babuk | 4abedc057389bdb9b4fded968db7ab78f9d2709fdd2ad14ba1d2947d5d62797e

General

Target

ff78e9706891818a3db5ef3f46f107250f59bff43276d72e77eb4ec9d26e0e66.exe
Size

79KB
MD5

dde253fbf823011af1961649e16e218c
SHA1

a725eac8b1e7487078dd79bac03b635fb658a511
SHA256

ff78e9706891818a3db5ef3f46f107250f59bff43276d72e77eb4ec9d26e0e66
SHA512

27f50866d9bd67b5859d0d7589a996b0ef0d131dea54b62d4e34c71200751739cba64257fe4cdc15ca86f52e3e017172b95b3290a1b6b76cb38c7ee46e5f9b77
SSDEEP

1536:UmkWBeG/vEbmsrQLOJgY8ZZP8LHD4XWaNH71dLdG1iiFM2iG2nsf:HBeQsmsrQLOJgY8Zp8LHD4XWaNH71dLc

Score

10^/10

babuk defense_evasion discovery execution impact ransomware

Malware Config

Signatures

Babuk Locker
RaaS first seen in 2021 initially called Vasa Locker.
ransomware babuk
Babuk family
babuk
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (204) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	ff78e9706891818a3db5ef3f46f107250f59bff43276d72e77eb4ec9d26e0e66.exe
File opened (read-only)	\??\E:	ff78e9706891818a3db5ef3f46f107250f59bff43276d72e77eb4ec9d26e0e66.exe
File opened (read-only)	\??\S:	ff78e9706891818a3db5ef3f46f107250f59bff43276d72e77eb4ec9d26e0e66.exe
File opened (read-only)	\??\K:	ff78e9706891818a3db5ef3f46f107250f59bff43276d72e77eb4ec9d26e0e66.exe
File opened (read-only)	\??\W:	ff78e9706891818a3db5ef3f46f107250f59bff43276d72e77eb4ec9d26e0e66.exe
File opened (read-only)	\??\Y:	ff78e9706891818a3db5ef3f46f107250f59bff43276d72e77eb4ec9d26e0e66.exe
File opened (read-only)	\??\U:	ff78e9706891818a3db5ef3f46f107250f59bff43276d72e77eb4ec9d26e0e66.exe
File opened (read-only)	\??\I:	ff78e9706891818a3db5ef3f46f107250f59bff43276d72e77eb4ec9d26e0e66.exe
File opened (read-only)	\??\O:	ff78e9706891818a3db5ef3f46f107250f59bff43276d72e77eb4ec9d26e0e66.exe
File opened (read-only)	\??\G:	ff78e9706891818a3db5ef3f46f107250f59bff43276d72e77eb4ec9d26e0e66.exe
File opened (read-only)	\??\Z:	ff78e9706891818a3db5ef3f46f107250f59bff43276d72e77eb4ec9d26e0e66.exe
File opened (read-only)	\??\X:	ff78e9706891818a3db5ef3f46f107250f59bff43276d72e77eb4ec9d26e0e66.exe
File opened (read-only)	\??\T:	ff78e9706891818a3db5ef3f46f107250f59bff43276d72e77eb4ec9d26e0e66.exe
File opened (read-only)	\??\P:	ff78e9706891818a3db5ef3f46f107250f59bff43276d72e77eb4ec9d26e0e66.exe
File opened (read-only)	\??\A:	ff78e9706891818a3db5ef3f46f107250f59bff43276d72e77eb4ec9d26e0e66.exe
File opened (read-only)	\??\H:	ff78e9706891818a3db5ef3f46f107250f59bff43276d72e77eb4ec9d26e0e66.exe
File opened (read-only)	\??\N:	ff78e9706891818a3db5ef3f46f107250f59bff43276d72e77eb4ec9d26e0e66.exe
File opened (read-only)	\??\R:	ff78e9706891818a3db5ef3f46f107250f59bff43276d72e77eb4ec9d26e0e66.exe
File opened (read-only)	\??\J:	ff78e9706891818a3db5ef3f46f107250f59bff43276d72e77eb4ec9d26e0e66.exe
File opened (read-only)	\??\L:	ff78e9706891818a3db5ef3f46f107250f59bff43276d72e77eb4ec9d26e0e66.exe
File opened (read-only)	\??\V:	ff78e9706891818a3db5ef3f46f107250f59bff43276d72e77eb4ec9d26e0e66.exe
File opened (read-only)	\??\B:	ff78e9706891818a3db5ef3f46f107250f59bff43276d72e77eb4ec9d26e0e66.exe
File opened (read-only)	\??\M:	ff78e9706891818a3db5ef3f46f107250f59bff43276d72e77eb4ec9d26e0e66.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ff78e9706891818a3db5ef3f46f107250f59bff43276d72e77eb4ec9d26e0e66.exe

Interacts with shadow copies 3 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
2588	vssadmin.exe
2660	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1776	ff78e9706891818a3db5ef3f46f107250f59bff43276d72e77eb4ec9d26e0e66.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeBackupPrivilege	1984	vssvc.exe
Token: SeRestorePrivilege	1984	vssvc.exe
Token: SeAuditPrivilege	1984	vssvc.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1776 wrote to memory of 1784	1776	ff78e9706891818a3db5ef3f46f107250f59bff43276d72e77eb4ec9d26e0e66.exe	30
PID 1776 wrote to memory of 1784	1776	ff78e9706891818a3db5ef3f46f107250f59bff43276d72e77eb4ec9d26e0e66.exe	30
PID 1776 wrote to memory of 1784	1776	ff78e9706891818a3db5ef3f46f107250f59bff43276d72e77eb4ec9d26e0e66.exe	30
PID 1776 wrote to memory of 1784	1776	ff78e9706891818a3db5ef3f46f107250f59bff43276d72e77eb4ec9d26e0e66.exe	30
PID 1784 wrote to memory of 2588	1784	cmd.exe	32
PID 1784 wrote to memory of 2588	1784	cmd.exe	32
PID 1784 wrote to memory of 2588	1784	cmd.exe	32
PID 1776 wrote to memory of 2828	1776	ff78e9706891818a3db5ef3f46f107250f59bff43276d72e77eb4ec9d26e0e66.exe	37
PID 1776 wrote to memory of 2828	1776	ff78e9706891818a3db5ef3f46f107250f59bff43276d72e77eb4ec9d26e0e66.exe	37
PID 1776 wrote to memory of 2828	1776	ff78e9706891818a3db5ef3f46f107250f59bff43276d72e77eb4ec9d26e0e66.exe	37
PID 1776 wrote to memory of 2828	1776	ff78e9706891818a3db5ef3f46f107250f59bff43276d72e77eb4ec9d26e0e66.exe	37
PID 2828 wrote to memory of 2660	2828	cmd.exe	39
PID 2828 wrote to memory of 2660	2828	cmd.exe	39
PID 2828 wrote to memory of 2660	2828	cmd.exe	39

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\ff78e9706891818a3db5ef3f46f107250f59bff43276d72e77eb4ec9d26e0e66.exe
"C:\Users\Admin\AppData\Local\Temp\ff78e9706891818a3db5ef3f46f107250f59bff43276d72e77eb4ec9d26e0e66.exe"
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1776
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1784
- - C:\Windows\system32\vssadmin.exe
    vssadmin.exe delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:2588
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2828
- - C:\Windows\system32\vssadmin.exe
    vssadmin.exe delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:2660

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

1

T1047

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

1

T1006

Indicator Removal

2

T1070

File Deletion

2

T1070.004

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PerfLogs\Admin\How To Restore Your Files.txt

Filesize
143B

MD5
4412c9256c586536fe50e4e597e3e17c

SHA1
63fb5a15306c6322feb227aa8a5fbdce5e38ef1c

SHA256
2c8b4cf863cf122558b64a47c47179312012ffcc84bc9176bebe031fb47b4648

SHA512
298283dd3ec47888b80ccaeecd33d9c386a2b2af1bd01ea74142a970c6bfd3e9fdc1258f2ee4bdfbb68914103482a3e07f5b4e8f9d50abeda6ba3f65c35eda63

Download Submit

Analysis

Sharing