Overview

overview

10

Static

static

3

caa499836c...54.exe

windows7-x64

10

caa499836c...54.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    caa499836c5e5fae87726b57d63cc554

  • Size

    334KB

  • Sample

    240315-gksmyahe2w

  • MD5

    caa499836c5e5fae87726b57d63cc554

  • SHA1

    7a820dd7549516edbf6f333ff2e4b7a21b63da96

  • SHA256

    cacd10b8c69270ec77d67d8b4d7fc1081ca247200e650f93a2a6e1b9c1c85e37

  • SHA512

    e6c8074aa183e407f3054fc07528576379d1980e97f17e7c4c10673c700a0a2af1354eb7484f9b33bebaa7e7fc04a0bcd2831ba6dcaf62da8c461e2672359b10

  • SSDEEP

    6144:igDsJ4kjHjjB0kATn3+65WffjAS0bBU4T3NY20hqYIyse5z:I6kjHjF0dnO6UXjUBPzNNGqJyLt

Score
10/10
buranzeppelinpersistenceransomware

Malware Config

Extracted

Path

C:\$Recycle.Bin\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT

Family

buran

Ransom Note
!!! ALL YOUR FILES ARE ENCRYPTED !!! All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. PAY FAST 590$=0.013 btc or the price will increase tomorrow bitcoin address bc1qqxnp9z0ff8x852dyflp5r9r6rzse8jl5hzmqz8 To be sure we have the decryptor and it works you can send an email: payfast290@mail2tor.com and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? payfast290@mail2tor.com TELEGRAM @ payfast290 Your personal ID: 153-CFD-14C Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Extracted

Path

C:\$Recycle.Bin\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT

Family

buran

Ransom Note
!!! ALL YOUR FILES ARE ENCRYPTED !!! All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. PAY FAST 590$=0.013 btc or the price will increase tomorrow bitcoin address bc1qqxnp9z0ff8x852dyflp5r9r6rzse8jl5hzmqz8 To be sure we have the decryptor and it works you can send an email: payfast290@mail2tor.com and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? payfast290@mail2tor.com TELEGRAM @ payfast290 Your personal ID: 123-8C2-07E Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Targets

    • Target

      caa499836c5e5fae87726b57d63cc554

    • Size

      334KB

    • MD5

      caa499836c5e5fae87726b57d63cc554

    • SHA1

      7a820dd7549516edbf6f333ff2e4b7a21b63da96

    • SHA256

      cacd10b8c69270ec77d67d8b4d7fc1081ca247200e650f93a2a6e1b9c1c85e37

    • SHA512

      e6c8074aa183e407f3054fc07528576379d1980e97f17e7c4c10673c700a0a2af1354eb7484f9b33bebaa7e7fc04a0bcd2831ba6dcaf62da8c461e2672359b10

    • SSDEEP

      6144:igDsJ4kjHjjB0kATn3+65WffjAS0bBU4T3NY20hqYIyse5z:I6kjHjF0dnO6UXjUBPzNNGqJyLt

    Score
    10/10
    buranzeppelinpersistenceransomware

    • Buran

      Ransomware-as-a-service based on the VegaLocker family first identified in 2019.

      ransomwareburan

    • Detects Zeppelin payload

    • Zeppelin Ransomware

      Ransomware-as-a-service (RaaS) written in Delphi and first seen in 2019.

      ransomwarezeppelin

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Renames multiple (7357) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Indicator Removal

2
T1070

File Deletion

2
T1070.004

Modify Registry

2
T1112

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Inhibit System Recovery

2
T1490

Resource Development

Reconnaissance

Tasks