Overview

overview

10

Static

static

b56a1f8a3b...76.exe

windows7_x64

10

b56a1f8a3b...76.exe

windows10_x64

10

Analysis

  • max time kernel
    151s
  • max time network
    133s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    14-12-2020 16:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b56a1f8a3ba9c5eb1a3b1a6aca398676.exe

  • Size

    325KB

  • MD5

    b56a1f8a3ba9c5eb1a3b1a6aca398676

  • SHA1

    345a633366ec3dab7813924773377afc005cc5fc

  • SHA256

    812e862c4c470d4728a408b64d1cff9dca2f302f2742ff5ec99aeb896870bc6e

  • SHA512

    ee9f751e332d9cf2cc8cc42a3cc9e7b2e6671358623c9e5a00a45a9f3a86e648aa7e13a43001d69a516ea78579c98fe6f102d42b930199872134d17efa6e32e4

Score
10/10
burandiscoverypersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT

Family

buran

Ransom Note
!!! ALL YOUR FILES ARE ENCRYPTED !!! All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. To be sure we have the decryptor and it works you can send an email: uspex1@cock.li and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? Pay $ 100 in BTC Write to email: uspex1@cock.li Reserved email: uspex2@cock.li Telegram: @uspex2 Your personal ID: 10F-18C-8B1 Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.
Emails

uspex1@cock.li

uspex2@cock.li

Signatures

  • Buran

    Ransomware-as-a-service based on the VegaLocker family first identified in 2019.

    ransomwareburan
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • Accesses 2FA software files, possible credential harvesting 2 TTPs
    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Program Files directory 9245 IoCs
  • Interacts with shadow copies 2 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies system certificate store 2 TTPs 5 IoCs
    evasionspywaretrojan
  • Suspicious use of AdjustPrivilegeToken 85 IoCs
  • Suspicious use of WriteProcessMemory 59 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b56a1f8a3ba9c5eb1a3b1a6aca398676.exe
    "C:\Users\Admin\AppData\Local\Temp\b56a1f8a3ba9c5eb1a3b1a6aca398676.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1776
    • C:\Users\Admin\AppData\Local\Temp\kjejdIHj.exe
      "C:\Users\Admin\AppData\Local\Temp\kjejdIHj.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Modifies system certificate store
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:636
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\services.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\services.exe" -start
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Modifies system certificate store
        • Suspicious use of WriteProcessMemory
        PID:1732
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /C wmic shadowcopy delete
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1896
          • C:\Windows\SysWOW64\Wbem\WMIC.exe
            wmic shadowcopy delete
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:756
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} recoveryenabled no
          4⤵
            PID:1636
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
            4⤵
              PID:1664
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /C wbadmin delete catalog -quiet
              4⤵
                PID:1660
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\system32\cmd.exe" /C vssadmin delete shadows /all /quiet
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:1844
                • C:\Windows\SysWOW64\vssadmin.exe
                  vssadmin delete shadows /all /quiet
                  5⤵
                  • Interacts with shadow copies
                  PID:1540
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\system32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\~temp001.bat
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:1008
                • C:\Windows\SysWOW64\Wbem\WMIC.exe
                  wmic shadowcopy delete
                  5⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:792
                • C:\Windows\SysWOW64\vssadmin.exe
                  vssadmin delete shadows /all /quiet
                  5⤵
                  • Interacts with shadow copies
                  PID:2028
              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\services.exe
                "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\services.exe" -agent 0
                4⤵
                • Executes dropped EXE
                • Drops file in Program Files directory
                PID:1744
            • C:\Windows\SysWOW64\notepad.exe
              notepad.exe
              3⤵
                PID:1324
          • C:\Windows\system32\vssvc.exe
            C:\Windows\system32\vssvc.exe
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:328

          Network

          MITRE ATT&CK Matrix ATT&CK v6

          Initial Access

          Execution

          Persistence

          Registry Run Keys / Startup Folder

          1
          T1060

          Privilege Escalation

          Defense Evasion

          File Deletion

          2
          T1107

          Modify Registry

          2
          T1112

          Install Root Certificate

          1
          T1130

          Credential Access

          Credentials in Files

          2
          T1081

          Discovery

          Query Registry

          2
          T1012

          Peripheral Device Discovery

          1
          T1120

          System Information Discovery

          1
          T1082

          Lateral Movement

          Collection

          Data from Local System

          2
          T1005

          Exfiltration

          Command and Control

          Web Service

          1
          T1102

          Impact

          Inhibit System Recovery

          2
          T1490

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3F26ED5DE6B4E859CCCA6035ECB8D9CB
            MD5

            b70dc0d32e75295574887a1eb8e8824d

            SHA1

            1c7aadf97657f25a66e2b26ffce20fae35a81b71

            SHA256

            9ba2afab5c73c6c8fef834f724b2b729553020c44495b12f87e5779d94354cd9

            SHA512

            4396416ab54ea4c5f50c3b9fa6c0679bb9ec3a5549ba0d729ef54266404a6ebbffdca86da989b17b6357f9bce3fcc0b8f43727d56adae84beac48e1fc7740dc8

            Download Submit
          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\204C1AA6F6114E6A513754A2AB5760FA_0673414C08DE7F919AE3F6C4CC65AEEE
            MD5

            ee6f44b70b1b952cca185c9c42455e50

            SHA1

            304e0d9730b1e2c36d42b12ff8ebb8ce12d2557b

            SHA256

            e61cbb508cf8bd896994b1feea6912f2d4319d6a382d9554ee43c9e44d76443c

            SHA512

            f0c69c3d063cc4aeb65467cb06b6a9a2f1fb56b9ca7419f3ad83a61725ab71ab7a0b0964eef422d11fb47bff7573ad18a5f6f004db7ddab829cb5b49c0897297

            Download Submit
          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
            MD5

            a79f29048b133ca17588ca54c6519db9

            SHA1

            45854963cb24a79f8b582fd13c6916d9bacf60b4

            SHA256

            164f85824da0142ecb22e5f6903e6b0628dc50c9425aac6a4819b9dd340a565d

            SHA512

            9da9eed3123c84d81fa784ec38c7b975ca8be47037d5d137d1d9124c2a35cb3f067cffd083e449fe5ce2547d9c31fa36409b9fe312a95b20d0dbc8c9c4ed8034

            Download Submit
          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3F26ED5DE6B4E859CCCA6035ECB8D9CB
            MD5

            de85a10419d30f347c7b0b0ed3b71fac

            SHA1

            231b7c6f43006b02aaaf9632e5d6e533dc458658

            SHA256

            d40a2a5ba83459adf8c01f628f3437908494b7c9d5aa8599830411bcb06d44b7

            SHA512

            62a9fccb7a7cf6d61f60e67053b2795c4cb39f1f5f7f9fe715d8c30ddc02058d5bb368a06ffebd78f98a82ec71fde6ea4c04c4a23b47e3fb526f531be8dfc2ba

            Download Submit
          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\204C1AA6F6114E6A513754A2AB5760FA_0673414C08DE7F919AE3F6C4CC65AEEE
            MD5

            fb3cba406b7db4427a2448a301472029

            SHA1

            81043fa56af65e0ed46f3ad04c630c16b338aa79

            SHA256

            845f01a62d34797f262348d1c43c1efc1a661657cc1ce428e1a1f10cfd728233

            SHA512

            ca1809a172057098ae49c5c73c36f84fef196988a75b90b3a8fb937cfeb71ddc76a260dc01027060687b372caac7582ff2981053efae8c5452057be4daf00287

            Download Submit
          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
            MD5

            2c3dab0ad9bdb538c770fdd2e0bc3598

            SHA1

            09fdafd2260d72481a62bae68601f9c641d3e0f4

            SHA256

            95c9ccad463037cf97f342766826ef0c69a9473b1b06ebf850f7cbc76829559b

            SHA512

            ac87f24f8e90f02a15cc16a4d0a7dbaf6ab70ffc3d8352dc7d98a86e045b260d740cd2e6a46dcbc9943bd067ebb3499ad03bd2d706032cba77e874ab55c8145c

            Download Submit
          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
            MD5

            491f17226e33cc9923f02e57de5dd8d0

            SHA1

            0d3f124234d9ff5777c5cdf68471f43ba0695b68

            SHA256

            b6127714c001a28a2530677954ad351252b881b5344dcde3cba9823d5b6423ee

            SHA512

            e1d8248c01a4152e48443ae39a1fe72642b346911b750c29450c756e2d09560269a1aeaef5fbca9ad594086ccd18161f4e566749453fe0181a32fbd45dbcbb6a

            Download Submit
          • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3O0J2C38\L4MFWJEK.htm
            MD5

            b1cd7c031debba3a5c77b39b6791c1a7

            SHA1

            e5d91e14e9c685b06f00e550d9e189deb2075f76

            SHA256

            57ba053f075e0b80f747f3102ed985687c16a8754d109e7c4d33633269a36aaa

            SHA512

            d2bbefdc1effb52a38964c4cec5990a5a226248eca36f99e446c0c5704436f666bf1cb514e73b8991411d497d3325ecc646cbd5065c364e92ab6b9c5f1ad4a72

            Download Submit
          • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I4HTQEUG\IC1KCPPZ.htm
            MD5

            8615e70875c2cc0b9db16027b9adf11d

            SHA1

            4ed62cf405311c0ff562a3c59334a15ddc4f1bf9

            SHA256

            da96949ba6b0567343f144486505c8c8fa1d892fd88c9cbc3ef3d751a570724d

            SHA512

            cd9dfc88dc2af9438b7d6b618d1b62029b3bdf739fc4daa5b37397afd12c4528561b3bf2fc3f3f2adf3fd1f582d5524332441fd30248fcd078e41aa91e17cb73

            Download Submit
          • C:\Users\Admin\AppData\Local\Temp\kjejdIHj.exe
            MD5

            43a791cfe3e906f15a432943088450a1

            SHA1

            0a2d12d30126385eb85d1ce88d06762bc429fb03

            SHA256

            7055e8438da61efa50058acd4e010c634f5e33352e2ee6d1f013572f004b7101

            SHA512

            372cb914052c02115f381e5dbc04d6885aa34a1dfa565b882eae7438681c1e14166b6bfbefb175cf2ca9cd036291057056b8c0a8b025c606c8a8f08eed4b466a

            Download Submit
          • C:\Users\Admin\AppData\Local\Temp\kjejdIHj.exe
            MD5

            43a791cfe3e906f15a432943088450a1

            SHA1

            0a2d12d30126385eb85d1ce88d06762bc429fb03

            SHA256

            7055e8438da61efa50058acd4e010c634f5e33352e2ee6d1f013572f004b7101

            SHA512

            372cb914052c02115f381e5dbc04d6885aa34a1dfa565b882eae7438681c1e14166b6bfbefb175cf2ca9cd036291057056b8c0a8b025c606c8a8f08eed4b466a

            Download Submit
          • C:\Users\Admin\AppData\Local\Temp\~temp001.bat
            MD5

            ef572e2c7b1bbd57654b36e8dcfdc37a

            SHA1

            b84c4db6d0dfd415c289d0c8ae099aea4001e3b7

            SHA256

            e6e609db3f387f42bfd16dd9e5695ddc2b73d86ae12baf4f0dfc4edda4a96a64

            SHA512

            b8c014b242e8e8f42da37b75fe96c52cd25ebd366d0b5103bcba5ac041806d13142a62351edecdee583d494d2a120f9b330f6229b1b5fe820e1c7d98981089e9

            Download Submit
          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\services.exe
            MD5

            43a791cfe3e906f15a432943088450a1

            SHA1

            0a2d12d30126385eb85d1ce88d06762bc429fb03

            SHA256

            7055e8438da61efa50058acd4e010c634f5e33352e2ee6d1f013572f004b7101

            SHA512

            372cb914052c02115f381e5dbc04d6885aa34a1dfa565b882eae7438681c1e14166b6bfbefb175cf2ca9cd036291057056b8c0a8b025c606c8a8f08eed4b466a

            Download Submit
          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\services.exe
            MD5

            43a791cfe3e906f15a432943088450a1

            SHA1

            0a2d12d30126385eb85d1ce88d06762bc429fb03

            SHA256

            7055e8438da61efa50058acd4e010c634f5e33352e2ee6d1f013572f004b7101

            SHA512

            372cb914052c02115f381e5dbc04d6885aa34a1dfa565b882eae7438681c1e14166b6bfbefb175cf2ca9cd036291057056b8c0a8b025c606c8a8f08eed4b466a

            Download Submit
          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\services.exe
            MD5

            43a791cfe3e906f15a432943088450a1

            SHA1

            0a2d12d30126385eb85d1ce88d06762bc429fb03

            SHA256

            7055e8438da61efa50058acd4e010c634f5e33352e2ee6d1f013572f004b7101

            SHA512

            372cb914052c02115f381e5dbc04d6885aa34a1dfa565b882eae7438681c1e14166b6bfbefb175cf2ca9cd036291057056b8c0a8b025c606c8a8f08eed4b466a

            Download Submit
          • \Users\Admin\AppData\Local\Temp\kjejdIHj.exe
            MD5

            43a791cfe3e906f15a432943088450a1

            SHA1

            0a2d12d30126385eb85d1ce88d06762bc429fb03

            SHA256

            7055e8438da61efa50058acd4e010c634f5e33352e2ee6d1f013572f004b7101

            SHA512

            372cb914052c02115f381e5dbc04d6885aa34a1dfa565b882eae7438681c1e14166b6bfbefb175cf2ca9cd036291057056b8c0a8b025c606c8a8f08eed4b466a

            Download Submit
          • \Users\Admin\AppData\Local\Temp\kjejdIHj.exe
            MD5

            43a791cfe3e906f15a432943088450a1

            SHA1

            0a2d12d30126385eb85d1ce88d06762bc429fb03

            SHA256

            7055e8438da61efa50058acd4e010c634f5e33352e2ee6d1f013572f004b7101

            SHA512

            372cb914052c02115f381e5dbc04d6885aa34a1dfa565b882eae7438681c1e14166b6bfbefb175cf2ca9cd036291057056b8c0a8b025c606c8a8f08eed4b466a

            Download Submit
          • \Users\Admin\AppData\Roaming\Microsoft\Windows\services.exe
            MD5

            43a791cfe3e906f15a432943088450a1

            SHA1

            0a2d12d30126385eb85d1ce88d06762bc429fb03

            SHA256

            7055e8438da61efa50058acd4e010c634f5e33352e2ee6d1f013572f004b7101

            SHA512

            372cb914052c02115f381e5dbc04d6885aa34a1dfa565b882eae7438681c1e14166b6bfbefb175cf2ca9cd036291057056b8c0a8b025c606c8a8f08eed4b466a

            Download Submit
          • \Users\Admin\AppData\Roaming\Microsoft\Windows\services.exe
            MD5

            43a791cfe3e906f15a432943088450a1

            SHA1

            0a2d12d30126385eb85d1ce88d06762bc429fb03

            SHA256

            7055e8438da61efa50058acd4e010c634f5e33352e2ee6d1f013572f004b7101

            SHA512

            372cb914052c02115f381e5dbc04d6885aa34a1dfa565b882eae7438681c1e14166b6bfbefb175cf2ca9cd036291057056b8c0a8b025c606c8a8f08eed4b466a

            Download Submit
          • memory/636-5-0x0000000000000000-mapping.dmp
            Download
          • memory/672-2-0x000007FEF6B20000-0x000007FEF6D9A000-memory.dmp
            Filesize

            2.5MB

            Download
          • memory/756-34-0x0000000000000000-mapping.dmp
            Download
          • memory/792-35-0x0000000000000000-mapping.dmp
            Download
          • memory/1008-28-0x0000000000000000-mapping.dmp
            Download
          • memory/1324-14-0x0000000000000000-mapping.dmp
            Download
          • memory/1324-13-0x00000000000A0000-0x00000000000A1000-memory.dmp
            Filesize

            4KB

            Download
          • memory/1540-32-0x0000000000000000-mapping.dmp
            Download
          • memory/1636-24-0x0000000000000000-mapping.dmp
            Download
          • memory/1660-26-0x0000000000000000-mapping.dmp
            Download
          • memory/1664-25-0x0000000000000000-mapping.dmp
            Download
          • memory/1732-10-0x0000000000000000-mapping.dmp
            Download
          • memory/1744-30-0x0000000000000000-mapping.dmp
            Download
          • memory/1844-27-0x0000000000000000-mapping.dmp
            Download
          • memory/1896-23-0x0000000000000000-mapping.dmp
            Download
          • memory/2028-36-0x0000000000000000-mapping.dmp
            Download