Overview

overview

10

Static

static

10

2024-01-02...in.exe

windows7-x64

10

2024-01-02...in.exe

windows10-1703-x64

10

2024-01-02...in.exe

windows10-2004-x64

10

2024-01-02...in.exe

windows11-21h2-x64

10

Resubmissions

03-01-2024 15:08

240103-shylyshgh6 10

03-01-2024 15:05

240103-sf7rvahgf3 10

03-01-2024 15:03

240103-sfclpsfdcq 10

Analysis

  • max time kernel
    89s
  • max time network
    92s
  • platform
    windows11-21h2_x64
  • resource
    win11-20231215-en
  • resource tags

    arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    03-01-2024 15:08

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-01-02_bab201c1a2c8e0f99e683591945e7e3d_zeppelin.exe

  • Size

    211KB

  • MD5

    bab201c1a2c8e0f99e683591945e7e3d

  • SHA1

    90e57172d463dcd6df22d2bf96a6b265a7fdec65

  • SHA256

    88b121f3b3e95e36a642cfdcb0c80f47e4b286e4dbf79b26c923909f4a4f11a4

  • SHA512

    d65bc6b40aa4843cf6a9889bcf47b42c8f5b5548c377bd57a32cb7e2cbe2851e5904c3e1631ec87005243b8e33ec371f599f60964e5c94c856943a1846cccc2a

  • SSDEEP

    6144:jia1gMHOPDWIhID8X/4DQFu/U3buRKlemZ9DnGAetTsB+zY+:jIMH06cID84DQFu/U3buRKlemZ9DnGAs

Score
10/10
buranzeppelinpersistenceransomware

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Lang\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT

Family

buran

Ransom Note
!!! ALL YOUR FILES ARE ENCRYPTED !!! All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. To be sure we have the decryptor and it works you can send an email: [email protected] and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? Write to email: [email protected] Reserved email: [email protected] Your personal ID: 255-807-181 Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Signatures

  • Buran

    Ransomware-as-a-service based on the VegaLocker family first identified in 2019.

    ransomwareburan
  • Detects Zeppelin payload 13 IoCs
  • Zeppelin Ransomware

    Ransomware-as-a-service (RaaS) written in Delphi and first seen in 2019.

    ransomwarezeppelin
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Renames multiple (6057) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-01-02_bab201c1a2c8e0f99e683591945e7e3d_zeppelin.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-01-02_bab201c1a2c8e0f99e683591945e7e3d_zeppelin.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1880
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\TrustedInstaller.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\TrustedInstaller.exe" -start
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1188
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C wmic shadowcopy delete
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:868
        • C:\Windows\SysWOW64\Wbem\WMIC.exe
          wmic shadowcopy delete
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2900
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\TrustedInstaller.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\TrustedInstaller.exe" -agent 1
        3⤵
        • Executes dropped EXE
        PID:3220
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\TrustedInstaller.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\TrustedInstaller.exe" -agent 0
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        PID:692
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C vssadmin delete shadows /all /quiet
        3⤵
          PID:3960
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /C wbadmin delete backup
          3⤵
            PID:2972
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /C wbadmin delete systemstatebackup -keepversions:0
            3⤵
              PID:4064
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /C wbadmin delete systemstatebackup
              3⤵
                PID:4344
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\system32\cmd.exe" /C wbadmin delete catalog -quiet
                3⤵
                  PID:656
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} recoveryenabled no
                  3⤵
                    PID:4088
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
                    3⤵
                      PID:2268
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
                    2⤵
                      PID:1632
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} recoveryenabled no
                      2⤵
                        PID:3244
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\system32\cmd.exe" /C wbadmin delete catalog -quiet
                        2⤵
                          PID:1744
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\system32\cmd.exe" /C wbadmin delete systemstatebackup
                          2⤵
                            PID:3724
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\system32\cmd.exe" /C wbadmin delete systemstatebackup -keepversions:0
                            2⤵
                              PID:616
                            • C:\Windows\SysWOW64\cmd.exe
                              "C:\Windows\system32\cmd.exe" /C wbadmin delete backup
                              2⤵
                                PID:2456
                              • C:\Windows\SysWOW64\cmd.exe
                                "C:\Windows\system32\cmd.exe" /C wmic shadowcopy delete
                                2⤵
                                • Suspicious use of WriteProcessMemory
                                PID:836
                                • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                  wmic shadowcopy delete
                                  3⤵
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:4680
                              • C:\Windows\SysWOW64\cmd.exe
                                "C:\Windows\system32\cmd.exe" /C vssadmin delete shadows /all /quiet
                                2⤵
                                  PID:2256
                                • C:\Users\Admin\AppData\Local\Temp\2024-01-02_bab201c1a2c8e0f99e683591945e7e3d_zeppelin.exe
                                  "C:\Users\Admin\AppData\Local\Temp\2024-01-02_bab201c1a2c8e0f99e683591945e7e3d_zeppelin.exe" -agent 0
                                  2⤵
                                  • Drops file in Program Files directory
                                  PID:3468
                                • C:\Users\Admin\AppData\Local\Temp\2024-01-02_bab201c1a2c8e0f99e683591945e7e3d_zeppelin.exe
                                  "C:\Users\Admin\AppData\Local\Temp\2024-01-02_bab201c1a2c8e0f99e683591945e7e3d_zeppelin.exe" -agent 1
                                  2⤵
                                    PID:232
                                • C:\Windows\system32\vssvc.exe
                                  C:\Windows\system32\vssvc.exe
                                  1⤵
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:3128

                                Network

                                MITRE ATT&CK Enterprise v15

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\DumpStack.log.tmp.255-807-181
                                  Filesize

                                  13KB

                                  MD5

                                  f45f3ff05ff5414985ac9a59cd146e7e

                                  SHA1

                                  ae01be85a7a0bcb0003623764950bb7b51ca75f3

                                  SHA256

                                  8593e1fc6a84293cf45fce2a7275a4ec610c820edc11f85badbbc19e2b14e0e0

                                  SHA512

                                  19233a92adef32410cbbd00fd4b0c9da82b0fbf91c370d93f0db2d61b104ca1e96f48b430c37ba1b1121736a756290dc73da3d0e4f85230c68c4270b9c848351

                                  Download Submit

                                • C:\Program Files\7-Zip\7-zip.chm.255-807-181
                                  Filesize

                                  114KB

                                  MD5

                                  6cb238f3cdcc9579637d67cbeec13d94

                                  SHA1

                                  9285081a3e781fbf330883a5c9280f301abb42dc

                                  SHA256

                                  c9a848ac6666879eb416daf946d7a46d974a481eb1786bc1076f73e8e7ddae8b

                                  SHA512

                                  9d58dc2ff2dcc15867683dea2a70e24fab28266214481aae63f84024ee261a5e2f739317a89a2f69ea8ca2ad6d504d9707fca73b63082a19d4873583dad0d335

                                  Download Submit

                                • C:\Program Files\7-Zip\7z.exe.255-807-181
                                  Filesize

                                  545KB

                                  MD5

                                  5fcea35e970904c0844971f60182bcc7

                                  SHA1

                                  2ae83139af720185900e156efada10daaed6da53

                                  SHA256

                                  5688ab70ef95d408b89a28ce95c8c68fa684c05f1f5f8f7339d8a5bfba3009ee

                                  SHA512

                                  a8f6cb5ff5ee3d6bbc36eb0332f3db9e6f3cb3a83cd4cc1d807aad02f2226add2c4790e70227d2536aa806cf282c791841196c2565994367c01cc9a5a1bb7219

                                  Download Submit

                                • C:\Program Files\7-Zip\Lang\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT
                                  Filesize

                                  936B

                                  MD5

                                  37a2c78dc025197b6fb8827882188c98

                                  SHA1

                                  e162dead5c7b7217bf06b9fe9466aad9721c8dbb

                                  SHA256

                                  7ffa392e2814750b9fc677fa6bada2127cbe4710f85bf9b5f23ff379db6750a0

                                  SHA512

                                  22e85f0982a9ec393db7eb6644281dbe7e10ff51cd1809bfef0316d1385afd3ba15208306d7a999802cebf8b093cc772b8e8dcd8117030d497ee3ab5d7de7f53

                                  Download Submit

                                • C:\Program Files\Microsoft Office\root\Office16\1033\PREVIEWTEMPLATE2.POTX
                                  Filesize

                                  292KB

                                  MD5

                                  3b0f2bfc8fb6d722b1dd5770a5d495de

                                  SHA1

                                  3283c052f879a6bedc779ea7668ab1c37a7378e5

                                  SHA256

                                  bb5938b4c96db059a06ec563a056596eac9a70e0af9d7e657af8aa2bad64930b

                                  SHA512

                                  f6bfd1aef7a52963e1dbe381ea4997fe6a2d8fd8fe91525260978a103ab4b7b7eecfceb6468dc767f7da84fabb079df703816cf9692b94f78136f3984778a39f

                                  Download Submit

                                • C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\osmdp64.msi
                                  Filesize

                                  2.4MB

                                  MD5

                                  b5ab95e5916cd48db23166a6b6a32652

                                  SHA1

                                  4cc3bcb7b114e0cb1a16a78270fbda6ea4053df4

                                  SHA256

                                  2bbeddfe24452da48fc8b958daff518c9c1440512098b850978a0b8b65553281

                                  SHA512

                                  fe99168572bba6de3ae4a0d114c6e6aa86118797817e809d6a598fdc6b59e22c0ce53ce47e4d159fc424a6a6cfc1367c5c368e07b9f0787d9513cc056dd8228c

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\TrustedInstaller.exe
                                  Filesize

                                  211KB

                                  MD5

                                  bab201c1a2c8e0f99e683591945e7e3d

                                  SHA1

                                  90e57172d463dcd6df22d2bf96a6b265a7fdec65

                                  SHA256

                                  88b121f3b3e95e36a642cfdcb0c80f47e4b286e4dbf79b26c923909f4a4f11a4

                                  SHA512

                                  d65bc6b40aa4843cf6a9889bcf47b42c8f5b5548c377bd57a32cb7e2cbe2851e5904c3e1631ec87005243b8e33ec371f599f60964e5c94c856943a1846cccc2a

                                  Download Submit

                                • C:\odt\office2016setup.exe.255-807-181
                                  Filesize

                                  92KB

                                  MD5

                                  87c53c71d8389dcc26cf52f5175b76e3

                                  SHA1

                                  f679546c7b6a72f9ae44b9cafd43939474963347

                                  SHA256

                                  df0109db0776aab6a97543dbe0ae485981b5c463a276ed173cfa95cd1cced7f8

                                  SHA512

                                  4a0995186e694924695019874f13de6aa193cf386dc67b44aacd0b606868de6284d140bb7e0b88f5b81a0fab256992a37b674224ce5c22a90ff45c37b9cad5c4

                                  Download Submit

                                • C:\vcredist2010_x64.log-MSI_vc_red.msi.txt.255-807-181
                                  Filesize

                                  381KB

                                  MD5

                                  de5f559e15ed08150e69b83d06572acd

                                  SHA1

                                  b3cbd7a854374a87ee9482936256f9b911a52cd3

                                  SHA256

                                  aa2465a66996129c8fbb5aec3d30f9100a36d825b8ad0ac2318fedfae2f3485e

                                  SHA512

                                  d70ff852d6c8913d0b9bab27280ea605f359a5abfd1da3571333322afbfe1e01b32cda1198b8a528ef882018ad6a62483222f77747700fc1124567a20a5000ea

                                  Download Submit

                                • C:\vcredist2010_x64.log.html.255-807-181
                                  Filesize

                                  88KB

                                  MD5

                                  cc2227f284ce607722b262dfa7e3a950

                                  SHA1

                                  f39412c2dfe6512be35e5fae1753a90e33e3c97c

                                  SHA256

                                  57a7b94617e9c47f747c6ca7eeecaf664cac0fd52234fe7dcc47deb549929cf1

                                  SHA512

                                  798c1b065c546cf73260b608d26cb8e6d85b9a0f13f988586be3878b5a799bb258711ebc21026950edfd5585aa5f671e388af528ad12bb120ba6303ba526cd9a

                                  Download Submit

                                • C:\vcredist2010_x86.log-MSI_vc_red.msi.txt.255-807-181
                                  Filesize

                                  396KB

                                  MD5

                                  da7d520d67dfae88583aa735d68bc736

                                  SHA1

                                  965acdc5a8754d3afd7a4480c085e8e6567184be

                                  SHA256

                                  b4ca08edef05b4dd03fe4e8f7b8b7a249a725d6af76f95e68658155eb6134d63

                                  SHA512

                                  ecae395ea71295d3fe15e355d58521a75b40107aad730fda31917c3a205c7e389ef8a2219104c7451a85100d2afab1373f7f519cc9e4a4d1e4104aa088d4b261

                                  Download Submit

                                • C:\vcredist2010_x86.log.html
                                  Filesize

                                  83KB

                                  MD5

                                  682457952447a2425fbfcea3518d60c7

                                  SHA1

                                  65b4657d7727a5422b9536b49c3b4c91b054a23d

                                  SHA256

                                  87453b2ceaf8ba4acd62fefddec1d2d9711863f27b7c127c75ed9f24c342382a

                                  SHA512

                                  9780985f2214b6f84ec157899cc7440d6735cab546d8413d8bbbbeabe4f4fa0584e13c47ef63a1af97813fd155d4281b824f02f9d7f312277d40e47bd4bc646a

                                  Download Submit

                                • memory/232-23-0x0000000000230000-0x0000000000370000-memory.dmp

                                  Filesize

                                  1.2MB

                                  Download

                                • memory/692-21878-0x0000000000E20000-0x0000000000F60000-memory.dmp

                                  Filesize

                                  1.2MB

                                  Download

                                • memory/1188-13633-0x0000000000E20000-0x0000000000F60000-memory.dmp

                                  Filesize

                                  1.2MB

                                  Download

                                • memory/1188-13-0x0000000000E20000-0x0000000000F60000-memory.dmp

                                  Filesize

                                  1.2MB

                                  Download

                                • memory/1188-21880-0x0000000000E20000-0x0000000000F60000-memory.dmp

                                  Filesize

                                  1.2MB

                                  Download

                                • memory/1880-6103-0x0000000000230000-0x0000000000370000-memory.dmp

                                  Filesize

                                  1.2MB

                                  Download

                                • memory/1880-21879-0x0000000000230000-0x0000000000370000-memory.dmp

                                  Filesize

                                  1.2MB

                                  Download

                                • memory/1880-12-0x0000000000230000-0x0000000000370000-memory.dmp

                                  Filesize

                                  1.2MB

                                  Download

                                • memory/3220-11780-0x0000000000E20000-0x0000000000F60000-memory.dmp

                                  Filesize

                                  1.2MB

                                  Download

                                • memory/3468-10477-0x0000000000230000-0x0000000000370000-memory.dmp

                                  Filesize

                                  1.2MB

                                  Download

                                • memory/3468-18796-0x0000000000230000-0x0000000000370000-memory.dmp

                                  Filesize

                                  1.2MB

                                  Download

                                • memory/3468-21877-0x0000000000230000-0x0000000000370000-memory.dmp

                                  Filesize

                                  1.2MB

                                  Download