Overview

overview

10

Static

static

0a49373e97...e6.exe

windows7_x64

10

0a49373e97...e6.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    4294213s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20220311-en
  • submitted
    28-03-2022 18:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0a49373e97366040658acf1971695740342c623beab93fc493cb2dadda5814e6.exe

  • Size

    423KB

  • MD5

    b8546e288ba47f4be8615e73d26f2215

  • SHA1

    0204fc6d8f011efc4ba2fafe5bf5ba7bbb2be50e

  • SHA256

    0a49373e97366040658acf1971695740342c623beab93fc493cb2dadda5814e6

  • SHA512

    29f91d6b359eb9115414726d2444187864f13904efd0653a8500dfd608a9598b08b3cee86503dd2fee507f6e3aff98773b5c46bab14dbfa880c5aa47c79e32f4

Score
10/10
buranpersistenceransomware

Malware Config

Extracted

Path

C:\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT

Family

buran

Ransom Note
!!! ALL YOUR FILES ARE ENCRYPTED !!! All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. To be sure we have the decryptor and it works you can send an email: [email protected] and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? Write to email: [email protected] Reserved email: [email protected] Your personal ID: F0D-028-47E Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Signatures

  • Buran

    Ransomware-as-a-service based on the VegaLocker family first identified in 2019.

    ransomwareburan
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Executes dropped EXE 2 IoCs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Interacts with shadow copies 2 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies system certificate store 2 TTPs 5 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 55 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0a49373e97366040658acf1971695740342c623beab93fc493cb2dadda5814e6.exe
    "C:\Users\Admin\AppData\Local\Temp\0a49373e97366040658acf1971695740342c623beab93fc493cb2dadda5814e6.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1832
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\spoolsv.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\spoolsv.exe" -start
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Enumerates connected drives
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1980
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C wmic shadowcopy delete
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1132
        • C:\Windows\SysWOW64\Wbem\WMIC.exe
          wmic shadowcopy delete
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:904
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} recoveryenabled no
        3⤵
          PID:1656
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
          3⤵
            PID:1052
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /C wbadmin delete catalog -quiet
            3⤵
              PID:1812
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /C vssadmin delete shadows /all /quiet
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:2020
              • C:\Windows\SysWOW64\vssadmin.exe
                vssadmin delete shadows /all /quiet
                4⤵
                • Interacts with shadow copies
                PID:1320
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\~temp001.bat
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:1152
              • C:\Windows\SysWOW64\Wbem\WMIC.exe
                wmic shadowcopy delete
                4⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:1728
              • C:\Windows\SysWOW64\vssadmin.exe
                vssadmin delete shadows /all /quiet
                4⤵
                • Interacts with shadow copies
                PID:1416
            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\spoolsv.exe
              "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\spoolsv.exe" -agent 0
              3⤵
              • Executes dropped EXE
              • Drops file in Program Files directory
              PID:1076
          • C:\Windows\SysWOW64\notepad.exe
            notepad.exe
            2⤵
            • Deletes itself
            PID:1480
        • C:\Windows\system32\vssvc.exe
          C:\Windows\system32\vssvc.exe
          1⤵
            PID:1536

          Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3F26ED5DE6B4E859CCCA6035ECB8D9CB
            Filesize

            728B

            MD5

            a115ab8dafff2ba9ef773c5c4c282723

            SHA1

            c0391d76dbba79176905fdffdd865053e7892ac7

            SHA256

            2b14412e5c2bed1e3c8a3414a403366a9ad377d228434d147ab16aba1124cbd4

            SHA512

            d7df5525ee4b6ee6796f005c1146634f122043183e6bf901d5575f82197f6d876bb01e29c02c7d7171cdddb1fa96ed5b15bcbb32b78d7c780d7cf0b0dec70599

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\204C1AA6F6114E6A513754A2AB5760FA_8AE57F9FAAC778EA4099F469BEEE4C46
            Filesize

            472B

            MD5

            451c60aee59ebd445876be838648d763

            SHA1

            8b14d0202ca7666f6419ebec052777632880d15c

            SHA256

            3aead2c16852aa9b1307ee68ebf5579c568c0f776bae0a0262b42b8b1056dc44

            SHA512

            80d955ef97db08f8cb5d073600fc725fe9c2b65753b299430de2a2acee9aa8573772418e0a3f3908b05f3e5d45ffed399ec3012cb424378a2d45f96ba102a486

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
            Filesize

            471B

            MD5

            ddb0f5f29483e3a5e3a152893bc363a9

            SHA1

            36c603ad11d23f33041039d3bd9eee47db013768

            SHA256

            4fab56d7bc76e0393be1bca6d52b7cb778424bf99e1efbc1725b44cdd557764b

            SHA512

            580401ebbe4eab757884badb51e5f650ec558bc09b2ae92cc47669061c13f9389a9a951ead537a79382b13d066515ced1c3a8557da6a8d287fc1bb16ee23a9bc

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3F26ED5DE6B4E859CCCA6035ECB8D9CB
            Filesize

            398B

            MD5

            b11984e19895d7c97338c687924d3687

            SHA1

            0096f52de299fea64a2d0c8778d2bc56de1d799b

            SHA256

            11f43506a4250df89448f5b64bbe782b7770c38393e8bbc3f60949b63c82d2bb

            SHA512

            358ef86102952b65b938c88c77f235e8627c2133f6c61dfaee0f031b900feff513ad277bdac64f383d80e1d2c2c88c63b97eb47c3a8c22fe85813b4681cc6a1b

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\204C1AA6F6114E6A513754A2AB5760FA_8AE57F9FAAC778EA4099F469BEEE4C46
            Filesize

            402B

            MD5

            b1f0cf81d17bd27fc297a44f41e13266

            SHA1

            91153ea9842c3f8358b9b7868c55592dcb83b815

            SHA256

            f22013182236372d4aa2034155d357ab225361ebbc2ee77029439728037f6637

            SHA512

            2d34191461135b68fcbbbca59d7489bdbf99e1337b3500eb0ebc2830c647c9f844ce44069b5d5107f40cfa062dace1a4489688cbbefe0cbe4cde2a75a45033ac

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
            Filesize

            344B

            MD5

            e39db9b75b5a84ba99d79c9910303942

            SHA1

            b8927a7ad42f255794b29fd58e536feab4df61ce

            SHA256

            a104211036d942dcdb7e664ee0b109bedaa9c034bb3172c3001d12733ef73cc3

            SHA512

            857aec3789cb982a1fccdf19effaf82a284e98765b6a785afb7dbd288bd949f0ff5b1496789c04250e773b4523e6b23b1daad00827904703a37d8b380021a15d

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
            Filesize

            396B

            MD5

            2b515eb5a452197a8ff0f0d2d1bb0887

            SHA1

            c72066af41a7b5c61b5ef99f8a158365f7f4de09

            SHA256

            b0700f715d718b8d102d7ce22ce9a2fa80e4049ff7c45fd90c580ed7c1abce8f

            SHA512

            dfdeb79a3e56fda793642d264abfb8a96d2c1208b66f686bb1f8017dc98c7882225e8caa5591598124f31f5876fec0bde45b4d8b951a89bda004f7bdf60c2517

            Download Submit

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GC0VJYYE\6QXYC6F1.htm
            Filesize

            184B

            MD5

            b1cd7c031debba3a5c77b39b6791c1a7

            SHA1

            e5d91e14e9c685b06f00e550d9e189deb2075f76

            SHA256

            57ba053f075e0b80f747f3102ed985687c16a8754d109e7c4d33633269a36aaa

            SHA512

            d2bbefdc1effb52a38964c4cec5990a5a226248eca36f99e446c0c5704436f666bf1cb514e73b8991411d497d3325ecc646cbd5065c364e92ab6b9c5f1ad4a72

            Download Submit

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VWB6EIWR\5GLNQV13.htm
            Filesize

            18KB

            MD5

            6b17a59cec1a7783febae9aa55c56556

            SHA1

            01d4581e2b3a6348679147a915a0b22b2a66643a

            SHA256

            66987b14b90d41632be98836f9601b12e7f329ffab05595887889c9c5716fbeb

            SHA512

            3337efd12b9c06b7768eb928a78caae243b75257c5aabe7a49e908a2f735af55f7257a40bd2330dc13865ead18ed805b54a6c5105740fdcbbaccacf7997bcbc3

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\~temp001.bat
            Filesize

            406B

            MD5

            ef572e2c7b1bbd57654b36e8dcfdc37a

            SHA1

            b84c4db6d0dfd415c289d0c8ae099aea4001e3b7

            SHA256

            e6e609db3f387f42bfd16dd9e5695ddc2b73d86ae12baf4f0dfc4edda4a96a64

            SHA512

            b8c014b242e8e8f42da37b75fe96c52cd25ebd366d0b5103bcba5ac041806d13142a62351edecdee583d494d2a120f9b330f6229b1b5fe820e1c7d98981089e9

            Download Submit

          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\spoolsv.exe
            Filesize

            423KB

            MD5

            b8546e288ba47f4be8615e73d26f2215

            SHA1

            0204fc6d8f011efc4ba2fafe5bf5ba7bbb2be50e

            SHA256

            0a49373e97366040658acf1971695740342c623beab93fc493cb2dadda5814e6

            SHA512

            29f91d6b359eb9115414726d2444187864f13904efd0653a8500dfd608a9598b08b3cee86503dd2fee507f6e3aff98773b5c46bab14dbfa880c5aa47c79e32f4

            Download Submit

          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\spoolsv.exe
            Filesize

            423KB

            MD5

            b8546e288ba47f4be8615e73d26f2215

            SHA1

            0204fc6d8f011efc4ba2fafe5bf5ba7bbb2be50e

            SHA256

            0a49373e97366040658acf1971695740342c623beab93fc493cb2dadda5814e6

            SHA512

            29f91d6b359eb9115414726d2444187864f13904efd0653a8500dfd608a9598b08b3cee86503dd2fee507f6e3aff98773b5c46bab14dbfa880c5aa47c79e32f4

            Download Submit

          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\spoolsv.exe
            Filesize

            423KB

            MD5

            b8546e288ba47f4be8615e73d26f2215

            SHA1

            0204fc6d8f011efc4ba2fafe5bf5ba7bbb2be50e

            SHA256

            0a49373e97366040658acf1971695740342c623beab93fc493cb2dadda5814e6

            SHA512

            29f91d6b359eb9115414726d2444187864f13904efd0653a8500dfd608a9598b08b3cee86503dd2fee507f6e3aff98773b5c46bab14dbfa880c5aa47c79e32f4

            Download Submit

          • \Users\Admin\AppData\Roaming\Microsoft\Windows\spoolsv.exe
            Filesize

            423KB

            MD5

            b8546e288ba47f4be8615e73d26f2215

            SHA1

            0204fc6d8f011efc4ba2fafe5bf5ba7bbb2be50e

            SHA256

            0a49373e97366040658acf1971695740342c623beab93fc493cb2dadda5814e6

            SHA512

            29f91d6b359eb9115414726d2444187864f13904efd0653a8500dfd608a9598b08b3cee86503dd2fee507f6e3aff98773b5c46bab14dbfa880c5aa47c79e32f4

            Download Submit

          • \Users\Admin\AppData\Roaming\Microsoft\Windows\spoolsv.exe
            Filesize

            423KB

            MD5

            b8546e288ba47f4be8615e73d26f2215

            SHA1

            0204fc6d8f011efc4ba2fafe5bf5ba7bbb2be50e

            SHA256

            0a49373e97366040658acf1971695740342c623beab93fc493cb2dadda5814e6

            SHA512

            29f91d6b359eb9115414726d2444187864f13904efd0653a8500dfd608a9598b08b3cee86503dd2fee507f6e3aff98773b5c46bab14dbfa880c5aa47c79e32f4

            Download Submit

          • memory/1076-96-0x0000000001DD0000-0x0000000001F7A000-memory.dmp

            Filesize

            1.7MB

            Download

          • memory/1076-97-0x0000000000400000-0x00000000005B0000-memory.dmp

            Filesize

            1.7MB

            Download

          • memory/1480-61-0x0000000000080000-0x0000000000081000-memory.dmp

            Filesize

            4KB

            Download

          • memory/1832-55-0x00000000020D0000-0x000000000227A000-memory.dmp

            Filesize

            1.7MB

            Download

          • memory/1832-56-0x0000000000400000-0x00000000005B0000-memory.dmp

            Filesize

            1.7MB

            Download

          • memory/1832-54-0x00000000759B1000-0x00000000759B3000-memory.dmp

            Filesize

            8KB

            Download

          • memory/1980-69-0x0000000001E50000-0x0000000001FFA000-memory.dmp

            Filesize

            1.7MB

            Download

          • memory/1980-71-0x0000000000400000-0x00000000005B0000-memory.dmp

            Filesize

            1.7MB

            Download