File name:

c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.zip

Full analysis: https://app.any.run/tasks/c1a5ca7a-2f30-4160-9982-c9de97bc454a
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: April 29, 2025, 18:50:23
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
babuk
ransomware
Indicators:
MIME: application/zip
File info: Zip archive data, at least v5.1 to extract, compression method=AES Encrypted
MD5:

ADA74AAAF0724796719152A322104B24

SHA1:

BD80FCB602BCD129594EFF771B97311876667B8E

SHA256:

79D0B54AE73AB48A5E69AD5BED5C3C444DF622FD291CFA9036D26C3DA627C524

SSDEEP:

3072:o2P6g3gu+UN7aOluoSkKWrCNRfw3erI6V3uZ9vaG6i35iw1I3q1lur:NT3PN7a4uoSBDPfwuP3uFb3Iw12q36

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 1132)

    • BABUK mutex has been found

      • c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.exe (PID: 8176)

    • Deletes shadow copies

      • cmd.exe (PID: 6028)
      • cmd.exe (PID: 4400)

    • RANSOMWARE has been detected

      • c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.exe (PID: 8176)

    • Renames files like ransomware

      • c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.exe (PID: 8176)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 1132)
      • c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.exe (PID: 8176)

    • Starts CMD.EXE for commands execution

      • c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.exe (PID: 8176)

    • Creates file in the systems drive root

      • c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.exe (PID: 8176)

    • Executes application which crashes

      • c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.exe (PID: 8176)

  • INFO

    • Reads the software policy settings

      • slui.exe (PID: 7232)
      • slui.exe (PID: 7916)

    • Checks proxy server information

      • slui.exe (PID: 7916)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1132)

    • Reads the computer name

      • c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.exe (PID: 8176)

    • Reads the machine GUID from the registry

      • c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.exe (PID: 8176)

    • Checks supported languages

      • c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.exe (PID: 8176)

    • Process checks computer location settings

      • c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.exe (PID: 8176)

    • Creates files or folders in the user directory

      • c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.exe (PID: 8176)
      • WerFault.exe (PID: 7180)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 51
ZipBitFlag: 0x0003
ZipCompression: Unknown (99)
ZipModifyDate: 2025:04:29 18:47:56
ZipCRC: 0x7fbfde2f
ZipCompressedSize: 174147
ZipUncompressedSize: 315904
ZipFileName: c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
145
Monitored processes
12
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe slui.exe #BABUK c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.exe cmd.exe no specs conhost.exe no specs vssadmin.exe no specs cmd.exe no specs conhost.exe no specs vssadmin.exe no specs werfault.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1132"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
4400"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quietC:\Windows\System32\cmd.exe—c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
4724\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4944\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4980vssadmin.exe delete shadows /all /quietC:\Windows\System32\vssadmin.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Command Line Interface for Microsoft® Volume Shadow Copy Service
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssadmin.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\combase.dll
5512vssadmin.exe delete shadows /all /quietC:\Windows\System32\vssadmin.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Command Line Interface for Microsoft® Volume Shadow Copy Service
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssadmin.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\combase.dll
6028"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quietC:\Windows\System32\cmd.exe—c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
7180C:\WINDOWS\SysWOW64\WerFault.exe -u -p 8176 -s 1064C:\Windows\SysWOW64\WerFault.exe—c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
7200C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7232"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
5 128
Read events
5 118
Write events
10
Delete events
0

Modification events

(PID) Process:(1132) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(1132) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(1132) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(1132) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.zip
(PID) Process:(1132) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1132) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1132) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1132) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1132) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(1132) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
1
Executable files
1
Suspicious files
71
Text files
88
Unknown types
0

Dropped files

PID
Process
Filename
Type
8176c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCookies\How To Restore Your Files.txttext
MD5:87E99DA0D6F2CF3DB51E44D63BE1EDB2
SHA256:9820D0318339646D3217C06AEA242391EE9745C813E06B15B2E1EA0C9D875C29
8176c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.exeC:\Users\admin\3D Objects\How To Restore Your Files.txttext
MD5:87E99DA0D6F2CF3DB51E44D63BE1EDB2
SHA256:9820D0318339646D3217C06AEA242391EE9745C813E06B15B2E1EA0C9D875C29
8176c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.exeC:\Users\admin\AppData\Local\VirtualStore\How To Restore Your Files.txttext
MD5:87E99DA0D6F2CF3DB51E44D63BE1EDB2
SHA256:9820D0318339646D3217C06AEA242391EE9745C813E06B15B2E1EA0C9D875C29
8176c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.exeC:\Users\admin\Contacts\How To Restore Your Files.txttext
MD5:87E99DA0D6F2CF3DB51E44D63BE1EDB2
SHA256:9820D0318339646D3217C06AEA242391EE9745C813E06B15B2E1EA0C9D875C29
8176c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.exeC:\Users\admin\AppData\Roaming\How To Restore Your Files.txttext
MD5:87E99DA0D6F2CF3DB51E44D63BE1EDB2
SHA256:9820D0318339646D3217C06AEA242391EE9745C813E06B15B2E1EA0C9D875C29
8176c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.exeC:\BOOTNXT.babykbinary
MD5:93B885ADFE0DA089CDF634904FD59F71
SHA256:6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
8176c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.exeC:\bootTel.dat.babykbinary
MD5:5C95D04D8A6FEF2C823E9538BD0A1B38
SHA256:FDD46368879C37E8002FE3CD17BF800A066B3D5A870DCE8B8D69D19C4513D485
8176c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.exeC:\Users\admin\How To Restore Your Files.txttext
MD5:87E99DA0D6F2CF3DB51E44D63BE1EDB2
SHA256:9820D0318339646D3217C06AEA242391EE9745C813E06B15B2E1EA0C9D875C29
8176c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.exeC:\Users\admin\.ms-ad\How To Restore Your Files.txttext
MD5:87E99DA0D6F2CF3DB51E44D63BE1EDB2
SHA256:9820D0318339646D3217C06AEA242391EE9745C813E06B15B2E1EA0C9D875C29
8176c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.exeC:\Users\admin\Documents\How To Restore Your Files.txttext
MD5:87E99DA0D6F2CF3DB51E44D63BE1EDB2
SHA256:9820D0318339646D3217C06AEA242391EE9745C813E06B15B2E1EA0C9D875C29
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
23
DNS requests
16
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.216.77.10:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
23.54.109.203:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7756
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7756
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
23.216.77.10:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6544
svchost.exe
40.126.31.2:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
23.54.109.203:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
7756
SIHClient.exe
172.202.163.200:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
GB
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 23.216.77.10
  • 23.216.77.12
  • 23.216.77.25
  • 23.216.77.36
  • 23.216.77.6
  • 23.216.77.42
  • 23.216.77.18
  • 23.216.77.21
  • 23.216.77.4
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
google.com
  • 142.250.185.110
whitelisted
login.live.com
  • 40.126.31.2
  • 20.190.159.71
  • 40.126.31.131
  • 40.126.31.69
  • 20.190.159.68
  • 20.190.159.64
  • 20.190.159.2
  • 40.126.31.71
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
ocsp.digicert.com
  • 23.54.109.203
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted
activation-v2.sls.microsoft.com
  • 52.161.91.37
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
c94a81fdf688d220827320e88cc0b89af8690142abe5c602131b6659297c7d24.zip