Analysis
- max time kernel
101s - max time network
124s - platform
windows11-21h2_x64 - resource
win11-20250619-en - resource tags
- submitted
23/06/2025, 03:56
General
- Target 4ab0ae29c6ed5a3f2e0319992de812fc65be4048739c7f10c6f729fe4238abf6.exe
- Size 103KB
- Sample250623-ehn6maxlt2
- SHA256 4ab0ae29c6ed5a3f2e0319992de812fc65be4048739c7f10c6f729fe4238abf6
Score
10/10
Malware Config
Extracted
Path
-
C:\Users\Admin\README.TXT
-
buran
Ransom Note
- YOUR FILES ARE ENCRYPTED Your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. To be sure we have the decryptor and it works you can send an email: [email protected] and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? Write to email: [email protected] Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.
Emails
Signatures
- Buran
Ransomware-as-a-service based on the VegaLocker family first identified in 2019.
- Buran family
- Renames multiple (146) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 62 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\4ab0ae29c6ed5a3f2e0319992de812fc65be4048739c7f10c6f729fe4238abf6.exe"C:\Users\Admin\AppData\Local\Temp\4ab0ae29c6ed5a3f2e0319992de812fc65be4048739c7f10c6f729fe4238abf6.exe"1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
README.TXT