Overview

overview

10

Static

static

10

2023-08-26...JC.exe

windows7-x64

10

2023-08-26...JC.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    165s
  • max time network
    175s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-10-2023 17:59

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2023-08-26_51e3c1e8f1e4bb84098cc6f86092aa51_zeppelin_JC.exe

  • Size

    211KB

  • MD5

    51e3c1e8f1e4bb84098cc6f86092aa51

  • SHA1

    d0dd5aa280c4db736aa1130d54cb8e8bd4830ccb

  • SHA256

    d7cece314f0c504bdb7f097718c4d66e4e5132016c83d9fbffb82528f440b13c

  • SHA512

    f6f274b7bfb91050f98a5190aac5790dc3d8d46b147f4200a993015442234c630a425b9800e2758aab4de5d554cf793d1ee529de3cafbf052fa29a05efe73080

  • SSDEEP

    6144:yia1gMHOPDWIhID8X/4DQFu/U3buRKlemZ9DnGAetTsB+7o+:yIMH06cID84DQFu/U3buRKlemZ9DnGAI

Score
10/10
buranzeppelinpersistenceransomware

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Lang\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT

Family

buran

Ransom Note
!!! ALL YOUR FILES ARE ENCRYPTED !!! All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. To be sure we have the decryptor and it works you can send an email: [email protected] and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? Write to email: [email protected] Reserved email: [email protected] Your personal ID: 1A2-B51-0DD Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Signatures

  • Buran

    Ransomware-as-a-service based on the VegaLocker family first identified in 2019.

    ransomwareburan
  • Detects Zeppelin payload 18 IoCs
  • Zeppelin Ransomware

    Ransomware-as-a-service (RaaS) written in Delphi and first seen in 2019.

    ransomwarezeppelin
  • Renames multiple (2497) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2023-08-26_51e3c1e8f1e4bb84098cc6f86092aa51_zeppelin_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\2023-08-26_51e3c1e8f1e4bb84098cc6f86092aa51_zeppelin_JC.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2036
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\services.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\services.exe" -start
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Suspicious use of WriteProcessMemory
      PID:4336
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\services.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\services.exe" -agent 0
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        PID:524
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\services.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\services.exe" -agent 1
        3⤵
        • Executes dropped EXE
        PID:2544
    • C:\Windows\SysWOW64\notepad.exe
      notepad.exe
      2⤵
        PID:2004

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\7-Zip\Lang\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT
      Filesize

      943B

      MD5

      8712c051889f6a05b81917f08addeeaa

      SHA1

      39ea73ab29fe2d77cf11fcf8b0e090339a0e1090

      SHA256

      5316aaf09a6ae9f8f2e6f150e42b2a23c6ba78ef87327403d0319feae018ac13

      SHA512

      5f5676c9ada1a4b6e915c58870e8ff4e2bf5cc106e68095a0fd3bc61de5419968771897db77ecc66227d82116b252cc40c588a49377cc2199379d1e5f29331b5

      Download Submit

    • C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\eclipse_update_120.jpg
      Filesize

      22KB

      MD5

      fc65fa3b536a0ceea134a1eb15187555

      SHA1

      66c3706ade32a95100411cff9479821f8ada0158

      SHA256

      7d80c82f1ee69ffcaec3f7a1b6a27a7f63c92e86ad8159afcfabda6a0f536102

      SHA512

      b9303fb1d81978e8a015e5c724d69f9749c77fb13974cc162c45be0a9f13f08d5467dfc02455667faa01b6862e652d829ad1341ff9c42caa0fec587f95415818

      Download Submit

    • C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\epl-v10.html
      Filesize

      17KB

      MD5

      a0bf03ffd75bde799658d7bcf631381a

      SHA1

      a7cf6bec4160e70207f6a5ccd2497103097b1f4b

      SHA256

      297609525950aeae11211bcf22a7dd5aa6ed318b3b927af259f4efb929668667

      SHA512

      328dce8102c591724eb536aeeb7569ef04e03dd31e8e8026e39c06c5e9578d1303feebc9989932724bb56370f646f02cd5ea0cf42fa74e2a2cc39dbe70a4b669

      Download Submit

    • C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\feature.properties
      Filesize

      7KB

      MD5

      7bad6207bcd2c4dbf059a695f3d8ccd3

      SHA1

      b20f03cc32749137343eeb0cb2ec142fa29fc824

      SHA256

      145043bceebd2aef114dab0175aa088781735868f9b44a21878eaea291c88b9c

      SHA512

      6555452cf76efc97ad8415c328adb72f2ecef0cac26abe463cf277efd31f48b941987c6b7c98b9233d6bb4aa173c200ba7b264bea3eea1e957f956f99110ca6c

      Download Submit

    • C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\epl-v10.html
      Filesize

      13KB

      MD5

      32210e71a9f5bd31480286dfd7e0e14e

      SHA1

      7b9001ec5d3d0484e489ef85633f00b35ddb2b1a

      SHA256

      243e00a322561c58d15e1f183844ee48c564e34dfe53df1f81821cad75cf1390

      SHA512

      254d5320416dd5dd6f25eee0689360d692da272b4d6236fb86416072d0dfe87412cc23dccf94becd1d69969e6a9f825618360d51be5bd4bad8feef66b4c19b8a

      Download Submit

    • C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\license.html
      Filesize

      10KB

      MD5

      b6051a9f5aa2bf3cc08a34fe85191c7b

      SHA1

      0c7df072d63eb38a4ce7ff63ba22d400da45848e

      SHA256

      081a08f50a5b07422e4e1e52b700fb91778838d4a6416813e755bca7b808d19a

      SHA512

      de5e25ad0ca4309554de9cb3afae2686366724cc765d955eb3f4317d52ecf25d76762cdbeb86bf4ce6023711ca739dc392b5b70c297c741fc82705941306df51

      Download Submit

    • C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\epl-v10.html
      Filesize

      13KB

      MD5

      8dd3f7c942db69737a4074e9e21cdad8

      SHA1

      2c4d716dcc5e9f1a32bf230ed5e26e875d73635a

      SHA256

      ddd7bab39b64144a9f477293871ed1b11f8c26fab42d10fc4182863c0d255fa7

      SHA512

      7909f5758d657e11aedcf0c024a6d32af309e89e9870870bf2bbf9f054abba2a43ec39decd7cc11290708ac40f4e8545c25337a0ca960228a010a08b805910d8

      Download Submit

    • C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\license.html
      Filesize

      10KB

      MD5

      a8d38a81231ad157a17e0671ab39d62f

      SHA1

      b7892d38b9d9a0896bd6aaab0a741ae4a4b80f39

      SHA256

      bfd0d6d32fe502e3fe52514aa12c3b496a5037374cac4f67361541183f14144e

      SHA512

      f4879a896caae050cde38260956c121ee7feb03700614732382d746e2fdc736aa073515a748d50b06a1ed3d5fe69c9995d06363e7d6d27d5ebde4c80f945c2d5

      Download Submit

    • C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\epl-v10.html
      Filesize

      13KB

      MD5

      b9410950fdc26a0840b279fe35f7cc6a

      SHA1

      8c622acf3a6dc9ba59ce6c12767332f9b0ef1b4f

      SHA256

      c0919b76c23826561d61036270302071cb81af63e7d846e4ffcc5263ca7cd04b

      SHA512

      9514dfa3a1fb4b419c5af8705e770afba297765163c1661c7cd617c17e797e9d7b593136069a244c2c5809c93a2bf36017593334bca191f3b17c45d5c8a1320c

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\services.exe
      Filesize

      211KB

      MD5

      51e3c1e8f1e4bb84098cc6f86092aa51

      SHA1

      d0dd5aa280c4db736aa1130d54cb8e8bd4830ccb

      SHA256

      d7cece314f0c504bdb7f097718c4d66e4e5132016c83d9fbffb82528f440b13c

      SHA512

      f6f274b7bfb91050f98a5190aac5790dc3d8d46b147f4200a993015442234c630a425b9800e2758aab4de5d554cf793d1ee529de3cafbf052fa29a05efe73080

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\services.exe
      Filesize

      211KB

      MD5

      51e3c1e8f1e4bb84098cc6f86092aa51

      SHA1

      d0dd5aa280c4db736aa1130d54cb8e8bd4830ccb

      SHA256

      d7cece314f0c504bdb7f097718c4d66e4e5132016c83d9fbffb82528f440b13c

      SHA512

      f6f274b7bfb91050f98a5190aac5790dc3d8d46b147f4200a993015442234c630a425b9800e2758aab4de5d554cf793d1ee529de3cafbf052fa29a05efe73080

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\services.exe
      Filesize

      211KB

      MD5

      51e3c1e8f1e4bb84098cc6f86092aa51

      SHA1

      d0dd5aa280c4db736aa1130d54cb8e8bd4830ccb

      SHA256

      d7cece314f0c504bdb7f097718c4d66e4e5132016c83d9fbffb82528f440b13c

      SHA512

      f6f274b7bfb91050f98a5190aac5790dc3d8d46b147f4200a993015442234c630a425b9800e2758aab4de5d554cf793d1ee529de3cafbf052fa29a05efe73080

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\services.exe
      Filesize

      211KB

      MD5

      51e3c1e8f1e4bb84098cc6f86092aa51

      SHA1

      d0dd5aa280c4db736aa1130d54cb8e8bd4830ccb

      SHA256

      d7cece314f0c504bdb7f097718c4d66e4e5132016c83d9fbffb82528f440b13c

      SHA512

      f6f274b7bfb91050f98a5190aac5790dc3d8d46b147f4200a993015442234c630a425b9800e2758aab4de5d554cf793d1ee529de3cafbf052fa29a05efe73080

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\services.exe
      Filesize

      211KB

      MD5

      51e3c1e8f1e4bb84098cc6f86092aa51

      SHA1

      d0dd5aa280c4db736aa1130d54cb8e8bd4830ccb

      SHA256

      d7cece314f0c504bdb7f097718c4d66e4e5132016c83d9fbffb82528f440b13c

      SHA512

      f6f274b7bfb91050f98a5190aac5790dc3d8d46b147f4200a993015442234c630a425b9800e2758aab4de5d554cf793d1ee529de3cafbf052fa29a05efe73080

      Download Submit

    • C:\vcredist2010_x86.log.html
      Filesize

      82KB

      MD5

      c8e3fdde2c33ab19e0b20cc98c14cbfc

      SHA1

      0ffd9bc9792c86c163de98aedb65e08869cbd364

      SHA256

      a4537570ee20e10258c3f61619efd2a24a5f5430afda36a5658c374a03cbeff9

      SHA512

      8230921aac557d7e315b1e0de50e44a6560ec3e03e7dc4f0f54ea907a5b25a5c4241c133bb3eff8c4aa78d6039a6853199e7a468ff519bf4fa535dcd28e89583

      Download Submit

    • memory/524-3759-0x00000000009D0000-0x0000000000B10000-memory.dmp

      Filesize

      1.2MB

      Download

    • memory/524-4906-0x00000000009D0000-0x0000000000B10000-memory.dmp

      Filesize

      1.2MB

      Download

    • memory/524-10174-0x00000000009D0000-0x0000000000B10000-memory.dmp

      Filesize

      1.2MB

      Download

    • memory/524-1985-0x00000000009D0000-0x0000000000B10000-memory.dmp

      Filesize

      1.2MB

      Download

    • memory/524-7376-0x00000000009D0000-0x0000000000B10000-memory.dmp

      Filesize

      1.2MB

      Download

    • memory/524-768-0x00000000009D0000-0x0000000000B10000-memory.dmp

      Filesize

      1.2MB

      Download

    • memory/524-4926-0x00000000009D0000-0x0000000000B10000-memory.dmp

      Filesize

      1.2MB

      Download

    • memory/524-2961-0x00000000009D0000-0x0000000000B10000-memory.dmp

      Filesize

      1.2MB

      Download

    • memory/524-4493-0x00000000009D0000-0x0000000000B10000-memory.dmp

      Filesize

      1.2MB

      Download

    • memory/2004-11-0x0000000000C30000-0x0000000000C31000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2036-13-0x0000000000340000-0x0000000000480000-memory.dmp

      Filesize

      1.2MB

      Download

    • memory/2544-18-0x00000000009D0000-0x0000000000B10000-memory.dmp

      Filesize

      1.2MB

      Download

    • memory/4336-207-0x00000000009D0000-0x0000000000B10000-memory.dmp

      Filesize

      1.2MB

      Download

    • memory/4336-15-0x00000000009D0000-0x0000000000B10000-memory.dmp

      Filesize

      1.2MB

      Download