Overview

overview

10

Static

static

10

2024-04-12...er.exe

windows7-x64

10

2024-04-12...er.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2024-04-12_44fcd277d0a92c0b7eafd911ccc93864_babuk_destroyer
  • Size 71KB
  • Sample240413-ac622abd8y
  • SHA256 e36819a304d8eb00a404b3ff1dce1f708de985ca87f56e8c571a4a14740ffd62
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
lockfileransomware

Malware Config

Targets

    • Target
      2024-04-12_44fcd277d0a92c0b7eafd911ccc93864_babuk_destroyer
    • Size 71KB
    • SHA256 e36819a304d8eb00a404b3ff1dce1f708de985ca87f56e8c571a4a14740ffd62
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    lockfileransomware

    • LockFile

      LockFile is a new ransomware that emerged in July 2021 with ProxyShell vulnerabilties.

      ransomwarelockfile

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Renames multiple (190) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks