Overview

overview

10

Static

static

3

8419573012...3c.exe

windows10-2004-x64

10

8419573012...3c.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    138s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/07/2026, 03:09

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    84195730129823c9956a2a10a20776a88aa8e613cbef264e610a50f4fb68543c.exe
  • Size 46KB
  • Sample260702-dnnavabv2t
  • SHA256 84195730129823c9956a2a10a20776a88aa8e613cbef264e610a50f4fb68543c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
credential_accessdefense_evasiondiscoveryexecutionbabukimpactransomwarespywarestealer

Malware Config

Extracted

Path

  • C:\PerfLogs\How To Restore Your Files.txt

Ransom Note
  • ----------- [ Hello! ] -------------> ****BY FLUX LOCKER**** What happened? ---------------------------------------------- Your network has been breached. Your computers, servers, and local backupshave been encrypted using a powerful cryptographic algorithm. Furthermore,to restore your entire network. Follow our instructions below to recover all your data. What guarantees? ---------------------------------------------- We value our reputation. If we do not do our work and liabilities, nobody will pay us. This is not in our interests. All our decryption software is perfectly tested and will decrypt your data. We will also provide support in case of problems. We guarantee to decrypt one file for free. Go to the site and contact us. How to contact us? ---------------------------------------------- Use gmail to chat us and chat us in the gmail/proton ([email protected])) you'll get instructions on how to buy the decoder and decrypt your data. we receive hundreds of messages every day, so we will reply to you as soon as possible. !!! DANGER !!! DO NOT MODIFY or try to RECOVER any files yourself. We WILL NOT be able to RESTORE them. !!! DANGER !!

Signatures

  • Family: Babuk Locker

    RaaS first seen in 2021 initially called Vasa Locker.

    ransomwarebabuk
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Renames multiple (1940) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Drops startup file 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Interacts with shadow copies 3 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies registry class 23 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\84195730129823c9956a2a10a20776a88aa8e613cbef264e610a50f4fb68543c.exe
    "C:\Users\Admin\AppData\Local\Temp\84195730129823c9956a2a10a20776a88aa8e613cbef264e610a50f4fb68543c.exe"
    1⤵
    • Drops startup file
    • Enumerates connected drives
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:1196
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5872
      • C:\Windows\system32\vssadmin.exe
        vssadmin.exe delete shadows /all /quiet
        3⤵
        • Interacts with shadow copies
        PID:5196
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5012
      • C:\Windows\system32\vssadmin.exe
        vssadmin.exe delete shadows /all /quiet
        3⤵
        • Interacts with shadow copies
        PID:4660
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:5904
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:1272
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3512

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        How To Restore Your Files.txt
        • Path C:\PerfLogs\How To Restore Your Files.txt
        • Size 1KB
        • SHA256 55bc15ccb8bdf7421103f20957eb2f2c422a707c1cdba82bc8eb393d5fffb24a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartUnifiedTileModelCache.dat
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat
        • Size 11KB
        • SHA256 1378daaf5f88fb720b0a8c137f79976f718fb6e50d2d73df19faefa109b79ed4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartUnifiedTileModelCache.dat
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat
        • Size 12KB
        • SHA256 31e92d3b94a9a699a6205847372e91f70562bcc89def2f6bd7b7975f1dc0af36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        prep_Activatable Class_Hermes_perf.cache
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
        • Size 603B
        • SHA256 b346273b0f3e13afaa9f07d97248343c45a667a5e097d1198a449a4de187aebb
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        prep_Activatable Class_Hermes_perf.cache
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
        • Size 599B
        • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        SearchUnifiedTileModelCache.dat
        • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchUnifiedTileModelCache.dat
        • Size 11KB
        • SHA256 641ccc211f7eaf17445eb98f3812fa6b682c43dc901d1e1539eef22d751f819a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SearchUnifiedTileModelCache.dat
        • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchUnifiedTileModelCache.dat
        • Size 12KB
        • SHA256 27a2415078c3f49ffed9e1f46e25822076bcc2d290b6e1863ccf031cee766f6f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SettingsCache.txt
        • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SettingsCache.txt
        • Size 575KB
        • SHA256 bfef4a905afe500c0f805c24896ad9cfaa3b6258a39497c7d00ce8a6d3f7d19c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1196-1009-0x00007FF7D8650000-0x00007FF7D8663000-memory.dmp
        Download

        memory/1196-815-0x00007FF7D8650000-0x00007FF7D8663000-memory.dmp
        Download

        memory/3512-819-0x000001F3801E0000-0x000001F3802E0000-memory.dmp
        Download

        memory/3512-828-0x000001F381AA0000-0x000001F381AC0000-memory.dmp
        Download

        memory/3512-839-0x000001F381CE0000-0x000001F381D00000-memory.dmp
        Download

        memory/3512-867-0x000001F394260000-0x000001F394280000-memory.dmp
        Download

        memory/3512-829-0x000001F381EE0000-0x000001F381FE0000-memory.dmp
        Download