babuk | c2f96661a63e6a894a46ae5bf83f85c3f9fa74cf20cc7b6d34b4888289ea7ae4

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	fd49374b6bf5ddfcf665a110da75f127_JaffaCakes118.exe

Renames multiple (204) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	fd49374b6bf5ddfcf665a110da75f127_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	fd49374b6bf5ddfcf665a110da75f127_JaffaCakes118.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Wine	fd49374b6bf5ddfcf665a110da75f127_JaffaCakes118.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	fd49374b6bf5ddfcf665a110da75f127_JaffaCakes118.exe
File opened (read-only)	\??\U:	fd49374b6bf5ddfcf665a110da75f127_JaffaCakes118.exe
File opened (read-only)	\??\K:	fd49374b6bf5ddfcf665a110da75f127_JaffaCakes118.exe
File opened (read-only)	\??\B:	fd49374b6bf5ddfcf665a110da75f127_JaffaCakes118.exe
File opened (read-only)	\??\M:	fd49374b6bf5ddfcf665a110da75f127_JaffaCakes118.exe
File opened (read-only)	\??\Q:	fd49374b6bf5ddfcf665a110da75f127_JaffaCakes118.exe
File opened (read-only)	\??\E:	fd49374b6bf5ddfcf665a110da75f127_JaffaCakes118.exe
File opened (read-only)	\??\I:	fd49374b6bf5ddfcf665a110da75f127_JaffaCakes118.exe
File opened (read-only)	\??\P:	fd49374b6bf5ddfcf665a110da75f127_JaffaCakes118.exe
File opened (read-only)	\??\A:	fd49374b6bf5ddfcf665a110da75f127_JaffaCakes118.exe
File opened (read-only)	\??\G:	fd49374b6bf5ddfcf665a110da75f127_JaffaCakes118.exe
File opened (read-only)	\??\H:	fd49374b6bf5ddfcf665a110da75f127_JaffaCakes118.exe
File opened (read-only)	\??\W:	fd49374b6bf5ddfcf665a110da75f127_JaffaCakes118.exe
File opened (read-only)	\??\T:	fd49374b6bf5ddfcf665a110da75f127_JaffaCakes118.exe
File opened (read-only)	\??\J:	fd49374b6bf5ddfcf665a110da75f127_JaffaCakes118.exe
File opened (read-only)	\??\L:	fd49374b6bf5ddfcf665a110da75f127_JaffaCakes118.exe
File opened (read-only)	\??\Z:	fd49374b6bf5ddfcf665a110da75f127_JaffaCakes118.exe
File opened (read-only)	\??\X:	fd49374b6bf5ddfcf665a110da75f127_JaffaCakes118.exe
File opened (read-only)	\??\O:	fd49374b6bf5ddfcf665a110da75f127_JaffaCakes118.exe
File opened (read-only)	\??\S:	fd49374b6bf5ddfcf665a110da75f127_JaffaCakes118.exe
File opened (read-only)	\??\N:	fd49374b6bf5ddfcf665a110da75f127_JaffaCakes118.exe
File opened (read-only)	\??\Y:	fd49374b6bf5ddfcf665a110da75f127_JaffaCakes118.exe
File opened (read-only)	\??\V:	fd49374b6bf5ddfcf665a110da75f127_JaffaCakes118.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2896	fd49374b6bf5ddfcf665a110da75f127_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Interacts with shadow copies 2 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
2964	vssadmin.exe
2884	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2896	fd49374b6bf5ddfcf665a110da75f127_JaffaCakes118.exe
2896	fd49374b6bf5ddfcf665a110da75f127_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeBackupPrivilege	2540	vssvc.exe
Token: SeRestorePrivilege	2540	vssvc.exe
Token: SeAuditPrivilege	2540	vssvc.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 2512	2896	fd49374b6bf5ddfcf665a110da75f127_JaffaCakes118.exe	28
PID 2896 wrote to memory of 2512	2896	fd49374b6bf5ddfcf665a110da75f127_JaffaCakes118.exe	28
PID 2896 wrote to memory of 2512	2896	fd49374b6bf5ddfcf665a110da75f127_JaffaCakes118.exe	28
PID 2896 wrote to memory of 2512	2896	fd49374b6bf5ddfcf665a110da75f127_JaffaCakes118.exe	28
PID 2512 wrote to memory of 2964	2512	cmd.exe	30
PID 2512 wrote to memory of 2964	2512	cmd.exe	30
PID 2512 wrote to memory of 2964	2512	cmd.exe	30
PID 2896 wrote to memory of 520	2896	fd49374b6bf5ddfcf665a110da75f127_JaffaCakes118.exe	34
PID 2896 wrote to memory of 520	2896	fd49374b6bf5ddfcf665a110da75f127_JaffaCakes118.exe	34
PID 2896 wrote to memory of 520	2896	fd49374b6bf5ddfcf665a110da75f127_JaffaCakes118.exe	34
PID 2896 wrote to memory of 520	2896	fd49374b6bf5ddfcf665a110da75f127_JaffaCakes118.exe	34
PID 520 wrote to memory of 2884	520	cmd.exe	36
PID 520 wrote to memory of 2884	520	cmd.exe	36
PID 520 wrote to memory of 2884	520	cmd.exe	36

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\fd49374b6bf5ddfcf665a110da75f127_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fd49374b6bf5ddfcf665a110da75f127_JaffaCakes118.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Enumerates connected drives
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2512
- - C:\Windows\system32\vssadmin.exe
    vssadmin.exe delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:2964
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:520
- - C:\Windows\system32\vssadmin.exe
    vssadmin.exe delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:2884

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Virtualization/Sandbox Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery