Overview

overview

10

Static

static

123.exe

windows7_x64

10

123.exe

windows10_x64

10

Analysis

  • max time kernel
    151s
  • max time network
    131s
  • platform
    windows10_x64
  • resource
    win10-en-20211104
  • submitted
    12-11-2021 14:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    123.exe

  • Size

    214KB

  • MD5

    c14d403c9e9d6b6054e09ceee047fbf1

  • SHA1

    2155b8d3b977f32641314207bb24126741b71d13

  • SHA256

    005b00d41740f7b0327d4d5fe0402dcfc84ae0df44a2231a89a59909eeb30b23

  • SHA512

    f5a0380cf6c7f3c14bd0efefeec1be88d0d92257ace44a97360e17c88e27c59cb424cd7283e2085431ba95d62eac30d017e3f41d7c1ccb4468a0bcaa3984d6d3

Score
10/10
buranpersistenceransomware

Malware Config

Extracted

Path

C:\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT

Family

buran

Ransom Note
!!! ALL YOUR FILES ARE ENCRYPTED !!! All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. To be sure we have the decryptor and it works you can send an email: [email protected] and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? Write to email: [email protected] Reserved email: [email protected] Reserved email: [email protected] Your personal ID: 13E-3F9-0A5 Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Signatures

  • Buran

    Ransomware-as-a-service based on the VegaLocker family first identified in 2019.

    ransomwareburan
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Executes dropped EXE 2 IoCs
  • Deletes itself 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 42 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\123.exe
    "C:\Users\Admin\AppData\Local\Temp\123.exe"
    1⤵
    • Adds Run key to start application
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3684
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\csrss.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\csrss.exe" -start
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Suspicious use of WriteProcessMemory
      PID:492
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C wmic shadowcopy delete
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3924
        • C:\Windows\SysWOW64\Wbem\WMIC.exe
          wmic shadowcopy delete
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1508
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} recoveryenabled no
        3⤵
          PID:2252
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /C wbadmin delete catalog -quiet
          3⤵
            PID:1676
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /C vssadmin delete shadows /all /quiet
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1768
            • C:\Windows\SysWOW64\vssadmin.exe
              vssadmin delete shadows /all /quiet
              4⤵
              • Interacts with shadow copies
              PID:940
          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\csrss.exe
            "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\csrss.exe" -agent 0
            3⤵
            • Executes dropped EXE
            • Drops file in Program Files directory
            PID:680
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\~temp001.bat
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1992
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -ExecutionPolicy ByPass -Command "Get-WmiObject Win32_Shadowcopy | ForEach-Object {$_.Delete();}"
              4⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1416
            • C:\Windows\SysWOW64\Wbem\WMIC.exe
              WMIC.exe shadowcopy delete /nointeractive
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:3208
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
            3⤵
              PID:972
          • C:\Windows\SysWOW64\notepad.exe
            notepad.exe
            2⤵
            • Deletes itself
            PID:1328
        • C:\Windows\system32\vssvc.exe
          C:\Windows\system32\vssvc.exe
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2216

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3F26ED5DE6B4E859CCCA6035ECB8D9CB
          MD5

          e3e3b0a46e8a480b91b2958f84492c21

          SHA1

          d53c4d0cae15edeb1364156cf5e7f1f78c8947a8

          SHA256

          8f80b0fc1c1c54daefb919e0ad44f52abfa9c4eb46da55fb8129b7f65209061f

          SHA512

          0549eddf61463dafce23e4d9808e64401d2ce9e61f65447287e98da73bcf9733fe9da2809b5887ac56dd4c313366496348510cb9d9576b264549148e4d0f39e9

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\204C1AA6F6114E6A513754A2AB5760FA_0673414C08DE7F919AE3F6C4CC65AEEE
          MD5

          eed44928e946f50ed36d37752d7de3ac

          SHA1

          a2ae1a3cad33819ebb8022ea9558769e5a441921

          SHA256

          7626e74ff44217673c53af18c53b5bc37ba411bb3f4db0daa1dc13f5db0edb5d

          SHA512

          ef7c6263485fa47204c5cea4d0c782def13b7b568653037eb1ef1d057aaaacd026fd40db3ab9ae90ea9473f69f5a3866fdf1dfb64ec03ab47a589ecd131c5918

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
          MD5

          c026f0cefed02193d3bf7078c32c1f4b

          SHA1

          74357c790437e708d6152492f14f9a308a41c1ee

          SHA256

          a2293aa5e0cba820827fe6cbecf5d053a12c5cd625971c6470a5fc5079b95d8e

          SHA512

          f0e718e04dbd20c150659251786bd363f5aceb0a789f6e03b84e43405aebd3487e682a9fdfaf68c9f55e260a632fde553d0c85f317dd80960aec547632f6874a

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3F26ED5DE6B4E859CCCA6035ECB8D9CB
          MD5

          208fb6619151f609f9ce87a72ac8a0fb

          SHA1

          825acdf9cc6d1f40de41f5a0df6d2269e7c3d7ad

          SHA256

          4ed18c9f6f08b02da29bf6b0fbae3f13c44312dfb963e7e1492d6a02ea2dab00

          SHA512

          566970d6a24081b232d357c3fc25d248358673a9b96874ea34e70ecb00533ec4b7a8409c9da09cd1047e28b2805c0e29b899ce47b85fd665ad97f09894b1e360

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\204C1AA6F6114E6A513754A2AB5760FA_0673414C08DE7F919AE3F6C4CC65AEEE
          MD5

          dac8c96041dbc73b6966d78079c5dbb5

          SHA1

          15785312a8e5103a8d1210eeba3cff0daabd1146

          SHA256

          20379319b47548a74b997a8398868bcfd9939a3db0744086b133001f98671126

          SHA512

          be0c733932704f61eefaaa80276640618f6c897a33c8b97fd93041504b0a5d6da155516cc3d93a4919f79a945ccb43f20fc9197075c8fea4b8a60c44483c5e0c

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
          MD5

          86dbed6814cdc7ce6d7d4830eeb0e628

          SHA1

          7ba5bad92f6f5f2ab410d5916a5d9e4a8a3d8732

          SHA256

          2e2b99f553093f40be0429cf4a8ef96ed666368a41316396e4ef6b07f5171da7

          SHA512

          b2a2b1eeb1da8c98419c7c8528b14c7218877cdff584aa5c5a7ebdda28c4439505cd32da5f2a34a58d588b61a482036646db25a36b0e134fc8369b65d8905c31

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0JDXA5XR\BH64WM7P.htm
          MD5

          6b17a59cec1a7783febae9aa55c56556

          SHA1

          01d4581e2b3a6348679147a915a0b22b2a66643a

          SHA256

          66987b14b90d41632be98836f9601b12e7f329ffab05595887889c9c5716fbeb

          SHA512

          3337efd12b9c06b7768eb928a78caae243b75257c5aabe7a49e908a2f735af55f7257a40bd2330dc13865ead18ed805b54a6c5105740fdcbbaccacf7997bcbc3

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8YCK9U05\A3QJAJ1A.htm
          MD5

          b1cd7c031debba3a5c77b39b6791c1a7

          SHA1

          e5d91e14e9c685b06f00e550d9e189deb2075f76

          SHA256

          57ba053f075e0b80f747f3102ed985687c16a8754d109e7c4d33633269a36aaa

          SHA512

          d2bbefdc1effb52a38964c4cec5990a5a226248eca36f99e446c0c5704436f666bf1cb514e73b8991411d497d3325ecc646cbd5065c364e92ab6b9c5f1ad4a72

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\~temp001.bat
          MD5

          e6545ccb3660f88529716ed4e647c713

          SHA1

          ecd628f29985599a24c5c1d23083c689917dd74e

          SHA256

          e802bf0c4481bef693d4d1f307aba48301e330d3728dd46a4ec97c4a96b4d4a7

          SHA512

          f745e7d5dd006083234e783dd5dc7fb83043a7d0479ea2a91a2ddbc8c20ca47343516efbd155271768c675a22b32e88febdfe51551ec42dfdb64805c62c3188d

          Download Submit

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\csrss.exe
          MD5

          c14d403c9e9d6b6054e09ceee047fbf1

          SHA1

          2155b8d3b977f32641314207bb24126741b71d13

          SHA256

          005b00d41740f7b0327d4d5fe0402dcfc84ae0df44a2231a89a59909eeb30b23

          SHA512

          f5a0380cf6c7f3c14bd0efefeec1be88d0d92257ace44a97360e17c88e27c59cb424cd7283e2085431ba95d62eac30d017e3f41d7c1ccb4468a0bcaa3984d6d3

          Download Submit

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\csrss.exe
          MD5

          c14d403c9e9d6b6054e09ceee047fbf1

          SHA1

          2155b8d3b977f32641314207bb24126741b71d13

          SHA256

          005b00d41740f7b0327d4d5fe0402dcfc84ae0df44a2231a89a59909eeb30b23

          SHA512

          f5a0380cf6c7f3c14bd0efefeec1be88d0d92257ace44a97360e17c88e27c59cb424cd7283e2085431ba95d62eac30d017e3f41d7c1ccb4468a0bcaa3984d6d3

          Download Submit

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\csrss.exe
          MD5

          c14d403c9e9d6b6054e09ceee047fbf1

          SHA1

          2155b8d3b977f32641314207bb24126741b71d13

          SHA256

          005b00d41740f7b0327d4d5fe0402dcfc84ae0df44a2231a89a59909eeb30b23

          SHA512

          f5a0380cf6c7f3c14bd0efefeec1be88d0d92257ace44a97360e17c88e27c59cb424cd7283e2085431ba95d62eac30d017e3f41d7c1ccb4468a0bcaa3984d6d3

          Download Submit

        • memory/492-118-0x0000000000000000-mapping.dmp

          Download

        • memory/680-137-0x0000000000000000-mapping.dmp

          Download

        • memory/940-142-0x0000000000000000-mapping.dmp

          Download

        • memory/972-133-0x0000000000000000-mapping.dmp

          Download

        • memory/1328-122-0x0000000000000000-mapping.dmp

          Download

        • memory/1328-130-0x0000000002360000-0x0000000002361000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1416-141-0x0000000000000000-mapping.dmp

          Download

        • memory/1416-149-0x0000000007A10000-0x0000000007A11000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1416-168-0x0000000004963000-0x0000000004964000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1416-166-0x0000000000EE0000-0x0000000000EE1000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1416-163-0x0000000009900000-0x0000000009901000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1416-162-0x0000000009060000-0x0000000009061000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1416-161-0x0000000008FF0000-0x0000000008FF1000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1416-143-0x0000000000EE0000-0x0000000000EE1000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1416-144-0x0000000000EE0000-0x0000000000EE1000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1416-145-0x0000000000FF0000-0x0000000000FF1000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1416-146-0x0000000007370000-0x0000000007371000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1416-147-0x0000000007270000-0x0000000007271000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1416-148-0x00000000079A0000-0x00000000079A1000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1416-160-0x00000000090D0000-0x00000000090D1000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1416-150-0x0000000007C60000-0x0000000007C61000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1416-151-0x0000000004960000-0x0000000004961000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1416-152-0x0000000004962000-0x0000000004963000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1416-153-0x0000000007BA0000-0x0000000007BA1000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1416-154-0x0000000008040000-0x0000000008041000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1416-155-0x0000000008390000-0x0000000008391000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1416-156-0x0000000000EE0000-0x0000000000EE1000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1508-140-0x0000000000000000-mapping.dmp

          Download

        • memory/1676-134-0x0000000000000000-mapping.dmp

          Download

        • memory/1768-135-0x0000000000000000-mapping.dmp

          Download

        • memory/1992-136-0x0000000000000000-mapping.dmp

          Download

        • memory/2252-132-0x0000000000000000-mapping.dmp

          Download

        • memory/3208-167-0x0000000000000000-mapping.dmp

          Download

        • memory/3924-131-0x0000000000000000-mapping.dmp

          Download