Overview

overview

10

Static

static

a73f8ece11...cf.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a73f8ece11668d7486e0823716550dcea7fce73fd3084303a359f2f182c8cacf

  • Size

    211KB

  • Sample

    211022-1rx1sacbc3

  • MD5

    d4e8fe23840956af5509d7f0ed048a0e

  • SHA1

    d7f01f6b45f4fbe64d1a58559bda909cba430277

  • SHA256

    a73f8ece11668d7486e0823716550dcea7fce73fd3084303a359f2f182c8cacf

  • SHA512

    efc26c1db244476c196cddaa4e5bf502dcaec87a8f39e24891e42bf418d039b728087517a27a85d9db875da77dc04e3bce9fd7bf6fe1fb62127e69da5cb45d6b

Score
10/10
buranpersistenceransomware

Malware Config

Extracted

Path

C:\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT

Family

buran

Ransom Note
!!! ALL YOUR FILES ARE ENCRYPTED !!! All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. To be sure we have the decryptor and it works you can send an email: [email protected] and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? Write to email: [email protected] Reserved email: [email protected] Your personal ID: 2D0-147-7B3 Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Targets

    • Target

      a73f8ece11668d7486e0823716550dcea7fce73fd3084303a359f2f182c8cacf

    • Size

      211KB

    • MD5

      d4e8fe23840956af5509d7f0ed048a0e

    • SHA1

      d7f01f6b45f4fbe64d1a58559bda909cba430277

    • SHA256

      a73f8ece11668d7486e0823716550dcea7fce73fd3084303a359f2f182c8cacf

    • SHA512

      efc26c1db244476c196cddaa4e5bf502dcaec87a8f39e24891e42bf418d039b728087517a27a85d9db875da77dc04e3bce9fd7bf6fe1fb62127e69da5cb45d6b

    Score
    10/10
    buranpersistenceransomware

    • Buran

      Ransomware-as-a-service based on the VegaLocker family first identified in 2019.

      ransomwareburan

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Executes dropped EXE

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Deletes itself

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

File Deletion

2
T1107

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2
T1490

Tasks