Analysis
-
max time kernel
106s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20250502-en -
resource tags
arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system -
submitted
07/05/2025, 10:26
Static task
static1
Behavioral task
behavioral1
Sample
0f423c7722c550d26cdb474b537144f4c6ed0bbb75eee0fa33cc667113b6aa40.exe
Resource
win10v2004-20250502-en
General
-
Target
0f423c7722c550d26cdb474b537144f4c6ed0bbb75eee0fa33cc667113b6aa40.exe
-
Size
270KB
-
MD5
2c05347bc5b09218850331071b34a4da
-
SHA1
f04deb7e6d7ab20bc53fd2437b2671c5bb9dd05f
-
SHA256
0f423c7722c550d26cdb474b537144f4c6ed0bbb75eee0fa33cc667113b6aa40
-
SHA512
9240cd3f0b63b3b0f95403d734b6751e32a20081d3aa2e11adc38db0ba26dc51366804255c60b320ad1f65dcb6a006d52eb4d0794323206b8a7be6507a22abee
-
SSDEEP
6144:XxohG6el4VQg/U+Dgx3bMAVVzddi6jWGPxF:XxoGlK53DgZMSVFjW0x
Malware Config
Extracted
C:\Recovery\Data breach warning.txt
https://qtox.github.io
http://raworldw32b2qxevn3gp63pvibgixr4v75z62etlptg3u3pmajwra4ad.onion
http://161.35.200.18
https://gofile.io/d/ufuFye
Signatures
-
RA World
RA World ransomware, also known as RA Group, is a crypto-ransomware variant that has evolved from the earlier Babuk ransomware. It emerged in April 2023.
-
Raworld family
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (180) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\Control Panel\International\Geo\Nation 0f423c7722c550d26cdb474b537144f4c6ed0bbb75eee0fa33cc667113b6aa40.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: 0f423c7722c550d26cdb474b537144f4c6ed0bbb75eee0fa33cc667113b6aa40.exe File opened (read-only) \??\T: 0f423c7722c550d26cdb474b537144f4c6ed0bbb75eee0fa33cc667113b6aa40.exe File opened (read-only) \??\P: 0f423c7722c550d26cdb474b537144f4c6ed0bbb75eee0fa33cc667113b6aa40.exe File opened (read-only) \??\S: 0f423c7722c550d26cdb474b537144f4c6ed0bbb75eee0fa33cc667113b6aa40.exe File opened (read-only) \??\H: 0f423c7722c550d26cdb474b537144f4c6ed0bbb75eee0fa33cc667113b6aa40.exe File opened (read-only) \??\L: 0f423c7722c550d26cdb474b537144f4c6ed0bbb75eee0fa33cc667113b6aa40.exe File opened (read-only) \??\V: 0f423c7722c550d26cdb474b537144f4c6ed0bbb75eee0fa33cc667113b6aa40.exe File opened (read-only) \??\N: 0f423c7722c550d26cdb474b537144f4c6ed0bbb75eee0fa33cc667113b6aa40.exe File opened (read-only) \??\M: 0f423c7722c550d26cdb474b537144f4c6ed0bbb75eee0fa33cc667113b6aa40.exe File opened (read-only) \??\W: 0f423c7722c550d26cdb474b537144f4c6ed0bbb75eee0fa33cc667113b6aa40.exe File opened (read-only) \??\U: 0f423c7722c550d26cdb474b537144f4c6ed0bbb75eee0fa33cc667113b6aa40.exe File opened (read-only) \??\J: 0f423c7722c550d26cdb474b537144f4c6ed0bbb75eee0fa33cc667113b6aa40.exe File opened (read-only) \??\X: 0f423c7722c550d26cdb474b537144f4c6ed0bbb75eee0fa33cc667113b6aa40.exe File opened (read-only) \??\Q: 0f423c7722c550d26cdb474b537144f4c6ed0bbb75eee0fa33cc667113b6aa40.exe File opened (read-only) \??\E: 0f423c7722c550d26cdb474b537144f4c6ed0bbb75eee0fa33cc667113b6aa40.exe File opened (read-only) \??\R: 0f423c7722c550d26cdb474b537144f4c6ed0bbb75eee0fa33cc667113b6aa40.exe File opened (read-only) \??\Y: 0f423c7722c550d26cdb474b537144f4c6ed0bbb75eee0fa33cc667113b6aa40.exe File opened (read-only) \??\I: 0f423c7722c550d26cdb474b537144f4c6ed0bbb75eee0fa33cc667113b6aa40.exe File opened (read-only) \??\A: 0f423c7722c550d26cdb474b537144f4c6ed0bbb75eee0fa33cc667113b6aa40.exe File opened (read-only) \??\O: 0f423c7722c550d26cdb474b537144f4c6ed0bbb75eee0fa33cc667113b6aa40.exe File opened (read-only) \??\G: 0f423c7722c550d26cdb474b537144f4c6ed0bbb75eee0fa33cc667113b6aa40.exe File opened (read-only) \??\K: 0f423c7722c550d26cdb474b537144f4c6ed0bbb75eee0fa33cc667113b6aa40.exe File opened (read-only) \??\Z: 0f423c7722c550d26cdb474b537144f4c6ed0bbb75eee0fa33cc667113b6aa40.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Help\Finish.exe 0f423c7722c550d26cdb474b537144f4c6ed0bbb75eee0fa33cc667113b6aa40.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 3 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1828 vssadmin.exe 2472 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4936 0f423c7722c550d26cdb474b537144f4c6ed0bbb75eee0fa33cc667113b6aa40.exe 4936 0f423c7722c550d26cdb474b537144f4c6ed0bbb75eee0fa33cc667113b6aa40.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 2340 vssvc.exe Token: SeRestorePrivilege 2340 vssvc.exe Token: SeAuditPrivilege 2340 vssvc.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4936 wrote to memory of 232 4936 0f423c7722c550d26cdb474b537144f4c6ed0bbb75eee0fa33cc667113b6aa40.exe 86 PID 4936 wrote to memory of 232 4936 0f423c7722c550d26cdb474b537144f4c6ed0bbb75eee0fa33cc667113b6aa40.exe 86 PID 232 wrote to memory of 1828 232 cmd.exe 90 PID 232 wrote to memory of 1828 232 cmd.exe 90 PID 4936 wrote to memory of 4076 4936 0f423c7722c550d26cdb474b537144f4c6ed0bbb75eee0fa33cc667113b6aa40.exe 92 PID 4936 wrote to memory of 4076 4936 0f423c7722c550d26cdb474b537144f4c6ed0bbb75eee0fa33cc667113b6aa40.exe 92 PID 4076 wrote to memory of 2472 4076 cmd.exe 95 PID 4076 wrote to memory of 2472 4076 cmd.exe 95 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f423c7722c550d26cdb474b537144f4c6ed0bbb75eee0fa33cc667113b6aa40.exe"C:\Users\Admin\AppData\Local\Temp\0f423c7722c550d26cdb474b537144f4c6ed0bbb75eee0fa33cc667113b6aa40.exe"1⤵
- Checks computer location settings
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
PID:232 -
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1828
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2472
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2340
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5e7264a4c331eac851fa75438919e0531
SHA138f6dc2b0c5e86d38c2a9bd7f5aaf4447be97a61
SHA25607ab218d5c865cb4fe78353340ab923e24a1f2881ec7206520651c5246b1a492
SHA512f8aca867b199f5494dbc6919423788533b4b55f249ac1ab2707c38788212b585eb39234be74d1f2b039d00ee096b5d2036c1066e19e4fa304b048ffb61ca1edb