Overview

overview

10

Static

static

11409.scr

windows7_x64

10

11409.scr

windows10_x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    11409.scr

  • Size

    250KB

  • Sample

    211207-yzzs8scgbn

  • MD5

    66b9986303e0ad7dc37c629a892dcdc4

  • SHA1

    9c2671507b9e71a2d799f93bb51055b35d3a681b

  • SHA256

    5876685b455f0c3f0228d03744b34df3e38add056fdbe111f639eafddf4fcc14

  • SHA512

    524bf54bb29656a663d72d02431114777c8cd245e5a27692596386ebbafd3e34b176bbf81261a90ffb817c6c62c9efb54f478dd4153eb6f15fd4a9e4d5a28e00

Score
10/10
buranpersistenceransomware

Malware Config

Extracted

Path

C:\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT

Family

buran

Ransom Note
!!! ALL YOUR FILES ARE ENCRYPTED !!! All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. To be sure we have the decryptor and it works you can send an email: [email protected] and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? Write to email: [email protected] Reserved email: [email protected] Reserved email: [email protected] Your personal ID: BA0-06D-C2A Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Targets

    • Target

      11409.scr

    • Size

      250KB

    • MD5

      66b9986303e0ad7dc37c629a892dcdc4

    • SHA1

      9c2671507b9e71a2d799f93bb51055b35d3a681b

    • SHA256

      5876685b455f0c3f0228d03744b34df3e38add056fdbe111f639eafddf4fcc14

    • SHA512

      524bf54bb29656a663d72d02431114777c8cd245e5a27692596386ebbafd3e34b176bbf81261a90ffb817c6c62c9efb54f478dd4153eb6f15fd4a9e4d5a28e00

    Score
    10/10
    buranpersistenceransomware

    • Buran

      Ransomware-as-a-service based on the VegaLocker family first identified in 2019.

      ransomwareburan

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

File Deletion

2
T1107

Modify Registry

2
T1112

Install Root Certificate

1
T1130

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Inhibit System Recovery

2
T1490

Tasks