Resubmissions

12-11-2021 18:04

211112-wnzb8aahhm 10

19-11-2020 10:08

201119-rhwlt38jrx 10

18-11-2020 17:26

201118-htd4fq29va 10

Analysis

  • max time kernel
    302s
  • max time network
    442s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    18-11-2020 17:26

General

  • Target

    default.exe

Malware Config

Extracted

Path

C:\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT

Family

buran

Ransom Note
!!! ALL YOUR FILES ARE ENCRYPTED !!! All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. To be sure we have the decryptor and it works you can send an email: lokeradmin@protonmail.com or adminsysloker@protonmail.com and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? Write to email: lokeradmin@protonmail.com Reserved email: adminsysloker@protonmail.com Your personal ID: 261-5BF-BF2 Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.
Emails

lokeradmin@protonmail.com

adminsysloker@protonmail.com

Signatures

  • Buran

    Ransomware-as-a-service based on the VegaLocker family first identified in 2019.

  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Executes dropped EXE 2 IoCs
  • Modifies extensions of user files 2 IoCs

    Ransomware generally changes the extension on encrypted files.

  • Deletes itself 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 50 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\default.exe
    "C:\Users\Admin\AppData\Local\Temp\default.exe"
    1⤵
    • Adds Run key to start application
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:504
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe" -start
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1136
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe" -agent 0
        3⤵
        • Executes dropped EXE
        • Modifies extensions of user files
        • Drops file in Program Files directory
        PID:3252
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
        3⤵
          PID:3472
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} recoveryenabled no
          3⤵
            PID:1832
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /C wbadmin delete catalog -quiet
            3⤵
              PID:3928
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /C wbadmin delete systemstatebackup
              3⤵
                PID:3752
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\system32\cmd.exe" /C wbadmin delete systemstatebackup -keepversions:0
                3⤵
                  PID:3976
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\system32\cmd.exe" /C wbadmin delete backup
                  3⤵
                    PID:2988
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\system32\cmd.exe" /C wmic shadowcopy delete
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:736
                    • C:\Windows\SysWOW64\Wbem\WMIC.exe
                      wmic shadowcopy delete
                      4⤵
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1436
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\system32\cmd.exe" /C vssadmin delete shadows /all /quiet
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2448
                    • C:\Windows\SysWOW64\vssadmin.exe
                      vssadmin delete shadows /all /quiet
                      4⤵
                      • Interacts with shadow copies
                      PID:3608
                  • C:\Windows\SysWOW64\notepad.exe
                    notepad.exe
                    3⤵
                      PID:1048
                  • C:\Windows\SysWOW64\notepad.exe
                    notepad.exe
                    2⤵
                    • Deletes itself
                    PID:2964
                • C:\Windows\system32\vssvc.exe
                  C:\Windows\system32\vssvc.exe
                  1⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3436

                Network

                MITRE ATT&CK Matrix ATT&CK v6

                Persistence

                Registry Run Keys / Startup Folder

                1
                T1060

                Defense Evasion

                File Deletion

                2
                T1107

                Modify Registry

                2
                T1112

                Install Root Certificate

                1
                T1130

                Discovery

                Query Registry

                1
                T1012

                Peripheral Device Discovery

                1
                T1120

                System Information Discovery

                2
                T1082

                Command and Control

                Web Service

                1
                T1102

                Impact

                Inhibit System Recovery

                2
                T1490

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3F26ED5DE6B4E859CCCA6035ECB8D9CB
                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\204C1AA6F6114E6A513754A2AB5760FA_0673414C08DE7F919AE3F6C4CC65AEEE
                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3F26ED5DE6B4E859CCCA6035ECB8D9CB
                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\204C1AA6F6114E6A513754A2AB5760FA_0673414C08DE7F919AE3F6C4CC65AEEE
                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
                • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\JGAO043J\1FARL17G.htm
                • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\S7PGJ114\42KLK6IC.htm
                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe
                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe
                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe
                • C:\Users\Admin\Desktop\CheckpointImport.docm.261-5BF-BF2
                • C:\Users\Admin\Desktop\CompressWrite.mpa.261-5BF-BF2
                • C:\Users\Admin\Desktop\ConfirmResolve.mp4v.261-5BF-BF2
                • C:\Users\Admin\Desktop\ConfirmUnlock.mpp.261-5BF-BF2
                • C:\Users\Admin\Desktop\DenyResume.mp3.261-5BF-BF2
                • C:\Users\Admin\Desktop\DismountDisconnect.wmx.261-5BF-BF2
                • C:\Users\Admin\Desktop\FindApprove.m4a.261-5BF-BF2
                • C:\Users\Admin\Desktop\HideWait.scf.261-5BF-BF2
                • C:\Users\Admin\Desktop\InstallCompare.easmx.261-5BF-BF2
                • C:\Users\Admin\Desktop\MeasureDeny.jtx.261-5BF-BF2
                • C:\Users\Admin\Desktop\MoveSync.svg.261-5BF-BF2
                • C:\Users\Admin\Desktop\MoveUnblock.xps.261-5BF-BF2
                • C:\Users\Admin\Desktop\NewPublish.mpeg.261-5BF-BF2
                • C:\Users\Admin\Desktop\OpenApprove.png.261-5BF-BF2
                • C:\Users\Admin\Desktop\OptimizeExport.avi.261-5BF-BF2
                • C:\Users\Admin\Desktop\ReadEdit.jpeg.261-5BF-BF2
                • C:\Users\Admin\Desktop\RenameSend.dib.261-5BF-BF2
                • C:\Users\Admin\Desktop\SelectAssert.exe.261-5BF-BF2
                • C:\Users\Admin\Desktop\SuspendEnable.ADTS.261-5BF-BF2
                • C:\Users\Admin\Desktop\SuspendShow.vssm.261-5BF-BF2
                • C:\Users\Admin\Desktop\UndoLock.xlsm.261-5BF-BF2
                • C:\Users\Admin\Desktop\UnpublishDismount.mp2v.261-5BF-BF2
                • C:\Users\Admin\Desktop\UpdateMerge.vdx.261-5BF-BF2
                • C:\Users\Admin\Desktop\WaitUnblock.3gp.261-5BF-BF2
                • C:\Users\Admin\Desktop\WatchHide.M2V.261-5BF-BF2
                • memory/736-21-0x0000000000000000-mapping.dmp
                • memory/1048-51-0x0000000000000000-mapping.dmp
                • memory/1048-50-0x0000000003260000-0x0000000003261000-memory.dmp
                  Filesize

                  4KB

                • memory/1136-0-0x0000000000000000-mapping.dmp
                • memory/1436-22-0x0000000000000000-mapping.dmp
                • memory/1832-16-0x0000000000000000-mapping.dmp
                • memory/2448-23-0x0000000000000000-mapping.dmp
                • memory/2964-3-0x0000000000BA0000-0x0000000000BA1000-memory.dmp
                  Filesize

                  4KB

                • memory/2964-4-0x0000000000000000-mapping.dmp
                • memory/2988-20-0x0000000000000000-mapping.dmp
                • memory/3252-13-0x0000000000000000-mapping.dmp
                • memory/3472-15-0x0000000000000000-mapping.dmp
                • memory/3608-24-0x0000000000000000-mapping.dmp
                • memory/3752-18-0x0000000000000000-mapping.dmp
                • memory/3928-17-0x0000000000000000-mapping.dmp
                • memory/3976-19-0x0000000000000000-mapping.dmp