Overview

overview

10

Static

static

3

ae5ebdadf8...ce.exe

windows10-2004-x64

10

ae5ebdadf8...ce.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    144s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/07/2026, 03:09

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ae5ebdadf816f8e67555d61e810366290a40cb90da2aef5460c186f4dcb0a8ce.exe
  • Size 47KB
  • Sample260702-dnptnsbv2v
  • SHA256 ae5ebdadf816f8e67555d61e810366290a40cb90da2aef5460c186f4dcb0a8ce
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
credential_accessdefense_evasiondiscoveryexecutionbabukimpactransomwarespywarestealer

Malware Config

Extracted

Path

  • C:\PerfLogs\How To Restore Your Files.txt

Ransom Note
  • ----------- [ Hello! ] -------------> ****BY FLUX LOCKER**** What happened? ---------------------------------------------- Your network has been breached. Your computers, servers, and local backupshave been encrypted using a powerful cryptographic algorithm. Furthermore,to restore your entire network. Follow our instructions below to recover all your data. What guarantees? ---------------------------------------------- We value our reputation. If we do not do our work and liabilities, nobody will pay us. This is not in our interests. All our decryption software is perfectly tested and will decrypt your data. We will also provide support in case of problems. We guarantee to decrypt one file for free. Go to the site and contact us. How to contact us? ---------------------------------------------- Use gmail to chat us and chat us in the gmail/proton ([email protected])) you'll get instructions on how to buy the decoder and decrypt your data. we receive hundreds of messages every day, so we will reply to you as soon as possible. !!! DANGER !!! DO NOT MODIFY or try to RECOVER any files yourself. We WILL NOT be able to RESTORE them. !!! DANGER !!

Signatures

  • Family: Babuk Locker

    RaaS first seen in 2021 initially called Vasa Locker.

    ransomwarebabuk
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Renames multiple (2075) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Drops startup file 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Interacts with shadow copies 3 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies registry class 23 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\ae5ebdadf816f8e67555d61e810366290a40cb90da2aef5460c186f4dcb0a8ce.exe
    "C:\Users\Admin\AppData\Local\Temp\ae5ebdadf816f8e67555d61e810366290a40cb90da2aef5460c186f4dcb0a8ce.exe"
    1⤵
    • Drops startup file
    • Enumerates connected drives
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:3948
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1840
      • C:\Windows\system32\vssadmin.exe
        vssadmin.exe delete shadows /all /quiet
        3⤵
        • Interacts with shadow copies
        PID:4672
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4300
      • C:\Windows\system32\vssadmin.exe
        vssadmin.exe delete shadows /all /quiet
        3⤵
        • Interacts with shadow copies
        PID:5560
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:5872
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:5736
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2996

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        How To Restore Your Files.txt
        • Path C:\PerfLogs\How To Restore Your Files.txt
        • Size 1KB
        • SHA256 55bc15ccb8bdf7421103f20957eb2f2c422a707c1cdba82bc8eb393d5fffb24a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartUnifiedTileModelCache.dat
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat
        • Size 11KB
        • SHA256 9b1375ea2e53f6edcd9d080d1ad3999efee47aa2d64e52ddd943b6da428c5597
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartUnifiedTileModelCache.dat
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat
        • Size 12KB
        • SHA256 ba3d8056f049dc5f6f7caebde1ef0a8146c02381d4837050a1c39cb43d1f1580
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        prep_Activatable Class_Hermes_perf.cache
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
        • Size 603B
        • SHA256 76051c7134ef5b2b172ae67cc7317ea11daedcc3d11f55c52922e505f501568b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        appsglobals.txt
        • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{9455e608-7a02-4c2d-8968-05459e2c9236}\appsglobals.txt
        • Size 331KB
        • SHA256 bcb6ad603f5f2d3b0df5663e8ccd4a4209201816e80bb2f60ba11c81d4dd6bdf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appssynonyms.txt
        • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{9455e608-7a02-4c2d-8968-05459e2c9236}\appssynonyms.txt
        • Size 374KB
        • SHA256 293742879d3eafac5178f28d9272f370481914bc76e80f90808bba7d9c423c26
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        settingsglobals.txt
        • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{f7afb85b-092c-454e-8e69-634a8840fa80}\settingsglobals.txt
        • Size 60KB
        • SHA256 980cf428a69ee46ec1385f1e3495b2fe91b21089a944de3a8bfb60f9091f3184
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        settingssynonyms.txt
        • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{f7afb85b-092c-454e-8e69-634a8840fa80}\settingssynonyms.txt
        • Size 125KB
        • SHA256 adc8986901f6d85440631722ff559c58f15bc7d3e555513278f4565c0675e9d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SearchUnifiedTileModelCache.dat
        • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchUnifiedTileModelCache.dat
        • Size 11KB
        • SHA256 d8a4c589f505eab2ebf2926e876b28c0af6303e176b2fff44fd9b18538574b60
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SearchUnifiedTileModelCache.dat
        • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchUnifiedTileModelCache.dat
        • Size 12KB
        • SHA256 07d21836147b048fe70d206f8b0977bde3af2499a27f2b96f281aa8844c53e5d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SettingsCache.txt
        • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SettingsCache.txt
        • Size 575KB
        • SHA256 bfef4a905afe500c0f805c24896ad9cfaa3b6258a39497c7d00ce8a6d3f7d19c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2996-897-0x000001A301DC0000-0x000001A301DE0000-memory.dmp
        Download

        memory/2996-894-0x000001A301CC0000-0x000001A301CE0000-memory.dmp
        Download

        memory/2996-895-0x000001A314000000-0x000001A314100000-memory.dmp
        Download

        memory/2996-932-0x000001A3146E0000-0x000001A314700000-memory.dmp
        Download

        memory/2996-876-0x000001A3001E0000-0x000001A3002E0000-memory.dmp
        Download

        memory/3948-1105-0x00007FF6F3330000-0x00007FF6F3344000-memory.dmp
        Download

        memory/3948-735-0x00007FF6F3330000-0x00007FF6F3344000-memory.dmp
        Download