Overview

overview

10

Static

static

54f6ec27eb...71.exe

windows7_x64

10

54f6ec27eb...71.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    153s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220112
  • submitted
    06-03-2022 00:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    54f6ec27eb7526c439d33e7592e4864842fccf950d828fe14ef7c8eb080ee371.exe

  • Size

    446KB

  • MD5

    567204cbb8d1c5908a5316f9dfdcb353

  • SHA1

    cc7eca3c24883a3b563288c08cfab7cc248a0315

  • SHA256

    54f6ec27eb7526c439d33e7592e4864842fccf950d828fe14ef7c8eb080ee371

  • SHA512

    ec4e2a03a525ae5150449d5403f2fc72b88d1cd977c503f4943b0889b82c543e46c35cd204fe27c5c03d4817bcc9413ec467637a038d2d7cd164d59d2b377f3b

Score
10/10
buranpersistenceransomware

Malware Config

Extracted

Path

C:\!!! HOW TO BACK YOUR FILES !!!.TXT

Family

buran

Ransom Note
YOUR FILES ARE ENCRYPTED !!! TO DECRYPT, FOLLOW THE INSTRUCTIONS: To recover data you need decrypt tool. To get the decrypt tool you should: 1.In the letter include your personal ID! Send me this ID in your first email to me! 2.We can give you free test for decrypt few files (NOT VALUE) and assign the price for decryption all files! 3.After we send you instruction how to pay for decrypt tool and after payment you will receive a decryption tool! 4.We can decrypt few files in quality the evidence that we have the decoder. DO NOT TRY TO DO SOMETHING WITH YOUR FILES BY YOURSELF YOU WILL BRAKE YOUR DATA !!! ONLY WE ARE CAN HELP YOU! CONTACT US: [email protected] ATTENTION !!! THIS IS YOUR PERSONAL ID WICH YOU HAVE TO SEND IN FIRST LETTER: Your personal ID: 6FB-0C6-540 Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Signatures

  • Buran

    Ransomware-as-a-service based on the VegaLocker family first identified in 2019.

    ransomwareburan
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\54f6ec27eb7526c439d33e7592e4864842fccf950d828fe14ef7c8eb080ee371.exe
    "C:\Users\Admin\AppData\Local\Temp\54f6ec27eb7526c439d33e7592e4864842fccf950d828fe14ef7c8eb080ee371.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2924
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe" -start
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Suspicious use of WriteProcessMemory
      PID:4048
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C wmic shadowcopy delete
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2696
        • C:\Windows\SysWOW64\Wbem\WMIC.exe
          wmic shadowcopy delete
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:3500
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C wbadmin delete catalog -quiet
        3⤵
          PID:3648
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
          3⤵
            PID:2664
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} recoveryenabled no
            3⤵
              PID:2612
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /C vssadmin delete shadows /all /quiet
              3⤵
                PID:976
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\system32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\~temp001.bat
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:2948
                • C:\Windows\SysWOW64\Wbem\WMIC.exe
                  wmic shadowcopy delete
                  4⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3188
              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe
                "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe" -agent 0
                3⤵
                • Executes dropped EXE
                • Drops file in Program Files directory
                PID:2432
          • C:\Windows\system32\vssvc.exe
            C:\Windows\system32\vssvc.exe
            1⤵
              PID:3224

            Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\~temp001.bat
              MD5

              49f30697c634c40272e3aa13c370279f

              SHA1

              bd543555d20162a2afcfb3a0f85cde37b7faf0db

              SHA256

              c4b9272708e65c60dcd4d94a9e5f0327590963911bf3c66b27de9666a050cfe3

              SHA512

              ee541518a003f153492457e3dfae6d0f05ac6d2f93360dc5708ed8f81ba19df612b8ef5a77495c0313e59162220936e41b4687bbf6df62e9c917054925e248bc

              Download Submit

            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe
              MD5

              567204cbb8d1c5908a5316f9dfdcb353

              SHA1

              cc7eca3c24883a3b563288c08cfab7cc248a0315

              SHA256

              54f6ec27eb7526c439d33e7592e4864842fccf950d828fe14ef7c8eb080ee371

              SHA512

              ec4e2a03a525ae5150449d5403f2fc72b88d1cd977c503f4943b0889b82c543e46c35cd204fe27c5c03d4817bcc9413ec467637a038d2d7cd164d59d2b377f3b

              Download Submit

            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe
              MD5

              567204cbb8d1c5908a5316f9dfdcb353

              SHA1

              cc7eca3c24883a3b563288c08cfab7cc248a0315

              SHA256

              54f6ec27eb7526c439d33e7592e4864842fccf950d828fe14ef7c8eb080ee371

              SHA512

              ec4e2a03a525ae5150449d5403f2fc72b88d1cd977c503f4943b0889b82c543e46c35cd204fe27c5c03d4817bcc9413ec467637a038d2d7cd164d59d2b377f3b

              Download Submit

            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe
              MD5

              567204cbb8d1c5908a5316f9dfdcb353

              SHA1

              cc7eca3c24883a3b563288c08cfab7cc248a0315

              SHA256

              54f6ec27eb7526c439d33e7592e4864842fccf950d828fe14ef7c8eb080ee371

              SHA512

              ec4e2a03a525ae5150449d5403f2fc72b88d1cd977c503f4943b0889b82c543e46c35cd204fe27c5c03d4817bcc9413ec467637a038d2d7cd164d59d2b377f3b

              Download Submit

            • memory/2432-138-0x0000000000400000-0x0000000000598000-memory.dmp

              Filesize

              1.6MB

              Download

            • memory/2432-137-0x0000000002600000-0x0000000002792000-memory.dmp

              Filesize

              1.6MB

              Download

            • memory/2924-130-0x0000000002310000-0x00000000024A2000-memory.dmp

              Filesize

              1.6MB

              Download

            • memory/2924-131-0x0000000000400000-0x0000000000598000-memory.dmp

              Filesize

              1.6MB

              Download

            • memory/4048-134-0x0000000002600000-0x0000000002792000-memory.dmp

              Filesize

              1.6MB

              Download

            • memory/4048-135-0x0000000000400000-0x0000000000598000-memory.dmp

              Filesize

              1.6MB

              Download