buran | b70ec8c6a31fd85c8161f4b94b95aa57ae59647e4559ae47b823ddcb906f7bbe

Analysis

max time kernel
39s
max time network
43s
platform
windows10-1703_x64
resource
win10-20240221-en
resource tags

arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
submitted
07-03-2024 19:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

824a76c39895bc3ad4f5dfc27fc3ac80d26514118c4669505a1f0cfdc8fdbcdc.exe
Size

416KB
MD5

dcef208fcdac3345c6899a478d16980f
SHA1

fd127c6ecaee57972b7acc3b8e4a2d3b25f928e0
SHA256

824a76c39895bc3ad4f5dfc27fc3ac80d26514118c4669505a1f0cfdc8fdbcdc
SHA512

28e403a6d66895a2461828f49acb2862602e6be94405657bee0aec5d35d86dd83713c4cd1f33d28b94fed6546633683f9ffa693d37dc94bc862f6584833f9fba
SSDEEP

6144:iYdiLQNWloaXoLJYksETr0vpvejH6ols25A0LJjI4WHB/N7:BiLQqosgZs+8vejap0LJ6h

Score

10^/10

buran zeppelin persistence ransomware

Malware Config

Extracted

Path

C:\$Recycle.Bin\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT

Family

buran

Ransom Note

!!! ALL YOUR FILES ARE ENCRYPTED !!! All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. To be sure we have the decryptor and it works you can send an email: [email protected] and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? Write to email: [email protected] Reserved email: [email protected] Reserved email: [email protected] Your personal ID: AF2-D34-5A6 Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Emails

[email protected]

Signatures

Buran
Ransomware-as-a-service based on the VegaLocker family first identified in 2019.
ransomware buran

Detects Zeppelin payload 10 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4560-2-0x0000000000400000-0x0000000000557000-memory.dmp	family_zeppelin
behavioral2/memory/1272-25-0x0000000000400000-0x0000000000557000-memory.dmp	family_zeppelin
behavioral2/memory/4560-27-0x0000000000400000-0x0000000000557000-memory.dmp	family_zeppelin
behavioral2/memory/1272-50-0x0000000000400000-0x0000000000557000-memory.dmp	family_zeppelin
behavioral2/memory/1272-54-0x0000000000400000-0x0000000000557000-memory.dmp	family_zeppelin
behavioral2/memory/200-59-0x0000000000400000-0x0000000000557000-memory.dmp	family_zeppelin
behavioral2/memory/200-65-0x0000000000400000-0x0000000000557000-memory.dmp	family_zeppelin
behavioral2/memory/1088-58-0x0000000000400000-0x0000000000557000-memory.dmp	family_zeppelin
behavioral2/memory/1088-2472-0x0000000000400000-0x0000000000557000-memory.dmp	family_zeppelin
behavioral2/memory/1088-5564-0x0000000000400000-0x0000000000557000-memory.dmp	family_zeppelin

Zeppelin Ransomware
Ransomware-as-a-service (RaaS) written in Delphi and first seen in 2019.
ransomware zeppelin
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490
Renames multiple (1696) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Deletes itself 1 IoCs

Processes:

notepad.exe

pid process

4776 notepad.exe
Executes dropped EXE 3 IoCs

Processes:

csrss.execsrss.execsrss.exe

pid process

1272 csrss.exe
1088 csrss.exe
200 csrss.exe

pid	process
4776	notepad.exe

pid	process
1272	csrss.exe
1088	csrss.exe
200	csrss.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

824a76c39895bc3ad4f5dfc27fc3ac80d26514118c4669505a1f0cfdc8fdbcdc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\csrss.exe\" -start"	824a76c39895bc3ad4f5dfc27fc3ac80d26514118c4669505a1f0cfdc8fdbcdc.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

csrss.exe

description	ioc	process
File opened (read-only)	\??\X:	csrss.exe
File opened (read-only)	\??\O:	csrss.exe
File opened (read-only)	\??\I:	csrss.exe
File opened (read-only)	\??\Y:	csrss.exe
File opened (read-only)	\??\B:	csrss.exe
File opened (read-only)	\??\A:	csrss.exe
File opened (read-only)	\??\T:	csrss.exe
File opened (read-only)	\??\N:	csrss.exe
File opened (read-only)	\??\M:	csrss.exe
File opened (read-only)	\??\J:	csrss.exe
File opened (read-only)	\??\H:	csrss.exe
File opened (read-only)	\??\W:	csrss.exe
File opened (read-only)	\??\V:	csrss.exe
File opened (read-only)	\??\U:	csrss.exe
File opened (read-only)	\??\G:	csrss.exe
File opened (read-only)	\??\Q:	csrss.exe
File opened (read-only)	\??\P:	csrss.exe
File opened (read-only)	\??\L:	csrss.exe
File opened (read-only)	\??\K:	csrss.exe
File opened (read-only)	\??\E:	csrss.exe
File opened (read-only)	\??\Z:	csrss.exe
File opened (read-only)	\??\S:	csrss.exe
File opened (read-only)	\??\R:	csrss.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

19 iplogger.org
21 iplogger.org
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

1 geoiptool.com

flow	ioc
19	iplogger.org
21	iplogger.org

flow	ioc
1	geoiptool.com

Drops file in Program Files directory 64 IoCs

Processes:

csrss.exe

description	ioc	process
File created	C:\Program Files\Java\jre-1.8\lib\cmm\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT	csrss.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightItalic.ttf.kd8eby0.AF2-D34-5A6	csrss.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremDemoR_BypassTrial365-ul-oob.xrm-ms.kd8eby0.AF2-D34-5A6	csrss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tg.txt	csrss.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe.kd8eby0.AF2-D34-5A6	csrss.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md	csrss.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-ppd.xrm-ms	csrss.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-ul-phn.xrm-ms	csrss.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe.kd8eby0.AF2-D34-5A6	csrss.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngcc.md.kd8eby0.AF2-D34-5A6	csrss.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-pl.xrm-ms.kd8eby0.AF2-D34-5A6	csrss.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe.kd8eby0.AF2-D34-5A6	csrss.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-ppd.xrm-ms	csrss.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Trial-ul-oob.xrm-ms.kd8eby0.AF2-D34-5A6	csrss.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-ppd.xrm-ms.kd8eby0.AF2-D34-5A6	csrss.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Orange Red.xml	csrss.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Reflection.eftx	csrss.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_KMS_Client-ppd.xrm-ms	csrss.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ul-oob.xrm-ms	csrss.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ul-phn.xrm-ms	csrss.exe
File opened for modification	C:\Program Files\TraceShow.m3u	csrss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	csrss.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\javafx-src.zip	csrss.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\server\Xusage.txt	csrss.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Trial-pl.xrm-ms.kd8eby0.AF2-D34-5A6	csrss.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\mesa3d.md	csrss.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\local_policy.jar	csrss.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms	csrss.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ul-oob.xrm-ms	csrss.exe
File created	C:\Program Files\Internet Explorer\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT	csrss.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\jdk\dom.md.kd8eby0.AF2-D34-5A6	csrss.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\jdk\icu.md	csrss.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml	csrss.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-ul-phn.xrm-ms.kd8eby0.AF2-D34-5A6	csrss.exe
File created	C:\Program Files\.sys	csrss.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-ul-oob.xrm-ms	csrss.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-pl.xrm-ms.kd8eby0.AF2-D34-5A6	csrss.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\icu.md.kd8eby0.AF2-D34-5A6	csrss.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-pl.xrm-ms	csrss.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-ul-phn.xrm-ms.kd8eby0.AF2-D34-5A6	csrss.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_KMS_Client_AE-ul.xrm-ms	csrss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	csrss.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-ul-oob.xrm-ms.kd8eby0.AF2-D34-5A6	csrss.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ul-phn.xrm-ms.kd8eby0.AF2-D34-5A6	csrss.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-ppd.xrm-ms	csrss.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-ppd.xrm-ms	csrss.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe.kd8eby0.AF2-D34-5A6	csrss.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\lcms.md	csrss.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-pl.xrm-ms	csrss.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Grace-ul-oob.xrm-ms.kd8eby0.AF2-D34-5A6	csrss.exe
File opened for modification	C:\Program Files\PushRegister.clr.kd8eby0.AF2-D34-5A6	csrss.exe
File created	C:\Program Files\Java\jdk-1.8\include\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT	csrss.exe
File created	C:\Program Files\Java\jre-1.8\bin\plugin2\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT	csrss.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription3-ppd.xrm-ms.kd8eby0.AF2-D34-5A6	csrss.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial2-ul-oob.xrm-ms	csrss.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ul-oob.xrm-ms.kd8eby0.AF2-D34-5A6	csrss.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\jvmti.h	csrss.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\pkcs11wrapper.md.kd8eby0.AF2-D34-5A6	csrss.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT	csrss.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-ul-phn.xrm-ms	csrss.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms.kd8eby0.AF2-D34-5A6	csrss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	csrss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt.kd8eby0.AF2-D34-5A6	csrss.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial2-ul-oob.xrm-ms	csrss.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

vssadmin.exevssadmin.exe

pid process

2328 vssadmin.exe
32 vssadmin.exe

pid	process
2328	vssadmin.exe
32	vssadmin.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

824a76c39895bc3ad4f5dfc27fc3ac80d26514118c4669505a1f0cfdc8fdbcdc.exeWMIC.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	4560	824a76c39895bc3ad4f5dfc27fc3ac80d26514118c4669505a1f0cfdc8fdbcdc.exe
Token: SeDebugPrivilege	4560	824a76c39895bc3ad4f5dfc27fc3ac80d26514118c4669505a1f0cfdc8fdbcdc.exe
Token: SeIncreaseQuotaPrivilege	4940	WMIC.exe
Token: SeSecurityPrivilege	4940	WMIC.exe
Token: SeTakeOwnershipPrivilege	4940	WMIC.exe
Token: SeLoadDriverPrivilege	4940	WMIC.exe
Token: SeSystemProfilePrivilege	4940	WMIC.exe
Token: SeSystemtimePrivilege	4940	WMIC.exe
Token: SeProfSingleProcessPrivilege	4940	WMIC.exe
Token: SeIncBasePriorityPrivilege	4940	WMIC.exe
Token: SeCreatePagefilePrivilege	4940	WMIC.exe
Token: SeBackupPrivilege	4940	WMIC.exe
Token: SeRestorePrivilege	4940	WMIC.exe
Token: SeShutdownPrivilege	4940	WMIC.exe
Token: SeDebugPrivilege	4940	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4940	WMIC.exe
Token: SeRemoteShutdownPrivilege	4940	WMIC.exe
Token: SeUndockPrivilege	4940	WMIC.exe
Token: SeManageVolumePrivilege	4940	WMIC.exe
Token: 33	4940	WMIC.exe
Token: 34	4940	WMIC.exe
Token: 35	4940	WMIC.exe
Token: 36	4940	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2880	WMIC.exe
Token: SeSecurityPrivilege	2880	WMIC.exe
Token: SeTakeOwnershipPrivilege	2880	WMIC.exe
Token: SeLoadDriverPrivilege	2880	WMIC.exe
Token: SeSystemProfilePrivilege	2880	WMIC.exe
Token: SeSystemtimePrivilege	2880	WMIC.exe
Token: SeProfSingleProcessPrivilege	2880	WMIC.exe
Token: SeIncBasePriorityPrivilege	2880	WMIC.exe
Token: SeCreatePagefilePrivilege	2880	WMIC.exe
Token: SeBackupPrivilege	2880	WMIC.exe
Token: SeRestorePrivilege	2880	WMIC.exe
Token: SeShutdownPrivilege	2880	WMIC.exe
Token: SeDebugPrivilege	2880	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2880	WMIC.exe
Token: SeRemoteShutdownPrivilege	2880	WMIC.exe
Token: SeUndockPrivilege	2880	WMIC.exe
Token: SeManageVolumePrivilege	2880	WMIC.exe
Token: 33	2880	WMIC.exe
Token: 34	2880	WMIC.exe
Token: 35	2880	WMIC.exe
Token: 36	2880	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2880	WMIC.exe
Token: SeSecurityPrivilege	2880	WMIC.exe
Token: SeTakeOwnershipPrivilege	2880	WMIC.exe
Token: SeLoadDriverPrivilege	2880	WMIC.exe
Token: SeSystemProfilePrivilege	2880	WMIC.exe
Token: SeSystemtimePrivilege	2880	WMIC.exe
Token: SeProfSingleProcessPrivilege	2880	WMIC.exe
Token: SeIncBasePriorityPrivilege	2880	WMIC.exe
Token: SeCreatePagefilePrivilege	2880	WMIC.exe
Token: SeBackupPrivilege	2880	WMIC.exe
Token: SeRestorePrivilege	2880	WMIC.exe
Token: SeShutdownPrivilege	2880	WMIC.exe
Token: SeDebugPrivilege	2880	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2880	WMIC.exe
Token: SeRemoteShutdownPrivilege	2880	WMIC.exe
Token: SeUndockPrivilege	2880	WMIC.exe
Token: SeManageVolumePrivilege	2880	WMIC.exe
Token: 33	2880	WMIC.exe
Token: 34	2880	WMIC.exe
Token: 35	2880	WMIC.exe

Suspicious use of WriteProcessMemory 45 IoCs

Processes:

824a76c39895bc3ad4f5dfc27fc3ac80d26514118c4669505a1f0cfdc8fdbcdc.execsrss.execmd.execmd.execmd.exe

description	pid	process	target process
PID 4560 wrote to memory of 1272	4560	824a76c39895bc3ad4f5dfc27fc3ac80d26514118c4669505a1f0cfdc8fdbcdc.exe	csrss.exe
PID 4560 wrote to memory of 1272	4560	824a76c39895bc3ad4f5dfc27fc3ac80d26514118c4669505a1f0cfdc8fdbcdc.exe	csrss.exe
PID 4560 wrote to memory of 1272	4560	824a76c39895bc3ad4f5dfc27fc3ac80d26514118c4669505a1f0cfdc8fdbcdc.exe	csrss.exe
PID 4560 wrote to memory of 4776	4560	824a76c39895bc3ad4f5dfc27fc3ac80d26514118c4669505a1f0cfdc8fdbcdc.exe	notepad.exe
PID 4560 wrote to memory of 4776	4560	824a76c39895bc3ad4f5dfc27fc3ac80d26514118c4669505a1f0cfdc8fdbcdc.exe	notepad.exe
PID 4560 wrote to memory of 4776	4560	824a76c39895bc3ad4f5dfc27fc3ac80d26514118c4669505a1f0cfdc8fdbcdc.exe	notepad.exe
PID 4560 wrote to memory of 4776	4560	824a76c39895bc3ad4f5dfc27fc3ac80d26514118c4669505a1f0cfdc8fdbcdc.exe	notepad.exe
PID 4560 wrote to memory of 4776	4560	824a76c39895bc3ad4f5dfc27fc3ac80d26514118c4669505a1f0cfdc8fdbcdc.exe	notepad.exe
PID 4560 wrote to memory of 4776	4560	824a76c39895bc3ad4f5dfc27fc3ac80d26514118c4669505a1f0cfdc8fdbcdc.exe	notepad.exe
PID 1272 wrote to memory of 1716	1272	csrss.exe	cmd.exe
PID 1272 wrote to memory of 1716	1272	csrss.exe	cmd.exe
PID 1272 wrote to memory of 1716	1272	csrss.exe	cmd.exe
PID 1272 wrote to memory of 5040	1272	csrss.exe	cmd.exe
PID 1272 wrote to memory of 5040	1272	csrss.exe	cmd.exe
PID 1272 wrote to memory of 5040	1272	csrss.exe	cmd.exe
PID 1272 wrote to memory of 4904	1272	csrss.exe	cmd.exe
PID 1272 wrote to memory of 4904	1272	csrss.exe	cmd.exe
PID 1272 wrote to memory of 4904	1272	csrss.exe	cmd.exe
PID 1272 wrote to memory of 2704	1272	csrss.exe	cmd.exe
PID 1272 wrote to memory of 2704	1272	csrss.exe	cmd.exe
PID 1272 wrote to memory of 2704	1272	csrss.exe	cmd.exe
PID 1272 wrote to memory of 2780	1272	csrss.exe	cmd.exe
PID 1272 wrote to memory of 2780	1272	csrss.exe	cmd.exe
PID 1272 wrote to memory of 2780	1272	csrss.exe	cmd.exe
PID 1272 wrote to memory of 364	1272	csrss.exe	cmd.exe
PID 1272 wrote to memory of 364	1272	csrss.exe	cmd.exe
PID 1272 wrote to memory of 364	1272	csrss.exe	cmd.exe
PID 1272 wrote to memory of 1088	1272	csrss.exe	csrss.exe
PID 1272 wrote to memory of 1088	1272	csrss.exe	csrss.exe
PID 1272 wrote to memory of 1088	1272	csrss.exe	csrss.exe
PID 1272 wrote to memory of 200	1272	csrss.exe	csrss.exe
PID 1272 wrote to memory of 200	1272	csrss.exe	csrss.exe
PID 1272 wrote to memory of 200	1272	csrss.exe	csrss.exe
PID 1716 wrote to memory of 4940	1716	cmd.exe	WMIC.exe
PID 1716 wrote to memory of 4940	1716	cmd.exe	WMIC.exe
PID 1716 wrote to memory of 4940	1716	cmd.exe	WMIC.exe
PID 364 wrote to memory of 2880	364	cmd.exe	WMIC.exe
PID 364 wrote to memory of 2880	364	cmd.exe	WMIC.exe
PID 364 wrote to memory of 2880	364	cmd.exe	WMIC.exe
PID 2780 wrote to memory of 32	2780	cmd.exe	vssadmin.exe
PID 2780 wrote to memory of 32	2780	cmd.exe	vssadmin.exe
PID 2780 wrote to memory of 32	2780	cmd.exe	vssadmin.exe
PID 364 wrote to memory of 2328	364	cmd.exe	vssadmin.exe
PID 364 wrote to memory of 2328	364	cmd.exe	vssadmin.exe
PID 364 wrote to memory of 2328	364	cmd.exe	vssadmin.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\824a76c39895bc3ad4f5dfc27fc3ac80d26514118c4669505a1f0cfdc8fdbcdc.exe
"C:\Users\Admin\AppData\Local\Temp\824a76c39895bc3ad4f5dfc27fc3ac80d26514118c4669505a1f0cfdc8fdbcdc.exe"
1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4560

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\csrss.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\csrss.exe" -start
2⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:1272

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C wmic shadowcopy delete
3⤵
- Suspicious use of WriteProcessMemory
PID:1716

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic shadowcopy delete
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4940

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C bcdedit /set {default} recoveryenabled no
3⤵
PID:5040

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
3⤵
PID:4904

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C wbadmin delete catalog -quiet
3⤵
PID:2704

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C vssadmin delete shadows /all /quiet
3⤵
- Suspicious use of WriteProcessMemory
PID:2780

C:\Windows\SysWOW64\vssadmin.exe
vssadmin delete shadows /all /quiet
4⤵
- Interacts with shadow copies
PID:32

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\~temp001.bat
3⤵
- Suspicious use of WriteProcessMemory
PID:364

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic shadowcopy delete
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2880

C:\Windows\SysWOW64\vssadmin.exe
vssadmin delete shadows /all /quiet
4⤵
- Interacts with shadow copies
PID:2328

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\csrss.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\csrss.exe" -agent 0
3⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1088

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\csrss.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\csrss.exe" -agent 1
3⤵
- Executes dropped EXE
PID:200

C:\Windows\SysWOW64\notepad.exe
notepad.exe
2⤵
- Deletes itself
PID:4776

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:3540

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT
Filesize
975B

MD5
ef3e169d037451c70f1d876e20eb7070

SHA1
56b5d8ee83753405e9b9d6e7b4c8f6672ec3bbaf

SHA256
960f379295c0d9cf2f4281c34817cf7e45c30a742b7cd7490ebef9a92f53bb7a

SHA512
4e18ed04bd78170f76ab5703b8f9f62dab67e5456a2105e0c5b4011dc52d0f14e98aa61f9cf3038c75ba886f68c4e9a626066ef41628076ea91de47c71e34823

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3F26ED5DE6B4E859CCCA6035ECB8D9CB
Filesize
2KB

MD5
ec3cab0d012a32ecb5441def3ff750cd

SHA1
018cce88f601d4a4fc739ce346b1d844635dcff4

SHA256
43e73f161a6fda56fc2b948653bb3a99aa2462d0ac804aaa4bcf04b34343efa9

SHA512
ee4a6e429ee0d204bc8c8388181eaf93a09e782591f3d2df52a9a0ee4d2260a31a4b602ec904fab7d545dc34957795665ede4d26900d004b8a2a89a20178ce40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\204C1AA6F6114E6A513754A2AB5760FA_3F2A9DB42365395CA97CFD2FA38D17E4
Filesize
472B

MD5
2a941866b71b87f1b517c9e6d84dfbed

SHA1
a5c2ea62ddb855d0f48f87f67b354f646c73cf3c

SHA256
2cc2cf579f63c3f4c242acf9d15b3454740806577713bc7d40e1ee3e804ba0d9

SHA512
d138ea83a1b5cdecd70e944c4244125afaf2e2d6dd21ab58d2bd9a9d03603191db10d6bdd9cedbfb552baa88e205105e4c5d8190b4fa8226ae96a333939c5322

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
Filesize
1KB

MD5
a5caead01378ea5e8b3b48bb4bf465d0

SHA1
ce6015bd0e6d004add7413334ed0ba90c7b857ab

SHA256
272105992830f2dd4e9a8e228fd8d223f899263ed8dbb1bc66a4c0a3ecb65d53

SHA512
9a85c23e184d0efb3c74dde0954a49a780e364d3eabff32ee80ae3452867812487a44a7580632e233c0abcacc1d8248c0df1582bdaff0725b49e167538cfd3af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3F26ED5DE6B4E859CCCA6035ECB8D9CB
Filesize
484B

MD5
4367896a5741ea638d9bd9a815c33c9e

SHA1
9929f47737bd11f5997e512585d9bfde5f21cb31

SHA256
57d2ef8fcfc120c5ef07d107834cc1040eb2064df3b9d1ba6307ec5c26b87d4f

SHA512
58d63f8c80c76d0d9af63ae25ecced61d589027173dfcedbe70c7b32ecdc812848d14aead980783b64c688f18f906087abbc7413602ea7cbdce38c25a799be2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\204C1AA6F6114E6A513754A2AB5760FA_3F2A9DB42365395CA97CFD2FA38D17E4
Filesize
488B

MD5
f84279f4c47e01651d6331981d67364b

SHA1
541b5d7c3aa48224578bb823a3ab88426fee7a79

SHA256
89c1a36aba4afcc974a228a81c981377475acaa4ab19fc6ecc989bf285da020e

SHA512
9921fa2ab6a7c586bf5567fcc17e75493dac384ef1155268e7183879483ee838d680284d8d8a3d54acb5e8845455d91cb2c63322da5269d93887223ba11e138a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
Filesize
482B

MD5
41895770e3be9243372919c353ba9d4e

SHA1
df1be400482deeb7de2ffac9654d06c4384d6d09

SHA256
efb05f6398ac6dd8b0fc117300a7f120257b9d6f119d8c67b69163939724dd08

SHA512
f2d3c6d047003b21d91a97c08056e7a39c37a028a7505a6013c3daa8c02b60e86852fa67ab02250319bcc8423e96e40cf11291ff97a34cb3f19e57d4c7a2a3e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\53V85Y29\CIICRD53.htm
Filesize
18KB

MD5
d86c179bcfbd66e883f47019ea1ca200

SHA1
c63ad8a4b2a4c3e5408225a1231e25ec44d65eb8

SHA256
b465036b723ca3a35874e6eb4a2560140a2a9364ecc53b2dc7c0f1b59d216bea

SHA512
d9136ce45ba1210a717199f6f9292a656ef0fa86674c168a9be09c7ae2aab25c247bc417d1bf24c11fc403becc0da50805a61f0731c358c596a0780ffe986d8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\U2DI4E2V\W0L1R2AZ.htm
Filesize
190B

MD5
6ebbeb8c70d5f8ffc3fb501950468594

SHA1
c06e60a316e48f5c35d39bcf7ed7e6254957ac9e

SHA256
a563426e24d132cd87b70d9cb5cd3d57c2e1428873a3f3eb94649cf42e37b6a1

SHA512
75cfab1c9f5a05c892cf3b564aed06d351c6dc40048faea03ae163154ff7635252817d66b72a6ef51c4f895eebf7728f302df51148acce2a0c285502bf13652c

Download Submit
C:\Users\Admin\AppData\Local\Temp\~temp001.bat
Filesize
406B

MD5
ef572e2c7b1bbd57654b36e8dcfdc37a

SHA1
b84c4db6d0dfd415c289d0c8ae099aea4001e3b7

SHA256
e6e609db3f387f42bfd16dd9e5695ddc2b73d86ae12baf4f0dfc4edda4a96a64

SHA512
b8c014b242e8e8f42da37b75fe96c52cd25ebd366d0b5103bcba5ac041806d13142a62351edecdee583d494d2a120f9b330f6229b1b5fe820e1c7d98981089e9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\csrss.exe
Filesize
416KB

MD5
dcef208fcdac3345c6899a478d16980f

SHA1
fd127c6ecaee57972b7acc3b8e4a2d3b25f928e0

SHA256
824a76c39895bc3ad4f5dfc27fc3ac80d26514118c4669505a1f0cfdc8fdbcdc

SHA512
28e403a6d66895a2461828f49acb2862602e6be94405657bee0aec5d35d86dd83713c4cd1f33d28b94fed6546633683f9ffa693d37dc94bc862f6584833f9fba

Download Submit
C:\odt\.zeppelin
Filesize
513B

MD5
8bff8f7ec2dee0630915c750011b1bad

SHA1
3f37e6bc23aba846bffa9d510bfd03024af53c73

SHA256
aca5c1161a85a45d36eaf2bceeff54a0d668bc04957b91f49665fe2a52857ef3

SHA512
e9f1100ee8ebb3614351f8300615fa9400198848502e7d67e8dce918d95a0ce7a245db2a9951fcb7baaeff9c8d0fe36b38d368c263e5daf34ddf0947470d9abe

Download Submit
C:\vcredist2010_x86.log.html
Filesize
83KB

MD5
83787ed946d32e91d3b943e4892846db

SHA1
fa337178540c8616a808cdd0801f4e473ba482ee

SHA256
b7636429f3e3b41582eb17ede1d04cf48c6bf82158aa144a34f59238f4d690bf

SHA512
ba392dea34e2b592b9328ba0354f3e499139e323b5b31352a2c8a6dd14f98f98ec4a58cb9ebfa2ecb13a50377c2eb77bdce723cb142fc8aa8025c4423de9d047

Download Submit
memory/200-78-0x0000000000E00000-0x0000000000F45000-memory.dmp

Filesize
1.3MB

Download
memory/200-65-0x0000000000400000-0x0000000000557000-memory.dmp

Filesize
1.3MB

Download
memory/200-59-0x0000000000400000-0x0000000000557000-memory.dmp

Filesize
1.3MB

Download
memory/200-56-0x0000000000E00000-0x0000000000F45000-memory.dmp

Filesize
1.3MB

Download
memory/1088-2472-0x0000000000400000-0x0000000000557000-memory.dmp

Filesize
1.3MB

Download
memory/1088-5598-0x0000000000D00000-0x0000000000E45000-memory.dmp

Filesize
1.3MB

Download
memory/1088-55-0x0000000000D00000-0x0000000000E45000-memory.dmp

Filesize
1.3MB

Download
memory/1088-58-0x0000000000400000-0x0000000000557000-memory.dmp

Filesize
1.3MB

Download
memory/1088-5564-0x0000000000400000-0x0000000000557000-memory.dmp

Filesize
1.3MB

Download
memory/1272-24-0x0000000000E00000-0x0000000000F45000-memory.dmp

Filesize
1.3MB

Download
memory/1272-54-0x0000000000400000-0x0000000000557000-memory.dmp

Filesize
1.3MB

Download
memory/1272-50-0x0000000000400000-0x0000000000557000-memory.dmp

Filesize
1.3MB

Download
memory/1272-25-0x0000000000400000-0x0000000000557000-memory.dmp

Filesize
1.3MB

Download
memory/1272-57-0x0000000000E00000-0x0000000000F45000-memory.dmp

Filesize
1.3MB

Download
memory/4560-0-0x0000000000400000-0x0000000000557000-memory.dmp

Filesize
1.3MB

Download
memory/4560-1-0x0000000000AB0000-0x0000000000BF5000-memory.dmp

Filesize
1.3MB

Download
memory/4560-27-0x0000000000400000-0x0000000000557000-memory.dmp

Filesize
1.3MB

Download
memory/4560-28-0x0000000000AB0000-0x0000000000BF5000-memory.dmp

Filesize
1.3MB

Download
memory/4560-2-0x0000000000400000-0x0000000000557000-memory.dmp

Filesize
1.3MB

Download
memory/4776-22-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download