Overview

overview

10

Static

static

1184.exe

windows10_x64

10

Analysis

  • max time kernel
    120s
  • max time network
    118s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    09-12-2021 19:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1184.exe

  • Size

    250KB

  • MD5

    17ba757ef56ce371b152db6a3c0dd288

  • SHA1

    094f68da6ba10ce0b30815e9179aa59f67b454ef

  • SHA256

    4091eb184d556bdb2234d8cc85042546264defc1fcc791538813b755d9255c86

  • SHA512

    6b375cdf488498f3fae0992d7636ea1d701625abdc07425be244a1524d89887908f2ec548cf9bb8a72578adc0bfd9509559c3dced1be3f5c0bfe3484d00868ae

Score
10/10
buranpersistenceransomware

Malware Config

Extracted

Path

C:\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT

Family

buran

Ransom Note
!!! ALL YOUR FILES ARE ENCRYPTED !!! All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. To be sure we have the decryptor and it works you can send an email: [email protected] and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? Write to email: [email protected] Reserved email: [email protected] Reserved email: [email protected] Your personal ID: 4AE-A5A-936 Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Signatures

  • Buran

    Ransomware-as-a-service based on the VegaLocker family first identified in 2019.

    ransomwareburan
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 45 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1184.exe
    "C:\Users\Admin\AppData\Local\Temp\1184.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2284
    • C:\Users\Public\Videos\hgfdfds.exe
      "C:\Users\Public\Videos\hgfdfds.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Modifies system certificate store
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2512
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\spoolsv.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\spoolsv.exe" -start
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Suspicious use of WriteProcessMemory
        PID:420
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /C wmic shadowcopy delete
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1440
          • C:\Windows\SysWOW64\Wbem\WMIC.exe
            wmic shadowcopy delete
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:1272
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} recoveryenabled no
          4⤵
            PID:2776
          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\spoolsv.exe
            "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\spoolsv.exe" -agent 0
            4⤵
            • Executes dropped EXE
            • Drops file in Program Files directory
            PID:1276
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\~temp001.bat
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:364
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -ExecutionPolicy ByPass -Command "Get-WmiObject Win32_Shadowcopy | ForEach-Object {$_.Delete();}"
              5⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3912
            • C:\Windows\SysWOW64\Wbem\WMIC.exe
              WMIC.exe shadowcopy delete /nointeractive
              5⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:4048
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /C vssadmin delete shadows /all /quiet
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:596
            • C:\Windows\SysWOW64\vssadmin.exe
              vssadmin delete shadows /all /quiet
              5⤵
              • Interacts with shadow copies
              PID:2112
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /C wbadmin delete catalog -quiet
            4⤵
              PID:1504
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
              4⤵
                PID:1192
            • C:\Windows\SysWOW64\notepad.exe
              notepad.exe
              3⤵
                PID:2216
          • C:\Windows\system32\vssvc.exe
            C:\Windows\system32\vssvc.exe
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2444

          Network

          MITRE ATT&CK Matrix ATT&CK v6

          Initial Access

          Execution

          Persistence

          Registry Run Keys / Startup Folder

          1
          T1060

          Privilege Escalation

          Defense Evasion

          File Deletion

          2
          T1107

          Modify Registry

          2
          T1112

          Install Root Certificate

          1
          T1130

          Credential Access

          Discovery

          Query Registry

          1
          T1012

          Peripheral Device Discovery

          1
          T1120

          System Information Discovery

          2
          T1082

          Lateral Movement

          Collection

          Exfiltration

          Command and Control

          Web Service

          1
          T1102

          Impact

          Inhibit System Recovery

          2
          T1490

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3F26ED5DE6B4E859CCCA6035ECB8D9CB
            MD5

            279be26aad260b946ffef7c3b84af047

            SHA1

            d3e611f11b66ad92de797954256f9f782c19e262

            SHA256

            242e762985f758451e42708685818beaf0d9bd6842836ec1c13f682fa218158f

            SHA512

            74028b86cf93a8ec9067b96a033ee42eec1080e8a96c1ffa95f85cc0d9343638528cc6343c3b10095804e727a2e4e749bf2e254864b79a1de16cdcf4fab4d414

            Download Submit
          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\204C1AA6F6114E6A513754A2AB5760FA_0673414C08DE7F919AE3F6C4CC65AEEE
            MD5

            dd0d6606151d8041eb3961af54fd8345

            SHA1

            2b2efaf447c34a8018fb56dedab8c43e32a0c18a

            SHA256

            db4f82f58c90ed085aca2495fe575545a2c81aeaf488760b4952017b65dec208

            SHA512

            65684d02a3d9271e835db198a1718825bc3410b083f2f74be39d1b072986669596f0a9e26edb6a2a01759ce458f2953ad0bf03dc5ad3ae0cf6d7839e2993fe1d

            Download Submit
          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
            MD5

            a4ce9d27fc3d4962e6d516a3396718a3

            SHA1

            8b59693be7f9eba072861fd7ef8b441a147d0f09

            SHA256

            b3d1cc229ea6dfb56ce7efa60cd6f550fd155d0148bf6e869c33df67931eee3c

            SHA512

            02e83d76266c7603cfa4ca00af14f720d9cf7ac5eb66a59cc2670c6cba4a32406d2a9ac4d1d43a8222b762e473c646ee8154aae9e3dcba071a7f431c1bb195be

            Download Submit
          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3F26ED5DE6B4E859CCCA6035ECB8D9CB
            MD5

            05d31dbca70f57d12969a0f60aba6ad3

            SHA1

            f170c2615fce989193a2383fc575c6c5e9a9aff3

            SHA256

            e985fcf69c7a05053a041d49a4abc00dd30450c60c22419145352a8c12083ed3

            SHA512

            3f5b30b6cbba34ccafee9b1c26e860173671634f154d74fbcf3f75db574a090b077e610eb7b7253cd23d5c55b4b2650c453a7a9e4683a9c12afdf6a533be61b7

            Download Submit
          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\204C1AA6F6114E6A513754A2AB5760FA_0673414C08DE7F919AE3F6C4CC65AEEE
            MD5

            3d9d0a0b762735840a99f4826e67c378

            SHA1

            43b19fe83762e96c54ddb2969d8015807216d424

            SHA256

            9844ec817ce2652ce77c7c4866c87388eab12ec973f8d9f65cc79db16077eb89

            SHA512

            1872a844b5cbf2450a59dd2b7d35780fb48b134cf64946aa006476ca694f22e1bcacabe91bccb82bea867e95d9ea67d736de9181e3a039a4a4e5e131df958dd0

            Download Submit
          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
            MD5

            69a57e0e7cf10d02798c0179ee72476f

            SHA1

            85f437b039e1950f06ad38cad85c50beec2055af

            SHA256

            2088e167967972c263700c377c50374527816734a42afbe56402c7bdcd3de039

            SHA512

            11aa7cfe399c7a06ac28f14dd1f323c9cae2b25ebc65d24a5a8e560b1ea42309f996d6ab04e8d52579cd211c6ea339b894c6b87858347d2e45f5d54d33112282

            Download Submit
          • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCJJ9ZOX\6CJ2U6FV.htm
            MD5

            a86c948b42ceda429fc5132fe95a65d7

            SHA1

            1e5433c55eb57b7dd6cbaf59f0701f027cd64fc0

            SHA256

            7d04d781251d6520f01f5ce6fcce399c774499e947ff1a7509ba0d9affdbc447

            SHA512

            daae68b891656a469d06ead87b06e67403bc3a96843b34f7c16acd3127d525b3e0a84e2830b664aa3c3b34189f2752f4b25602d1f76f02661e8bbd5fc1b7965e

            Download Submit
          • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\UJMJYC0S\P7MW5P8I.htm
            MD5

            b1cd7c031debba3a5c77b39b6791c1a7

            SHA1

            e5d91e14e9c685b06f00e550d9e189deb2075f76

            SHA256

            57ba053f075e0b80f747f3102ed985687c16a8754d109e7c4d33633269a36aaa

            SHA512

            d2bbefdc1effb52a38964c4cec5990a5a226248eca36f99e446c0c5704436f666bf1cb514e73b8991411d497d3325ecc646cbd5065c364e92ab6b9c5f1ad4a72

            Download Submit
          • C:\Users\Admin\AppData\Local\Temp\~temp001.bat
            MD5

            e6545ccb3660f88529716ed4e647c713

            SHA1

            ecd628f29985599a24c5c1d23083c689917dd74e

            SHA256

            e802bf0c4481bef693d4d1f307aba48301e330d3728dd46a4ec97c4a96b4d4a7

            SHA512

            f745e7d5dd006083234e783dd5dc7fb83043a7d0479ea2a91a2ddbc8c20ca47343516efbd155271768c675a22b32e88febdfe51551ec42dfdb64805c62c3188d

            Download Submit
          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\spoolsv.exe
            MD5

            c14d403c9e9d6b6054e09ceee047fbf1

            SHA1

            2155b8d3b977f32641314207bb24126741b71d13

            SHA256

            005b00d41740f7b0327d4d5fe0402dcfc84ae0df44a2231a89a59909eeb30b23

            SHA512

            f5a0380cf6c7f3c14bd0efefeec1be88d0d92257ace44a97360e17c88e27c59cb424cd7283e2085431ba95d62eac30d017e3f41d7c1ccb4468a0bcaa3984d6d3

            Download Submit
          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\spoolsv.exe
            MD5

            c14d403c9e9d6b6054e09ceee047fbf1

            SHA1

            2155b8d3b977f32641314207bb24126741b71d13

            SHA256

            005b00d41740f7b0327d4d5fe0402dcfc84ae0df44a2231a89a59909eeb30b23

            SHA512

            f5a0380cf6c7f3c14bd0efefeec1be88d0d92257ace44a97360e17c88e27c59cb424cd7283e2085431ba95d62eac30d017e3f41d7c1ccb4468a0bcaa3984d6d3

            Download Submit
          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\spoolsv.exe
            MD5

            c14d403c9e9d6b6054e09ceee047fbf1

            SHA1

            2155b8d3b977f32641314207bb24126741b71d13

            SHA256

            005b00d41740f7b0327d4d5fe0402dcfc84ae0df44a2231a89a59909eeb30b23

            SHA512

            f5a0380cf6c7f3c14bd0efefeec1be88d0d92257ace44a97360e17c88e27c59cb424cd7283e2085431ba95d62eac30d017e3f41d7c1ccb4468a0bcaa3984d6d3

            Download Submit
          • C:\Users\Public\Videos\hgfdfds.exe
            MD5

            c14d403c9e9d6b6054e09ceee047fbf1

            SHA1

            2155b8d3b977f32641314207bb24126741b71d13

            SHA256

            005b00d41740f7b0327d4d5fe0402dcfc84ae0df44a2231a89a59909eeb30b23

            SHA512

            f5a0380cf6c7f3c14bd0efefeec1be88d0d92257ace44a97360e17c88e27c59cb424cd7283e2085431ba95d62eac30d017e3f41d7c1ccb4468a0bcaa3984d6d3

            Download Submit
          • C:\Users\Public\Videos\hgfdfds.exe
            MD5

            c14d403c9e9d6b6054e09ceee047fbf1

            SHA1

            2155b8d3b977f32641314207bb24126741b71d13

            SHA256

            005b00d41740f7b0327d4d5fe0402dcfc84ae0df44a2231a89a59909eeb30b23

            SHA512

            f5a0380cf6c7f3c14bd0efefeec1be88d0d92257ace44a97360e17c88e27c59cb424cd7283e2085431ba95d62eac30d017e3f41d7c1ccb4468a0bcaa3984d6d3

            Download Submit
          • memory/364-136-0x0000000000000000-mapping.dmp
            Download
          • memory/420-118-0x0000000000000000-mapping.dmp
            Download
          • memory/596-135-0x0000000000000000-mapping.dmp
            Download
          • memory/1192-133-0x0000000000000000-mapping.dmp
            Download
          • memory/1272-140-0x0000000000000000-mapping.dmp
            Download
          • memory/1276-137-0x0000000000000000-mapping.dmp
            Download
          • memory/1440-131-0x0000000000000000-mapping.dmp
            Download
          • memory/1504-134-0x0000000000000000-mapping.dmp
            Download
          • memory/2112-139-0x0000000000000000-mapping.dmp
            Download
          • memory/2216-124-0x0000000000610000-0x0000000000611000-memory.dmp
            Filesize

            4KB

            Download
          • memory/2216-121-0x0000000000000000-mapping.dmp
            Download
          • memory/2512-115-0x0000000000000000-mapping.dmp
            Download
          • memory/2776-132-0x0000000000000000-mapping.dmp
            Download
          • memory/3912-148-0x0000000007740000-0x0000000007741000-memory.dmp
            Filesize

            4KB

            Download
          • memory/3912-153-0x0000000007CF0000-0x0000000007CF1000-memory.dmp
            Filesize

            4KB

            Download
          • memory/3912-144-0x0000000003590000-0x0000000003591000-memory.dmp
            Filesize

            4KB

            Download
          • memory/3912-145-0x0000000004F80000-0x0000000004F81000-memory.dmp
            Filesize

            4KB

            Download
          • memory/3912-146-0x0000000007D80000-0x0000000007D81000-memory.dmp
            Filesize

            4KB

            Download
          • memory/3912-147-0x00000000079C0000-0x00000000079C1000-memory.dmp
            Filesize

            4KB

            Download
          • memory/3912-142-0x0000000000000000-mapping.dmp
            Download
          • memory/3912-149-0x0000000007742000-0x0000000007743000-memory.dmp
            Filesize

            4KB

            Download
          • memory/3912-150-0x0000000007900000-0x0000000007901000-memory.dmp
            Filesize

            4KB

            Download
          • memory/3912-151-0x0000000007A60000-0x0000000007A61000-memory.dmp
            Filesize

            4KB

            Download
          • memory/3912-152-0x00000000083B0000-0x00000000083B1000-memory.dmp
            Filesize

            4KB

            Download
          • memory/3912-143-0x0000000003590000-0x0000000003591000-memory.dmp
            Filesize

            4KB

            Download
          • memory/3912-154-0x00000000087C0000-0x00000000087C1000-memory.dmp
            Filesize

            4KB

            Download
          • memory/3912-155-0x0000000008AE0000-0x0000000008AE1000-memory.dmp
            Filesize

            4KB

            Download
          • memory/3912-156-0x0000000003590000-0x0000000003591000-memory.dmp
            Filesize

            4KB

            Download
          • memory/3912-162-0x0000000009930000-0x0000000009931000-memory.dmp
            Filesize

            4KB

            Download
          • memory/3912-163-0x0000000009850000-0x0000000009851000-memory.dmp
            Filesize

            4KB

            Download
          • memory/3912-164-0x00000000098C0000-0x00000000098C1000-memory.dmp
            Filesize

            4KB

            Download
          • memory/3912-165-0x0000000009F60000-0x0000000009F61000-memory.dmp
            Filesize

            4KB

            Download
          • memory/3912-168-0x0000000003590000-0x0000000003591000-memory.dmp
            Filesize

            4KB

            Download
          • memory/3912-170-0x0000000007743000-0x0000000007744000-memory.dmp
            Filesize

            4KB

            Download
          • memory/4048-169-0x0000000000000000-mapping.dmp
            Download