Overview

overview

10

Static

static

3

5b558a91c6...d5.exe

windows10-2004-x64

10

5b558a91c6...d5.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    138s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/07/2026, 03:09

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    5b558a91c645d132300eb9261cf7e49f6392748252845e11248e8236dbb432d5.exe
  • Size 92KB
  • Sample260702-dnfk1abv2s
  • SHA256 5b558a91c645d132300eb9261cf7e49f6392748252845e11248e8236dbb432d5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
credential_accessdefense_evasiondiscoveryexecutionbabukimpactransomwarespywarestealer

Malware Config

Extracted

Path

  • C:\PerfLogs\How To Restore Your Files.txt

Ransom Note
  • ----------- [ Hello! ] -------------> ****BY FLUX LOCKER**** What happened? ---------------------------------------------- Your network has been breached. Your computers, servers, and local backupshave been encrypted using a powerful cryptographic algorithm. Furthermore,to restore your entire network. Follow our instructions below to recover all your data. What guarantees? ---------------------------------------------- We value our reputation. If we do not do our work and liabilities, nobody will pay us. This is not in our interests. All our decryption software is perfectly tested and will decrypt your data. We will also provide support in case of problems. We guarantee to decrypt one file for free. Go to the site and contact us. How to contact us? ---------------------------------------------- Use gmail to chat us and chat us in the gmail/proton ([email protected])) you'll get instructions on how to buy the decoder and decrypt your data. we receive hundreds of messages every day, so we will reply to you as soon as possible. !!! DANGER !!! DO NOT MODIFY or try to RECOVER any files yourself. We WILL NOT be able to RESTORE them. !!! DANGER !!

Signatures

  • Family: Babuk Locker

    RaaS first seen in 2021 initially called Vasa Locker.

    ransomwarebabuk
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Renames multiple (2422) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Drops startup file 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Interacts with shadow copies 3 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies registry class 23 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\5b558a91c645d132300eb9261cf7e49f6392748252845e11248e8236dbb432d5.exe
    "C:\Users\Admin\AppData\Local\Temp\5b558a91c645d132300eb9261cf7e49f6392748252845e11248e8236dbb432d5.exe"
    1⤵
    • Drops startup file
    • Enumerates connected drives
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:6156
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5984
      • C:\Windows\system32\vssadmin.exe
        vssadmin.exe delete shadows /all /quiet
        3⤵
        • Interacts with shadow copies
        PID:2756
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:700
      • C:\Windows\system32\vssadmin.exe
        vssadmin.exe delete shadows /all /quiet
        3⤵
        • Interacts with shadow copies
        PID:4220
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4892
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:1740
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:7072

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        How To Restore Your Files.txt
        • Path C:\PerfLogs\How To Restore Your Files.txt
        • Size 1KB
        • SHA256 55bc15ccb8bdf7421103f20957eb2f2c422a707c1cdba82bc8eb393d5fffb24a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartUnifiedTileModelCache.dat
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat
        • Size 11KB
        • SHA256 4cc1777d0319251aed72ea32b01b5a1e32736b04567f053362feb7ed4798687b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartUnifiedTileModelCache.dat
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat
        • Size 12KB
        • SHA256 a15fd8440d95b01905f6bb0292dc414e673d6f785cf67c880b6190630fd9078c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        prep_Activatable Class_Hermes_perf.cache
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
        • Size 603B
        • SHA256 76051c7134ef5b2b172ae67cc7317ea11daedcc3d11f55c52922e505f501568b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        appsglobals.txt
        • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{824a3183-3553-4442-b4a4-788385ecf8e0}\appsglobals.txt
        • Size 331KB
        • SHA256 bcb6ad603f5f2d3b0df5663e8ccd4a4209201816e80bb2f60ba11c81d4dd6bdf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appssynonyms.txt
        • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{824a3183-3553-4442-b4a4-788385ecf8e0}\appssynonyms.txt
        • Size 374KB
        • SHA256 293742879d3eafac5178f28d9272f370481914bc76e80f90808bba7d9c423c26
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        settingsglobals.txt
        • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{b1cfe60c-f018-4172-9f70-28b31879404a}\settingsglobals.txt
        • Size 60KB
        • SHA256 980cf428a69ee46ec1385f1e3495b2fe91b21089a944de3a8bfb60f9091f3184
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        settingssynonyms.txt
        • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{b1cfe60c-f018-4172-9f70-28b31879404a}\settingssynonyms.txt
        • Size 125KB
        • SHA256 adc8986901f6d85440631722ff559c58f15bc7d3e555513278f4565c0675e9d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SearchUnifiedTileModelCache.dat
        • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchUnifiedTileModelCache.dat
        • Size 11KB
        • SHA256 d2441fd2a96a8b0e2f49b71f7297f6c41ecd84c8a4dec9988fc0a16546080b61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SearchUnifiedTileModelCache.dat
        • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchUnifiedTileModelCache.dat
        • Size 12KB
        • SHA256 efe6d932aab97c1c0c095f84ade8ff89a292298908acac3bf8bed0a37d7af4cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SettingsCache.txt
        • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SettingsCache.txt
        • Size 575KB
        • SHA256 bfef4a905afe500c0f805c24896ad9cfaa3b6258a39497c7d00ce8a6d3f7d19c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1740-1222-0x0000022C326D0000-0x0000022C32B04000-memory.dmp
        Download

        memory/6156-1190-0x00007FF688700000-0x00007FF68871E000-memory.dmp
        Download

        memory/6156-836-0x00007FF688700000-0x00007FF68871E000-memory.dmp
        Download

        memory/7072-967-0x000001AA842A0000-0x000001AA842C0000-memory.dmp
        Download

        memory/7072-971-0x000001AA947D0000-0x000001AA947F0000-memory.dmp
        Download

        memory/7072-956-0x000001AA81EB0000-0x000001AA81ED0000-memory.dmp
        Download

        memory/7072-957-0x000001AA842E0000-0x000001AA843E0000-memory.dmp
        Download

        memory/7072-879-0x000001AA80220000-0x000001AA80320000-memory.dmp
        Download