Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

5_debug_f_..._1.exe

windows7-x64

10

5_debug_f_..._1.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5_debug_f_4_multibabyk_ST_1.bin

  • Size

    87KB

  • Sample

    250307-jssc9axk14

  • MD5

    d04e5e760da11b8b53b14b9fd4436935

  • SHA1

    1468184aba0d32a25211120b1299a943b983e741

  • SHA256

    b3e2ca4aabd7110693d160aa02fead6e51007a0623320a099f62b913ae0eb369

  • SHA512

    1fd101602a69dcb3d09d79fb41a29441d2fda94c5bd2b0eecc6cfdfc235a8c866e39e8ba1bbd91b41e1611dd041d79ae914def226faf60e1b8836aae28683f31

  • SSDEEP

    1536:+nWwDhe/yPhBgGPUsrQLOJgY8ZZP8LHD4XWaNH71dLdG1iiFM2iG2CgE:8he/yPbssrQLOJgY8Zp8LHD4XWaNH71O

Score
10/10
babukdefense_evasiondiscoveryexecutionimpactransomware

Malware Config

Targets

    • Target

      5_debug_f_4_multibabyk_ST_1.bin

    • Size

      87KB

    • MD5

      d04e5e760da11b8b53b14b9fd4436935

    • SHA1

      1468184aba0d32a25211120b1299a943b983e741

    • SHA256

      b3e2ca4aabd7110693d160aa02fead6e51007a0623320a099f62b913ae0eb369

    • SHA512

      1fd101602a69dcb3d09d79fb41a29441d2fda94c5bd2b0eecc6cfdfc235a8c866e39e8ba1bbd91b41e1611dd041d79ae914def226faf60e1b8836aae28683f31

    • SSDEEP

      1536:+nWwDhe/yPhBgGPUsrQLOJgY8ZZP8LHD4XWaNH71dLdG1iiFM2iG2CgE:8he/yPbssrQLOJgY8Zp8LHD4XWaNH71O

    Score
    10/10
    babukdefense_evasiondiscoveryexecutionimpactransomware

    • Babuk Locker

      RaaS first seen in 2021 initially called Vasa Locker.

      ransomwarebabuk

    • Babuk family

      babuk

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Renames multiple (209) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks