{"description": "Enterprise techniques used by Babuk, ATT&CK software S0638 v1.0", "name": "Babuk (S0638)", "domain": "enterprise-attack", "versions": {"layer": "4.3", "attack": "10", "navigator": "4.5"}, "techniques": [{"techniqueID": "T1059", "showSubtechniques": true}, {"score": 1, "techniqueID": "T1059.003", "showSubtechniques": true, "comment": "[Babuk](https://attack.mitre.org/software/S0638) has the ability to use the command line to control execution on compromised hosts.(Citation: Sogeti CERT ESEC Babuk March 2021)(Citation: McAfee Babuk February 2021)"}, {"score": 1, "techniqueID": "T1486", "showSubtechniques": false, "comment": "[Babuk](https://attack.mitre.org/software/S0638) can use ChaCha8 and ECDH to encrypt data.(Citation: Sogeti CERT ESEC Babuk March 2021)(Citation: McAfee Babuk February 2021)(Citation: Medium Babuk February 2021)(Citation: Trend Micro Ransomware February 2021)"}, {"score": 1, "techniqueID": "T1140", "showSubtechniques": false, "comment": "[Babuk](https://attack.mitre.org/software/S0638) has the ability to unpack itself into memory using XOR.(Citation: Sogeti CERT ESEC Babuk March 2021)(Citation: Medium Babuk February 2021)"}, {"score": 1, "techniqueID": "T1083", "showSubtechniques": false, "comment": "[Babuk](https://attack.mitre.org/software/S0638) has the ability to enumerate files on a targeted system.(Citation: McAfee Babuk February 2021)(Citation: Trend Micro Ransomware February 2021)"}, {"techniqueID": "T1562", "showSubtechniques": true}, {"score": 1, "techniqueID": "T1562.001", "showSubtechniques": true, "comment": "[Babuk](https://attack.mitre.org/software/S0638) can stop anti-virus services on a compromised host.(Citation: Sogeti CERT ESEC Babuk March 2021)"}, {"score": 1, "techniqueID": "T1490", "showSubtechniques": false, "comment": "[Babuk](https://attack.mitre.org/software/S0638) has the ability to delete shadow volumes using vssadmin.exe delete shadows /all /quiet.(Citation: Sogeti CERT ESEC Babuk March 2021)(Citation: McAfee Babuk February 2021)"}, {"score": 1, "techniqueID": "T1106", "showSubtechniques": false, "comment": "[Babuk](https://attack.mitre.org/software/S0638) can use multiple Windows API calls for actions on compromised hosts including discovery and execution.(Citation: Sogeti CERT ESEC Babuk March 2021)(Citation: McAfee Babuk February 2021)(Citation: Medium Babuk February 2021)"}, {"score": 1, "techniqueID": "T1135", "showSubtechniques": false, "comment": "[Babuk](https://attack.mitre.org/software/S0638) has the ability to enumerate network shares.(Citation: Sogeti CERT ESEC Babuk March 2021)"}, {"techniqueID": "T1027", "showSubtechniques": true}, {"score": 1, "techniqueID": "T1027.002", "showSubtechniques": true, "comment": "Versions of [Babuk](https://attack.mitre.org/software/S0638) have been packed.(Citation: Sogeti CERT ESEC Babuk March 2021)(Citation: McAfee Babuk February 2021)(Citation: Medium Babuk February 2021)"}, {"score": 1, "techniqueID": "T1057", "showSubtechniques": false, "comment": "[Babuk](https://attack.mitre.org/software/S0638) has the ability to check running processes on a targeted system.(Citation: Sogeti CERT ESEC Babuk March 2021)(Citation: McAfee Babuk February 2021)(Citation: Trend Micro Ransomware February 2021)"}, {"score": 1, "techniqueID": "T1489", "showSubtechniques": false, "comment": "[Babuk](https://attack.mitre.org/software/S0638) can stop specific services related to backups.(Citation: Sogeti CERT ESEC Babuk March 2021)(Citation: McAfee Babuk February 2021)(Citation: Trend Micro Ransomware February 2021)"}, {"score": 1, "techniqueID": "T1082", "showSubtechniques": false, "comment": "[Babuk](https://attack.mitre.org/software/S0638) can enumerate disk volumes, get disk information, and query service status.(Citation: McAfee Babuk February 2021)"}, {"score": 1, "techniqueID": "T1049", "showSubtechniques": false, "comment": "[Babuk](https://attack.mitre.org/software/S0638) can use \u201cWNetOpenEnumW\u201d and \u201cWNetEnumResourceW\u201d to enumerate files in network resources for encryption.(Citation: McAfee Babuk February 2021)"}, {"score": 1, "techniqueID": "T1007", "showSubtechniques": false, "comment": "[Babuk](https://attack.mitre.org/software/S0638) can enumerate all services running on a compromised host.(Citation: McAfee Babuk February 2021)"}], "gradient": {"colors": ["#ffffff", "#66b1ff"], "minValue": 0, "maxValue": 1}, "legendItems": [{"label": "used by Babuk", "color": "#66b1ff"}]}