0150ca403ae96a68321d3529ae13bca57fd36c754a9d03a95b502cdf3221af0f

General

Target

0150ca403ae96a68321d3529ae13bca57fd36c754a9d03a95b502cdf3221af0f.exe
Size

270KB
MD5

1eef02b9cecf23c530b292c68a481a1c
SHA1

c49760d63d957ebd6c1420ef176c5dadda039702
SHA256

0150ca403ae96a68321d3529ae13bca57fd36c754a9d03a95b502cdf3221af0f
SHA512

ca98eb08aa7c0fc851ed16ba57ca90a9d4fc98afd40b634ca3e2c0c661037d0a222db1259190acd159be833e6ca6da6c77c7e0084a851386b2ca5004e02e830d
SSDEEP

6144:XxohG5el4VQg/U+Dgx3bMAVVzddi6jWGPxF:XxodlK53DgZMSVFjW0x

Score

10^/10

ransomware

Malware Config

Extracted

Path

C:\Recovery\WindowsRE\Data breach warning.txt

Ransom Note

# RA World ---- ## Notification Your data are stolen and encrypted when you read this letter. We have copied all data to our server. Don't worry, your data will not be made public if you do what I want. But if you don't pay, we will release the data, contact your customers and regulators and destroy your system again. We can decrypt some files to prove that the decrypt tool works correctly. ## What we want? Contact us, pay for ransom. If you pay, we will provide you the programs for decryption and we will delete your data where on our servers. If not, we will leak your datas and your company will appear in the shame list below. If not, we will email to your customers and report to supervisory authority. ## How contact us? We use qTox to contact, you can download qTox from office website: https://qtox.github.io Our qTox ID is: 358AC0F6C813DD4FD243524F040E2F77969278274BD8A8945B5041A249786E32CC784580F2EC We have no other contacts. If there is no contact within 3 days, you will appear on our website and we will make sample files public. If there is no contact within 7 days, we will stop communicating and release data in batches. The longer time, the higher ransom. ## RA World Office Site: [Permanent address] http://raworldw32b2qxevn3gp63pvibgixr4v75z62etlptg3u3pmajwra4ad.onion [Temporary address] http://161.35.200.18 ## Sample files release link: Sample files: https://gofile.io/d/ufuFye ## Unpay Victim Lists *** You'll be here too if you don't pay! *** *** More and more people will get your files! *** [NIDEC GPM GmbH] [Die Unfallkasse Th�ringen] [HALLIDAYS GROUP LIMITED] [Rockford Gastroenterology Associates] [Di Martino Group] [Alablaboratoria] [Comer] [Informist Media] [SUMMIT VETERINARY PHARMACEUTICALS LIMITED] [Chung Hwa Chemical Industrial Works] [Aceromex] [247ExpressLogistics] [Yuxin Automobile Co.Ltd] [Piex Group] [Zurvita] [BiscoIndustries] [Decimal Point Analytics Pvt] [DeepNoid] [Eastern Media International Corporation] [EyeGene] [Insurance Providers Group] [Thaire] [Wealth Enhancement Group] You can use Tor Browser to open .onion url. Ger more information from Tor office website: https://www.torproject.org

URLs

https://qtox.github.io

http://raworldw32b2qxevn3gp63pvibgixr4v75z62etlptg3u3pmajwra4ad.onion

http://161.35.200.18

https://gofile.io/d/ufuFye

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490
Renames multiple (163) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	0150ca403ae96a68321d3529ae13bca57fd36c754a9d03a95b502cdf3221af0f.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	0150ca403ae96a68321d3529ae13bca57fd36c754a9d03a95b502cdf3221af0f.exe
File opened (read-only)	\??\S:	0150ca403ae96a68321d3529ae13bca57fd36c754a9d03a95b502cdf3221af0f.exe
File opened (read-only)	\??\L:	0150ca403ae96a68321d3529ae13bca57fd36c754a9d03a95b502cdf3221af0f.exe
File opened (read-only)	\??\X:	0150ca403ae96a68321d3529ae13bca57fd36c754a9d03a95b502cdf3221af0f.exe
File opened (read-only)	\??\B:	0150ca403ae96a68321d3529ae13bca57fd36c754a9d03a95b502cdf3221af0f.exe
File opened (read-only)	\??\Y:	0150ca403ae96a68321d3529ae13bca57fd36c754a9d03a95b502cdf3221af0f.exe
File opened (read-only)	\??\J:	0150ca403ae96a68321d3529ae13bca57fd36c754a9d03a95b502cdf3221af0f.exe
File opened (read-only)	\??\K:	0150ca403ae96a68321d3529ae13bca57fd36c754a9d03a95b502cdf3221af0f.exe
File opened (read-only)	\??\M:	0150ca403ae96a68321d3529ae13bca57fd36c754a9d03a95b502cdf3221af0f.exe
File opened (read-only)	\??\N:	0150ca403ae96a68321d3529ae13bca57fd36c754a9d03a95b502cdf3221af0f.exe
File opened (read-only)	\??\T:	0150ca403ae96a68321d3529ae13bca57fd36c754a9d03a95b502cdf3221af0f.exe
File opened (read-only)	\??\U:	0150ca403ae96a68321d3529ae13bca57fd36c754a9d03a95b502cdf3221af0f.exe
File opened (read-only)	\??\I:	0150ca403ae96a68321d3529ae13bca57fd36c754a9d03a95b502cdf3221af0f.exe
File opened (read-only)	\??\O:	0150ca403ae96a68321d3529ae13bca57fd36c754a9d03a95b502cdf3221af0f.exe
File opened (read-only)	\??\P:	0150ca403ae96a68321d3529ae13bca57fd36c754a9d03a95b502cdf3221af0f.exe
File opened (read-only)	\??\H:	0150ca403ae96a68321d3529ae13bca57fd36c754a9d03a95b502cdf3221af0f.exe
File opened (read-only)	\??\Z:	0150ca403ae96a68321d3529ae13bca57fd36c754a9d03a95b502cdf3221af0f.exe
File opened (read-only)	\??\Q:	0150ca403ae96a68321d3529ae13bca57fd36c754a9d03a95b502cdf3221af0f.exe
File opened (read-only)	\??\E:	0150ca403ae96a68321d3529ae13bca57fd36c754a9d03a95b502cdf3221af0f.exe
File opened (read-only)	\??\R:	0150ca403ae96a68321d3529ae13bca57fd36c754a9d03a95b502cdf3221af0f.exe
File opened (read-only)	\??\A:	0150ca403ae96a68321d3529ae13bca57fd36c754a9d03a95b502cdf3221af0f.exe
File opened (read-only)	\??\G:	0150ca403ae96a68321d3529ae13bca57fd36c754a9d03a95b502cdf3221af0f.exe
File opened (read-only)	\??\V:	0150ca403ae96a68321d3529ae13bca57fd36c754a9d03a95b502cdf3221af0f.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Help\Finish.exe	0150ca403ae96a68321d3529ae13bca57fd36c754a9d03a95b502cdf3221af0f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Interacts with shadow copies 2 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
3400	vssadmin.exe
2572	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1044	0150ca403ae96a68321d3529ae13bca57fd36c754a9d03a95b502cdf3221af0f.exe
1044	0150ca403ae96a68321d3529ae13bca57fd36c754a9d03a95b502cdf3221af0f.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeBackupPrivilege	4796	vssvc.exe
Token: SeRestorePrivilege	4796	vssvc.exe
Token: SeAuditPrivilege	4796	vssvc.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 4348	1044	0150ca403ae96a68321d3529ae13bca57fd36c754a9d03a95b502cdf3221af0f.exe	86
PID 1044 wrote to memory of 4348	1044	0150ca403ae96a68321d3529ae13bca57fd36c754a9d03a95b502cdf3221af0f.exe	86
PID 4348 wrote to memory of 3400	4348	cmd.exe	89
PID 4348 wrote to memory of 3400	4348	cmd.exe	89
PID 1044 wrote to memory of 2528	1044	0150ca403ae96a68321d3529ae13bca57fd36c754a9d03a95b502cdf3221af0f.exe	90
PID 1044 wrote to memory of 2528	1044	0150ca403ae96a68321d3529ae13bca57fd36c754a9d03a95b502cdf3221af0f.exe	90
PID 2528 wrote to memory of 2572	2528	cmd.exe	93
PID 2528 wrote to memory of 2572	2528	cmd.exe	93

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\0150ca403ae96a68321d3529ae13bca57fd36c754a9d03a95b502cdf3221af0f.exe
"C:\Users\Admin\AppData\Local\Temp\0150ca403ae96a68321d3529ae13bca57fd36c754a9d03a95b502cdf3221af0f.exe"
1⤵
- Checks computer location settings
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4348
- - C:\Windows\system32\vssadmin.exe
    vssadmin.exe delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:3400
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2528
- - C:\Windows\system32\vssadmin.exe
    vssadmin.exe delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:2572

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

2

T1070

File Deletion

2

T1070.004

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Recovery\WindowsRE\Data breach warning.txt

Filesize
2KB

MD5
e7264a4c331eac851fa75438919e0531

SHA1
38f6dc2b0c5e86d38c2a9bd7f5aaf4447be97a61

SHA256
07ab218d5c865cb4fe78353340ab923e24a1f2881ec7206520651c5246b1a492

SHA512
f8aca867b199f5494dbc6919423788533b4b55f249ac1ab2707c38788212b585eb39234be74d1f2b039d00ee096b5d2036c1066e19e4fa304b048ffb61ca1edb

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads