Overview

overview

10

Static

static

b56a1f8a3b...76.exe

windows7_x64

10

b56a1f8a3b...76.exe

windows10_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    130s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    14-12-2020 16:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b56a1f8a3ba9c5eb1a3b1a6aca398676.exe

  • Size

    325KB

  • MD5

    b56a1f8a3ba9c5eb1a3b1a6aca398676

  • SHA1

    345a633366ec3dab7813924773377afc005cc5fc

  • SHA256

    812e862c4c470d4728a408b64d1cff9dca2f302f2742ff5ec99aeb896870bc6e

  • SHA512

    ee9f751e332d9cf2cc8cc42a3cc9e7b2e6671358623c9e5a00a45a9f3a86e648aa7e13a43001d69a516ea78579c98fe6f102d42b930199872134d17efa6e32e4

Score
10/10
burandiscoverypersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT

Family

buran

Ransom Note
!!! ALL YOUR FILES ARE ENCRYPTED !!! All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. To be sure we have the decryptor and it works you can send an email: uspex1@cock.li and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? Pay $ 100 in BTC Write to email: uspex1@cock.li Reserved email: uspex2@cock.li Telegram: @uspex2 Your personal ID: 10B-6CF-235 Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.
Emails

uspex1@cock.li

uspex2@cock.li

Signatures

  • Buran

    Ransomware-as-a-service based on the VegaLocker family first identified in 2019.

    ransomwareburan
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Executes dropped EXE 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • Accesses 2FA software files, possible credential harvesting 2 TTPs
    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Program Files directory 19543 IoCs
  • Interacts with shadow copies 2 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious use of AdjustPrivilegeToken 89 IoCs
  • Suspicious use of WriteProcessMemory 45 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b56a1f8a3ba9c5eb1a3b1a6aca398676.exe
    "C:\Users\Admin\AppData\Local\Temp\b56a1f8a3ba9c5eb1a3b1a6aca398676.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3988
    • C:\Users\Admin\AppData\Local\Temp\chKlkcHb.exe
      "C:\Users\Admin\AppData\Local\Temp\chKlkcHb.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Modifies system certificate store
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2476
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\spoolsv.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\spoolsv.exe" -start
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Suspicious use of WriteProcessMemory
        PID:3860
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /C wmic shadowcopy delete
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1804
          • C:\Windows\SysWOW64\Wbem\WMIC.exe
            wmic shadowcopy delete
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:3912
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} recoveryenabled no
          4⤵
            PID:2788
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
            4⤵
              PID:2516
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /C wbadmin delete catalog -quiet
              4⤵
                PID:1676
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\system32\cmd.exe" /C vssadmin delete shadows /all /quiet
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:2124
                • C:\Windows\SysWOW64\vssadmin.exe
                  vssadmin delete shadows /all /quiet
                  5⤵
                  • Interacts with shadow copies
                  PID:3492
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\system32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\~temp001.bat
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:1324
                • C:\Windows\SysWOW64\Wbem\WMIC.exe
                  wmic shadowcopy delete
                  5⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1288
                • C:\Windows\SysWOW64\vssadmin.exe
                  vssadmin delete shadows /all /quiet
                  5⤵
                  • Interacts with shadow copies
                  PID:3176
              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\spoolsv.exe
                "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\spoolsv.exe" -agent 0
                4⤵
                • Executes dropped EXE
                • Drops file in Program Files directory
                PID:1728
            • C:\Windows\SysWOW64\notepad.exe
              notepad.exe
              3⤵
                PID:4000
          • C:\Windows\system32\vssvc.exe
            C:\Windows\system32\vssvc.exe
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:1448

          Network

          MITRE ATT&CK Matrix ATT&CK v6

          Initial Access

          Execution

          Persistence

          Registry Run Keys / Startup Folder

          1
          T1060

          Privilege Escalation

          Defense Evasion

          File Deletion

          2
          T1107

          Modify Registry

          2
          T1112

          Install Root Certificate

          1
          T1130

          Credential Access

          Credentials in Files

          2
          T1081

          Discovery

          Query Registry

          2
          T1012

          Peripheral Device Discovery

          1
          T1120

          System Information Discovery

          1
          T1082

          Lateral Movement

          Collection

          Data from Local System

          2
          T1005

          Exfiltration

          Command and Control

          Web Service

          1
          T1102

          Impact

          Inhibit System Recovery

          2
          T1490

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3F26ED5DE6B4E859CCCA6035ECB8D9CB
            MD5

            b70dc0d32e75295574887a1eb8e8824d

            SHA1

            1c7aadf97657f25a66e2b26ffce20fae35a81b71

            SHA256

            9ba2afab5c73c6c8fef834f724b2b729553020c44495b12f87e5779d94354cd9

            SHA512

            4396416ab54ea4c5f50c3b9fa6c0679bb9ec3a5549ba0d729ef54266404a6ebbffdca86da989b17b6357f9bce3fcc0b8f43727d56adae84beac48e1fc7740dc8

            Download Submit
          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\204C1AA6F6114E6A513754A2AB5760FA_0673414C08DE7F919AE3F6C4CC65AEEE
            MD5

            ee6f44b70b1b952cca185c9c42455e50

            SHA1

            304e0d9730b1e2c36d42b12ff8ebb8ce12d2557b

            SHA256

            e61cbb508cf8bd896994b1feea6912f2d4319d6a382d9554ee43c9e44d76443c

            SHA512

            f0c69c3d063cc4aeb65467cb06b6a9a2f1fb56b9ca7419f3ad83a61725ab71ab7a0b0964eef422d11fb47bff7573ad18a5f6f004db7ddab829cb5b49c0897297

            Download Submit
          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
            MD5

            a79f29048b133ca17588ca54c6519db9

            SHA1

            45854963cb24a79f8b582fd13c6916d9bacf60b4

            SHA256

            164f85824da0142ecb22e5f6903e6b0628dc50c9425aac6a4819b9dd340a565d

            SHA512

            9da9eed3123c84d81fa784ec38c7b975ca8be47037d5d137d1d9124c2a35cb3f067cffd083e449fe5ce2547d9c31fa36409b9fe312a95b20d0dbc8c9c4ed8034

            Download Submit
          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3F26ED5DE6B4E859CCCA6035ECB8D9CB
            MD5

            d0dc3586389120a968696cce242cc00f

            SHA1

            56eed62d2040aa19723f0ea147c09c2a9924a2ae

            SHA256

            1e8443a60dd3a0efba884f6e76641822d073d5557174e5e15b0b21b7dec4bc6e

            SHA512

            595c3fb542a4d657e29136432bde9fc7431a6158fdf360fabf292f1801e2356dff2306946553e7bd75f54cde5ae6c86c84cad03ac91c23cec92dfc7e2205ee0d

            Download Submit
          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\204C1AA6F6114E6A513754A2AB5760FA_0673414C08DE7F919AE3F6C4CC65AEEE
            MD5

            1e4c2148d7c3bf9be2bb0fde437b9bcb

            SHA1

            59fc9690054a6e36f5e97eefe4f383c820ad1951

            SHA256

            5abd296e5ec8d8128fad97d84caad7c7ea2ede5afa3bcdd3924b35716e7962ad

            SHA512

            9d32a5f78a10c9347b7176ab86c543a1e4f36bd85867e82ddbbcf154b596f924eb04a2989bae10a51c7e1d2a526a5edccf53551cf7f60b24e3d3c8eb161c618c

            Download Submit
          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
            MD5

            3293fa35259d1633c60d7ef8c998b299

            SHA1

            8881b4c423f487d9313e47f11392e065e7106402

            SHA256

            4c1ef8c86d1202e5bb007b1f1110a360f22abaaaa24fd1207495b778bdcd79a0

            SHA512

            ed4d362957a340e10595a590b5d311230182865f9b7faee8d02d3928b119a986079bd8a8354e69caf6bb3a7247dc91269b34be6884620b55828585c0e7f5cb8c

            Download Submit
          • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\C75WK71L\W12O05Q7.htm
            MD5

            6b17a59cec1a7783febae9aa55c56556

            SHA1

            01d4581e2b3a6348679147a915a0b22b2a66643a

            SHA256

            66987b14b90d41632be98836f9601b12e7f329ffab05595887889c9c5716fbeb

            SHA512

            3337efd12b9c06b7768eb928a78caae243b75257c5aabe7a49e908a2f735af55f7257a40bd2330dc13865ead18ed805b54a6c5105740fdcbbaccacf7997bcbc3

            Download Submit
          • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\JGAO043J\LYP77TUZ.htm
            MD5

            b1cd7c031debba3a5c77b39b6791c1a7

            SHA1

            e5d91e14e9c685b06f00e550d9e189deb2075f76

            SHA256

            57ba053f075e0b80f747f3102ed985687c16a8754d109e7c4d33633269a36aaa

            SHA512

            d2bbefdc1effb52a38964c4cec5990a5a226248eca36f99e446c0c5704436f666bf1cb514e73b8991411d497d3325ecc646cbd5065c364e92ab6b9c5f1ad4a72

            Download Submit
          • C:\Users\Admin\AppData\Local\Temp\chKlkcHb.exe
            MD5

            43a791cfe3e906f15a432943088450a1

            SHA1

            0a2d12d30126385eb85d1ce88d06762bc429fb03

            SHA256

            7055e8438da61efa50058acd4e010c634f5e33352e2ee6d1f013572f004b7101

            SHA512

            372cb914052c02115f381e5dbc04d6885aa34a1dfa565b882eae7438681c1e14166b6bfbefb175cf2ca9cd036291057056b8c0a8b025c606c8a8f08eed4b466a

            Download Submit
          • C:\Users\Admin\AppData\Local\Temp\chKlkcHb.exe
            MD5

            43a791cfe3e906f15a432943088450a1

            SHA1

            0a2d12d30126385eb85d1ce88d06762bc429fb03

            SHA256

            7055e8438da61efa50058acd4e010c634f5e33352e2ee6d1f013572f004b7101

            SHA512

            372cb914052c02115f381e5dbc04d6885aa34a1dfa565b882eae7438681c1e14166b6bfbefb175cf2ca9cd036291057056b8c0a8b025c606c8a8f08eed4b466a

            Download Submit
          • C:\Users\Admin\AppData\Local\Temp\~temp001.bat
            MD5

            ef572e2c7b1bbd57654b36e8dcfdc37a

            SHA1

            b84c4db6d0dfd415c289d0c8ae099aea4001e3b7

            SHA256

            e6e609db3f387f42bfd16dd9e5695ddc2b73d86ae12baf4f0dfc4edda4a96a64

            SHA512

            b8c014b242e8e8f42da37b75fe96c52cd25ebd366d0b5103bcba5ac041806d13142a62351edecdee583d494d2a120f9b330f6229b1b5fe820e1c7d98981089e9

            Download Submit
          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\spoolsv.exe
            MD5

            43a791cfe3e906f15a432943088450a1

            SHA1

            0a2d12d30126385eb85d1ce88d06762bc429fb03

            SHA256

            7055e8438da61efa50058acd4e010c634f5e33352e2ee6d1f013572f004b7101

            SHA512

            372cb914052c02115f381e5dbc04d6885aa34a1dfa565b882eae7438681c1e14166b6bfbefb175cf2ca9cd036291057056b8c0a8b025c606c8a8f08eed4b466a

            Download Submit
          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\spoolsv.exe
            MD5

            43a791cfe3e906f15a432943088450a1

            SHA1

            0a2d12d30126385eb85d1ce88d06762bc429fb03

            SHA256

            7055e8438da61efa50058acd4e010c634f5e33352e2ee6d1f013572f004b7101

            SHA512

            372cb914052c02115f381e5dbc04d6885aa34a1dfa565b882eae7438681c1e14166b6bfbefb175cf2ca9cd036291057056b8c0a8b025c606c8a8f08eed4b466a

            Download Submit
          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\spoolsv.exe
            MD5

            43a791cfe3e906f15a432943088450a1

            SHA1

            0a2d12d30126385eb85d1ce88d06762bc429fb03

            SHA256

            7055e8438da61efa50058acd4e010c634f5e33352e2ee6d1f013572f004b7101

            SHA512

            372cb914052c02115f381e5dbc04d6885aa34a1dfa565b882eae7438681c1e14166b6bfbefb175cf2ca9cd036291057056b8c0a8b025c606c8a8f08eed4b466a

            Download Submit
          • memory/1288-29-0x0000000000000000-mapping.dmp
            Download
          • memory/1324-23-0x0000000000000000-mapping.dmp
            Download
          • memory/1676-21-0x0000000000000000-mapping.dmp
            Download
          • memory/1728-24-0x0000000000000000-mapping.dmp
            Download
          • memory/1804-18-0x0000000000000000-mapping.dmp
            Download
          • memory/2124-22-0x0000000000000000-mapping.dmp
            Download
          • memory/2476-2-0x0000000000000000-mapping.dmp
            Download
          • memory/2516-20-0x0000000000000000-mapping.dmp
            Download
          • memory/2788-19-0x0000000000000000-mapping.dmp
            Download
          • memory/3176-30-0x0000000000000000-mapping.dmp
            Download
          • memory/3492-26-0x0000000000000000-mapping.dmp
            Download
          • memory/3860-5-0x0000000000000000-mapping.dmp
            Download
          • memory/3912-28-0x0000000000000000-mapping.dmp
            Download
          • memory/4000-7-0x0000000000340000-0x0000000000341000-memory.dmp
            Filesize

            4KB

            Download
          • memory/4000-9-0x0000000000000000-mapping.dmp
            Download