quantum | b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192

Analysis

max time kernel
53s
max time network
57s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
22/02/2023, 02:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
Size 75KB
Sample230222-c5ffwshe64
SHA256 b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192
MD5 0706764b3963df092079d3bdef787a1f
SHA1 73c2460d59f3d0637523ca6d35425aae14358ba1
SHA512 3af7ff3b2aa689eb4c410562b5ead74ff77417da941521928391c6fac3dcc6a75f6d866f52b12f67a41564cfa81afcda51857c0f208f9e90e8629e0f0b5d5cb4
SSDEEP 1536:9aX51pVH9hsgNGLs6BLM1frxz/HTfcKKBaJGp:OfJGLs6BwNxnfTKsG
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quantum ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\README_TO_DECRYPT.html

quantum

Ransom Note

<html> <head> <title>Quantum</title> </head> <body> <h1>Your ID:</h1> <pre> 9064d8b148a0f19a9e3598a6e0b0aeb1602bd79273359845164eefdf45b6ef32 </pre> <hr/> This message contains an information how to fix the troubles you've got with your network. Files on the workstations in your network were encrypted and any your attempt to change, decrypt or rename them could destroy the content. The only way to get files back is a decryption with Key, provided by the Quantum Locker. During the period your network was under our control, we downloaded a huge volume of information. Now it is stored on our servers with high-secure access. This information contains a lot of sensitive, private and personal data. Publishing of such data will cause serious consequences and even business disruption. It's not a threat, on the contrary - it's a manual how to get a way out. Quantum team doesn't aim to damage your company, our goals are only financial. After a payment you'll get network decryption, full destruction of downloaded data, information about your network vulnerabilities and penetration points. If you decide not to negotiate, in 48 hours the fact of the attack and all your information will be posted on our site and will be promoted among dozens of cyber forums, news agencies, websites etc. To contact our support and start the negotiations, please visit our support chat. It is simple, secure and you can set a password to avoid intervention of unauthorised persons. <a href="http://tijykgureh7kqq5cczzeutaoxvmf6yinpar72o3bxome7b44vwqxadyd.onion/?cid=9064d8b148a0f19a9e3598a6e0b0aeb1602bd79273359845164eefdf45b6ef32">http://tijykgureh7kqq5cczzeutaoxvmf6yinpar72o3bxome7b44vwqxadyd.onion/?cid=9064d8b148a0f19a9e3598a6e0b0aeb1602bd79273359845164eefdf45b6ef32</a> <ul> <li>Password field should be blank for the first login. <li>Note that this server is available via Tor browser only. </ul> P.S. How to get TOR browser - see at https://www.torproject.org </body> </html>

Extracted

Path

C:\Users\Admin\Desktop\README_TO_DECRYPT.html

quantum

Ransom Note

Your ID: This message contains an information how to fix the troubles you've got with your network. Files on the workstations in your network were encrypted and any your attempt to change, decrypt or rename them could destroy the content. The only way to get files back is a decryption with Key, provided by the Quantum Locker. During the period your network was under our control, we downloaded a huge volume of information. Now it is stored on our servers with high-secure access. This information contains a lot of sensitive, private and personal data. Publishing of such data will cause serious consequences and even business disruption. It's not a threat, on the contrary - it's a manual how to get a way out. Quantum team doesn't aim to damage your company, our goals are only financial. After a payment you'll get network decryption, full destruction of downloaded data, information about your network vulnerabilities and penetration points. If you decide not to negotiate, in 48 hours the fact of the attack and all your information will be posted on our site and will be promoted among dozens of cyber forums, news agencies, websites etc. To contact our support and start the negotiations, please visit our support chat. It is simple, secure and you can set a password to avoid intervention of unauthorised persons. http://tijykgureh7kqq5cczzeutaoxvmf6yinpar72o3bxome7b44vwqxadyd.onion/?cid=9064d8b148a0f19a9e3598a6e0b0aeb1602bd79273359845164eefdf45b6ef32 Password field should be blank for the first login. Note that this server is available via Tor browser only. P.S. How to get TOR browser - see at https://www.torproject.org

URLs

http://tijykgureh7kqq5cczzeutaoxvmf6yinpar72o3bxome7b44vwqxadyd.onion/?cid=9064d8b148a0f19a9e3598a6e0b0aeb1602bd79273359845164eefdf45b6ef32

Signatures

Quantum Ransomware
A rebrand of the MountLocker ransomware first seen in August 2021.
ransomware quantum

Modifies extensions of user files 6 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File renamed	C:\Users\Admin\Pictures\FormatClear.crw => \??\c:\Users\Admin\Pictures\FormatClear.crw.quantum	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File renamed	C:\Users\Admin\Pictures\GetUse.crw => \??\c:\Users\Admin\Pictures\GetUse.crw.quantum	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File renamed	C:\Users\Admin\Pictures\ImportDisconnect.png => \??\c:\Users\Admin\Pictures\ImportDisconnect.png.quantum	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File renamed	C:\Users\Admin\Pictures\MeasureSplit.tif => \??\c:\Users\Admin\Pictures\MeasureSplit.tif.quantum	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File renamed	C:\Users\Admin\Pictures\ReceiveCompress.tif => \??\c:\Users\Admin\Pictures\ReceiveCompress.tif.quantum	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File renamed	C:\Users\Admin\Pictures\SplitReset.crw => \??\c:\Users\Admin\Pictures\SplitReset.crw.quantum	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe

Deletes itself 1 IoCs

pid	Process
1736	cmd.exe

Drops desktop.ini file(s) 26 IoCs

description	ioc	Process
File opened for modification	\??\c:\Users\Admin\Contacts\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File opened for modification	\??\c:\Users\Admin\Desktop\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File opened for modification	\??\c:\Users\Admin\Favorites\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File opened for modification	\??\c:\Users\Admin\Favorites\Links for United States\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File opened for modification	\??\c:\Users\Public\Desktop\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File opened for modification	\??\c:\Users\Public\Music\Sample Music\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File opened for modification	\??\c:\Users\Public\Pictures\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File opened for modification	\??\c:\Users\Public\Videos\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File opened for modification	\??\c:\Users\Public\Videos\Sample Videos\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File opened for modification	\??\c:\Users\Admin\Downloads\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File opened for modification	\??\c:\Users\Admin\Music\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File opened for modification	\??\c:\Users\Admin\Saved Games\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File opened for modification	\??\c:\Users\Admin\Searches\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File opened for modification	\??\c:\Users\Public\Pictures\Sample Pictures\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File opened for modification	\??\c:\Users\Admin\Documents\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File opened for modification	\??\c:\Users\Admin\Links\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File opened for modification	\??\c:\Users\Admin\Videos\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File opened for modification	\??\c:\Users\Public\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File opened for modification	\??\c:\Users\Public\Libraries\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File opened for modification	\??\c:\Users\Public\Recorded TV\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File opened for modification	\??\c:\Users\Public\Recorded TV\Sample Media\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File opened for modification	\??\c:\Users\Admin\Favorites\Links\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File opened for modification	\??\c:\Users\Admin\Pictures\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File opened for modification	\??\c:\Users\Public\Documents\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File opened for modification	\??\c:\Users\Public\Downloads\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File opened for modification	\??\c:\Users\Public\Music\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe

Modifies Internet Explorer settings 1 TTPs 27 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{31B241C1-B25A-11ED-AC42-C227D5A71BE4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\.quantum\shell	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\.quantum\shell\Open	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\.quantum\shell\Open\command\ = "explorer.exe README_TO_DECRYPT.html"	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\.quantum\shell\Open\command	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\.quantum	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
324	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
324	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	324	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
Token: SeDebugPrivilege	324	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1232	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1232	iexplore.exe
1232	iexplore.exe
568	IEXPLORE.EXE
568	IEXPLORE.EXE
568	IEXPLORE.EXE
568	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 324 wrote to memory of 1736	324	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe	27
PID 324 wrote to memory of 1736	324	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe	27
PID 324 wrote to memory of 1736	324	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe	27
PID 1736 wrote to memory of 1352	1736	cmd.exe	29
PID 1736 wrote to memory of 1352	1736	cmd.exe	29
PID 1736 wrote to memory of 1352	1736	cmd.exe	29
PID 1232 wrote to memory of 568	1232	iexplore.exe	32
PID 1232 wrote to memory of 568	1232	iexplore.exe	32
PID 1232 wrote to memory of 568	1232	iexplore.exe	32
PID 1232 wrote to memory of 568	1232	iexplore.exe	32

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
1352	attrib.exe

C:\Users\Admin\AppData\Local\Temp\b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
"C:\Users\Admin\AppData\Local\Temp\b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe"
1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:324
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\\006CCABF.bat" "C:\Users\Admin\AppData\Local\Temp\b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe""
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:1736
- - C:\Windows\system32\attrib.exe
    attrib -s -r -h "C:\Users\Admin\AppData\Local\Temp\b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe"
    3⤵
    - Views/modifies file attributes
    PID:1352

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\README_TO_DECRYPT.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1232
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1232 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:568

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact