Overview

overview

10

Static

static

0a49373e97...e6.exe

windows7_x64

10

0a49373e97...e6.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    151s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220310-en
  • submitted
    28-03-2022 18:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0a49373e97366040658acf1971695740342c623beab93fc493cb2dadda5814e6.exe

  • Size

    423KB

  • MD5

    b8546e288ba47f4be8615e73d26f2215

  • SHA1

    0204fc6d8f011efc4ba2fafe5bf5ba7bbb2be50e

  • SHA256

    0a49373e97366040658acf1971695740342c623beab93fc493cb2dadda5814e6

  • SHA512

    29f91d6b359eb9115414726d2444187864f13904efd0653a8500dfd608a9598b08b3cee86503dd2fee507f6e3aff98773b5c46bab14dbfa880c5aa47c79e32f4

Score
10/10
buranpersistenceransomware

Malware Config

Extracted

Path

C:\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT

Family

buran

Ransom Note
!!! ALL YOUR FILES ARE ENCRYPTED !!! All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. To be sure we have the decryptor and it works you can send an email: [email protected] and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? Write to email: [email protected] Reserved email: [email protected] Your personal ID: 239-D38-4A1 Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Signatures

  • Buran

    Ransomware-as-a-service based on the VegaLocker family first identified in 2019.

    ransomwareburan
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies data under HKEY_USERS 6 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0a49373e97366040658acf1971695740342c623beab93fc493cb2dadda5814e6.exe
    "C:\Users\Admin\AppData\Local\Temp\0a49373e97366040658acf1971695740342c623beab93fc493cb2dadda5814e6.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3512
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe" -start
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1528
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C wmic shadowcopy delete
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4508
        • C:\Windows\SysWOW64\Wbem\WMIC.exe
          wmic shadowcopy delete
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1480
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
        3⤵
          PID:4672
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} recoveryenabled no
          3⤵
            PID:4616
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /C wbadmin delete catalog -quiet
            3⤵
              PID:5020
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\~temp001.bat
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:4236
              • C:\Windows\SysWOW64\Wbem\WMIC.exe
                wmic shadowcopy delete
                4⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:3492
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /C vssadmin delete shadows /all /quiet
              3⤵
                PID:444
              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
                "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe" -agent 0
                3⤵
                • Executes dropped EXE
                • Drops file in Program Files directory
                PID:3912
            • C:\Windows\SysWOW64\notepad.exe
              notepad.exe
              2⤵
                PID:4472
            • C:\Windows\System32\svchost.exe
              C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
              1⤵
              • Modifies data under HKEY_USERS
              PID:632
            • C:\Windows\system32\vssvc.exe
              C:\Windows\system32\vssvc.exe
              1⤵
                PID:1496
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
                1⤵
                  PID:4692

                Network

                MITRE ATT&CK Enterprise v6

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3F26ED5DE6B4E859CCCA6035ECB8D9CB
                  Filesize

                  728B

                  MD5

                  a115ab8dafff2ba9ef773c5c4c282723

                  SHA1

                  c0391d76dbba79176905fdffdd865053e7892ac7

                  SHA256

                  2b14412e5c2bed1e3c8a3414a403366a9ad377d228434d147ab16aba1124cbd4

                  SHA512

                  d7df5525ee4b6ee6796f005c1146634f122043183e6bf901d5575f82197f6d876bb01e29c02c7d7171cdddb1fa96ed5b15bcbb32b78d7c780d7cf0b0dec70599

                  Download Submit

                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\204C1AA6F6114E6A513754A2AB5760FA_8AE57F9FAAC778EA4099F469BEEE4C46
                  Filesize

                  472B

                  MD5

                  451c60aee59ebd445876be838648d763

                  SHA1

                  8b14d0202ca7666f6419ebec052777632880d15c

                  SHA256

                  3aead2c16852aa9b1307ee68ebf5579c568c0f776bae0a0262b42b8b1056dc44

                  SHA512

                  80d955ef97db08f8cb5d073600fc725fe9c2b65753b299430de2a2acee9aa8573772418e0a3f3908b05f3e5d45ffed399ec3012cb424378a2d45f96ba102a486

                  Download Submit

                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
                  Filesize

                  471B

                  MD5

                  ddb0f5f29483e3a5e3a152893bc363a9

                  SHA1

                  36c603ad11d23f33041039d3bd9eee47db013768

                  SHA256

                  4fab56d7bc76e0393be1bca6d52b7cb778424bf99e1efbc1725b44cdd557764b

                  SHA512

                  580401ebbe4eab757884badb51e5f650ec558bc09b2ae92cc47669061c13f9389a9a951ead537a79382b13d066515ced1c3a8557da6a8d287fc1bb16ee23a9bc

                  Download Submit

                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3F26ED5DE6B4E859CCCA6035ECB8D9CB
                  Filesize

                  398B

                  MD5

                  026b33309bcee97b4bb917acb99b27b7

                  SHA1

                  890608c0fa936905ec6cffb2f026946f8531a691

                  SHA256

                  ae4df3d6dc417f4af91b82ec28489960513723076ae1d350194c29a556f2709b

                  SHA512

                  d760f0f291d6fbbdd6b124647f2874465635e4b3e4083c3a550a506f07b7c31b53456b6b8c8dec4d5f7d859ace2b8ea6c36e868036b07450326d5d792e4c6b76

                  Download Submit

                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\204C1AA6F6114E6A513754A2AB5760FA_8AE57F9FAAC778EA4099F469BEEE4C46
                  Filesize

                  402B

                  MD5

                  8d2865c5e9b8db5ae1570cd5f587fedb

                  SHA1

                  98de8f255e43f393ae8d063457092de1c38a19a5

                  SHA256

                  784f1732f71f230b4da395057f52e89a30151c03b603a35ff29b80c43d6ddabf

                  SHA512

                  ee1352d28d7f743f96cf56e14faf71ca48bbacc3a697b069e4b409af8bf1c5f14028b8e3667ad8d0d9d0fa3c295a7435eaab7a7ab75ab61b2d09ab89d71541b5

                  Download Submit

                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
                  Filesize

                  396B

                  MD5

                  bfcca107730a79b8f0401764cc7a0c29

                  SHA1

                  8a1994f4fa55f1b7f0c4075e3aff6e8effca4aad

                  SHA256

                  b2bfb608720ff211bc21fe259392d89feea1b3bb2e1fdfcc9475c0fecf680d8e

                  SHA512

                  584252eddb101a488023ababb6de451a44ae3225b910631e3124fe695f3667be35df7c5f28cdb71c8ee8d34429b3be561580822cd0b7c561ff8a6ce70dce20bd

                  Download Submit

                • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\1RDBARVA\5RKAGGDM.htm
                  Filesize

                  184B

                  MD5

                  b1cd7c031debba3a5c77b39b6791c1a7

                  SHA1

                  e5d91e14e9c685b06f00e550d9e189deb2075f76

                  SHA256

                  57ba053f075e0b80f747f3102ed985687c16a8754d109e7c4d33633269a36aaa

                  SHA512

                  d2bbefdc1effb52a38964c4cec5990a5a226248eca36f99e446c0c5704436f666bf1cb514e73b8991411d497d3325ecc646cbd5065c364e92ab6b9c5f1ad4a72

                  Download Submit

                • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\558DW1ID\DDU48KUI.htm
                  Filesize

                  18KB

                  MD5

                  8615e70875c2cc0b9db16027b9adf11d

                  SHA1

                  4ed62cf405311c0ff562a3c59334a15ddc4f1bf9

                  SHA256

                  da96949ba6b0567343f144486505c8c8fa1d892fd88c9cbc3ef3d751a570724d

                  SHA512

                  cd9dfc88dc2af9438b7d6b618d1b62029b3bdf739fc4daa5b37397afd12c4528561b3bf2fc3f3f2adf3fd1f582d5524332441fd30248fcd078e41aa91e17cb73

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\~temp001.bat
                  Filesize

                  406B

                  MD5

                  ef572e2c7b1bbd57654b36e8dcfdc37a

                  SHA1

                  b84c4db6d0dfd415c289d0c8ae099aea4001e3b7

                  SHA256

                  e6e609db3f387f42bfd16dd9e5695ddc2b73d86ae12baf4f0dfc4edda4a96a64

                  SHA512

                  b8c014b242e8e8f42da37b75fe96c52cd25ebd366d0b5103bcba5ac041806d13142a62351edecdee583d494d2a120f9b330f6229b1b5fe820e1c7d98981089e9

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
                  Filesize

                  423KB

                  MD5

                  b8546e288ba47f4be8615e73d26f2215

                  SHA1

                  0204fc6d8f011efc4ba2fafe5bf5ba7bbb2be50e

                  SHA256

                  0a49373e97366040658acf1971695740342c623beab93fc493cb2dadda5814e6

                  SHA512

                  29f91d6b359eb9115414726d2444187864f13904efd0653a8500dfd608a9598b08b3cee86503dd2fee507f6e3aff98773b5c46bab14dbfa880c5aa47c79e32f4

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
                  Filesize

                  423KB

                  MD5

                  b8546e288ba47f4be8615e73d26f2215

                  SHA1

                  0204fc6d8f011efc4ba2fafe5bf5ba7bbb2be50e

                  SHA256

                  0a49373e97366040658acf1971695740342c623beab93fc493cb2dadda5814e6

                  SHA512

                  29f91d6b359eb9115414726d2444187864f13904efd0653a8500dfd608a9598b08b3cee86503dd2fee507f6e3aff98773b5c46bab14dbfa880c5aa47c79e32f4

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
                  Filesize

                  423KB

                  MD5

                  b8546e288ba47f4be8615e73d26f2215

                  SHA1

                  0204fc6d8f011efc4ba2fafe5bf5ba7bbb2be50e

                  SHA256

                  0a49373e97366040658acf1971695740342c623beab93fc493cb2dadda5814e6

                  SHA512

                  29f91d6b359eb9115414726d2444187864f13904efd0653a8500dfd608a9598b08b3cee86503dd2fee507f6e3aff98773b5c46bab14dbfa880c5aa47c79e32f4

                  Download Submit

                • memory/444-154-0x0000000000000000-mapping.dmp

                  Download

                • memory/1480-158-0x0000000000000000-mapping.dmp

                  Download

                • memory/1528-140-0x00000000024D0000-0x000000000267A000-memory.dmp

                  Filesize

                  1.7MB

                  Download

                • memory/1528-136-0x0000000000000000-mapping.dmp

                  Download

                • memory/1528-142-0x0000000000400000-0x00000000005B0000-memory.dmp

                  Filesize

                  1.7MB

                  Download

                • memory/3492-160-0x0000000000000000-mapping.dmp

                  Download

                • memory/3512-134-0x0000000002520000-0x00000000026CA000-memory.dmp

                  Filesize

                  1.7MB

                  Download

                • memory/3512-135-0x0000000000400000-0x00000000005B0000-memory.dmp

                  Filesize

                  1.7MB

                  Download

                • memory/3912-156-0x0000000000000000-mapping.dmp

                  Download

                • memory/3912-161-0x0000000000400000-0x00000000005B0000-memory.dmp

                  Filesize

                  1.7MB

                  Download

                • memory/4236-155-0x0000000000000000-mapping.dmp

                  Download

                • memory/4472-139-0x0000000000000000-mapping.dmp

                  Download

                • memory/4508-150-0x0000000000000000-mapping.dmp

                  Download

                • memory/4616-151-0x0000000000000000-mapping.dmp

                  Download

                • memory/4672-152-0x0000000000000000-mapping.dmp

                  Download

                • memory/5020-153-0x0000000000000000-mapping.dmp

                  Download