2a7265293bd7ce8b6_babuk_destroyer_JC.exe"1⤵
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2676
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1592
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1688
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD596b08ce9d50c3ae4912a18665fab4183
SHA18785affc30c6cb04ef5a806d0900445ac247d887
SHA2566795b780c8aa19e4f81e69b3c805dafa8d3d407ba6f9718e1ee6a9ddee92c16a
SHA51296794c19f6f61861f6f166ab4805dc0e4a3948857a8a45af0c0c815f4a50f21fdffe964d1d605a1d044625aaad307ecca9ee45917c798d6efffa757be7d409c1