Analysis
-
max time kernel
96s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
07/03/2025, 15:25
General
-
Target
2025-03-07_4f0ccb90deee7a1c682aee81ed6b178f_babuk_destroyer.exe
-
Size
79KB
-
MD5
4f0ccb90deee7a1c682aee81ed6b178f
-
SHA1
8e04625ea33a81ead19b76a61f0f93c767184175
-
SHA256
ed07799f0d08d37f1ea3841f3727b142ecceddfaf1ee01896af149853eda7a38
-
SHA512
5068373c347f4cadcdaee9455a6e410218756f53f71e6596bc2f3a3b62cb12b918afe37ee4abd37797bec7a0246804c1bb7c4638f14a1e6cb94e27383e85667d
-
SSDEEP
1536:ZOknM8H9Uzzb9srQLOJgY8ZZP8LHD4XWaNH71dLdG1iiFM2iG2n4B:XnM8Hsf9srQLOJgY8Zp8LHD4XWaNH71C
Malware Config
Signatures
-
Babuk Locker
RaaS first seen in 2021 initially called Vasa Locker.
-
Babuk family
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (224) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
NTFS ADS 28 IoCs
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-03-07_4f0ccb90deee7a1c682aee81ed6b178f_babuk_destroyer.exe"C:\Users\Admin\AppData\Local\Temp\2025-03-07_4f0ccb90deee7a1c682aee81ed6b178f_babuk_destroyer.exe"1⤵
- Checks computer location settings
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1144 -s 16482⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1144 -ip 11441⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1144 -ip 11441⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
306KB
MD564de709da66bc145c746516dc438e059
SHA1fb2ed86224bfb75235edae7b7a6470cdd5fb3054
SHA2562fcf7129da6310ccf95343e69ee3d74ac7cbc3f6ac101fd7c6b4c37499e97b0e
SHA512105169822249b5282dbcbd7eb00ac546d730183c094e810d5addfcd51e2ac203c5ed115febf76fa2a829009dd493a41efd9e8979894211e32fb756e78d25d6ed
-
Filesize
8KB
MD55eada003dc497b00bac5b5288e70d52b
SHA1daa4849fcb7dfc00a938b52d44a53f3bc28a4f74
SHA256990fbd0af1060c1c9c1c06dc8fac2a8e0d776d33e18dffb4e297636a40b6ac4d
SHA5128148a4359499f7e28d4540c4c549ab4ae922c3b031cc1cf5d6a1f379a50cf7810c056c7c56c2704f09a51c60e8c59607fc64e06e8618748112bc7d17be295f0f
-
Filesize
8KB
MD52af817219bb1d24a11ab839b9453b5f3
SHA1f9ff9075f9472c41aeb93df2e439fe624dc143b0
SHA2566a16454cad4534d51025f65277abaec0ff4a30082840154a35889445bb3ad0a0
SHA512d443e149d8b097cc64b0bbbf65e3d660de43943a4b36ac4c41bfbdfe814fb895d7ba97128aa1235b85d2292b79afc451fbcb89cc6a56d33ecff7d93e18a15c30
-
Filesize
272KB
MD50cbea0afdc09ac6b51f73d68080f0d80
SHA10eab68f04d0bd00244fef29a00d1ad2c6d87fa92
SHA256c7069f46e1210022a9c2781396e10ab838ee43b10079afc5d7732320c168ded0
SHA5129decdf40f739df4a0f25b59b48872c01a8e15a284d408985e38740181fc530dc3be5ebe10ddb8bca37051610f956905897ed2f53606e2f65b80ae187df2c5051
-
Filesize
8KB
MD506c7ae023feec5d8de0fe3b13738268c
SHA1e3089d21615506a8628eedf509e49e43c78b68b8
SHA2568c9f47c495f822e9809485cfa51d800e6b4d97eac47026e9f978c86c0640adae
SHA51236a95c71614ff844619cd94596a070f0bbf7efa4500935f0b43b03592d6ec15a69ac3ed6014fe90ec11b6f84638127a524c5d29c770047c91ab65bcef963fb3b
-
Filesize
8KB
MD597608712329d87bdc7bd16051d3ff59b
SHA1184c133ed1182b6c4d27a68f21d9b980bec01176
SHA256213e8eca032a6cb8c997b249b15794b36502fe1a7929a55a828e3a0f428bcdf3
SHA512d325a9d319654058d689530be2882e46ebcfdfb52591028d4a941d53e9c0235f442eba4c5fde59a53654bc9dd349970033ad6825ccf4753c84f8f462afaa1890
-
Filesize
8KB
MD5b155bdef47aef8541ecf6ab410d83786
SHA142d56e3f5eba1f6ba3546212ac10356d2d4b6e1f
SHA2560d6e7ed7cac7fdce87c1207cd1fa5c1979fc3e2caa1effa14a9e9da163f6654d
SHA512cb0dcea16e721fb017047b0db0b684da5464c5d56119c28d481af69dfdf26029bca8880670d8669d9fe83fd81e23dd2f1b2811bfe7ce9d82943f64b6c734d2fb
-
Filesize
8KB
MD5099884066a968153685cdad82d919d72
SHA1f926f66c603c13adfcb880c187f88bdba57774f9
SHA2565a9f5fbdced6a834780c00f46f5f53c4aa45be1a817a2bb2262ae0c467d77447
SHA51257849bb22b9fbae6239ef2c803f32fb3342eedcd1bbb1cb650c93cb9934d9ca7f55d21e76c0c665ec65041fe3a4e2ab8493c5335f17d883cba434950f54a43e2
-
Filesize
367KB
MD50ce534661a6fad9c851200fb9345f45d
SHA19e88286c538dece6a5db527394402e12dd12fc08
SHA25615e6da59aa97fec2b79f4601e0b7bfdcb40f2481bff881e77030109a17b2eb70
SHA5129971c82b1c7cb2e5825d999ccc44e351e6ce8dd147801b39176f3fde3b5c54a411805309e53004ed3c6161131eae6a2dff199d9a77104e306d1e877fa0b2d5cf
-
Filesize
8KB
MD59f335b16672ffee31a03d965a87412c1
SHA157674d8eb8f63c9d968c18bb82cb210b48023e0b
SHA2563f239b52581a3bfbca4efe87b959bbee78226c117c2fac51d50ea1f4f67e8193
SHA5124158db2c8d0996ec49177a21f7a058e9a8c3964a74c2626c049153fb73403cf420383d33d37fd81ca9d145ab9d52d4d49b448d377adad889918306b774edf109
-
Filesize
8KB
MD543ded46da19a7a49223c29be8952588f
SHA10d3d295883ffb717cad4c156d49c9e068fbe4f55
SHA25681808de67360be0631e7094155ac6612ff6a44855647ad939961ed681a091a93
SHA5123404bc1a0c2353d5053243446f8a3e26cb26f3eeff2b0ab20fff52738a1d009a7b5da46843012c7050a344b32bb653312dc8506cc85d3372f9b131cb8a925d20
-
Filesize
8KB
MD53fec770fedd5353b57f555030e8f1b28
SHA1ce48571521eb6e9d1a046ed4d8fc515bd03e6bd6
SHA256e64b6c60c7dfc02c2f063edb8e6cd113b8872e600ae8d586986856adf6379bc4
SHA51238d9074f5fb50586e227493a91a84378f1ef2fad4ac4744fd8780e82de654df26304b8dce3d5d28d87d924bef9878191a8f60290dc9843da3f7efba731fd3f43
-
Filesize
8KB
MD5163a588de1ae8d643c379734f6eb4f0d
SHA1fbca23b05872b78c3a68e737c024483b2d640bae
SHA256495c039dd336493c094069e7475cba2ee4facba5dd24acd3866a28a2d61fc62a
SHA512d21d7895eafe14e8a18cebf8d6051e6107c226e727d491dd744fe603326ad67bc5ca66cc25727b260b27dcb57bf00e3d0317198c36e252b241cbce2581c666e9