buran | feeca43d32c8d2ad551298812ba8439dee19f0dcd1f0f568dfe1690bef5eba62

Analysis

max time kernel
102s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24-09-2022 09:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1.exe
Size

211KB
MD5

102f05cffa7d4ac4b7f02f38e6df632c
SHA1

9f4077164fe67ce25d0e64e4bd5e1ab6c95695de
SHA256

feeca43d32c8d2ad551298812ba8439dee19f0dcd1f0f568dfe1690bef5eba62
SHA512

b9f60951c2dd051a4be77cc7efa2355e4978543389fb50b433500928161d6c9cca6781532bb9a622d4ac107dcd5a24c35ebff722419ea0bf14350ff4fa53130e
SSDEEP

6144:Cia1gMHOPDWIhID8X/4DQFu/U3buRKlemZ9DnGAetTsB+6S+:CIMH06cID84DQFu/U3buRKlemZ9DnGAI

Score

10^/10

buran zeppelin persistence ransomware

Malware Config

Extracted

Path

C:\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT

Family

buran

Ransom Note

!!! ALL YOUR FILES ARE ENCRYPTED !!! All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. To be sure we have the decryptor and it works you can send an email: [email protected] and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? Write to email: [email protected] Reserved email: [email protected] Your personal ID: 6D7-EAC-F1B Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Emails

[email protected]

Signatures

Buran
Ransomware-as-a-service based on the VegaLocker family first identified in 2019.
ransomware buran

Detects Zeppelin payload 5 IoCs

resource	yara_rule
behavioral1/files/0x0008000000005c50-55.dat	family_zeppelin
behavioral1/files/0x0008000000005c50-56.dat	family_zeppelin
behavioral1/files/0x0008000000005c50-58.dat	family_zeppelin
behavioral1/files/0x0008000000005c50-72.dat	family_zeppelin
behavioral1/files/0x0008000000005c50-74.dat	family_zeppelin

Zeppelin Ransomware
Ransomware-as-a-service (RaaS) written in Delphi and first seen in 2019.
ransomware zeppelin
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Executes dropped EXE 2 IoCs

pid	Process
576	lsass.exe
628	lsass.exe

Modifies extensions of user files 1 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\ApproveSearch.tiff	lsass.exe

Deletes itself 1 IoCs

pid	Process
1200	notepad.exe

Loads dropped DLL 2 IoCs

pid	Process
1712	1.exe
1712	1.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run	1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsass.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\lsass.exe\" -start"	1.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	lsass.exe
File opened (read-only)	\??\R:	lsass.exe
File opened (read-only)	\??\O:	lsass.exe
File opened (read-only)	\??\M:	lsass.exe
File opened (read-only)	\??\K:	lsass.exe
File opened (read-only)	\??\Z:	lsass.exe
File opened (read-only)	\??\V:	lsass.exe
File opened (read-only)	\??\J:	lsass.exe
File opened (read-only)	\??\F:	lsass.exe
File opened (read-only)	\??\B:	lsass.exe
File opened (read-only)	\??\Q:	lsass.exe
File opened (read-only)	\??\N:	lsass.exe
File opened (read-only)	\??\W:	lsass.exe
File opened (read-only)	\??\U:	lsass.exe
File opened (read-only)	\??\T:	lsass.exe
File opened (read-only)	\??\H:	lsass.exe
File opened (read-only)	\??\G:	lsass.exe
File opened (read-only)	\??\E:	lsass.exe
File opened (read-only)	\??\Y:	lsass.exe
File opened (read-only)	\??\X:	lsass.exe
File opened (read-only)	\??\I:	lsass.exe
File opened (read-only)	\??\A:	lsass.exe
File opened (read-only)	\??\P:	lsass.exe
File opened (read-only)	\??\L:	lsass.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Games\Solitaire\de-DE\Solitaire.exe.mui.6D7-EAC-F1B	lsass.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107152.WMF	lsass.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Pacific\Pitcairn.6D7-EAC-F1B	lsass.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_ButtonGraphic.png	lsass.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationUp_SelectionSubpicture.png	lsass.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-javahelp.jar	lsass.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\TURKISH.TXT	lsass.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+8.6D7-EAC-F1B	lsass.exe
File opened for modification	C:\Program Files\Java\jre7\bin\ssvagent.exe.6D7-EAC-F1B	lsass.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\BREAK.JPG	lsass.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Rankin_Inlet.6D7-EAC-F1B	lsass.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0185796.WMF.6D7-EAC-F1B	lsass.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107728.WMF.6D7-EAC-F1B	lsass.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0235241.WMF.6D7-EAC-F1B	lsass.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\FAX\OriginFax.Dotx	lsass.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Maceio.6D7-EAC-F1B	lsass.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Novosibirsk.6D7-EAC-F1B	lsass.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\Paris	lsass.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_browser.gif.6D7-EAC-F1B	lsass.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\RPLBRF35.CHM	lsass.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\license.html.6D7-EAC-F1B	lsass.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\Hardware Tracker.fdt	lsass.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsHomePage.html.6D7-EAC-F1B	lsass.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\OutSyncPC.ico	lsass.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport.png	lsass.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Moncton	lsass.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT	lsass.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\meta-index.6D7-EAC-F1B	lsass.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SCDREQS.ICO	lsass.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.commands_0.10.2.v20140424-2344.jar.6D7-EAC-F1B	lsass.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02265_.WMF	lsass.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\MSPUB.DEV_K_COL.HXK	lsass.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Swirl\TAB_OFF.GIF.6D7-EAC-F1B	lsass.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Nassau	lsass.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\ShvlRes.dll.mui	lsass.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Niue	lsass.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.components.ui_5.5.0.165303.jar.6D7-EAC-F1B	lsass.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0287645.JPG	lsass.exe
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\en-US\SpiderSolitaire.exe.mui.6D7-EAC-F1B	lsass.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0309664.JPG	lsass.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsColorChart.html.6D7-EAC-F1B	lsass.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\form_edit.js	lsass.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Slipstream.eftx.6D7-EAC-F1B	lsass.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Sts2.css.6D7-EAC-F1B	lsass.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\ENVELOPE.XML.6D7-EAC-F1B	lsass.exe
File opened for modification	C:\Program Files\Java\jre7\lib\jfr\default.jfc	lsass.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00732_.WMF	lsass.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\RADIO.JPG.6D7-EAC-F1B	lsass.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_Buttongraphic.png	lsass.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0239955.WMF	lsass.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\TR00178_.WMF.6D7-EAC-F1B	lsass.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Desert\HEADER.GIF.6D7-EAC-F1B	lsass.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ja_5.5.0.165303.jar	lsass.exe
File opened for modification	C:\Program Files\Microsoft Games\Hearts\fr-FR\Hearts.exe.mui	lsass.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD10307_.GIF	lsass.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Library\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT	lsass.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGSTORY.XML	lsass.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-back-static.png	lsass.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0153313.WMF.6D7-EAC-F1B	lsass.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0198025.WMF	lsass.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0238959.WMF	lsass.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\MSPUB.DEV_COL.HXT.6D7-EAC-F1B	lsass.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\UnformattedNumeric.jpg.6D7-EAC-F1B	lsass.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\CodeFile.zip	lsass.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

pid	Process
1968	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
576	lsass.exe
576	lsass.exe
576	lsass.exe
576	lsass.exe
576	lsass.exe
576	lsass.exe
576	lsass.exe
576	lsass.exe
576	lsass.exe
576	lsass.exe
576	lsass.exe
576	lsass.exe
576	lsass.exe
576	lsass.exe
576	lsass.exe
576	lsass.exe
576	lsass.exe
576	lsass.exe
576	lsass.exe
576	lsass.exe
576	lsass.exe
576	lsass.exe
576	lsass.exe
576	lsass.exe
576	lsass.exe
576	lsass.exe
576	lsass.exe
576	lsass.exe
576	lsass.exe
576	lsass.exe
576	lsass.exe
576	lsass.exe
576	lsass.exe
576	lsass.exe
576	lsass.exe
576	lsass.exe
576	lsass.exe
576	lsass.exe
576	lsass.exe
576	lsass.exe
576	lsass.exe
576	lsass.exe
576	lsass.exe
576	lsass.exe
576	lsass.exe
576	lsass.exe
576	lsass.exe
576	lsass.exe
576	lsass.exe
576	lsass.exe
576	lsass.exe
576	lsass.exe
576	lsass.exe
576	lsass.exe
576	lsass.exe
576	lsass.exe
576	lsass.exe
576	lsass.exe
576	lsass.exe
576	lsass.exe
576	lsass.exe
576	lsass.exe
576	lsass.exe
576	lsass.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeDebugPrivilege	1712	1.exe
Token: SeDebugPrivilege	1712	1.exe
Token: SeDebugPrivilege	576	lsass.exe
Token: SeIncreaseQuotaPrivilege	804	WMIC.exe
Token: SeSecurityPrivilege	804	WMIC.exe
Token: SeTakeOwnershipPrivilege	804	WMIC.exe
Token: SeLoadDriverPrivilege	804	WMIC.exe
Token: SeSystemProfilePrivilege	804	WMIC.exe
Token: SeSystemtimePrivilege	804	WMIC.exe
Token: SeProfSingleProcessPrivilege	804	WMIC.exe
Token: SeIncBasePriorityPrivilege	804	WMIC.exe
Token: SeCreatePagefilePrivilege	804	WMIC.exe
Token: SeBackupPrivilege	804	WMIC.exe
Token: SeRestorePrivilege	804	WMIC.exe
Token: SeShutdownPrivilege	804	WMIC.exe
Token: SeDebugPrivilege	804	WMIC.exe
Token: SeSystemEnvironmentPrivilege	804	WMIC.exe
Token: SeRemoteShutdownPrivilege	804	WMIC.exe
Token: SeUndockPrivilege	804	WMIC.exe
Token: SeManageVolumePrivilege	804	WMIC.exe
Token: 33	804	WMIC.exe
Token: 34	804	WMIC.exe
Token: 35	804	WMIC.exe
Token: SeIncreaseQuotaPrivilege	804	WMIC.exe
Token: SeSecurityPrivilege	804	WMIC.exe
Token: SeTakeOwnershipPrivilege	804	WMIC.exe
Token: SeLoadDriverPrivilege	804	WMIC.exe
Token: SeSystemProfilePrivilege	804	WMIC.exe
Token: SeSystemtimePrivilege	804	WMIC.exe
Token: SeProfSingleProcessPrivilege	804	WMIC.exe
Token: SeIncBasePriorityPrivilege	804	WMIC.exe
Token: SeCreatePagefilePrivilege	804	WMIC.exe
Token: SeBackupPrivilege	804	WMIC.exe
Token: SeRestorePrivilege	804	WMIC.exe
Token: SeShutdownPrivilege	804	WMIC.exe
Token: SeDebugPrivilege	804	WMIC.exe
Token: SeSystemEnvironmentPrivilege	804	WMIC.exe
Token: SeRemoteShutdownPrivilege	804	WMIC.exe
Token: SeUndockPrivilege	804	WMIC.exe
Token: SeManageVolumePrivilege	804	WMIC.exe
Token: 33	804	WMIC.exe
Token: 34	804	WMIC.exe
Token: 35	804	WMIC.exe
Token: SeBackupPrivilege	2036	vssvc.exe
Token: SeRestorePrivilege	2036	vssvc.exe
Token: SeAuditPrivilege	2036	vssvc.exe
Token: SeDebugPrivilege	576	lsass.exe
Token: SeDebugPrivilege	576	lsass.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 576	1712	1.exe	26
PID 1712 wrote to memory of 576	1712	1.exe	26
PID 1712 wrote to memory of 576	1712	1.exe	26
PID 1712 wrote to memory of 576	1712	1.exe	26
PID 1712 wrote to memory of 1200	1712	1.exe	27
PID 1712 wrote to memory of 1200	1712	1.exe	27
PID 1712 wrote to memory of 1200	1712	1.exe	27
PID 1712 wrote to memory of 1200	1712	1.exe	27
PID 1712 wrote to memory of 1200	1712	1.exe	27
PID 1712 wrote to memory of 1200	1712	1.exe	27
PID 1712 wrote to memory of 1200	1712	1.exe	27
PID 576 wrote to memory of 2008	576	lsass.exe	28
PID 576 wrote to memory of 2008	576	lsass.exe	28
PID 576 wrote to memory of 2008	576	lsass.exe	28
PID 576 wrote to memory of 2008	576	lsass.exe	28
PID 576 wrote to memory of 948	576	lsass.exe	30
PID 576 wrote to memory of 948	576	lsass.exe	30
PID 576 wrote to memory of 948	576	lsass.exe	30
PID 576 wrote to memory of 948	576	lsass.exe	30
PID 576 wrote to memory of 2012	576	lsass.exe	32
PID 576 wrote to memory of 2012	576	lsass.exe	32
PID 576 wrote to memory of 2012	576	lsass.exe	32
PID 576 wrote to memory of 2012	576	lsass.exe	32
PID 576 wrote to memory of 1964	576	lsass.exe	34
PID 576 wrote to memory of 1964	576	lsass.exe	34
PID 576 wrote to memory of 1964	576	lsass.exe	34
PID 576 wrote to memory of 1964	576	lsass.exe	34
PID 576 wrote to memory of 456	576	lsass.exe	36
PID 576 wrote to memory of 456	576	lsass.exe	36
PID 576 wrote to memory of 456	576	lsass.exe	36
PID 576 wrote to memory of 456	576	lsass.exe	36
PID 576 wrote to memory of 1868	576	lsass.exe	38
PID 576 wrote to memory of 1868	576	lsass.exe	38
PID 576 wrote to memory of 1868	576	lsass.exe	38
PID 576 wrote to memory of 1868	576	lsass.exe	38
PID 576 wrote to memory of 1504	576	lsass.exe	40
PID 576 wrote to memory of 1504	576	lsass.exe	40
PID 576 wrote to memory of 1504	576	lsass.exe	40
PID 576 wrote to memory of 1504	576	lsass.exe	40
PID 1504 wrote to memory of 804	1504	cmd.exe	42
PID 1504 wrote to memory of 804	1504	cmd.exe	42
PID 1504 wrote to memory of 804	1504	cmd.exe	42
PID 1504 wrote to memory of 804	1504	cmd.exe	42
PID 576 wrote to memory of 568	576	lsass.exe	45
PID 576 wrote to memory of 568	576	lsass.exe	45
PID 576 wrote to memory of 568	576	lsass.exe	45
PID 576 wrote to memory of 568	576	lsass.exe	45
PID 568 wrote to memory of 1968	568	cmd.exe	47
PID 568 wrote to memory of 1968	568	cmd.exe	47
PID 568 wrote to memory of 1968	568	cmd.exe	47
PID 568 wrote to memory of 1968	568	cmd.exe	47
PID 576 wrote to memory of 628	576	lsass.exe	48
PID 576 wrote to memory of 628	576	lsass.exe	48
PID 576 wrote to memory of 628	576	lsass.exe	48
PID 576 wrote to memory of 628	576	lsass.exe	48
PID 576 wrote to memory of 1752	576	lsass.exe	49
PID 576 wrote to memory of 1752	576	lsass.exe	49
PID 576 wrote to memory of 1752	576	lsass.exe	49
PID 576 wrote to memory of 1752	576	lsass.exe	49
PID 576 wrote to memory of 1752	576	lsass.exe	49
PID 576 wrote to memory of 1752	576	lsass.exe	49
PID 576 wrote to memory of 1752	576	lsass.exe	49

C:\Users\Admin\AppData\Local\Temp\1.exe
"C:\Users\Admin\AppData\Local\Temp\1.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe" -start
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:576
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    PID:2008
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} recoveryenabled no
    3⤵
    PID:948
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C wbadmin delete catalog -quiet
    3⤵
    PID:2012
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C wbadmin delete systemstatebackup
    3⤵
    PID:1964
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C wbadmin delete systemstatebackup -keepversions:0
    3⤵
    PID:456
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C wbadmin delete backup
    3⤵
    PID:1868
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C wmic shadowcopy delete
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1504
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic shadowcopy delete
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:804
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C vssadmin delete shadows /all /quiet
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:568
  - - C:\Windows\SysWOW64\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:1968
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe" -agent 0
    3⤵
    - Executes dropped EXE
    - Modifies extensions of user files
    - Drops file in Program Files directory
    PID:628
- - C:\Windows\SysWOW64\notepad.exe
    notepad.exe
    3⤵
    PID:1752
- C:\Windows\SysWOW64\notepad.exe
  notepad.exe
  2⤵
  - Deletes itself
  PID:1200

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2036

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

File Deletion

T1107

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe

Filesize
211KB

MD5
102f05cffa7d4ac4b7f02f38e6df632c

SHA1
9f4077164fe67ce25d0e64e4bd5e1ab6c95695de

SHA256
feeca43d32c8d2ad551298812ba8439dee19f0dcd1f0f568dfe1690bef5eba62

SHA512
b9f60951c2dd051a4be77cc7efa2355e4978543389fb50b433500928161d6c9cca6781532bb9a622d4ac107dcd5a24c35ebff722419ea0bf14350ff4fa53130e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe

Filesize
211KB

MD5
102f05cffa7d4ac4b7f02f38e6df632c

SHA1
9f4077164fe67ce25d0e64e4bd5e1ab6c95695de

SHA256
feeca43d32c8d2ad551298812ba8439dee19f0dcd1f0f568dfe1690bef5eba62

SHA512
b9f60951c2dd051a4be77cc7efa2355e4978543389fb50b433500928161d6c9cca6781532bb9a622d4ac107dcd5a24c35ebff722419ea0bf14350ff4fa53130e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe

Filesize
211KB

MD5
102f05cffa7d4ac4b7f02f38e6df632c

SHA1
9f4077164fe67ce25d0e64e4bd5e1ab6c95695de

SHA256
feeca43d32c8d2ad551298812ba8439dee19f0dcd1f0f568dfe1690bef5eba62

SHA512
b9f60951c2dd051a4be77cc7efa2355e4978543389fb50b433500928161d6c9cca6781532bb9a622d4ac107dcd5a24c35ebff722419ea0bf14350ff4fa53130e

Download Submit
C:\Users\Admin\Desktop\AddEdit.avi.6D7-EAC-F1B

Filesize
619KB

MD5
43ff4913e2615179e94c38862bea246f

SHA1
adb88b0a1692af6f568d0c4848998e6cf2ba7568

SHA256
43d0f5a67bc88c629c3e0815aedda2bb63a61a2e5589fed92a939b331bb839a9

SHA512
5ce5b40db85c27a968d76a8987ad1881564e1c23d6f16b7dcc3ce5fe21e2a5d5c679c662169f3d849af3f231f87f2212c31d9a583f9dce0b6b0568bfdff67c68

Download Submit
C:\Users\Admin\Desktop\BackupJoin.xml.6D7-EAC-F1B

Filesize
664KB

MD5
368384652d310cbeb8c2d8aabbea0efd

SHA1
b39cc952d7fbc7db5313c4ada0e0acf9b4626438

SHA256
dcc7d0b25a63c8206c93a8f3bc280fad4f45b27e9c794e6b3b7b74336a5a93b4

SHA512
9940f149202c7b3aedffc73d05179175ffc7ca7f0fe0235665041a5483b115c546d9df653fa320e50ed9b32f7d7315a182052fde16742eb2b301fd9aa054221f

Download Submit
C:\Users\Admin\Desktop\BackupUndo.php.6D7-EAC-F1B

Filesize
799KB

MD5
afaa4cae61929a9906b41cfa7e26bd38

SHA1
8d61539f034b0a7b6ff6e4fc92557b2214ce0182

SHA256
e4aa38dfc3fe64daf1ae04a585b81d62e6a610ecce8b58612c44ba158a2fee0e

SHA512
c0dc2bed0facca2c512f73d919a6e87df4b23c9a76c7512c8b41e7afdc05384957429656a4c2627cabf49f75edf86411e97b3c367cca655f029a55a9db973cc1

Download Submit
C:\Users\Admin\Desktop\BlockExpand.dotx.6D7-EAC-F1B

Filesize
754KB

MD5
cee3c31848e4e6baa0c7cb127e91465c

SHA1
04e6efe3924ec086e65797caa278d3f38eb9bef5

SHA256
58b9da742157fea8dbee1ee5cb105e6e3d8075a636e5446711dcdff537f2e0ab

SHA512
25d67d5e679228f8da7311a407a20bd7410b28b3e5506d22bed30af5682818cde75708bfa7acfb9f401d6120179006004749dc39d45b76db8bcc523053486469

Download Submit
C:\Users\Admin\Desktop\CompareRemove.html.6D7-EAC-F1B

Filesize
417KB

MD5
f3c903515cca0022031d19edf00314b5

SHA1
f599a5d6248b08dac1e12b104cd66242a2f5bdb7

SHA256
be3ee914c8483b2cf74456dbc555068e0a79f4231017bc01af229aee6f8df1e6

SHA512
f847c459d7822a85e9033464bf1c0a184489feecf5adbba5d9209f5f2eb0789c78774a6de8c04f4fdfbc199ba63e71d8bd766e1c18e780a7f2800d1b152359d5

Download Submit
C:\Users\Admin\Desktop\ConfirmClear.zip.6D7-EAC-F1B

Filesize
462KB

MD5
750ec8bf1a04ebd3dfe08f64c85cdc83

SHA1
fdd977ea7f0a7a1d57835e4297038b3514c3cc82

SHA256
dbf48afe80637f0b70ac57ea97eb57b7515c065cac7dede3bb3d3d1fc4a680ad

SHA512
51f318e298102e0dc06fff6359c7687c32fd38c7cde6fe942c17d19cca9657507ec22c9378cfbfd21f4e632c751758b5542dedc12ee72e69715560bb5c6e20e9

Download Submit
C:\Users\Admin\Desktop\ConvertInitialize.mhtml.6D7-EAC-F1B

Filesize
439KB

MD5
20cd8c14dc2a0830665be5d2bcd5a8eb

SHA1
c2377c891f023bb7d7690c845c658f4da4dc27fc

SHA256
5a3a07bf8a944c3d3a7066c5a4653180f20a5bb70c3dba7c2d17f1072d6e536b

SHA512
9ca35608ac100e7f671876066aea80699ae773eaa37f34ddff584aff17def5b8ac402ce545c072a2a1b31a6bdb261acaf8a86cd9e3f76f80d734a9038cd49816

Download Submit
C:\Users\Admin\Desktop\CopySubmit.vsx.6D7-EAC-F1B

Filesize
642KB

MD5
7f695659ef79b7e21ec9cc5f52b07666

SHA1
238417fedc5617f3a452f9778d2eeb35562f8af4

SHA256
e12a961068170ac430e60d51e0a1f5f37b0344df14b29ff17116191b49961e40

SHA512
70dbf27d547b6944f5c1bfff7179da8e89182baa70e48751f93f8104103449aa3ed5cc37932b459250ff51ea3d3b82f4f1c4b8d5f681085d344c00677490392c

Download Submit
C:\Users\Admin\Desktop\DismountBackup.txt.6D7-EAC-F1B

Filesize
552KB

MD5
1fc23cf38add9bdd0b06f8fdefe2bf84

SHA1
34c4013fefc1d257d590cb97c9502476a820e9c7

SHA256
7d19ceb8a15542f54c46a3df4ea396f03e2cf8087a7a15f9e43953801cb3ac3f

SHA512
94ec1ed0723514b1b97608ea66227e4bb7583b6737f542a06ec3a54891eb879bb8707f58b395c7fb408e4f892b46e895bbf3ebfb22841b1c75f4915b0a78042e

Download Submit
C:\Users\Admin\Desktop\EditMount.3gp2.6D7-EAC-F1B

Filesize
709KB

MD5
98792de5ea0f88f4d00169e2b87159f9

SHA1
04e630f792a216ef87f1952af9e2719fdf52616c

SHA256
5c6b0ad2b249d02bfd1b0af1be4169971703784fae05b1296106d6db5ad0b071

SHA512
449c0374ae000e5693888997a6208e370c1067d0e7ca6e95169ebdd2982f11e9ddd2ee47848a46e615794300f46d3964b18bc8f0cfc433ea66aa91b743d57ad7

Download Submit
C:\Users\Admin\Desktop\EditSearch.ps1.6D7-EAC-F1B

Filesize
777KB

MD5
bf34d8986aaa0c5219f0b1c0c81c3aaf

SHA1
a35dce78c57876bb3f70e1a425595e91dec34ce3

SHA256
e7a8ea953384cb3fada5a33ad3ebe449cb560e89a7eb200e82f5cdccea44436f

SHA512
32c81501f1e3e7834c339da5c7f48cb82eefb112181d1ea11684fb34a68eac386dbb5a77eb7996d100d06f05c4cdcba5d024dee1dd5b44badffddac15af129e0

Download Submit
C:\Users\Admin\Desktop\EnterPush.vb.6D7-EAC-F1B

Filesize
372KB

MD5
70db01bf3ac5b504e945c2f07777391d

SHA1
fd9977bebd4dbfda2bc4fc0fff3e26fe01f897df

SHA256
856ebd88f2c6529eb1c517e678272501fcecbd1e48ab3cc7275fccd2d7438141

SHA512
cb09aebf9353e365725e9a112bad472f4287ac838bc806f41ff923e661ba4b2731e3c0b9ce7a8ea70b33456a4722594335be9a6e724d92e0102ef4c91fbdbc9a

Download Submit
C:\Users\Admin\Desktop\ImportSubmit.wmv.6D7-EAC-F1B

Filesize
1.2MB

MD5
dc19d1c1fd3e5dafcfa1366aa6646470

SHA1
3c8fd621ea1290330008bf95f301af192a268329

SHA256
fe70aab6a7b93718d8711d2cb2dee0507305bd799bb995c3f3a67965642fc15f

SHA512
fe2b595e08638275be37022fee00bb1333cd2f5dde23376b2c8d1ee78c98441176953b456ae7166f4dbcdb5d526fa4903de8f640fd1c7b9404bd45e20da57a46

Download Submit
C:\Users\Admin\Desktop\InvokePing.jpg.6D7-EAC-F1B

Filesize
484KB

MD5
4afcd40bc70b93041c5b5634468f5f95

SHA1
d91474b88ec2c24d4d11e7690dfc7f6835cfe1ba

SHA256
80c460ffb7ed470b443e524065c4eb26315b367000a5eeedf1bd2cec0e68b508

SHA512
596385ab21a50318b20710556a7e1cab2edcfbf104beda0528bf45e87004d509c77922f45d85f3d582065a59a4f14139f466f0352738994a38262340223f77ec

Download Submit
C:\Users\Admin\Desktop\LockOut.odt.6D7-EAC-F1B

Filesize
732KB

MD5
d531539f1c715c65e5eb651ae762c08b

SHA1
2e1f0e23158ec0b2ec269ff2f358139be25aeaeb

SHA256
7af8de7aa42c92730503ae28cd4af991a141f14ed867f784e27e2ebbdc2f8742

SHA512
6e4bb26bd258ef74154ba2f5e84de0b281de1bf9e4fdfeac8391702233df98e98b550887af6c30d40911905ad8fa5c46db65ad2b2947721deaa3fb24fa4e10ff

Download Submit
C:\Users\Admin\Desktop\MountPing.ppt.6D7-EAC-F1B

Filesize
394KB

MD5
295d25a13c295e243628837b6c3c2570

SHA1
998f8e2842921849a2f5ca4b16d6ee5d914cd304

SHA256
627ac104504670c52fc175bf2bd94d023ce450d7b5498a0cc4c8985e4f0a79a4

SHA512
e742c17d438c7c1f82f6da90293812557ff97120fcdb980e896ad84af5c4ba4896e4418f7c544e6632bb7d1fe9521d2e05db995d62b32595a55ff3da0616352d

Download Submit
C:\Users\Admin\Desktop\OutInstall.ods.6D7-EAC-F1B

Filesize
844KB

MD5
6345ad86bdeaa2c4c22c9244791b8ff5

SHA1
f864d5270bc37332e14894329078189aef6f883b

SHA256
14aafbae55ee6bf0297d47280a9764e57705640549fe9c665378a50913ec9adf

SHA512
d3bea8e3c23050e185d49ec6bd841c5d36870a5ac219d13c50a81fc607dcb14b904bd5453ee5662fa2255a6e342dd6abc41e0d234e081f87d72a6199057fb558

Download Submit
C:\Users\Admin\Desktop\ProtectBlock.jfif.6D7-EAC-F1B

Filesize
866KB

MD5
348ce9c3b1ebece851f760333e9858bc

SHA1
474408def76d94bf18edbc36fc949a02d4d48f0b

SHA256
f8b9e125dc7a66ad3cce67cd66ee8d163b793e4e60701fb2b67d7ce3c601a061

SHA512
b7d79b064e9a3818a153461f9be5e38eb05f922f732af0ce60ae0467298a9bdedad4cd3e4aa6ee534b78b5ef41f47237a90e02538a01a5f674cf2f50fdc12094

Download Submit
C:\Users\Admin\Desktop\PublishSync.htm.6D7-EAC-F1B

Filesize
687KB

MD5
ed951eb1523d8d43105d381c590fc446

SHA1
4be3bab69c2e00514f90661932105d2286ba367a

SHA256
5508a5ec74dda0b2b19193e226e2089438ef38ab247a84f339fa24995e507362

SHA512
645b020484c7a5e89cc8b8b002f68734e848153d75eade08b889b6b34c808125a69e9f41f50b860efdb5c67545a4c01cf343305205a6f36f37e28718050b1814

Download Submit
C:\Users\Admin\Desktop\RedoBlock.mht.6D7-EAC-F1B

Filesize
507KB

MD5
92dd33ef8196ce91e4198a6d94157fa0

SHA1
1a2d3c06c1ca553ec9cd4f9133324a525c5a3a00

SHA256
332a91cfccd56faf9ee74ff6533fdebe19380f61bb3c18930746477ffe908542

SHA512
a223c40df5b8d6d366737de27223d59b7ecf8c10f768494859de95497fabd70caf3b1ae449023ae51f8c07b1cb12891a90951ee3848146238fdef2cdc2b81b56

Download Submit
C:\Users\Admin\Desktop\RenameDebug.pdf.6D7-EAC-F1B

Filesize
305KB

MD5
a9d97384aef94343bd1b46c3ea87ba61

SHA1
d66b575d6acf24e5d17d480b41743a210636bdba

SHA256
6e22eba07943cef31523ac903a7c5f389437ab765838c3cf2e5511bbb94589cb

SHA512
b605d1eb21d4ea1a70ae0b42613065759e2845baec72e4dc5b458d67c0ceb9fbfc647412b2b47ceff5dcc54a6f4ede65e5e965a6126e72d9430357e9f3b712c0

Download Submit
C:\Users\Admin\Desktop\RestoreGrant.tiff.6D7-EAC-F1B

Filesize
821KB

MD5
b0e7f18f919d4113a2fb3781486546c3

SHA1
f4357d4ae3e468cb542f1a31cf3cfc49ea47c587

SHA256
ee9c79956b41f48ae0df900cd5bc3e0a35a567940ce36fc008424cb8f1506f9a

SHA512
441b8295efcb6c4938cddb79faff75df6850932616ac2219067d8c2114125aff0e7482e5ee2281bfd5f2c2988def48d2ef9d698947109768d2b0e231c61c1d3c

Download Submit
C:\Users\Admin\Desktop\SendEnter.cr2.6D7-EAC-F1B

Filesize
574KB

MD5
89d87c98d9b7823c92f7d9e0ccb86c11

SHA1
fcb5bfa4045c756fe70eec378bfe4b762cf1ba09

SHA256
a9eda86cfeae36785a1b899f58c27706ae37defa88465eb4fe6759cd82b8392f

SHA512
a44ada322f306661ddd34d8d396165f47e39568650d3f43e7028f2d9b1d8c8d8c6498c76cf686314f5af92c579b42ac07a0498f1d8c23035ec8b9d3969fa5aa0

Download Submit
C:\Users\Admin\Desktop\SkipCompress.wdp.6D7-EAC-F1B

Filesize
597KB

MD5
7c440e6877e2ea14444c8512e1ad8e10

SHA1
309516dc07b54c014675b7866dcfa74f26461b96

SHA256
6b454c0844bc73209edd1e8d9dfdc0060352eba3bdc7ed7436c94309b67f1648

SHA512
ec325c44ee4c974875b77f03c7730134d9f86a197f422f8c29a8eeb5feb1b26a5f29ba3dce1a66cd39b44c194cf4c7820f29ea86dfca07cc30afca7da0702a11

Download Submit
C:\Users\Admin\Desktop\UndoReset.css.6D7-EAC-F1B

Filesize
327KB

MD5
2163717301061c4a6affa3df54e6799e

SHA1
89ba0f42be36343fd4e419c1d411f45e914c89b4

SHA256
6f2fbd2f0a2afe2d5ea95653e283c3850adabe0e6cdc48586fa1ff636f0f6cea

SHA512
5dce6ddc205092e4fb2ab17e42dd81c1863e7517c20eb1dbdbcb92f0fd6278ddc32fdda5956d832e408f3add9ffda1f520444e23cff75b25755de45df02a08e4

Download Submit
C:\Users\Admin\Desktop\UnregisterClear.csv.6D7-EAC-F1B

Filesize
529KB

MD5
e06b7c6fa466b66efe5a0dc8d9e7f9fb

SHA1
f55062c6a6e4b1133891f6fb99e682f75660513d

SHA256
059564987700461dedf1c667ccd03f5860c426838aa586c64efb187e410bc886

SHA512
1b8c93837bf4a823a9c4ae3345d8785dd6f09d603649ede8476e4bad355cd9571d3069fa07f2d3b03d28f9fe3b2e7f05cee073440f46565da95994569d1c53e3

Download Submit
C:\Users\Admin\Desktop\UseUndo.m3u.6D7-EAC-F1B

Filesize
350KB

MD5
fd5d471f60d58b6eb6f121455fcbfc55

SHA1
c96444b0b38322608ec97e442141e85c8acac35b

SHA256
6a81dfd923507ad191c4770a118723572bfea42becca82c58623666606a6684f

SHA512
5930b35e426447c43022ecc2e24cf48a1e71c204ea2da8648a7acaac0cebbed01ef1e42996440b28056ec90408db2d34b485b8b5bfe4b5dbbd4e9917d820c655

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe

Filesize
211KB

MD5
102f05cffa7d4ac4b7f02f38e6df632c

SHA1
9f4077164fe67ce25d0e64e4bd5e1ab6c95695de

SHA256
feeca43d32c8d2ad551298812ba8439dee19f0dcd1f0f568dfe1690bef5eba62

SHA512
b9f60951c2dd051a4be77cc7efa2355e4978543389fb50b433500928161d6c9cca6781532bb9a622d4ac107dcd5a24c35ebff722419ea0bf14350ff4fa53130e

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe

Filesize
211KB

MD5
102f05cffa7d4ac4b7f02f38e6df632c

SHA1
9f4077164fe67ce25d0e64e4bd5e1ab6c95695de

SHA256
feeca43d32c8d2ad551298812ba8439dee19f0dcd1f0f568dfe1690bef5eba62

SHA512
b9f60951c2dd051a4be77cc7efa2355e4978543389fb50b433500928161d6c9cca6781532bb9a622d4ac107dcd5a24c35ebff722419ea0bf14350ff4fa53130e

Download Submit
memory/1712-54-0x00000000762B1000-0x00000000762B3000-memory.dmp

Filesize
8KB

Download