Extracted

• • Target
    7d685a01e341a784feef63cc669ac3d692a6bf6ac13a8da897a50de4afdca984
  • Size 44KB
  • SHA256 7d685a01e341a784feef63cc669ac3d692a6bf6ac13a8da897a50de4afdca984
  • MD5 062c8de22f2f795b3804b7132ef310ec
  • SHA1 0cbafe315a79ad059dd7943e29ca2ae1ba642ab9
  • SHA512 4b92518343aff06f8d5410efe86701cf1f12ca953893a47a3b34991072b692d98e56d084b5c80767502b03f1b13dfd84a8dccb6aa9af2f2ae2ec8b80d2b9c38b
  • SSDEEP 768:K81u8mXOe3QVpc+hMsb75Ms5Lczxyjagytq1QTBTz+:KOFe3ZvsbtjFczQx
  • TLSH
    T16C23084AFFE390FCC526D5B496FA8A36F561FC4108309E3E43D0DA7A0D65A505E2CA1B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdefense_evasiondiscoveryexecutionbabukimpactransomwarespywarestealer

  • Family: Babuk Locker

    RaaS first seen in 2021 initially called Vasa Locker.

    ransomwarebabuk

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Renames multiple (2485) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Drops startup file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2