Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

2025-03-08...er.exe

windows7-x64

10

2025-03-08...er.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2025-03-08_d0fe83c7d3f84d90f71ba3a682cc75f9_babuk_destroyer

  • Size

    79KB

  • Sample

    250308-kmzqtatzbt

  • MD5

    d0fe83c7d3f84d90f71ba3a682cc75f9

  • SHA1

    e6d1422a7691287f041505a3f68a87014137800a

  • SHA256

    db2625edd1448fc3abe3edd4d9606d211e61c83ebae8ff205d1f29aa331ab9f3

  • SHA512

    a38301e1fbe67cbee0d8395a55df8c488ab37c0c0ed1619b199c284d56310b776ed5cf921d7aa22c9bd7006ac4c1288c9281551ed8a66a9b3e3695261157e13a

  • SSDEEP

    1536:b5kaWBeGrVZbzsrQLOJgY8ZZP8LHD4XWaNH71dLdG1iiFM2iG2nwd:b8BeuNzsrQLOJgY8Zp8LHD4XWaNH71d8

Score
10/10
babukdefense_evasiondiscoveryexecutionimpactransomware

Malware Config

Targets

    • Target

      2025-03-08_d0fe83c7d3f84d90f71ba3a682cc75f9_babuk_destroyer

    • Size

      79KB

    • MD5

      d0fe83c7d3f84d90f71ba3a682cc75f9

    • SHA1

      e6d1422a7691287f041505a3f68a87014137800a

    • SHA256

      db2625edd1448fc3abe3edd4d9606d211e61c83ebae8ff205d1f29aa331ab9f3

    • SHA512

      a38301e1fbe67cbee0d8395a55df8c488ab37c0c0ed1619b199c284d56310b776ed5cf921d7aa22c9bd7006ac4c1288c9281551ed8a66a9b3e3695261157e13a

    • SSDEEP

      1536:b5kaWBeGrVZbzsrQLOJgY8ZZP8LHD4XWaNH71dLdG1iiFM2iG2nwd:b8BeuNzsrQLOJgY8Zp8LHD4XWaNH71d8

    Score
    10/10
    babukdefense_evasiondiscoveryexecutionimpactransomware

    • Babuk Locker

      RaaS first seen in 2021 initially called Vasa Locker.

      ransomwarebabuk

    • Babuk family

      babuk

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Renames multiple (199) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks