Overview

overview

10

Static

static

8ab4218a7e...06.exe

windows7_x64

10

8ab4218a7e...06.exe

windows10_x64

10

Analysis

  • max time kernel
    84s
  • max time network
    140s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    27-04-2021 07:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8ab4218a7ee9239d218f2729d6c00fb0246eeea1e97f85833dacfc73457c8b06.exe

  • Size

    311KB

  • MD5

    7e6635c48ad3d8c59b825f4b09caba1c

  • SHA1

    f685d5da78e69a52e2dfa4dc4b5ec16c8538671b

  • SHA256

    8ab4218a7ee9239d218f2729d6c00fb0246eeea1e97f85833dacfc73457c8b06

  • SHA512

    44021a0b7a6b6be8517e70b8d5bac9e039caa59f6d995272e1a185dec9b71c302c13cb05b55bd5b48b6b0b9c9b0f5534e4c8285cdcafe38e9e7f24252e79698c

Score
10/10
buranransomware

Malware Config

Extracted

Path

C:\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT

Family

buran

Ransom Note
!!! ALL YOUR FILES ARE ENCRYPTED !!! All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. To be sure we have the decryptor and it works you can send an email: rootiunik@cock.li and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? Write to email: rootiunik@cock.li Reserved email: TimothyCrabtree@protonmail.com Your personal ID: 18D-E54-3A4 Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.
Emails

rootiunik@cock.li

TimothyCrabtree@protonmail.com

Signatures

  • Buran

    Ransomware-as-a-service based on the VegaLocker family first identified in 2019.

    ransomwareburan
  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies extensions of user files 1 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Program crash 22 IoCs
  • Interacts with shadow copies 2 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8ab4218a7ee9239d218f2729d6c00fb0246eeea1e97f85833dacfc73457c8b06.exe
    "C:\Users\Admin\AppData\Local\Temp\8ab4218a7ee9239d218f2729d6c00fb0246eeea1e97f85833dacfc73457c8b06.exe"
    1⤵
    • Enumerates connected drives
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:3944
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3944 -s 756
      2⤵
      • Program crash
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3836
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3944 -s 868
      2⤵
      • Program crash
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3408
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3944 -s 856
      2⤵
      • Program crash
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3496
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3944 -s 936
      2⤵
      • Program crash
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4036
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3944 -s 1084
      2⤵
      • Program crash
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2428
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3944 -s 1096
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:1184
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3944 -s 1220
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:3576
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3944 -s 1432
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:3308
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3944 -s 1432
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:3692
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3944 -s 1648
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:1120
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3944 -s 1688
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:1184
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3944 -s 1728
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:2472
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3944 -s 1688
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:4016
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3944 -s 1788
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:2072
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3944 -s 1732
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:2480
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3944 -s 1680
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:3588
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3944 -s 1900
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:3932
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3944 -s 1824
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:1360
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3944 -s 1992
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:2660
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3944 -s 2000
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:3948
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /C wmic shadowcopy delete
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2284
      • C:\Windows\SysWOW64\Wbem\WMIC.exe
        wmic shadowcopy delete
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4108
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} recoveryenabled no
      2⤵
        PID:2072
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
        2⤵
          PID:3896
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\~temp001.bat
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:412
          • C:\Windows\SysWOW64\Wbem\WMIC.exe
            wmic shadowcopy delete
            3⤵
              PID:4292
            • C:\Windows\SysWOW64\vssadmin.exe
              vssadmin delete shadows /all /quiet
              3⤵
              • Interacts with shadow copies
              PID:4328
          • C:\Users\Admin\AppData\Local\Temp\8ab4218a7ee9239d218f2729d6c00fb0246eeea1e97f85833dacfc73457c8b06.exe
            "C:\Users\Admin\AppData\Local\Temp\8ab4218a7ee9239d218f2729d6c00fb0246eeea1e97f85833dacfc73457c8b06.exe" -agent 0
            2⤵
            • Modifies extensions of user files
            • Drops file in Program Files directory
            • Drops file in Windows directory
            PID:1188
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /C vssadmin delete shadows /all /quiet
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:2732
            • C:\Windows\SysWOW64\vssadmin.exe
              vssadmin delete shadows /all /quiet
              3⤵
              • Interacts with shadow copies
              PID:4120
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /C wbadmin delete catalog -quiet
            2⤵
              PID:3568
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 3944 -s 1860
              2⤵
              • Program crash
              PID:4396
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 3944 -s 1880
              2⤵
              • Suspicious use of NtCreateProcessExOtherParentProcess
              • Program crash
              PID:4444
          • C:\Windows\system32\vssvc.exe
            C:\Windows\system32\vssvc.exe
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:4168

          Network

          MITRE ATT&CK Matrix ATT&CK v6

          Initial Access

          Execution

          Persistence

          Privilege Escalation

          Defense Evasion

          File Deletion

          2
          T1107

          Install Root Certificate

          1
          T1130

          Modify Registry

          1
          T1112

          Credential Access

          Discovery

          Query Registry

          1
          T1012

          Peripheral Device Discovery

          1
          T1120

          System Information Discovery

          1
          T1082

          Lateral Movement

          Collection

          Exfiltration

          Command and Control

          Web Service

          1
          T1102

          Impact

          Inhibit System Recovery

          2
          T1490

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\~temp001.bat
            MD5

            ef572e2c7b1bbd57654b36e8dcfdc37a

            SHA1

            b84c4db6d0dfd415c289d0c8ae099aea4001e3b7

            SHA256

            e6e609db3f387f42bfd16dd9e5695ddc2b73d86ae12baf4f0dfc4edda4a96a64

            SHA512

            b8c014b242e8e8f42da37b75fe96c52cd25ebd366d0b5103bcba5ac041806d13142a62351edecdee583d494d2a120f9b330f6229b1b5fe820e1c7d98981089e9

            Download Submit
          • memory/412-121-0x0000000000000000-mapping.dmp
            Download
          • memory/1188-129-0x0000000000400000-0x0000000002BBE000-memory.dmp
            Filesize

            39.7MB

            Download
          • memory/1188-128-0x0000000002DF0000-0x0000000002E27000-memory.dmp
            Filesize

            220KB

            Download
          • memory/1188-122-0x0000000000000000-mapping.dmp
            Download
          • memory/2072-117-0x0000000000000000-mapping.dmp
            Download
          • memory/2284-116-0x0000000000000000-mapping.dmp
            Download
          • memory/2732-120-0x0000000000000000-mapping.dmp
            Download
          • memory/3568-119-0x0000000000000000-mapping.dmp
            Download
          • memory/3896-118-0x0000000000000000-mapping.dmp
            Download
          • memory/3944-114-0x0000000002BC0000-0x0000000002D0A000-memory.dmp
            Filesize

            1.3MB

            Download
          • memory/3944-115-0x0000000000400000-0x0000000002BBE000-memory.dmp
            Filesize

            39.7MB

            Download
          • memory/4108-123-0x0000000000000000-mapping.dmp
            Download
          • memory/4120-124-0x0000000000000000-mapping.dmp
            Download
          • memory/4292-126-0x0000000000000000-mapping.dmp
            Download
          • memory/4328-127-0x0000000000000000-mapping.dmp
            Download