Extracted

• • Target
    5b558a91c645d132300eb9261cf7e49f6392748252845e11248e8236dbb432d5
  • Size 92KB
  • SHA256 5b558a91c645d132300eb9261cf7e49f6392748252845e11248e8236dbb432d5
  • MD5 ebcb39cd30b58654d6f7dbbb32683fd3
  • SHA1 21ee7b4bbb23415a7dbfe1776c98cc5379c5d795
  • SHA512 f61876857d49c375609c1670ca4b48ba2e4c9955162665cc016ce0efc3c08c149b0ae6bdca0e2ee3186875df126a01d1afae85f727be2d26a536e7af03d0ae41
  • SSDEEP 1536:m7TP1hye3vtPUM/wZKJp4j6YBV0ifurjKhGchPUtRuMQ:m7TP1Me3vtPUMdbSDLKrjKhGchPUvTQ
  • TLSH
    T12393E54D96AE61B8D356D8F4F1FE4A30B7217DC00C2E96A9425085E01EF55F0AE2CDBB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdefense_evasiondiscoveryexecutionbabukimpactransomwarespywarestealer

  • Family: Babuk Locker

    RaaS first seen in 2021 initially called Vasa Locker.

    ransomwarebabuk

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Renames multiple (2494) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Drops startup file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2