Overview

overview

10

Static

static

332bca23e3...5a.exe

windows7_x64

10

332bca23e3...5a.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    151s
  • max time network
    135s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    06-03-2022 06:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    332bca23e362f6c95326ecc943cb39e93d6fdcf454d72a5e60c9e14f5802ce5a.exe

  • Size

    214KB

  • MD5

    42ea94ee3adca8b82fba15ecdde25f26

  • SHA1

    ca17412cd44d186db91c4b2fa7df03363533ffd2

  • SHA256

    332bca23e362f6c95326ecc943cb39e93d6fdcf454d72a5e60c9e14f5802ce5a

  • SHA512

    cbec5875fdbcd1182ce9cb87728f36f9a36da032589394b20418229780a2182f6641519fd7545bd812257492a0fd9a68ebfd487d6ec5ebb9e3f666558bb81874

Score
10/10
buranpersistenceransomware

Malware Config

Extracted

Path

C:\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT

Family

buran

Ransom Note
!!! ALL YOUR FILES ARE ENCRYPTED !!! All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. To be sure we have the decryptor and it works you can send an email: [email protected] and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? Write to email: [email protected] Reserved email: [email protected] telegram:uspex12345 Your personal ID: 4ED-42E-774 Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Signatures

  • Buran

    Ransomware-as-a-service based on the VegaLocker family first identified in 2019.

    ransomwareburan
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\332bca23e362f6c95326ecc943cb39e93d6fdcf454d72a5e60c9e14f5802ce5a.exe
    "C:\Users\Admin\AppData\Local\Temp\332bca23e362f6c95326ecc943cb39e93d6fdcf454d72a5e60c9e14f5802ce5a.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3020
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\taskeng.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\taskeng.exe" -start
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Suspicious use of WriteProcessMemory
      PID:384
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C wmic shadowcopy delete
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1560
        • C:\Windows\SysWOW64\Wbem\WMIC.exe
          wmic shadowcopy delete
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:3392
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
        3⤵
          PID:1592
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\taskeng.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\taskeng.exe" -agent 0
          3⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          PID:1888
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\~temp001.bat
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1836
          • C:\Windows\SysWOW64\Wbem\WMIC.exe
            wmic shadowcopy delete
            4⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:116
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /C vssadmin delete shadows /all /quiet
          3⤵
            PID:1756
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /C wbadmin delete catalog -quiet
            3⤵
              PID:2368
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} recoveryenabled no
              3⤵
                PID:2376
            • C:\Windows\SysWOW64\notepad.exe
              notepad.exe
              2⤵
                PID:4064
            • C:\Windows\system32\vssvc.exe
              C:\Windows\system32\vssvc.exe
              1⤵
                PID:4472

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3F26ED5DE6B4E859CCCA6035ECB8D9CB
                MD5

                1c7207d15a7f303c73d5d89d6aae43be

                SHA1

                19fe550a31cf89ab706e3ebcd6fcc78ca57bdeac

                SHA256

                52a8f1b16a9d4bcec89850a5f6d30488cd8390d0e6bc19eaea5a138d5dc64dc9

                SHA512

                d6216aa45ffcd9345139792c94a55d53fe40f775d42a6d6127fc2cb066c653bdc005d133ed85d73aa34f1bcf634c221c7624a7e840c2424cf1f29a2bcd088342

                Download Submit

              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\204C1AA6F6114E6A513754A2AB5760FA_0673414C08DE7F919AE3F6C4CC65AEEE
                MD5

                5bfa51f3a417b98e7443eca90fc94703

                SHA1

                8c015d80b8a23f780bdd215dc842b0f5551f63bd

                SHA256

                bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128

                SHA512

                4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399

                Download Submit

              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B1230D967FD647CD5194F3FFA6C7E7E4
                MD5

                0f96cf32580efc867ff48db74bc92e4b

                SHA1

                2d16ce1151807b1cc5445db9bd511d0a2c90cf01

                SHA256

                7176b87dd59195a7e0fb8624010b143d1ca991161748e2cd38a88a4eec91a8da

                SHA512

                9d9e74180ef53053ebcfe25dd50659b002a4422c9253b82c78804b97329b57ea1ee19edf9eadec09d45f1b034270a15a7da5e5943406415dc259ca58fa459dbe

                Download Submit

              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
                MD5

                c167da7b8b4c7fcda6675c7e0088f400

                SHA1

                994596505635ae1ea5d515c3812bde4da71453da

                SHA256

                393c90d40294d1f9e4875acc639b3c1b0207a68c7ca49aaf715f97746c128062

                SHA512

                8fbb72b5d58e34709eb545ab324112d4392f3af389b68b1e184d885ea210f529dede92167578687f47c1b40e49341cbbd62eaf8d71dc09397b5d44a4c9b767f0

                Download Submit

              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3F26ED5DE6B4E859CCCA6035ECB8D9CB
                MD5

                e95ce7eb9ff29dab01883fa689cf16eb

                SHA1

                8d7bc727c9228207e7ecf2734cdc99af26e54856

                SHA256

                2a3b46516c4b955739728bbf890d1c8b8e3bb31d05126571f526b9472354098c

                SHA512

                e08a3f5d0ffe4cc62c02741c0c1245ce187a21e197686b877ec1cab350aa5cc4629a3d57b00d3b9596acb53f809db49c298f0a7d647a4d2ff4aba43dcc1d7d2f

                Download Submit

              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\204C1AA6F6114E6A513754A2AB5760FA_0673414C08DE7F919AE3F6C4CC65AEEE
                MD5

                8b6fceb9c3d70296b1695c932fe1a365

                SHA1

                9b8457a968e0e4d1b5ea3818a8d36e996f0eda09

                SHA256

                78dac802f2d02aa3c931d810f316ba5df64345c950470b7cc588225bbe950132

                SHA512

                5b131ab5942a1b681cbd43d10ef225818a3f3e323583aa1db70631bc02498d0474c2a26552942df42fe639d237d511cdc01da9463e6a4805853ab4ce813f8d21

                Download Submit

              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B1230D967FD647CD5194F3FFA6C7E7E4
                MD5

                9802c4aee6f15d3e915e79ba50a2ad85

                SHA1

                a2babf90d5a6de6fcc7d83075f07800f6ba96774

                SHA256

                2bf1f3d4d0447d84b3a8cb59d7aadeeda24324872a6d0646f5f1d444becae254

                SHA512

                a0623c03b8e01229903bb30e2e32670f15945e858edffa61ae795ebaa26228cec02302cfcb341c01d97b9aec1d7425309f86040fd253c11553de94c729cdb075

                Download Submit

              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
                MD5

                318b0c28312a438eb23d2b2f0a0714c6

                SHA1

                bf96c1e4583499884c181a125905ce37e9d23db3

                SHA256

                572c72af167abeea0fea8aedb0d72118ecab9a7f870fae52fe976d6f04d5bfae

                SHA512

                284d6dcb667284102676ae6f41ec67b348780a32a94951673b1eb98e9d7d51730f091fadef0a6b33d23c74cd11aaae671e2f94efa16d5e1f9d634193efdfcfc4

                Download Submit

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\K6H59MEI\1KUCEL9L.htm
                MD5

                b1cd7c031debba3a5c77b39b6791c1a7

                SHA1

                e5d91e14e9c685b06f00e550d9e189deb2075f76

                SHA256

                57ba053f075e0b80f747f3102ed985687c16a8754d109e7c4d33633269a36aaa

                SHA512

                d2bbefdc1effb52a38964c4cec5990a5a226248eca36f99e446c0c5704436f666bf1cb514e73b8991411d497d3325ecc646cbd5065c364e92ab6b9c5f1ad4a72

                Download Submit

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OMK7HR9K\NJ9Y0POH.htm
                MD5

                6b17a59cec1a7783febae9aa55c56556

                SHA1

                01d4581e2b3a6348679147a915a0b22b2a66643a

                SHA256

                66987b14b90d41632be98836f9601b12e7f329ffab05595887889c9c5716fbeb

                SHA512

                3337efd12b9c06b7768eb928a78caae243b75257c5aabe7a49e908a2f735af55f7257a40bd2330dc13865ead18ed805b54a6c5105740fdcbbaccacf7997bcbc3

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\~temp001.bat
                MD5

                ef572e2c7b1bbd57654b36e8dcfdc37a

                SHA1

                b84c4db6d0dfd415c289d0c8ae099aea4001e3b7

                SHA256

                e6e609db3f387f42bfd16dd9e5695ddc2b73d86ae12baf4f0dfc4edda4a96a64

                SHA512

                b8c014b242e8e8f42da37b75fe96c52cd25ebd366d0b5103bcba5ac041806d13142a62351edecdee583d494d2a120f9b330f6229b1b5fe820e1c7d98981089e9

                Download Submit

              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\taskeng.exe
                MD5

                42ea94ee3adca8b82fba15ecdde25f26

                SHA1

                ca17412cd44d186db91c4b2fa7df03363533ffd2

                SHA256

                332bca23e362f6c95326ecc943cb39e93d6fdcf454d72a5e60c9e14f5802ce5a

                SHA512

                cbec5875fdbcd1182ce9cb87728f36f9a36da032589394b20418229780a2182f6641519fd7545bd812257492a0fd9a68ebfd487d6ec5ebb9e3f666558bb81874

                Download Submit

              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\taskeng.exe
                MD5

                42ea94ee3adca8b82fba15ecdde25f26

                SHA1

                ca17412cd44d186db91c4b2fa7df03363533ffd2

                SHA256

                332bca23e362f6c95326ecc943cb39e93d6fdcf454d72a5e60c9e14f5802ce5a

                SHA512

                cbec5875fdbcd1182ce9cb87728f36f9a36da032589394b20418229780a2182f6641519fd7545bd812257492a0fd9a68ebfd487d6ec5ebb9e3f666558bb81874

                Download Submit

              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\taskeng.exe
                MD5

                42ea94ee3adca8b82fba15ecdde25f26

                SHA1

                ca17412cd44d186db91c4b2fa7df03363533ffd2

                SHA256

                332bca23e362f6c95326ecc943cb39e93d6fdcf454d72a5e60c9e14f5802ce5a

                SHA512

                cbec5875fdbcd1182ce9cb87728f36f9a36da032589394b20418229780a2182f6641519fd7545bd812257492a0fd9a68ebfd487d6ec5ebb9e3f666558bb81874

                Download Submit

              • memory/4064-134-0x0000000000AB0000-0x0000000000AB1000-memory.dmp

                Filesize

                4KB

                Download