Day 20: Babuk Ransomware

The infection begins with a downloader module on the victim’s server and is modified as an EfsPotato exploit targeting ProxyShell and PetitPotam vulnerabilities. The downloader runs an embedded obfuscated PowerShell command from the actor’s infrastructure to connect and download a packed downloader module. An AMSI bypass is executed by the PowerShell command to circumvent endpoint protection and the malicious domains, fbi[.]fund and xxxs[.]info, are used to host the downloader server. The encrypted .NET resources, as bitmap images, are contained within the initial packed loader module. The actual Bubak ransomware payload is the decrypted content, and the loader connects to a URL on pastebin.pl that contains the intermediate unpacker module to decrypt and unpack the payload. The embedded Babuk ransomware payload is decrypted in memory by the unpacker module and injected into a newly created process AddInProcess32. Running within the process AddInProcess32, the ransomware module summarizes the processes running on the victim’s server attempting to disable numerous processes related to backup products including the Veeam backup service. The ransomware deletes volume shadow service (VSS) snapshots from the server ensuring the encrypted files can’t be restored from their VSS copies using the vssadmin utility. The files are encrypted in the victim’s server and the ransomware appends the ‘.babyk’ file extension to the encrypted files.