Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
02/07/2026, 03:09
General
- Target ae5ebdadf816f8e67555d61e810366290a40cb90da2aef5460c186f4dcb0a8ce.exe
- Size 47KB
- Sample260702-dnptnsbv2v
- SHA256 ae5ebdadf816f8e67555d61e810366290a40cb90da2aef5460c186f4dcb0a8ce
Malware Config
Extracted
-
C:\PerfLogs\How To Restore Your Files.txt
- ----------- [ Hello! ] -------------> ****BY FLUX LOCKER**** What happened? ---------------------------------------------- Your network has been breached. Your computers, servers, and local backupshave been encrypted using a powerful cryptographic algorithm. Furthermore,to restore your entire network. Follow our instructions below to recover all your data. What guarantees? ---------------------------------------------- We value our reputation. If we do not do our work and liabilities, nobody will pay us. This is not in our interests. All our decryption software is perfectly tested and will decrypt your data. We will also provide support in case of problems. We guarantee to decrypt one file for free. Go to the site and contact us. How to contact us? ---------------------------------------------- Use gmail to chat us and chat us in the gmail/proton ([email protected])) you'll get instructions on how to buy the decoder and decrypt your data. we receive hundreds of messages every day, so we will reply to you as soon as possible. !!! DANGER !!! DO NOT MODIFY or try to RECOVER any files yourself. We WILL NOT be able to RESTORE them. !!! DANGER !!
Signatures
- Family: Babuk Locker
RaaS first seen in 2021 initially called Vasa Locker.
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Renames multiple (2493) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
- Drops startup file 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Interacts with shadow copies 3 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ae5ebdadf816f8e67555d61e810366290a40cb90da2aef5460c186f4dcb0a8ce.exe"C:\Users\Admin\AppData\Local\Temp\ae5ebdadf816f8e67555d61e810366290a40cb90da2aef5460c186f4dcb0a8ce.exe"1⤵
- Checks computer location settings
- Drops startup file
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
How To Restore Your Files.txt
StartUnifiedTileModelCache.dat
StartUnifiedTileModelCache.dat
memory/1792-1262-0x00007FF777530000-0x00007FF777544000-memory.dmp
memory/1792-1374-0x00007FF777530000-0x00007FF777544000-memory.dmp