Overview

overview

10

Static

static

332bca23e3...5a.exe

windows7_x64

10

332bca23e3...5a.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    4294211s
  • max time network
    130s
  • platform
    windows7_x64
  • resource
    win7-20220223-en
  • submitted
    06-03-2022 06:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    332bca23e362f6c95326ecc943cb39e93d6fdcf454d72a5e60c9e14f5802ce5a.exe

  • Size

    214KB

  • MD5

    42ea94ee3adca8b82fba15ecdde25f26

  • SHA1

    ca17412cd44d186db91c4b2fa7df03363533ffd2

  • SHA256

    332bca23e362f6c95326ecc943cb39e93d6fdcf454d72a5e60c9e14f5802ce5a

  • SHA512

    cbec5875fdbcd1182ce9cb87728f36f9a36da032589394b20418229780a2182f6641519fd7545bd812257492a0fd9a68ebfd487d6ec5ebb9e3f666558bb81874

Score
10/10
buranpersistenceransomware

Malware Config

Extracted

Path

C:\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT

Family

buran

Ransom Note
!!! ALL YOUR FILES ARE ENCRYPTED !!! All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. To be sure we have the decryptor and it works you can send an email: [email protected] and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? Write to email: [email protected] Reserved email: [email protected] telegram:uspex12345 Your personal ID: 822-7B1-847 Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Signatures

  • Buran

    Ransomware-as-a-service based on the VegaLocker family first identified in 2019.

    ransomwareburan
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Interacts with shadow copies 2 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies system certificate store 2 TTPs 5 IoCs
    evasionspywaretrojan
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 59 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\332bca23e362f6c95326ecc943cb39e93d6fdcf454d72a5e60c9e14f5802ce5a.exe
    "C:\Users\Admin\AppData\Local\Temp\332bca23e362f6c95326ecc943cb39e93d6fdcf454d72a5e60c9e14f5802ce5a.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1620
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe" -start
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Modifies system certificate store
      • Suspicious use of WriteProcessMemory
      PID:272
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C wmic shadowcopy delete
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1380
        • C:\Windows\SysWOW64\Wbem\WMIC.exe
          wmic shadowcopy delete
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1596
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} recoveryenabled no
        3⤵
          PID:916
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
          3⤵
            PID:456
          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
            "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe" -agent 0
            3⤵
            • Executes dropped EXE
            • Drops file in Program Files directory
            PID:1480
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\~temp001.bat
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:612
            • C:\Windows\SysWOW64\Wbem\WMIC.exe
              wmic shadowcopy delete
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:2004
            • C:\Windows\SysWOW64\vssadmin.exe
              vssadmin delete shadows /all /quiet
              4⤵
              • Interacts with shadow copies
              PID:1092
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /C vssadmin delete shadows /all /quiet
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1504
            • C:\Windows\SysWOW64\vssadmin.exe
              vssadmin delete shadows /all /quiet
              4⤵
              • Interacts with shadow copies
              PID:1980
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /C wbadmin delete catalog -quiet
            3⤵
              PID:1472
          • C:\Windows\SysWOW64\notepad.exe
            notepad.exe
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:1988
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1988 -s 196
              3⤵
              • Program crash
              PID:1672
        • C:\Windows\system32\vssvc.exe
          C:\Windows\system32\vssvc.exe
          1⤵
            PID:1448

          Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3F26ED5DE6B4E859CCCA6035ECB8D9CB
            MD5

            1c7207d15a7f303c73d5d89d6aae43be

            SHA1

            19fe550a31cf89ab706e3ebcd6fcc78ca57bdeac

            SHA256

            52a8f1b16a9d4bcec89850a5f6d30488cd8390d0e6bc19eaea5a138d5dc64dc9

            SHA512

            d6216aa45ffcd9345139792c94a55d53fe40f775d42a6d6127fc2cb066c653bdc005d133ed85d73aa34f1bcf634c221c7624a7e840c2424cf1f29a2bcd088342

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\204C1AA6F6114E6A513754A2AB5760FA_0673414C08DE7F919AE3F6C4CC65AEEE
            MD5

            5bfa51f3a417b98e7443eca90fc94703

            SHA1

            8c015d80b8a23f780bdd215dc842b0f5551f63bd

            SHA256

            bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128

            SHA512

            4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
            MD5

            637481df32351129e60560d5a5c100b5

            SHA1

            a46aee6e5a4a4893fba5806bcc14fc7fb3ce80ae

            SHA256

            1f1029d94ca4656a577d554cedd79d447658f475af08620084897a5523587052

            SHA512

            604bfd0a78a57dfddd45872803501ad89491e37e89e0778b0f13644fa9164ff509955a57469dfdd65a05bbedaf0acb669f68430e84800d17efe7d360a70569e3

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B1230D967FD647CD5194F3FFA6C7E7E4
            MD5

            0f96cf32580efc867ff48db74bc92e4b

            SHA1

            2d16ce1151807b1cc5445db9bd511d0a2c90cf01

            SHA256

            7176b87dd59195a7e0fb8624010b143d1ca991161748e2cd38a88a4eec91a8da

            SHA512

            9d9e74180ef53053ebcfe25dd50659b002a4422c9253b82c78804b97329b57ea1ee19edf9eadec09d45f1b034270a15a7da5e5943406415dc259ca58fa459dbe

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
            MD5

            c167da7b8b4c7fcda6675c7e0088f400

            SHA1

            994596505635ae1ea5d515c3812bde4da71453da

            SHA256

            393c90d40294d1f9e4875acc639b3c1b0207a68c7ca49aaf715f97746c128062

            SHA512

            8fbb72b5d58e34709eb545ab324112d4392f3af389b68b1e184d885ea210f529dede92167578687f47c1b40e49341cbbd62eaf8d71dc09397b5d44a4c9b767f0

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3F26ED5DE6B4E859CCCA6035ECB8D9CB
            MD5

            df11f60c99660e0f3c18219ac6895d4d

            SHA1

            48557bccad64d790260c9a54b7da53cedca59264

            SHA256

            d564d9c1619d57a750ff9b1abb77243762a241be2b7e522e76d5ec9b5f0aef9f

            SHA512

            2a8e92ab42bc66dba988f4d0c22660a586bebe4f432c6bfbd39888e0a6d8daf084c19facb832c1edefcc515d1fe6db15eb0a8aed3ed27c16f78e04666f120beb

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\204C1AA6F6114E6A513754A2AB5760FA_0673414C08DE7F919AE3F6C4CC65AEEE
            MD5

            4d5e6b72ea8cbcfecc5ed2b559b7592a

            SHA1

            78fe98d962ea819f10f0587159be39d1e165e836

            SHA256

            ee5bfb791cb2c81ae849e4d5c04d32a2f146538cda065343f660c5abb5a1dc58

            SHA512

            27fc2c3563d8a00f35e3ec34eecc8f32d8148b582fdcc19b877bfb6e9acf9ab3c52ee3445d939c54d27537ed5c7f62a914f319e52550658f560b3d4488d64686

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
            MD5

            0e590cdf32cf927048e86f07e3355f1e

            SHA1

            9179cdf36b337082cd753109f194115c6ee7ae65

            SHA256

            083bdf51ae117948b80ccdedf1f6764431df465de903fe4dab1fb2240c698d07

            SHA512

            90adbe65c26c1c33757bc9778f8cc2ae5a0cee60e399b8d49bdcb3673a272c66b16355f678efaa36eee57aff5c8bfcf42e64944777e85e94d253ac86cf3fed2f

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B1230D967FD647CD5194F3FFA6C7E7E4
            MD5

            bf51e4ccb5c6ef38fc1f2fb1bfdc4a4b

            SHA1

            b6fcb32b035a0b033dd2a923a5cbba35c54a9c31

            SHA256

            af6a047e8ae74bb157a5c6d9263b700848e80996065255089735da5c1822f09c

            SHA512

            f16cbb9adfdd728b569a2580193e742f30b895075629121e81756d11e67e2ac04bba2dc62d803c01a5546355ab9d21f46a577590f59e4fd57cbc9cd0dffbbbe0

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
            MD5

            157a16117ddc2466c0eb9137e921c46d

            SHA1

            a54644a23b9a80e1743bf9913156fa76792217d9

            SHA256

            4897a9afbfa9ddbb017cabf6d8df16d4730e56eeb1aefcaed7c24b8bf9f93031

            SHA512

            6b9b36573b7e4a69f5840cee2a533fa51972ee5c04006ddd67c78c609ec81c073d75de209b4f18abca32003352cae35bca6ec01496a6c36582f672ceadedcacf

            Download Submit

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Z12QDLN4\J6390Z7V.htm
            MD5

            b1cd7c031debba3a5c77b39b6791c1a7

            SHA1

            e5d91e14e9c685b06f00e550d9e189deb2075f76

            SHA256

            57ba053f075e0b80f747f3102ed985687c16a8754d109e7c4d33633269a36aaa

            SHA512

            d2bbefdc1effb52a38964c4cec5990a5a226248eca36f99e446c0c5704436f666bf1cb514e73b8991411d497d3325ecc646cbd5065c364e92ab6b9c5f1ad4a72

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\~temp001.bat
            MD5

            ef572e2c7b1bbd57654b36e8dcfdc37a

            SHA1

            b84c4db6d0dfd415c289d0c8ae099aea4001e3b7

            SHA256

            e6e609db3f387f42bfd16dd9e5695ddc2b73d86ae12baf4f0dfc4edda4a96a64

            SHA512

            b8c014b242e8e8f42da37b75fe96c52cd25ebd366d0b5103bcba5ac041806d13142a62351edecdee583d494d2a120f9b330f6229b1b5fe820e1c7d98981089e9

            Download Submit

          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
            MD5

            42ea94ee3adca8b82fba15ecdde25f26

            SHA1

            ca17412cd44d186db91c4b2fa7df03363533ffd2

            SHA256

            332bca23e362f6c95326ecc943cb39e93d6fdcf454d72a5e60c9e14f5802ce5a

            SHA512

            cbec5875fdbcd1182ce9cb87728f36f9a36da032589394b20418229780a2182f6641519fd7545bd812257492a0fd9a68ebfd487d6ec5ebb9e3f666558bb81874

            Download Submit

          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
            MD5

            42ea94ee3adca8b82fba15ecdde25f26

            SHA1

            ca17412cd44d186db91c4b2fa7df03363533ffd2

            SHA256

            332bca23e362f6c95326ecc943cb39e93d6fdcf454d72a5e60c9e14f5802ce5a

            SHA512

            cbec5875fdbcd1182ce9cb87728f36f9a36da032589394b20418229780a2182f6641519fd7545bd812257492a0fd9a68ebfd487d6ec5ebb9e3f666558bb81874

            Download Submit

          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
            MD5

            42ea94ee3adca8b82fba15ecdde25f26

            SHA1

            ca17412cd44d186db91c4b2fa7df03363533ffd2

            SHA256

            332bca23e362f6c95326ecc943cb39e93d6fdcf454d72a5e60c9e14f5802ce5a

            SHA512

            cbec5875fdbcd1182ce9cb87728f36f9a36da032589394b20418229780a2182f6641519fd7545bd812257492a0fd9a68ebfd487d6ec5ebb9e3f666558bb81874

            Download Submit

          • \Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
            MD5

            42ea94ee3adca8b82fba15ecdde25f26

            SHA1

            ca17412cd44d186db91c4b2fa7df03363533ffd2

            SHA256

            332bca23e362f6c95326ecc943cb39e93d6fdcf454d72a5e60c9e14f5802ce5a

            SHA512

            cbec5875fdbcd1182ce9cb87728f36f9a36da032589394b20418229780a2182f6641519fd7545bd812257492a0fd9a68ebfd487d6ec5ebb9e3f666558bb81874

            Download Submit

          • \Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
            MD5

            42ea94ee3adca8b82fba15ecdde25f26

            SHA1

            ca17412cd44d186db91c4b2fa7df03363533ffd2

            SHA256

            332bca23e362f6c95326ecc943cb39e93d6fdcf454d72a5e60c9e14f5802ce5a

            SHA512

            cbec5875fdbcd1182ce9cb87728f36f9a36da032589394b20418229780a2182f6641519fd7545bd812257492a0fd9a68ebfd487d6ec5ebb9e3f666558bb81874

            Download Submit

          • memory/1620-54-0x0000000075AC1000-0x0000000075AC3000-memory.dmp

            Filesize

            8KB

            Download

          • memory/1988-59-0x00000000000C0000-0x00000000000C1000-memory.dmp

            Filesize

            4KB

            Download