c1a1809621329fce9021f0b891e4594a702184daef71bc19adf438389ebaec25

General

Target

c1a1809621329fce9021f0b891e4594a702184daef71bc19adf438389ebaec25.exe
Size

270KB
MD5

0922b67facd189b672670001d2910eca
SHA1

140f950dc6d83d80185d75136d5ce72821b83f8e
SHA256

c1a1809621329fce9021f0b891e4594a702184daef71bc19adf438389ebaec25
SHA512

ed94a848e3a42674054c5c24b7c8bc775ee8e695331a9348b15247b3983ff0cceb3a088329757b8a52398cd850fda2ef7199086479fa4ea1c4e07a916d46536b
SSDEEP

6144:XdohG1el4VQg/U+Dgx3bMAVVzddi6jWGPxF:XdoJlK53DgZMSVFjW0x

Score

10^/10

ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Data breach warning.txt

Ransom Note

# RA World ---- ## Notification Your data are stolen and encrypted when you read this letter. We have copied all data to our server. Don't worry, your data will not be made public if you do what I want. But if you don't pay, we will release the data, contact your customers and regulators and destroy your system again. We can decrypt some files to prove that the decrypt tool works correctly. ## What we want? Contact us, pay for ransom. If you pay, we will provide you the programs for decryption and we will delete your data where on our servers. If not, we will leak your datas and your company will appear in the shame list below. If not, we will email to your customers and report to supervisory authority. ## How contact us? We use qTox to contact, you can download qTox from office website: https://qtox.github.io Our qTox ID is: 358AC0F6C813DD4FD243524F040E2F77969278274BD8A8945B5041A249786E32CC784580F2EC We have no other contacts. If there is no contact within 3 days, you will appear on our website and we will make sample files public. If there is no contact within 7 days, we will stop communicating and release data in batches. The longer time, the higher ransom. ## RA World Office Site: [Permanent address] http://raworldw32b2qxevn3gp63pvibgixr4v75z62etlptg3u3pmajwra4ad.onion [Temporary address] http://161.35.200.18 ## Sample files release link: Sample files: https://gofile.io/d/ufuFye ## Unpay Victim Lists *** You'll be here too if you don't pay! *** *** More and more people will get your files! *** [NIDEC GPM GmbH] [Die Unfallkasse Th�ringen] [HALLIDAYS GROUP LIMITED] [Rockford Gastroenterology Associates] [Di Martino Group] [Alablaboratoria] [Comer] [Informist Media] [SUMMIT VETERINARY PHARMACEUTICALS LIMITED] [Chung Hwa Chemical Industrial Works] [Aceromex] [247ExpressLogistics] [Yuxin Automobile Co.Ltd] [Piex Group] [Zurvita] [BiscoIndustries] [Decimal Point Analytics Pvt] [DeepNoid] [Eastern Media International Corporation] [EyeGene] [Insurance Providers Group] [Thaire] [Wealth Enhancement Group] You can use Tor Browser to open .onion url. Ger more information from Tor office website: https://www.torproject.org

URLs

https://qtox.github.io

http://raworldw32b2qxevn3gp63pvibgixr4v75z62etlptg3u3pmajwra4ad.onion

http://161.35.200.18

https://gofile.io/d/ufuFye

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490
Renames multiple (159) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation	c1a1809621329fce9021f0b891e4594a702184daef71bc19adf438389ebaec25.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	c1a1809621329fce9021f0b891e4594a702184daef71bc19adf438389ebaec25.exe
File opened (read-only)	\??\A:	c1a1809621329fce9021f0b891e4594a702184daef71bc19adf438389ebaec25.exe
File opened (read-only)	\??\H:	c1a1809621329fce9021f0b891e4594a702184daef71bc19adf438389ebaec25.exe
File opened (read-only)	\??\X:	c1a1809621329fce9021f0b891e4594a702184daef71bc19adf438389ebaec25.exe
File opened (read-only)	\??\W:	c1a1809621329fce9021f0b891e4594a702184daef71bc19adf438389ebaec25.exe
File opened (read-only)	\??\E:	c1a1809621329fce9021f0b891e4594a702184daef71bc19adf438389ebaec25.exe
File opened (read-only)	\??\P:	c1a1809621329fce9021f0b891e4594a702184daef71bc19adf438389ebaec25.exe
File opened (read-only)	\??\K:	c1a1809621329fce9021f0b891e4594a702184daef71bc19adf438389ebaec25.exe
File opened (read-only)	\??\T:	c1a1809621329fce9021f0b891e4594a702184daef71bc19adf438389ebaec25.exe
File opened (read-only)	\??\U:	c1a1809621329fce9021f0b891e4594a702184daef71bc19adf438389ebaec25.exe
File opened (read-only)	\??\B:	c1a1809621329fce9021f0b891e4594a702184daef71bc19adf438389ebaec25.exe
File opened (read-only)	\??\N:	c1a1809621329fce9021f0b891e4594a702184daef71bc19adf438389ebaec25.exe
File opened (read-only)	\??\M:	c1a1809621329fce9021f0b891e4594a702184daef71bc19adf438389ebaec25.exe
File opened (read-only)	\??\I:	c1a1809621329fce9021f0b891e4594a702184daef71bc19adf438389ebaec25.exe
File opened (read-only)	\??\S:	c1a1809621329fce9021f0b891e4594a702184daef71bc19adf438389ebaec25.exe
File opened (read-only)	\??\Y:	c1a1809621329fce9021f0b891e4594a702184daef71bc19adf438389ebaec25.exe
File opened (read-only)	\??\G:	c1a1809621329fce9021f0b891e4594a702184daef71bc19adf438389ebaec25.exe
File opened (read-only)	\??\J:	c1a1809621329fce9021f0b891e4594a702184daef71bc19adf438389ebaec25.exe
File opened (read-only)	\??\L:	c1a1809621329fce9021f0b891e4594a702184daef71bc19adf438389ebaec25.exe
File opened (read-only)	\??\Z:	c1a1809621329fce9021f0b891e4594a702184daef71bc19adf438389ebaec25.exe
File opened (read-only)	\??\V:	c1a1809621329fce9021f0b891e4594a702184daef71bc19adf438389ebaec25.exe
File opened (read-only)	\??\Q:	c1a1809621329fce9021f0b891e4594a702184daef71bc19adf438389ebaec25.exe
File opened (read-only)	\??\R:	c1a1809621329fce9021f0b891e4594a702184daef71bc19adf438389ebaec25.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Help\Finish.exe	c1a1809621329fce9021f0b891e4594a702184daef71bc19adf438389ebaec25.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Interacts with shadow copies 2 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
1160	vssadmin.exe
4992	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2372	c1a1809621329fce9021f0b891e4594a702184daef71bc19adf438389ebaec25.exe
2372	c1a1809621329fce9021f0b891e4594a702184daef71bc19adf438389ebaec25.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeBackupPrivilege	5032	vssvc.exe
Token: SeRestorePrivilege	5032	vssvc.exe
Token: SeAuditPrivilege	5032	vssvc.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2928	2372	c1a1809621329fce9021f0b891e4594a702184daef71bc19adf438389ebaec25.exe	87
PID 2372 wrote to memory of 2928	2372	c1a1809621329fce9021f0b891e4594a702184daef71bc19adf438389ebaec25.exe	87
PID 2928 wrote to memory of 1160	2928	cmd.exe	91
PID 2928 wrote to memory of 1160	2928	cmd.exe	91
PID 2372 wrote to memory of 548	2372	c1a1809621329fce9021f0b891e4594a702184daef71bc19adf438389ebaec25.exe	93
PID 2372 wrote to memory of 548	2372	c1a1809621329fce9021f0b891e4594a702184daef71bc19adf438389ebaec25.exe	93
PID 548 wrote to memory of 4992	548	cmd.exe	95
PID 548 wrote to memory of 4992	548	cmd.exe	95

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\c1a1809621329fce9021f0b891e4594a702184daef71bc19adf438389ebaec25.exe
"C:\Users\Admin\AppData\Local\Temp\c1a1809621329fce9021f0b891e4594a702184daef71bc19adf438389ebaec25.exe"
1⤵
- Checks computer location settings
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2928
- - C:\Windows\system32\vssadmin.exe
    vssadmin.exe delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:1160
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:548
- - C:\Windows\system32\vssadmin.exe
    vssadmin.exe delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:4992

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

2

T1070

File Deletion

2

T1070.004

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Data breach warning.txt

Filesize
2KB

MD5
e7264a4c331eac851fa75438919e0531

SHA1
38f6dc2b0c5e86d38c2a9bd7f5aaf4447be97a61

SHA256
07ab218d5c865cb4fe78353340ab923e24a1f2881ec7206520651c5246b1a492

SHA512
f8aca867b199f5494dbc6919423788533b4b55f249ac1ab2707c38788212b585eb39234be74d1f2b039d00ee096b5d2036c1066e19e4fa304b048ffb61ca1edb

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads