Resubmissions

07-11-2020 21:55

201107-hpbkxklwmn 10

07-11-2020 21:28

201107-vkwbkzk1ej 10

General

  • Target

    lsass.exe

  • Size

    214KB

  • Sample

    201107-vkwbkzk1ej

  • MD5

    3a87a3c5abcdc92ef421700ac6f5d0d1

  • SHA1

    70509f9eed0f90f62b804da75aa73b6a3f6390ec

  • SHA256

    45dd162163830e078517e6afb39a1b472d5077394500f2b3f85fa3711eb742af

  • SHA512

    f6ae90245715e6e0a1e640ab123fa2c47971517142a65ebd4960aefac3493cabd65686cdb99623ce06d586f76b1e12d93e238086e83beed0a6bf649eb2518a6f

Malware Config

Extracted

Path

C:\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT

Family

buran

Ransom Note
!!! ALL YOUR FILES ARE ENCRYPTED !!! All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. To be sure we have the decryptor and it works you can send an email: tomriddle1337@cock.li and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? Write to email: tomriddle1337@cock.li Reserved email: riddletom1337@protonmail.com Your personal ID: 285-093-7AC Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.
Emails

tomriddle1337@cock.li

riddletom1337@protonmail.com

Extracted

Path

C:\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT

Family

buran

Ransom Note
!!! ALL YOUR FILES ARE ENCRYPTED !!! All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. To be sure we have the decryptor and it works you can send an email: tomriddle1337@cock.li and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? Write to email: tomriddle1337@cock.li Reserved email: riddletom1337@protonmail.com Your personal ID: 608-BE8-D51 Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.
Emails

tomriddle1337@cock.li

riddletom1337@protonmail.com

Targets

    • Target

      lsass.exe

    • Size

      214KB

    • MD5

      3a87a3c5abcdc92ef421700ac6f5d0d1

    • SHA1

      70509f9eed0f90f62b804da75aa73b6a3f6390ec

    • SHA256

      45dd162163830e078517e6afb39a1b472d5077394500f2b3f85fa3711eb742af

    • SHA512

      f6ae90245715e6e0a1e640ab123fa2c47971517142a65ebd4960aefac3493cabd65686cdb99623ce06d586f76b1e12d93e238086e83beed0a6bf649eb2518a6f

    • Buran

      Ransomware-as-a-service based on the VegaLocker family first identified in 2019.

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Modifies service

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Modify Existing Service

1
T1031

Defense Evasion

File Deletion

2
T1107

Modify Registry

3
T1112

Install Root Certificate

1
T1130

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Command and Control

Web Service

1
T1102

Impact

Inhibit System Recovery

2
T1490

Tasks