Overview
overview
10Static
static
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
7Resubmissions
28-07-2024 16:38
240728-t5tryssgmm 1007-07-2024 14:07
240707-rfgd8atekm 1007-07-2024 14:07
240707-re689awdpe 1013-09-2022 17:54
220913-wg1lpsgbg7 10Analysis
-
max time kernel
1559s -
max time network
1569s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
07-07-2024 14:07
Static task
static1
Behavioral task
behavioral1
Sample
RansomwareSamples/Avaddon_09_06_2020_1054KB.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
RansomwareSamples/Avaddon_09_06_2020_1054KB.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral3
Sample
RansomwareSamples/Avos_18_07_2021_403KB.exe
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
RansomwareSamples/Avos_18_07_2021_403KB.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral5
Sample
RansomwareSamples/Babik_04_01_2021_31KB.exe
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
RansomwareSamples/Babik_04_01_2021_31KB.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral7
Sample
RansomwareSamples/Babuk_20_04_2021_79KB.exe
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
RansomwareSamples/Babuk_20_04_2021_79KB.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral9
Sample
RansomwareSamples/BlackKingdom_23_03_2021_12460KB.exe
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
RansomwareSamples/BlackKingdom_23_03_2021_12460KB.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral11
Sample
RansomwareSamples/BlackMatter_02_08_2021_67KB.exe
Resource
win7-20240508-en
Behavioral task
behavioral12
Sample
RansomwareSamples/BlackMatter_02_08_2021_67KB.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral13
Sample
RansomwareSamples/Conti_22_12_2020_186KB.exe
Resource
win7-20240705-en
Behavioral task
behavioral14
Sample
RansomwareSamples/Conti_22_12_2020_186KB.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral15
Sample
RansomwareSamples/Cuba_08_03_2021_1130KB.exe
Resource
win7-20240705-en
Behavioral task
behavioral16
Sample
RansomwareSamples/Cuba_08_03_2021_1130KB.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral17
Sample
RansomwareSamples/DarkSide_01_05_2021_30KB.exe
Resource
win7-20240705-en
Behavioral task
behavioral18
Sample
RansomwareSamples/DarkSide_01_05_2021_30KB.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral19
Sample
RansomwareSamples/DarkSide_16_01_2021_59KB.exe
Resource
win7-20240705-en
Behavioral task
behavioral20
Sample
RansomwareSamples/DarkSide_16_01_2021_59KB.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral21
Sample
RansomwareSamples/DarkSide_18_11_2020_17KB.exe
Resource
win7-20240705-en
Behavioral task
behavioral22
Sample
RansomwareSamples/DarkSide_18_11_2020_17KB.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral23
Sample
RansomwareSamples/DearCry_13_03_2021_1292KB.exe
Resource
win7-20240704-en
Behavioral task
behavioral24
Sample
RansomwareSamples/DearCry_13_03_2021_1292KB.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral25
Sample
RansomwareSamples/Hades_29_03_2021_1909KB.exe
Resource
win7-20240704-en
Behavioral task
behavioral26
Sample
RansomwareSamples/Hades_29_03_2021_1909KB.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
RansomwareSamples/Hive_17_07_2021_808KB.exe
Resource
win7-20240704-en
Behavioral task
behavioral28
Sample
RansomwareSamples/Hive_17_07_2021_808KB.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
RansomwareSamples/LockBit_14_02_2021_146KB.exe
Resource
win7-20240705-en
Behavioral task
behavioral30
Sample
RansomwareSamples/LockBit_14_02_2021_146KB.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral31
Sample
RansomwareSamples/MAKOP_27_10_2020_115KB.exe
Resource
win7-20240704-en
Behavioral task
behavioral32
Sample
RansomwareSamples/MAKOP_27_10_2020_115KB.exe
Resource
win10v2004-20240704-en
General
-
Target
RansomwareSamples/Babik_04_01_2021_31KB.exe
-
Size
30KB
-
MD5
e10713a4a5f635767dcd54d609bed977
-
SHA1
320d799beef673a98481757b2ff7e3463ce67916
-
SHA256
8203c2f00ecd3ae960cb3247a7d7bfb35e55c38939607c85dbdb5c92f0495fa9
-
SHA512
fed1cb7e1798ea0d131a0d4962a2b9f6c700ee3e1c9482c7837be930ce5167196ac7b1e715d9c9a5c171c349f3df3dde1a42db8e439459bc742928f9d19b38a7
-
SSDEEP
768:S4DnL4DGrUVvP917yo6Xee7amb26ZghLybmGJ87tHvg7jzTzt:SILd639NdCbXZxbytH6
Malware Config
Extracted
\Device\HarddiskVolume1\Boot\cs-CZ\How To Restore Your Files.txt
babuk
http://babukq4e2p4wu4iq.onion/login.php?id=8M60J4vCbbkKgM6QnA07E9qpkn0Qk7
Signatures
-
Babuk Locker
RaaS first seen in 2021 initially called Vasa Locker.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (450) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
Babik_04_01_2021_31KB.exedescription ioc process File opened (read-only) \??\E: Babik_04_01_2021_31KB.exe File opened (read-only) \??\O: Babik_04_01_2021_31KB.exe File opened (read-only) \??\K: Babik_04_01_2021_31KB.exe File opened (read-only) \??\Z: Babik_04_01_2021_31KB.exe File opened (read-only) \??\V: Babik_04_01_2021_31KB.exe File opened (read-only) \??\W: Babik_04_01_2021_31KB.exe File opened (read-only) \??\R: Babik_04_01_2021_31KB.exe File opened (read-only) \??\T: Babik_04_01_2021_31KB.exe File opened (read-only) \??\Y: Babik_04_01_2021_31KB.exe File opened (read-only) \??\U: Babik_04_01_2021_31KB.exe File opened (read-only) \??\P: Babik_04_01_2021_31KB.exe File opened (read-only) \??\S: Babik_04_01_2021_31KB.exe File opened (read-only) \??\J: Babik_04_01_2021_31KB.exe File opened (read-only) \??\Q: Babik_04_01_2021_31KB.exe File opened (read-only) \??\M: Babik_04_01_2021_31KB.exe File opened (read-only) \??\B: Babik_04_01_2021_31KB.exe File opened (read-only) \??\A: Babik_04_01_2021_31KB.exe File opened (read-only) \??\H: Babik_04_01_2021_31KB.exe File opened (read-only) \??\N: Babik_04_01_2021_31KB.exe File opened (read-only) \??\I: Babik_04_01_2021_31KB.exe File opened (read-only) \??\L: Babik_04_01_2021_31KB.exe File opened (read-only) \??\X: Babik_04_01_2021_31KB.exe File opened (read-only) \??\G: Babik_04_01_2021_31KB.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 3 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 2428 vssadmin.exe 2640 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Babik_04_01_2021_31KB.exepid process 2960 Babik_04_01_2021_31KB.exe 2960 Babik_04_01_2021_31KB.exe 2960 Babik_04_01_2021_31KB.exe 2960 Babik_04_01_2021_31KB.exe 2960 Babik_04_01_2021_31KB.exe 2960 Babik_04_01_2021_31KB.exe 2960 Babik_04_01_2021_31KB.exe 2960 Babik_04_01_2021_31KB.exe 2960 Babik_04_01_2021_31KB.exe 2960 Babik_04_01_2021_31KB.exe 2960 Babik_04_01_2021_31KB.exe 2960 Babik_04_01_2021_31KB.exe 2960 Babik_04_01_2021_31KB.exe 2960 Babik_04_01_2021_31KB.exe 2960 Babik_04_01_2021_31KB.exe 2960 Babik_04_01_2021_31KB.exe 2960 Babik_04_01_2021_31KB.exe 2960 Babik_04_01_2021_31KB.exe 2960 Babik_04_01_2021_31KB.exe 2960 Babik_04_01_2021_31KB.exe 2960 Babik_04_01_2021_31KB.exe 2960 Babik_04_01_2021_31KB.exe 2960 Babik_04_01_2021_31KB.exe 2960 Babik_04_01_2021_31KB.exe 2960 Babik_04_01_2021_31KB.exe 2960 Babik_04_01_2021_31KB.exe 2960 Babik_04_01_2021_31KB.exe 2960 Babik_04_01_2021_31KB.exe 2960 Babik_04_01_2021_31KB.exe 2960 Babik_04_01_2021_31KB.exe 2960 Babik_04_01_2021_31KB.exe 2960 Babik_04_01_2021_31KB.exe 2960 Babik_04_01_2021_31KB.exe 2960 Babik_04_01_2021_31KB.exe 2960 Babik_04_01_2021_31KB.exe 2960 Babik_04_01_2021_31KB.exe 2960 Babik_04_01_2021_31KB.exe 2960 Babik_04_01_2021_31KB.exe 2960 Babik_04_01_2021_31KB.exe 2960 Babik_04_01_2021_31KB.exe 2960 Babik_04_01_2021_31KB.exe 2960 Babik_04_01_2021_31KB.exe 2960 Babik_04_01_2021_31KB.exe 2960 Babik_04_01_2021_31KB.exe 2960 Babik_04_01_2021_31KB.exe 2960 Babik_04_01_2021_31KB.exe 2960 Babik_04_01_2021_31KB.exe 2960 Babik_04_01_2021_31KB.exe 2960 Babik_04_01_2021_31KB.exe 2960 Babik_04_01_2021_31KB.exe 2960 Babik_04_01_2021_31KB.exe 2960 Babik_04_01_2021_31KB.exe 2960 Babik_04_01_2021_31KB.exe 2960 Babik_04_01_2021_31KB.exe 2960 Babik_04_01_2021_31KB.exe 2960 Babik_04_01_2021_31KB.exe 2960 Babik_04_01_2021_31KB.exe 2960 Babik_04_01_2021_31KB.exe 2960 Babik_04_01_2021_31KB.exe 2960 Babik_04_01_2021_31KB.exe 2960 Babik_04_01_2021_31KB.exe 2960 Babik_04_01_2021_31KB.exe 2960 Babik_04_01_2021_31KB.exe 2960 Babik_04_01_2021_31KB.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 1556 vssvc.exe Token: SeRestorePrivilege 1556 vssvc.exe Token: SeAuditPrivilege 1556 vssvc.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
Babik_04_01_2021_31KB.execmd.execmd.exedescription pid process target process PID 2960 wrote to memory of 2408 2960 Babik_04_01_2021_31KB.exe cmd.exe PID 2960 wrote to memory of 2408 2960 Babik_04_01_2021_31KB.exe cmd.exe PID 2960 wrote to memory of 2408 2960 Babik_04_01_2021_31KB.exe cmd.exe PID 2960 wrote to memory of 2408 2960 Babik_04_01_2021_31KB.exe cmd.exe PID 2408 wrote to memory of 2428 2408 cmd.exe vssadmin.exe PID 2408 wrote to memory of 2428 2408 cmd.exe vssadmin.exe PID 2408 wrote to memory of 2428 2408 cmd.exe vssadmin.exe PID 2960 wrote to memory of 2176 2960 Babik_04_01_2021_31KB.exe cmd.exe PID 2960 wrote to memory of 2176 2960 Babik_04_01_2021_31KB.exe cmd.exe PID 2960 wrote to memory of 2176 2960 Babik_04_01_2021_31KB.exe cmd.exe PID 2960 wrote to memory of 2176 2960 Babik_04_01_2021_31KB.exe cmd.exe PID 2176 wrote to memory of 2640 2176 cmd.exe vssadmin.exe PID 2176 wrote to memory of 2640 2176 cmd.exe vssadmin.exe PID 2176 wrote to memory of 2640 2176 cmd.exe vssadmin.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\Babik_04_01_2021_31KB.exe"C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\Babik_04_01_2021_31KB.exe"1⤵
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2428 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2640
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1556
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5b6e97028103bc6b18214f4b2bd0e0d23
SHA14c202c77782d55af635c28fa71b2ba58b294415e
SHA256db1c8cafdedfc4be8dd6b81aa086b998ae49ad929b8a260d4030c7b5ca373a45
SHA512214f7e9354a76f031bc3d28c6c20b3d5fafed32e5cb2d7414b7c2d185637d2f47e3538b62c722ba8b018cb3e6e3d9ff11bd6437d3f2af8eca9cd8504eb8c0f7d