Overview

overview

10

Static

static

lsass.exe

windows7_x64

10

lsass.exe

windows10_x64

10

Resubmissions

07-11-2020 21:55

201107-hpbkxklwmn 10

07-11-2020 21:28

201107-vkwbkzk1ej 10

Analysis

  • max time kernel
    150s
  • max time network
    135s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    07-11-2020 21:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    lsass.exe

  • Size

    214KB

  • MD5

    3a87a3c5abcdc92ef421700ac6f5d0d1

  • SHA1

    70509f9eed0f90f62b804da75aa73b6a3f6390ec

  • SHA256

    45dd162163830e078517e6afb39a1b472d5077394500f2b3f85fa3711eb742af

  • SHA512

    f6ae90245715e6e0a1e640ab123fa2c47971517142a65ebd4960aefac3493cabd65686cdb99623ce06d586f76b1e12d93e238086e83beed0a6bf649eb2518a6f

Score
10/10
buranpersistenceransomware

Malware Config

Extracted

Path

C:\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT

Family

buran

Ransom Note
!!! ALL YOUR FILES ARE ENCRYPTED !!! All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. To be sure we have the decryptor and it works you can send an email: tomriddle1337@cock.li and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? Write to email: tomriddle1337@cock.li Reserved email: riddletom1337@protonmail.com Your personal ID: 608-BE8-D51 Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.
Emails

tomriddle1337@cock.li

riddletom1337@protonmail.com

Signatures

  • Buran

    Ransomware-as-a-service based on the VegaLocker family first identified in 2019.

    ransomwareburan
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Executes dropped EXE 2 IoCs
  • Deletes itself 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Modifies service 2 TTPs 4 IoCs
    persistence
  • Drops file in Program Files directory 23156 IoCs
  • Interacts with shadow copies 2 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 7414 IoCs
  • Suspicious use of AdjustPrivilegeToken 89 IoCs
  • Suspicious use of WriteProcessMemory 42 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\lsass.exe
    "C:\Users\Admin\AppData\Local\Temp\lsass.exe"
    1⤵
    • Adds Run key to start application
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3988
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\services.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\services.exe" -start
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2756
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C wmic shadowcopy delete
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:480
        • C:\Windows\SysWOW64\Wbem\WMIC.exe
          wmic shadowcopy delete
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:3028
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} recoveryenabled no
        3⤵
          PID:908
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
          3⤵
            PID:3828
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /C wbadmin delete catalog -quiet
            3⤵
              PID:3856
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /C vssadmin delete shadows /all /quiet
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:2500
              • C:\Windows\SysWOW64\vssadmin.exe
                vssadmin delete shadows /all /quiet
                4⤵
                • Interacts with shadow copies
                PID:3956
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\~temp001.bat
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:4000
              • C:\Windows\SysWOW64\Wbem\WMIC.exe
                wmic shadowcopy delete
                4⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:2688
              • C:\Windows\SysWOW64\vssadmin.exe
                vssadmin delete shadows /all /quiet
                4⤵
                • Interacts with shadow copies
                PID:2064
            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\services.exe
              "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\services.exe" -agent 0
              3⤵
              • Executes dropped EXE
              • Drops file in Program Files directory
              PID:1432
          • C:\Windows\SysWOW64\notepad.exe
            notepad.exe
            2⤵
            • Deletes itself
            PID:1636
        • C:\Windows\system32\vssvc.exe
          C:\Windows\system32\vssvc.exe
          1⤵
          • Modifies service
          • Suspicious use of AdjustPrivilegeToken
          PID:1272
        • C:\Windows\System32\rundll32.exe
          C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
          1⤵
            PID:2300

          Network

          MITRE ATT&CK Matrix ATT&CK v6

          Initial Access

          Execution

          Persistence

          Registry Run Keys / Startup Folder

          1
          T1060

          Modify Existing Service

          1
          T1031

          Privilege Escalation

          Defense Evasion

          File Deletion

          2
          T1107

          Modify Registry

          3
          T1112

          Install Root Certificate

          1
          T1130

          Credential Access

          Discovery

          Query Registry

          1
          T1012

          Peripheral Device Discovery

          1
          T1120

          System Information Discovery

          1
          T1082

          Lateral Movement

          Collection

          Exfiltration

          Command and Control

          Web Service

          1
          T1102

          Impact

          Inhibit System Recovery

          2
          T1490

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3F26ED5DE6B4E859CCCA6035ECB8D9CB
            MD5

            e5be8c65934ad0c00c584026d085108e

            SHA1

            6ce4c8bc54630bf9f70d3fe93ce91bf44004439f

            SHA256

            68413df5f5923c0283167f5bf10bb7a65b1cdbea7602d263f64af49820efa315

            SHA512

            50470648453a249e3ec06572fd418a123bd0500291a8b3bc0c7cde453ac36e027130f49f01c17ab21034d6033abe1f81402166ee80460b0fcb56856f20db2539

            Download Submit
          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\204C1AA6F6114E6A513754A2AB5760FA_0673414C08DE7F919AE3F6C4CC65AEEE
            MD5

            3208da0c038576623565b095fcea4ad1

            SHA1

            bc421f8eb4b9c6100aa444edece988c01dd63b26

            SHA256

            16ca708624c0f83871bbb8349e31fba20e5591f298ee91ddf08faf2919041f4b

            SHA512

            17fd810bdb400ce06167d6009a23cbdafdeb5eb0cb5c18456ec3a833546ad050429b003bdec753aa591d5b370cbb1290633abc1cc71f3ae29e81d58c56b8408c

            Download Submit
          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
            MD5

            3bf227caeee1b07d47b29873a1640f1a

            SHA1

            61af6e587db89d7d7f518bb1e16c2d73451e5ed6

            SHA256

            30becef61dd6dd9d8b0402aec82db12ebb3ef7b76d854ca1f8bd30fa50ab5980

            SHA512

            29a3663efa62ccc6dce4e083b7e43e80560de48ebc0eebfff5aed1fc158f0ed65a009589046773cb3c97588005219f45ae414c53f7bffe5a0a2ec80b0c2a903e

            Download Submit
          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3F26ED5DE6B4E859CCCA6035ECB8D9CB
            MD5

            35aca68d66bdd9e4a95bda5f3c538df8

            SHA1

            751dd5064f0ebe281a1c7f62d7b843b060358b4c

            SHA256

            cd2148e565e406a19219e48a0863c181f80b1989a9fbb35f41ff02d7944a3141

            SHA512

            8a7cc64df7352f741496fc70c6bd71cdb5e3c501dd25e587af23c2b7e9a31258e2f56e0d0fa3d24c5de71e6e06a39f40c309b892e1e8129439ceefbd218a86cb

            Download Submit
          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\204C1AA6F6114E6A513754A2AB5760FA_0673414C08DE7F919AE3F6C4CC65AEEE
            MD5

            10d74ff50c4d114f978062a58aa2c5aa

            SHA1

            ac9ef94568b908ec006b93fdb6f2d747d198f209

            SHA256

            5c484cbae43e72381ba1d62df7d2dda11f918c69621ebecc427a8d7ad6fa2bb3

            SHA512

            800c38c0f9ad4d59f9c4297ff4b209d668656d5b0e43c6f6fb3bf67e6527709842ed6fdf60aa7ed3a5b7022017835e547f3d35b0293c5e658a3a699ef953ba5d

            Download Submit
          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
            MD5

            afb42e4a399444bd72dec8e27dd3ae27

            SHA1

            6b31b9dd80d88dda85eef7e6a6949554b9c0fe0e

            SHA256

            7a567b8941ddfdd89a908e42370e989b16279fccb0b8de2862802c5017d159da

            SHA512

            1ec707e9f14b6537df6d2e2d8ecd24ca9e7c3e4640fced2bf67418827b9c1e0882b60e360f39fa76f9994ee360b4a584c889195ef2769bc9a88ee0853ba30026

            Download Submit
          • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\JGAO043J\32N1POL7.htm
            MD5

            6b17a59cec1a7783febae9aa55c56556

            SHA1

            01d4581e2b3a6348679147a915a0b22b2a66643a

            SHA256

            66987b14b90d41632be98836f9601b12e7f329ffab05595887889c9c5716fbeb

            SHA512

            3337efd12b9c06b7768eb928a78caae243b75257c5aabe7a49e908a2f735af55f7257a40bd2330dc13865ead18ed805b54a6c5105740fdcbbaccacf7997bcbc3

            Download Submit
          • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\S7PGJ114\9BKPPHZT.htm
            MD5

            b1cd7c031debba3a5c77b39b6791c1a7

            SHA1

            e5d91e14e9c685b06f00e550d9e189deb2075f76

            SHA256

            57ba053f075e0b80f747f3102ed985687c16a8754d109e7c4d33633269a36aaa

            SHA512

            d2bbefdc1effb52a38964c4cec5990a5a226248eca36f99e446c0c5704436f666bf1cb514e73b8991411d497d3325ecc646cbd5065c364e92ab6b9c5f1ad4a72

            Download Submit
          • C:\Users\Admin\AppData\Local\Temp\~temp001.bat
            MD5

            ef572e2c7b1bbd57654b36e8dcfdc37a

            SHA1

            b84c4db6d0dfd415c289d0c8ae099aea4001e3b7

            SHA256

            e6e609db3f387f42bfd16dd9e5695ddc2b73d86ae12baf4f0dfc4edda4a96a64

            SHA512

            b8c014b242e8e8f42da37b75fe96c52cd25ebd366d0b5103bcba5ac041806d13142a62351edecdee583d494d2a120f9b330f6229b1b5fe820e1c7d98981089e9

            Download Submit
          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\services.exe
            MD5

            3a87a3c5abcdc92ef421700ac6f5d0d1

            SHA1

            70509f9eed0f90f62b804da75aa73b6a3f6390ec

            SHA256

            45dd162163830e078517e6afb39a1b472d5077394500f2b3f85fa3711eb742af

            SHA512

            f6ae90245715e6e0a1e640ab123fa2c47971517142a65ebd4960aefac3493cabd65686cdb99623ce06d586f76b1e12d93e238086e83beed0a6bf649eb2518a6f

            Download Submit
          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\services.exe
            MD5

            3a87a3c5abcdc92ef421700ac6f5d0d1

            SHA1

            70509f9eed0f90f62b804da75aa73b6a3f6390ec

            SHA256

            45dd162163830e078517e6afb39a1b472d5077394500f2b3f85fa3711eb742af

            SHA512

            f6ae90245715e6e0a1e640ab123fa2c47971517142a65ebd4960aefac3493cabd65686cdb99623ce06d586f76b1e12d93e238086e83beed0a6bf649eb2518a6f

            Download Submit
          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\services.exe
            MD5

            3a87a3c5abcdc92ef421700ac6f5d0d1

            SHA1

            70509f9eed0f90f62b804da75aa73b6a3f6390ec

            SHA256

            45dd162163830e078517e6afb39a1b472d5077394500f2b3f85fa3711eb742af

            SHA512

            f6ae90245715e6e0a1e640ab123fa2c47971517142a65ebd4960aefac3493cabd65686cdb99623ce06d586f76b1e12d93e238086e83beed0a6bf649eb2518a6f

            Download Submit
          • memory/480-13-0x0000000000000000-mapping.dmp
            Download
          • memory/908-14-0x0000000000000000-mapping.dmp
            Download
          • memory/1432-19-0x0000000000000000-mapping.dmp
            Download
          • memory/1636-3-0x0000000003090000-0x0000000003091000-memory.dmp
            Filesize

            4KB

            Download
          • memory/1636-4-0x0000000000000000-mapping.dmp
            Download
          • memory/2064-25-0x0000000000000000-mapping.dmp
            Download
          • memory/2500-17-0x0000000000000000-mapping.dmp
            Download
          • memory/2688-23-0x0000000000000000-mapping.dmp
            Download
          • memory/2756-0-0x0000000000000000-mapping.dmp
            Download
          • memory/3028-22-0x0000000000000000-mapping.dmp
            Download
          • memory/3828-15-0x0000000000000000-mapping.dmp
            Download
          • memory/3856-16-0x0000000000000000-mapping.dmp
            Download
          • memory/3956-24-0x0000000000000000-mapping.dmp
            Download
          • memory/4000-18-0x0000000000000000-mapping.dmp
            Download