38263d5d34ed82028ea2f415d89191b3ee41e07f95227c16b0508aff996a3111

General

Target

38263d5d34ed82028ea2f415d89191b3ee41e07f95227c16b0508aff996a3111.exe
Size

270KB
MD5

6168cd6f30fc65e735163266863e9c41
SHA1

2a24f91e38f27b97320b9b085eb8e0dac4e9079d
SHA256

38263d5d34ed82028ea2f415d89191b3ee41e07f95227c16b0508aff996a3111
SHA512

e7009c1c01640fa5a2375da53f076d3119ebfee03c4418274f2cd6eda5d2bf3beafaf696bd177ca831d8b75dfff7a2eeb6a5f68a5261e925c935709b6c4cde17
SSDEEP

6144:XqohGlel4VQg/U+Dgx3bMAVVzddi6jWGPxF:XqoplK53DgZMSVFjW0x

Score

10^/10

ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Data breach warning.txt

Ransom Note

# RA World ---- ## Notification Your data are stolen and encrypted when you read this letter. We have copied all data to our server. Don't worry, your data will not be made public if you do what I want. But if you don't pay, we will release the data, contact your customers and regulators and destroy your system again. We can decrypt some files to prove that the decrypt tool works correctly. ## What we want? Contact us, pay for ransom. If you pay, we will provide you the programs for decryption and we will delete your data where on our servers. If not, we will leak your datas and your company will appear in the shame list below. If not, we will email to your customers and report to supervisory authority. ## How contact us? We use qTox to contact, you can download qTox from office website: https://qtox.github.io Our qTox ID is: 358AC0F6C813DD4FD243524F040E2F77969278274BD8A8945B5041A249786E32CC784580F2EC We have no other contacts. If there is no contact within 3 days, you will appear on our website and we will make sample files public. If there is no contact within 7 days, we will stop communicating and release data in batches. The longer time, the higher ransom. ## RA World Office Site: [Permanent address] http://raworldw32b2qxevn3gp63pvibgixr4v75z62etlptg3u3pmajwra4ad.onion [Temporary address] http://161.35.200.18 ## Sample files release link: Sample files: https://gofile.io/d/ufuFye ## Unpay Victim Lists *** You'll be here too if you don't pay! *** *** More and more people will get your files! *** [NIDEC GPM GmbH] [Die Unfallkasse Th�ringen] [HALLIDAYS GROUP LIMITED] [Rockford Gastroenterology Associates] [Di Martino Group] [Alablaboratoria] [Comer] [Informist Media] [SUMMIT VETERINARY PHARMACEUTICALS LIMITED] [Chung Hwa Chemical Industrial Works] [Aceromex] [247ExpressLogistics] [Yuxin Automobile Co.Ltd] [Piex Group] [Zurvita] [BiscoIndustries] [Decimal Point Analytics Pvt] [DeepNoid] [Eastern Media International Corporation] [EyeGene] [Insurance Providers Group] [Thaire] [Wealth Enhancement Group] You can use Tor Browser to open .onion url. Ger more information from Tor office website: https://www.torproject.org

URLs

https://qtox.github.io

http://raworldw32b2qxevn3gp63pvibgixr4v75z62etlptg3u3pmajwra4ad.onion

http://161.35.200.18

https://gofile.io/d/ufuFye

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490
Renames multiple (155) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation	38263d5d34ed82028ea2f415d89191b3ee41e07f95227c16b0508aff996a3111.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	38263d5d34ed82028ea2f415d89191b3ee41e07f95227c16b0508aff996a3111.exe
File opened (read-only)	\??\Q:	38263d5d34ed82028ea2f415d89191b3ee41e07f95227c16b0508aff996a3111.exe
File opened (read-only)	\??\Y:	38263d5d34ed82028ea2f415d89191b3ee41e07f95227c16b0508aff996a3111.exe
File opened (read-only)	\??\H:	38263d5d34ed82028ea2f415d89191b3ee41e07f95227c16b0508aff996a3111.exe
File opened (read-only)	\??\Z:	38263d5d34ed82028ea2f415d89191b3ee41e07f95227c16b0508aff996a3111.exe
File opened (read-only)	\??\G:	38263d5d34ed82028ea2f415d89191b3ee41e07f95227c16b0508aff996a3111.exe
File opened (read-only)	\??\L:	38263d5d34ed82028ea2f415d89191b3ee41e07f95227c16b0508aff996a3111.exe
File opened (read-only)	\??\W:	38263d5d34ed82028ea2f415d89191b3ee41e07f95227c16b0508aff996a3111.exe
File opened (read-only)	\??\E:	38263d5d34ed82028ea2f415d89191b3ee41e07f95227c16b0508aff996a3111.exe
File opened (read-only)	\??\A:	38263d5d34ed82028ea2f415d89191b3ee41e07f95227c16b0508aff996a3111.exe
File opened (read-only)	\??\S:	38263d5d34ed82028ea2f415d89191b3ee41e07f95227c16b0508aff996a3111.exe
File opened (read-only)	\??\T:	38263d5d34ed82028ea2f415d89191b3ee41e07f95227c16b0508aff996a3111.exe
File opened (read-only)	\??\U:	38263d5d34ed82028ea2f415d89191b3ee41e07f95227c16b0508aff996a3111.exe
File opened (read-only)	\??\K:	38263d5d34ed82028ea2f415d89191b3ee41e07f95227c16b0508aff996a3111.exe
File opened (read-only)	\??\J:	38263d5d34ed82028ea2f415d89191b3ee41e07f95227c16b0508aff996a3111.exe
File opened (read-only)	\??\X:	38263d5d34ed82028ea2f415d89191b3ee41e07f95227c16b0508aff996a3111.exe
File opened (read-only)	\??\V:	38263d5d34ed82028ea2f415d89191b3ee41e07f95227c16b0508aff996a3111.exe
File opened (read-only)	\??\B:	38263d5d34ed82028ea2f415d89191b3ee41e07f95227c16b0508aff996a3111.exe
File opened (read-only)	\??\R:	38263d5d34ed82028ea2f415d89191b3ee41e07f95227c16b0508aff996a3111.exe
File opened (read-only)	\??\I:	38263d5d34ed82028ea2f415d89191b3ee41e07f95227c16b0508aff996a3111.exe
File opened (read-only)	\??\O:	38263d5d34ed82028ea2f415d89191b3ee41e07f95227c16b0508aff996a3111.exe
File opened (read-only)	\??\P:	38263d5d34ed82028ea2f415d89191b3ee41e07f95227c16b0508aff996a3111.exe
File opened (read-only)	\??\N:	38263d5d34ed82028ea2f415d89191b3ee41e07f95227c16b0508aff996a3111.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Help\Finish.exe	38263d5d34ed82028ea2f415d89191b3ee41e07f95227c16b0508aff996a3111.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Interacts with shadow copies 2 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
692	vssadmin.exe
3572	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1136	38263d5d34ed82028ea2f415d89191b3ee41e07f95227c16b0508aff996a3111.exe
1136	38263d5d34ed82028ea2f415d89191b3ee41e07f95227c16b0508aff996a3111.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeBackupPrivilege	2640	vssvc.exe
Token: SeRestorePrivilege	2640	vssvc.exe
Token: SeAuditPrivilege	2640	vssvc.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1136 wrote to memory of 3948	1136	38263d5d34ed82028ea2f415d89191b3ee41e07f95227c16b0508aff996a3111.exe	86
PID 1136 wrote to memory of 3948	1136	38263d5d34ed82028ea2f415d89191b3ee41e07f95227c16b0508aff996a3111.exe	86
PID 3948 wrote to memory of 692	3948	cmd.exe	89
PID 3948 wrote to memory of 692	3948	cmd.exe	89
PID 1136 wrote to memory of 2772	1136	38263d5d34ed82028ea2f415d89191b3ee41e07f95227c16b0508aff996a3111.exe	91
PID 1136 wrote to memory of 2772	1136	38263d5d34ed82028ea2f415d89191b3ee41e07f95227c16b0508aff996a3111.exe	91
PID 2772 wrote to memory of 3572	2772	cmd.exe	94
PID 2772 wrote to memory of 3572	2772	cmd.exe	94

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\38263d5d34ed82028ea2f415d89191b3ee41e07f95227c16b0508aff996a3111.exe
"C:\Users\Admin\AppData\Local\Temp\38263d5d34ed82028ea2f415d89191b3ee41e07f95227c16b0508aff996a3111.exe"
1⤵
- Checks computer location settings
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1136
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3948
- - C:\Windows\system32\vssadmin.exe
    vssadmin.exe delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:692
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Windows\system32\vssadmin.exe
    vssadmin.exe delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:3572

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

2

T1070

File Deletion

2

T1070.004

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Data breach warning.txt

Filesize
2KB

MD5
e7264a4c331eac851fa75438919e0531

SHA1
38f6dc2b0c5e86d38c2a9bd7f5aaf4447be97a61

SHA256
07ab218d5c865cb4fe78353340ab923e24a1f2881ec7206520651c5246b1a492

SHA512
f8aca867b199f5494dbc6919423788533b4b55f249ac1ab2707c38788212b585eb39234be74d1f2b039d00ee096b5d2036c1066e19e4fa304b048ffb61ca1edb

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads