Analysis
-
max time kernel
123s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21-10-2024 13:46
Static task
static1
Behavioral task
behavioral1
Sample
encrypter-windows-gui-x86.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
encrypter-windows-gui-x86.exe
Resource
win10v2004-20241007-en
General
-
Target
encrypter-windows-gui-x86.exe
-
Size
104KB
-
MD5
bae8e04226ff74f7c40f9bd2e6e3b4ae
-
SHA1
87ca31acfcb12b6eac57e1fd47926be330a11e03
-
SHA256
cc0680de960f3e1b727b61a42e59f9c282bd8e41fe20146ed191c7f4bf9283a7
-
SHA512
56fa390dd466b36797986bd4ae5ec01fb4717f191e2a0098885a603786c42bceee0f2917b3c961c0b0478d040ef7b0ecfda8504ab254afa2d7688f9a19ebb08f
-
SSDEEP
3072:vufqM7tExy3nGt1yc0bwEIrn/eufCNzxaR6:mfG/yc0bM/eufCNzxaR6
Malware Config
Extracted
C:\Users\README.TXT
buran
Signatures
-
Buran
Ransomware-as-a-service based on the VegaLocker family first identified in 2019.
-
Renames multiple (8941) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: encrypter-windows-gui-x86.exe File opened (read-only) \??\Z: encrypter-windows-gui-x86.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\resources.pri encrypter-windows-gui-x86.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\images\README.TXT encrypter-windows-gui-x86.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ro-ro\README.TXT encrypter-windows-gui-x86.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\jsse.jar encrypter-windows-gui-x86.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.Reporting.AdHoc.Shell.Bootstrapper.xap encrypter-windows-gui-x86.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\typing\bubble\dark.gif encrypter-windows-gui-x86.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe encrypter-windows-gui-x86.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\en-il\README.TXT encrypter-windows-gui-x86.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Pipes.AccessControl.dll encrypter-windows-gui-x86.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteNewNoteWideTile.scale-400.png encrypter-windows-gui-x86.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosLogoExtensions.targetsize-256.png encrypter-windows-gui-x86.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\Programmer.targetsize-24_contrast-black.png encrypter-windows-gui-x86.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\StoreLogo.scale-100_contrast-black.png encrypter-windows-gui-x86.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_targetsize-60_altform-unplated.png encrypter-windows-gui-x86.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\s_opencarat_18.svg encrypter-windows-gui-x86.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\contrast-black\LargeTile.scale-100.png encrypter-windows-gui-x86.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\README.TXT encrypter-windows-gui-x86.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-ppd.xrm-ms encrypter-windows-gui-x86.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Assets\LargeTile.scale-200_contrast-black.png encrypter-windows-gui-x86.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BREEZE\BREEZE.INF encrypter-windows-gui-x86.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-256_altform-unplated_devicefamily-colorfulunplated.png encrypter-windows-gui-x86.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\Assets\PackageLogo.png encrypter-windows-gui-x86.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\PhotosAppList.scale-125.png encrypter-windows-gui-x86.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Lighting\Themes.json encrypter-windows-gui-x86.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\CancelFluent.White.png encrypter-windows-gui-x86.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftEdge.Stable_92.0.902.67_neutral__8wekyb3d8bbwe\AppxManifest.xml encrypter-windows-gui-x86.exe File created C:\Program Files\VideoLAN\VLC\locale\bn_IN\README.TXT encrypter-windows-gui-x86.exe File created C:\Program Files\VideoLAN\VLC\locale\ms\README.TXT encrypter-windows-gui-x86.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\css\main.css encrypter-windows-gui-x86.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.scale-125_contrast-black.png encrypter-windows-gui-x86.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\security\trusted.libraries encrypter-windows-gui-x86.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\ANTQUABI.TTF encrypter-windows-gui-x86.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Comments.aapp encrypter-windows-gui-x86.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerBackgroundTasks.dll encrypter-windows-gui-x86.exe File created C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\README.TXT encrypter-windows-gui-x86.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\fi-fi\README.TXT encrypter-windows-gui-x86.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon.png encrypter-windows-gui-x86.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Voices\beeps\beeps\README.TXT encrypter-windows-gui-x86.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.scale-100.png encrypter-windows-gui-x86.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.targetsize-60.png encrypter-windows-gui-x86.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\create_stream.html encrypter-windows-gui-x86.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe encrypter-windows-gui-x86.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\eu-es\README.TXT encrypter-windows-gui-x86.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Grace-ul-oob.xrm-ms encrypter-windows-gui-x86.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\Store.Purchase\Controls\ProgressControl.xaml encrypter-windows-gui-x86.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\hu-hu\README.TXT encrypter-windows-gui-x86.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Pipes.dll encrypter-windows-gui-x86.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\contrast-black\LargeTile.scale-200.png encrypter-windows-gui-x86.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\pt-br\ui-strings.js encrypter-windows-gui-x86.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml encrypter-windows-gui-x86.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\AppxManifest.xml encrypter-windows-gui-x86.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\nb-no\README.TXT encrypter-windows-gui-x86.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-80.png encrypter-windows-gui-x86.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe.config encrypter-windows-gui-x86.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\eu-es\ui-strings.js encrypter-windows-gui-x86.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ko-kr\README.TXT encrypter-windows-gui-x86.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-125_8wekyb3d8bbwe\resources.pri encrypter-windows-gui-x86.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteNewNoteLargeTile.scale-400.png encrypter-windows-gui-x86.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\SwipeTeachingCalloutImage.layoutdir-RTL.gif encrypter-windows-gui-x86.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Transactions.Local.dll encrypter-windows-gui-x86.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\SmartSelect\RemoveStroke_Illustration.png encrypter-windows-gui-x86.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ul.xrm-ms encrypter-windows-gui-x86.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_KMS_Client_AE-ppd.xrm-ms encrypter-windows-gui-x86.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-64_altform-unplated.png encrypter-windows-gui-x86.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language encrypter-windows-gui-x86.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5064 encrypter-windows-gui-x86.exe 5064 encrypter-windows-gui-x86.exe 5064 encrypter-windows-gui-x86.exe 5064 encrypter-windows-gui-x86.exe 5064 encrypter-windows-gui-x86.exe 5064 encrypter-windows-gui-x86.exe 5064 encrypter-windows-gui-x86.exe 5064 encrypter-windows-gui-x86.exe 5064 encrypter-windows-gui-x86.exe 5064 encrypter-windows-gui-x86.exe 5064 encrypter-windows-gui-x86.exe 5064 encrypter-windows-gui-x86.exe 5064 encrypter-windows-gui-x86.exe 5064 encrypter-windows-gui-x86.exe 5064 encrypter-windows-gui-x86.exe 5064 encrypter-windows-gui-x86.exe 5064 encrypter-windows-gui-x86.exe 5064 encrypter-windows-gui-x86.exe 5064 encrypter-windows-gui-x86.exe 5064 encrypter-windows-gui-x86.exe 5064 encrypter-windows-gui-x86.exe 5064 encrypter-windows-gui-x86.exe 5064 encrypter-windows-gui-x86.exe 5064 encrypter-windows-gui-x86.exe 5064 encrypter-windows-gui-x86.exe 5064 encrypter-windows-gui-x86.exe 5064 encrypter-windows-gui-x86.exe 5064 encrypter-windows-gui-x86.exe 5064 encrypter-windows-gui-x86.exe 5064 encrypter-windows-gui-x86.exe 5064 encrypter-windows-gui-x86.exe 5064 encrypter-windows-gui-x86.exe 5064 encrypter-windows-gui-x86.exe 5064 encrypter-windows-gui-x86.exe 5064 encrypter-windows-gui-x86.exe 5064 encrypter-windows-gui-x86.exe 5064 encrypter-windows-gui-x86.exe 5064 encrypter-windows-gui-x86.exe 5064 encrypter-windows-gui-x86.exe 5064 encrypter-windows-gui-x86.exe 5064 encrypter-windows-gui-x86.exe 5064 encrypter-windows-gui-x86.exe 5064 encrypter-windows-gui-x86.exe 5064 encrypter-windows-gui-x86.exe 5064 encrypter-windows-gui-x86.exe 5064 encrypter-windows-gui-x86.exe 5064 encrypter-windows-gui-x86.exe 5064 encrypter-windows-gui-x86.exe 5064 encrypter-windows-gui-x86.exe 5064 encrypter-windows-gui-x86.exe 5064 encrypter-windows-gui-x86.exe 5064 encrypter-windows-gui-x86.exe 5064 encrypter-windows-gui-x86.exe 5064 encrypter-windows-gui-x86.exe 5064 encrypter-windows-gui-x86.exe 5064 encrypter-windows-gui-x86.exe 5064 encrypter-windows-gui-x86.exe 5064 encrypter-windows-gui-x86.exe 5064 encrypter-windows-gui-x86.exe 5064 encrypter-windows-gui-x86.exe 5064 encrypter-windows-gui-x86.exe 5064 encrypter-windows-gui-x86.exe 5064 encrypter-windows-gui-x86.exe 5064 encrypter-windows-gui-x86.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 5064 encrypter-windows-gui-x86.exe Token: SeBackupPrivilege 1876 vssvc.exe Token: SeRestorePrivilege 1876 vssvc.exe Token: SeAuditPrivilege 1876 vssvc.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\encrypter-windows-gui-x86.exe"C:\Users\Admin\AppData\Local\Temp\encrypter-windows-gui-x86.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5064
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1876
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD57d6ff8f56a6b251bbf524957ea185150
SHA1a20a884c722851b056b25bbdd51991c371acd9f5
SHA256ca9d73bacf174d6ddaf7bb91d86e3ebe6864d31ebb7e8138ce5d6b80999e6fb8
SHA51255ab05205c9746a088188e09ac489bcd7d7de11303591c1359a3c2b2974757db70202672849b5be3d3568564063420f5f70976ed50222281ab427b14cf069d09