Overview

overview

10

Static

static

lsass.exe

windows7_x64

10

lsass.exe

windows10_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    136s
  • platform
    windows10_x64
  • resource
    win10
  • submitted
    09/07/2020, 01:31

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    lsass.exe
  • Size 214KB
  • Sample200709-hypr6l8dse
  • SHA256 da75d48c48022aae0f3134dcb66c3a8180003b014cb12b4727dc02a8e1a83b10
  • MD5 SHA1 SHA512
Score
10/10
ransomwarepersistenceburan

Malware Config

Extracted

Path

  • C:\!!! ALL YOUR FILES ARE STOLEN and ENCRYPTED !!!.TXT

  • buran

Ransom Note
  • !!! ALL YOUR FILES ARE STOLEN and ENCRYPTED !!! All your files, documents, databases and other important files are STOLEN and ENCRYPTED. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. To be sure we have the decryptor and it works you can send 4 crypt file an email: [email protected] and decrypt one random file for free. But this file should be of not valuable! Do you really want to restore your files? you must transfer 1110 bitcoins to wallet : 125WPKS5eEtrhiRmZPX1MrAzeAG8AmzrG8 Write to email: [email protected] if there is no payment, in 30 DAYS this information will be PUBLIC. Some of the data will be sold on the DarkWeb, and some will be publicly available for cyber crime. After payment this information is guaranteed to be DELETED! Your personal ID: 582-22C-A06 Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Signatures

  • Suspicious use of AdjustPrivilegeToken 89 IoCs
  • Buran

    Ransomware-as-a-service based on the VegaLocker family first identified in 2019.

    ransomwareburan
  • Adds Run entry to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Interacts with shadow copies 2 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious use of WriteProcessMemory 42 IoCs
  • Executes dropped EXE 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 8160 IoCs
  • Deletes itself 1 IoCs
  • Modifies service 2 TTPs 4 IoCs
    persistence
  • Drops file in Program Files directory 9283 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\lsass.exe
    "C:\Users\Admin\AppData\Local\Temp\lsass.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Adds Run entry to start application
    • Suspicious use of WriteProcessMemory
    PID:716
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\taskeng.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\taskeng.exe" -start
      2⤵
      • Suspicious use of WriteProcessMemory
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:3008
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C wmic shadowcopy delete
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3812
        • C:\Windows\SysWOW64\Wbem\WMIC.exe
          wmic shadowcopy delete
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2700
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} recoveryenabled no
        3⤵
          PID:3932
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
          3⤵
            PID:3868
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /C wbadmin delete catalog -quiet
            3⤵
              PID:3784
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /C vssadmin delete shadows /all /quiet
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:3368
              • C:\Windows\SysWOW64\vssadmin.exe
                vssadmin delete shadows /all /quiet
                4⤵
                • Interacts with shadow copies
                PID:392
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\~temp001.bat
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:1004
              • C:\Windows\SysWOW64\Wbem\WMIC.exe
                wmic shadowcopy delete
                4⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:3756
              • C:\Windows\SysWOW64\vssadmin.exe
                vssadmin delete shadows /all /quiet
                4⤵
                • Interacts with shadow copies
                PID:3676
            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\taskeng.exe
              "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\taskeng.exe" -agent 0
              3⤵
              • Executes dropped EXE
              • Drops file in Program Files directory
              PID:1508
          • C:\Windows\SysWOW64\notepad.exe
            notepad.exe
            2⤵
            • Deletes itself
            PID:2972
        • C:\Windows\system32\vssvc.exe
          C:\Windows\system32\vssvc.exe
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          • Modifies service
          PID:780

        Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads