1773b284d3dd1e06be6dd92012d05720471395affc653874aa34636bf58d328c

General

Target

1773b284d3dd1e06be6dd92012d05720471395affc653874aa34636bf58d328c.exe
Size

270KB
MD5

49f2be089ed87da030c5d331a8a9da66
SHA1

f7fbc851936c3b90b2029d3f7f0b134e601dcd44
SHA256

1773b284d3dd1e06be6dd92012d05720471395affc653874aa34636bf58d328c
SHA512

67631a14501c573d6abeb31fce5177af7191c1cf799feced7e00ed4ecb9da7cc34d90279c397ba264274a862dacaf9a1929c096aa1d48ba49f3066a9d91a154f
SSDEEP

6144:XqohGKel4VQg/U+Dgx3bMAVVzddi6jWGPxF:XqoGlK53DgZMSVFjW0x

Score

10^/10

ransomware

Malware Config

Extracted

Path

C:\Data breach warning.txt

Ransom Note

# RA World ---- ## Notification Your data are stolen and encrypted when you read this letter. We have copied all data to our server. Don't worry, your data will not be made public if you do what I want. But if you don't pay, we will release the data, contact your customers and regulators and destroy your system again. We can decrypt some files to prove that the decrypt tool works correctly. ## What we want? Contact us, pay for ransom. If you pay, we will provide you the programs for decryption and we will delete your data where on our servers. If not, we will leak your datas and your company will appear in the shame list below. If not, we will email to your customers and report to supervisory authority. ## How contact us? We use qTox to contact, you can download qTox from office website: https://qtox.github.io Our qTox ID is: 358AC0F6C813DD4FD243524F040E2F77969278274BD8A8945B5041A249786E32CC784580F2EC We have no other contacts. If there is no contact within 3 days, you will appear on our website and we will make sample files public. If there is no contact within 7 days, we will stop communicating and release data in batches. The longer time, the higher ransom. ## RA World Office Site: [Permanent address] http://raworldw32b2qxevn3gp63pvibgixr4v75z62etlptg3u3pmajwra4ad.onion [Temporary address] http://161.35.200.18 ## Sample files release link: Sample files: https://gofile.io/d/ufuFye ## Unpay Victim Lists *** You'll be here too if you don't pay! *** *** More and more people will get your files! *** [NIDEC GPM GmbH] [Die Unfallkasse Th�ringen] [HALLIDAYS GROUP LIMITED] [Rockford Gastroenterology Associates] [Di Martino Group] [Alablaboratoria] [Comer] [Informist Media] [SUMMIT VETERINARY PHARMACEUTICALS LIMITED] [Chung Hwa Chemical Industrial Works] [Aceromex] [247ExpressLogistics] [Yuxin Automobile Co.Ltd] [Piex Group] [Zurvita] [BiscoIndustries] [Decimal Point Analytics Pvt] [DeepNoid] [Eastern Media International Corporation] [EyeGene] [Insurance Providers Group] [Thaire] [Wealth Enhancement Group] You can use Tor Browser to open .onion url. Ger more information from Tor office website: https://www.torproject.org

URLs

https://qtox.github.io

http://raworldw32b2qxevn3gp63pvibgixr4v75z62etlptg3u3pmajwra4ad.onion

http://161.35.200.18

https://gofile.io/d/ufuFye

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490
Renames multiple (172) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	1773b284d3dd1e06be6dd92012d05720471395affc653874aa34636bf58d328c.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	1773b284d3dd1e06be6dd92012d05720471395affc653874aa34636bf58d328c.exe
File opened (read-only)	\??\I:	1773b284d3dd1e06be6dd92012d05720471395affc653874aa34636bf58d328c.exe
File opened (read-only)	\??\O:	1773b284d3dd1e06be6dd92012d05720471395affc653874aa34636bf58d328c.exe
File opened (read-only)	\??\A:	1773b284d3dd1e06be6dd92012d05720471395affc653874aa34636bf58d328c.exe
File opened (read-only)	\??\J:	1773b284d3dd1e06be6dd92012d05720471395affc653874aa34636bf58d328c.exe
File opened (read-only)	\??\L:	1773b284d3dd1e06be6dd92012d05720471395affc653874aa34636bf58d328c.exe
File opened (read-only)	\??\M:	1773b284d3dd1e06be6dd92012d05720471395affc653874aa34636bf58d328c.exe
File opened (read-only)	\??\E:	1773b284d3dd1e06be6dd92012d05720471395affc653874aa34636bf58d328c.exe
File opened (read-only)	\??\Y:	1773b284d3dd1e06be6dd92012d05720471395affc653874aa34636bf58d328c.exe
File opened (read-only)	\??\S:	1773b284d3dd1e06be6dd92012d05720471395affc653874aa34636bf58d328c.exe
File opened (read-only)	\??\G:	1773b284d3dd1e06be6dd92012d05720471395affc653874aa34636bf58d328c.exe
File opened (read-only)	\??\Z:	1773b284d3dd1e06be6dd92012d05720471395affc653874aa34636bf58d328c.exe
File opened (read-only)	\??\V:	1773b284d3dd1e06be6dd92012d05720471395affc653874aa34636bf58d328c.exe
File opened (read-only)	\??\R:	1773b284d3dd1e06be6dd92012d05720471395affc653874aa34636bf58d328c.exe
File opened (read-only)	\??\T:	1773b284d3dd1e06be6dd92012d05720471395affc653874aa34636bf58d328c.exe
File opened (read-only)	\??\P:	1773b284d3dd1e06be6dd92012d05720471395affc653874aa34636bf58d328c.exe
File opened (read-only)	\??\H:	1773b284d3dd1e06be6dd92012d05720471395affc653874aa34636bf58d328c.exe
File opened (read-only)	\??\X:	1773b284d3dd1e06be6dd92012d05720471395affc653874aa34636bf58d328c.exe
File opened (read-only)	\??\B:	1773b284d3dd1e06be6dd92012d05720471395affc653874aa34636bf58d328c.exe
File opened (read-only)	\??\Q:	1773b284d3dd1e06be6dd92012d05720471395affc653874aa34636bf58d328c.exe
File opened (read-only)	\??\U:	1773b284d3dd1e06be6dd92012d05720471395affc653874aa34636bf58d328c.exe
File opened (read-only)	\??\K:	1773b284d3dd1e06be6dd92012d05720471395affc653874aa34636bf58d328c.exe
File opened (read-only)	\??\N:	1773b284d3dd1e06be6dd92012d05720471395affc653874aa34636bf58d328c.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Help\Finish.exe	1773b284d3dd1e06be6dd92012d05720471395affc653874aa34636bf58d328c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Interacts with shadow copies 2 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
1944	vssadmin.exe
4808	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4356	1773b284d3dd1e06be6dd92012d05720471395affc653874aa34636bf58d328c.exe
4356	1773b284d3dd1e06be6dd92012d05720471395affc653874aa34636bf58d328c.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeBackupPrivilege	3628	vssvc.exe
Token: SeRestorePrivilege	3628	vssvc.exe
Token: SeAuditPrivilege	3628	vssvc.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4356 wrote to memory of 5040	4356	1773b284d3dd1e06be6dd92012d05720471395affc653874aa34636bf58d328c.exe	85
PID 4356 wrote to memory of 5040	4356	1773b284d3dd1e06be6dd92012d05720471395affc653874aa34636bf58d328c.exe	85
PID 5040 wrote to memory of 1944	5040	cmd.exe	88
PID 5040 wrote to memory of 1944	5040	cmd.exe	88
PID 4356 wrote to memory of 4964	4356	1773b284d3dd1e06be6dd92012d05720471395affc653874aa34636bf58d328c.exe	92
PID 4356 wrote to memory of 4964	4356	1773b284d3dd1e06be6dd92012d05720471395affc653874aa34636bf58d328c.exe	92
PID 4964 wrote to memory of 4808	4964	cmd.exe	94
PID 4964 wrote to memory of 4808	4964	cmd.exe	94

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\1773b284d3dd1e06be6dd92012d05720471395affc653874aa34636bf58d328c.exe
"C:\Users\Admin\AppData\Local\Temp\1773b284d3dd1e06be6dd92012d05720471395affc653874aa34636bf58d328c.exe"
1⤵
- Checks computer location settings
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4356
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5040
- - C:\Windows\system32\vssadmin.exe
    vssadmin.exe delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:1944
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4964
- - C:\Windows\system32\vssadmin.exe
    vssadmin.exe delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:4808

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

2

T1070

File Deletion

2

T1070.004

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Data breach warning.txt

Filesize
2KB

MD5
e7264a4c331eac851fa75438919e0531

SHA1
38f6dc2b0c5e86d38c2a9bd7f5aaf4447be97a61

SHA256
07ab218d5c865cb4fe78353340ab923e24a1f2881ec7206520651c5246b1a492

SHA512
f8aca867b199f5494dbc6919423788533b4b55f249ac1ab2707c38788212b585eb39234be74d1f2b039d00ee096b5d2036c1066e19e4fa304b048ffb61ca1edb

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads