Overview

overview

10

Static

static

bc67b94181...cb.exe

windows7-x64

10

bc67b94181...cb.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    231s
  • max time network
    232s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/11/2022, 05:47

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    bc67b94181dd4d613f3648c25c584aad5226cc1ec1999bd03d550c7f242eb7cb.exe

  • Size

    189KB

  • MD5

    f1ebb4dbdfc6ec7a53bcefabdc7fb6de

  • SHA1

    b76bc50249e7420ac0f4f64e83d1a58da2068eaa

  • SHA256

    bc67b94181dd4d613f3648c25c584aad5226cc1ec1999bd03d550c7f242eb7cb

  • SHA512

    8608689d716fe8ed44348b4382cf4aed67de6dd4a9da2d92a8fcbd731ccf1a7f42e60ce35376ccef81b67414f2f8ea8bbcd3b2054d78f344ad92d1f4f29ca788

  • SSDEEP

    3072:t3blGV9hulKmhbfvjv69vF6nHynNPFW7Lifa81Hh7Gl8emNiq8q/f+2L:t3bq9UlKgPuEyNFWSb1Hg6l8q/ffL

Score
10/10
buranransomware

Malware Config

Extracted

Path

C:\WE CAN RECOVER YOUR DATA.txt

Family

buran

Ransom Note
YOUR FILES ARE ENCRYPTED Your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. To be sure we have the decryptor and it works you can send an email: 1. Visit qtox.github.io 2. Download and install qTOX on your PC. 3. Open it, click "New Profile" and create profile. 4. Click "Add friends" button and search our contact - DA639EF141F3E3C35EA62FF284200C29FA2E7E597EF150FDD526F9891CED372CBB9AB7B8BEC8 and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? Write to email: [email protected] Your personal ID: F2F22DBB Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Signatures

  • Buran

    Ransomware-as-a-service based on the VegaLocker family first identified in 2019.

    ransomwareburan
  • Executes dropped EXE 1 IoCs
  • Modifies extensions of user files 1 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bc67b94181dd4d613f3648c25c584aad5226cc1ec1999bd03d550c7f242eb7cb.exe
    "C:\Users\Admin\AppData\Local\Temp\bc67b94181dd4d613f3648c25c584aad5226cc1ec1999bd03d550c7f242eb7cb.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2024
    • C:\ProgramData\Installed Updates.{D450A8A1-9568-45C7-9C0E-B4F9FB4537BD}\nrnkgirn.exe
      "C:\ProgramData\Installed Updates.{D450A8A1-9568-45C7-9C0E-B4F9FB4537BD}\nrnkgirn.exe"
      2⤵
      • Executes dropped EXE
      • Modifies extensions of user files
      • Checks computer location settings
      • Drops desktop.ini file(s)
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1116
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /C CSCRIPT.EXE //E:JScript "C:\Users\Admin\AppData\Local\Temp\PRNALLRP.SYS"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4640
        • C:\Windows\SysWOW64\cscript.exe
          CSCRIPT.EXE //E:JScript "C:\Users\Admin\AppData\Local\Temp\PRNALLRP.SYS"
          4⤵
            PID:3808
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c for /l %i in (1,1,1000) do (ping -n 2 localhost & del "C:\ProgramData\Installed Updates.{D450A8A1-9568-45C7-9C0E-B4F9FB4537BD}\nrnkgirn.exe" & if not exist "C:\ProgramData\Installed Updates.{D450A8A1-9568-45C7-9C0E-B4F9FB4537BD}\nrnkgirn.exe" exit)
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4728
          • C:\Windows\SysWOW64\PING.EXE
            ping -n 2 localhost
            4⤵
            • Runs ping.exe
            PID:4540
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2360

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\Installed Updates.{D450A8A1-9568-45C7-9C0E-B4F9FB4537BD}\nrnkgirn.exe
      Filesize

      189KB

      MD5

      f1ebb4dbdfc6ec7a53bcefabdc7fb6de

      SHA1

      b76bc50249e7420ac0f4f64e83d1a58da2068eaa

      SHA256

      bc67b94181dd4d613f3648c25c584aad5226cc1ec1999bd03d550c7f242eb7cb

      SHA512

      8608689d716fe8ed44348b4382cf4aed67de6dd4a9da2d92a8fcbd731ccf1a7f42e60ce35376ccef81b67414f2f8ea8bbcd3b2054d78f344ad92d1f4f29ca788

      Download Submit

    • C:\ProgramData\Installed Updates.{D450A8A1-9568-45C7-9C0E-B4F9FB4537BD}\nrnkgirn.exe
      Filesize

      189KB

      MD5

      f1ebb4dbdfc6ec7a53bcefabdc7fb6de

      SHA1

      b76bc50249e7420ac0f4f64e83d1a58da2068eaa

      SHA256

      bc67b94181dd4d613f3648c25c584aad5226cc1ec1999bd03d550c7f242eb7cb

      SHA512

      8608689d716fe8ed44348b4382cf4aed67de6dd4a9da2d92a8fcbd731ccf1a7f42e60ce35376ccef81b67414f2f8ea8bbcd3b2054d78f344ad92d1f4f29ca788

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\PRNALLRP.SYS
      Filesize

      175B

      MD5

      98a1a4dbdf75466df301906093847417

      SHA1

      3e8c7656887496694512e118795f4d28894d8f6e

      SHA256

      7f8367fc0177355741b1def74b2f1d81d99571f674a014896478815c9fb4d3bd

      SHA512

      d61cd7cbc63e28189a800efa46f82c5f4a1e513dc945b65e57d4a79308c04ab86945dd48249190456caa582891377e4e75ba678d4b28c28d4d0656d87d31519b

      Download Submit