quantum | 1d64879bf7b1c7aea1d3c2c0171b31a329d026dc4e2f1c876d7ec7cae17bbc58

Analysis

max time kernel
31s
max time network
26s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
22/02/2023, 02:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1d64879bf7b1c7aea1d3c2c0171b31a329d026dc4e2f1c876d7ec7cae17bbc58.dll
Size 76KB
Sample230222-c653yabd5w
SHA256 1d64879bf7b1c7aea1d3c2c0171b31a329d026dc4e2f1c876d7ec7cae17bbc58
MD5 8a132d9eb16ab0a492c7858fa5d6b6fb
SHA1 bb3d3258e9207f9499f3f7dcf53442fc8ddabd45
SHA512 7f74eece1ba22e553f86c151b5364207b06b46ffb58330406021c668e2ee5fa332a8dabcf227278f10dfbc7a6d2593f5d2fb32e344c33fca174874300c9eb985
SSDEEP 1536:PaX1IbkVQJih8Ls2WZYbz+n26HNmAC6UsK4Xe:0KntKmzK2736UsK4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quantum ransomware

Malware Config

Extracted

Path

C:\Users\Admin\3D Objects\README_TO_DECRYPT.html

quantum

Ransom Note

<html> <head> <title>Quantum</title> </head> <body> <h1>Your ID:</h1> <pre> 5f9d05e06bea5711acba31a7b1740c807dd89d7c38d74d6648ea0fb0e5dc0d35 </pre> <hr/> This message contains an information how to fix the troubles you've got with your network. Files on the workstations in your network were encrypted and any your attempt to change, decrypt or rename them could destroy the content. The only way to get files back is a decryption with Key, provided by the Quantum Locker. During the period your network was under our control, we downloaded a huge volume of information. Now it is stored on our servers with high-secure access. This information contains a lot of sensitive, private and personal data. Publishing of such data will cause serious consequences and even business disruption. It's not a threat, on the contrary - it's a manual how to get a way out. Quantum team doesn't aim to damage your company, our goals are only financial. After a payment you'll get network decryption, full destruction of downloaded data, information about your network vulnerabilities and penetration points. If you decide not to negotiate, in 48 hours the fact of the attack and all your information will be posted on our site and will be promoted among dozens of cyber forums, news agencies, websites etc. To contact our support and start the negotiations, please visit our support chat. It is simple, secure and you can set a password to avoid intervention of unauthorised persons. <a href="http://iwwbtudyckekvukw7462v32ugqgnzzzaxsyw5yfxhe24ok5hbc46x6qd.onion/?cid=5f9d05e06bea5711acba31a7b1740c807dd89d7c38d74d6648ea0fb0e5dc0d35">http://iwwbtudyckekvukw7462v32ugqgnzzzaxsyw5yfxhe24ok5hbc46x6qd.onion/?cid=5f9d05e06bea5711acba31a7b1740c807dd89d7c38d74d6648ea0fb0e5dc0d35</a> <ul> <li>Password field should be blank for the first login. <li>Note that this server is available via Tor browser only. </ul> P.S. How to get TOR browser - see at https://www.torproject.org </body> </html>

Extracted

Path

C:\Users\Admin\Desktop\README_TO_DECRYPT.html

quantum

Ransom Note

Your ID: This message contains an information how to fix the troubles you've got with your network. Files on the workstations in your network were encrypted and any your attempt to change, decrypt or rename them could destroy the content. The only way to get files back is a decryption with Key, provided by the Quantum Locker. During the period your network was under our control, we downloaded a huge volume of information. Now it is stored on our servers with high-secure access. This information contains a lot of sensitive, private and personal data. Publishing of such data will cause serious consequences and even business disruption. It's not a threat, on the contrary - it's a manual how to get a way out. Quantum team doesn't aim to damage your company, our goals are only financial. After a payment you'll get network decryption, full destruction of downloaded data, information about your network vulnerabilities and penetration points. If you decide not to negotiate, in 48 hours the fact of the attack and all your information will be posted on our site and will be promoted among dozens of cyber forums, news agencies, websites etc. To contact our support and start the negotiations, please visit our support chat. It is simple, secure and you can set a password to avoid intervention of unauthorised persons. http://iwwbtudyckekvukw7462v32ugqgnzzzaxsyw5yfxhe24ok5hbc46x6qd.onion/?cid=5f9d05e06bea5711acba31a7b1740c807dd89d7c38d74d6648ea0fb0e5dc0d35 Password field should be blank for the first login. Note that this server is available via Tor browser only. P.S. How to get TOR browser - see at https://www.torproject.org

URLs

http://iwwbtudyckekvukw7462v32ugqgnzzzaxsyw5yfxhe24ok5hbc46x6qd.onion/?cid=5f9d05e06bea5711acba31a7b1740c807dd89d7c38d74d6648ea0fb0e5dc0d35

Signatures

Quantum Ransomware
A rebrand of the MountLocker ransomware first seen in August 2021.
ransomware quantum

Modifies extensions of user files 13 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File renamed	C:\Users\Admin\Pictures\NewUndo.tiff => \??\c:\Users\Admin\Pictures\NewUndo.tiff.quantum	rundll32.exe
File renamed	C:\Users\Admin\Pictures\UnblockMerge.png => \??\c:\Users\Admin\Pictures\UnblockMerge.png.quantum	rundll32.exe
File renamed	C:\Users\Admin\Pictures\UnlockWait.raw => \??\c:\Users\Admin\Pictures\UnlockWait.raw.quantum	rundll32.exe
File renamed	C:\Users\Admin\Pictures\ConvertUnprotect.crw => \??\c:\Users\Admin\Pictures\ConvertUnprotect.crw.quantum	rundll32.exe
File renamed	C:\Users\Admin\Pictures\CopySend.png => \??\c:\Users\Admin\Pictures\CopySend.png.quantum	rundll32.exe
File renamed	C:\Users\Admin\Pictures\ExpandResume.tif => \??\c:\Users\Admin\Pictures\ExpandResume.tif.quantum	rundll32.exe
File renamed	C:\Users\Admin\Pictures\LockUnblock.raw => \??\c:\Users\Admin\Pictures\LockUnblock.raw.quantum	rundll32.exe
File opened for modification	\??\c:\Users\Admin\Pictures\NewUndo.tiff	rundll32.exe
File opened for modification	\??\c:\Users\Admin\Pictures\UnpublishTrace.tiff	rundll32.exe
File renamed	C:\Users\Admin\Pictures\AddUnpublish.png => \??\c:\Users\Admin\Pictures\AddUnpublish.png.quantum	rundll32.exe
File renamed	C:\Users\Admin\Pictures\PopUnregister.tif => \??\c:\Users\Admin\Pictures\PopUnregister.tif.quantum	rundll32.exe
File renamed	C:\Users\Admin\Pictures\PushNew.png => \??\c:\Users\Admin\Pictures\PushNew.png.quantum	rundll32.exe
File renamed	C:\Users\Admin\Pictures\UnpublishTrace.tiff => \??\c:\Users\Admin\Pictures\UnpublishTrace.tiff.quantum	rundll32.exe

Drops desktop.ini file(s) 25 IoCs

description	ioc	Process
File opened for modification	\??\c:\Users\Public\desktop.ini	rundll32.exe
File opened for modification	\??\c:\Users\Public\Downloads\desktop.ini	rundll32.exe
File opened for modification	\??\c:\Users\Admin\Documents\desktop.ini	rundll32.exe
File opened for modification	\??\c:\Users\Admin\Links\desktop.ini	rundll32.exe
File opened for modification	\??\c:\Users\Admin\OneDrive\desktop.ini	rundll32.exe
File opened for modification	\??\c:\Users\Admin\Pictures\Camera Roll\desktop.ini	rundll32.exe
File opened for modification	\??\c:\Users\Admin\Saved Games\desktop.ini	rundll32.exe
File opened for modification	\??\c:\Users\Admin\Searches\desktop.ini	rundll32.exe
File opened for modification	\??\c:\Users\Public\Pictures\desktop.ini	rundll32.exe
File opened for modification	\??\c:\Users\Admin\Favorites\Links\desktop.ini	rundll32.exe
File opened for modification	\??\c:\Users\Admin\Videos\desktop.ini	rundll32.exe
File opened for modification	\??\c:\Users\Public\Music\desktop.ini	rundll32.exe
File opened for modification	\??\c:\Users\Public\AccountPictures\desktop.ini	rundll32.exe
File opened for modification	\??\c:\Users\Public\Desktop\desktop.ini	rundll32.exe
File opened for modification	\??\c:\Users\Admin\3D Objects\desktop.ini	rundll32.exe
File opened for modification	\??\c:\Users\Admin\Contacts\desktop.ini	rundll32.exe
File opened for modification	\??\c:\Users\Admin\Downloads\desktop.ini	rundll32.exe
File opened for modification	\??\c:\Users\Admin\Favorites\desktop.ini	rundll32.exe
File opened for modification	\??\c:\Users\Admin\Music\desktop.ini	rundll32.exe
File opened for modification	\??\c:\Users\Admin\Pictures\Saved Pictures\desktop.ini	rundll32.exe
File opened for modification	\??\c:\Users\Public\Libraries\desktop.ini	rundll32.exe
File opened for modification	\??\c:\Users\Public\Videos\desktop.ini	rundll32.exe
File opened for modification	\??\c:\Users\Admin\Desktop\desktop.ini	rundll32.exe
File opened for modification	\??\c:\Users\Admin\Pictures\desktop.ini	rundll32.exe
File opened for modification	\??\c:\Users\Public\Documents\desktop.ini	rundll32.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\da14a299-2a38-4ad2-b8df-1d045d7f393d.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230222034240.pma	setup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\.quantum	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\.quantum\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\.quantum\shell\Open	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\.quantum\shell\Open\command\ = "explorer.exe README_TO_DECRYPT.html"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\.quantum\shell\Open\command	rundll32.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2560	rundll32.exe
2560	rundll32.exe
2116	msedge.exe
2116	msedge.exe
4460	msedge.exe
4460	msedge.exe
1932	identity_helper.exe
1932	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2560	rundll32.exe
Token: SeDebugPrivilege	2560	rundll32.exe

Suspicious use of FindShellTrayWindow 11 IoCs

pid	Process
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe

Suspicious use of SendNotifyMessage 8 IoCs

pid	Process
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4460 wrote to memory of 5032	4460	msedge.exe	87
PID 4460 wrote to memory of 5032	4460	msedge.exe	87
PID 4460 wrote to memory of 4856	4460	msedge.exe	88
PID 4460 wrote to memory of 4856	4460	msedge.exe	88
PID 4460 wrote to memory of 4856	4460	msedge.exe	88
PID 4460 wrote to memory of 4856	4460	msedge.exe	88
PID 4460 wrote to memory of 4856	4460	msedge.exe	88
PID 4460 wrote to memory of 4856	4460	msedge.exe	88
PID 4460 wrote to memory of 4856	4460	msedge.exe	88
PID 4460 wrote to memory of 4856	4460	msedge.exe	88
PID 4460 wrote to memory of 4856	4460	msedge.exe	88
PID 4460 wrote to memory of 4856	4460	msedge.exe	88
PID 4460 wrote to memory of 4856	4460	msedge.exe	88
PID 4460 wrote to memory of 4856	4460	msedge.exe	88
PID 4460 wrote to memory of 4856	4460	msedge.exe	88
PID 4460 wrote to memory of 4856	4460	msedge.exe	88
PID 4460 wrote to memory of 4856	4460	msedge.exe	88
PID 4460 wrote to memory of 4856	4460	msedge.exe	88
PID 4460 wrote to memory of 4856	4460	msedge.exe	88
PID 4460 wrote to memory of 4856	4460	msedge.exe	88
PID 4460 wrote to memory of 4856	4460	msedge.exe	88
PID 4460 wrote to memory of 4856	4460	msedge.exe	88
PID 4460 wrote to memory of 4856	4460	msedge.exe	88
PID 4460 wrote to memory of 4856	4460	msedge.exe	88
PID 4460 wrote to memory of 4856	4460	msedge.exe	88
PID 4460 wrote to memory of 4856	4460	msedge.exe	88
PID 4460 wrote to memory of 4856	4460	msedge.exe	88
PID 4460 wrote to memory of 4856	4460	msedge.exe	88
PID 4460 wrote to memory of 4856	4460	msedge.exe	88
PID 4460 wrote to memory of 4856	4460	msedge.exe	88
PID 4460 wrote to memory of 4856	4460	msedge.exe	88
PID 4460 wrote to memory of 4856	4460	msedge.exe	88
PID 4460 wrote to memory of 4856	4460	msedge.exe	88
PID 4460 wrote to memory of 4856	4460	msedge.exe	88
PID 4460 wrote to memory of 4856	4460	msedge.exe	88
PID 4460 wrote to memory of 4856	4460	msedge.exe	88
PID 4460 wrote to memory of 4856	4460	msedge.exe	88
PID 4460 wrote to memory of 4856	4460	msedge.exe	88
PID 4460 wrote to memory of 4856	4460	msedge.exe	88
PID 4460 wrote to memory of 4856	4460	msedge.exe	88
PID 4460 wrote to memory of 4856	4460	msedge.exe	88
PID 4460 wrote to memory of 4856	4460	msedge.exe	88
PID 4460 wrote to memory of 2116	4460	msedge.exe	89
PID 4460 wrote to memory of 2116	4460	msedge.exe	89
PID 4460 wrote to memory of 1708	4460	msedge.exe	90
PID 4460 wrote to memory of 1708	4460	msedge.exe	90
PID 4460 wrote to memory of 1708	4460	msedge.exe	90
PID 4460 wrote to memory of 1708	4460	msedge.exe	90
PID 4460 wrote to memory of 1708	4460	msedge.exe	90
PID 4460 wrote to memory of 1708	4460	msedge.exe	90
PID 4460 wrote to memory of 1708	4460	msedge.exe	90
PID 4460 wrote to memory of 1708	4460	msedge.exe	90
PID 4460 wrote to memory of 1708	4460	msedge.exe	90
PID 4460 wrote to memory of 1708	4460	msedge.exe	90
PID 4460 wrote to memory of 1708	4460	msedge.exe	90
PID 4460 wrote to memory of 1708	4460	msedge.exe	90
PID 4460 wrote to memory of 1708	4460	msedge.exe	90
PID 4460 wrote to memory of 1708	4460	msedge.exe	90
PID 4460 wrote to memory of 1708	4460	msedge.exe	90
PID 4460 wrote to memory of 1708	4460	msedge.exe	90
PID 4460 wrote to memory of 1708	4460	msedge.exe	90
PID 4460 wrote to memory of 1708	4460	msedge.exe	90
PID 4460 wrote to memory of 1708	4460	msedge.exe	90
PID 4460 wrote to memory of 1708	4460	msedge.exe	90

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
3884	attrib.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1d64879bf7b1c7aea1d3c2c0171b31a329d026dc4e2f1c876d7ec7cae17bbc58.dll,#1
1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2560
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\\0E56B098.bat" "C:\Users\Admin\AppData\Local\Temp\1d64879bf7b1c7aea1d3c2c0171b31a329d026dc4e2f1c876d7ec7cae17bbc58.dll""
  2⤵
  PID:3272
- - C:\Windows\system32\attrib.exe
    attrib -s -r -h "C:\Users\Admin\AppData\Local\Temp\1d64879bf7b1c7aea1d3c2c0171b31a329d026dc4e2f1c876d7ec7cae17bbc58.dll"
    3⤵
    - Views/modifies file attributes
    PID:3884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\README_TO_DECRYPT.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffcb0d046f8,0x7ffcb0d04708,0x7ffcb0d04718
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,7638857964099825123,12946791027473431277,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,7638857964099825123,12946791027473431277,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,7638857964099825123,12946791027473431277,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:8
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7638857964099825123,12946791027473431277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3584 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7638857964099825123,12946791027473431277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,7638857964099825123,12946791027473431277,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:1760
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff620375460,0x7ff620375470,0x7ff620375480
    3⤵
    PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,7638857964099825123,12946791027473431277,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7638857964099825123,12946791027473431277,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7638857964099825123,12946791027473431277,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7638857964099825123,12946791027473431277,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7638857964099825123,12946791027473431277,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:4124

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1772

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

README_TO_DECRYPT.html

Path C:\Users\Admin\3D Objects\README_TO_DECRYPT.html
Size 2KB
SHA256 b2ee0d7a2cd15e91c0bdd9d982b9b4477ba439ef5a394d4d8f2a5d9dac37be3e
MD5 4bcdbdff387a14d7e1578fbf5c24ece3
SHA1 69efbcb1bc7e0278eb75018c3641ae91a0388a88
SHA512 ca78b0db4df2fbf8c157b1949e55e4add749e749d408e49f4ccbd83f86386ac47ffad846d932940b46412622f8e29e11d5bb52d08088f0983cebbe1c393959ac
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1654b27bfaeee49bfe56e0c4c0303418f4887f3ea1933f03cafce10352321aef
MD5 aaeb1f5e097ab38083674077b84b8ed6
SHA1 7d9191cb2277c30f1147c9d29d75fc8e6aa0a4f2
SHA512 130f1b62134626959f69b13e33c42c3182e343d7f0a5b6291f7bb0c2f64b60885f5e6331e1866a4944e9b7b2e49fe798e073316fde23927ede2c348ba0e56eda
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 0d73ba3eea4c552ce3ffa767e4cd5fff4e459e543756987ab5d55f1e6d963f48
MD5 1db53baf44edd6b1bc2b7576e2f01e12
SHA1 e35739fa87978775dcb3d8df5c8d2063631fa8df
SHA512 84f544858803ac14bac962d2df1dbc7ed6e1134ecf16d242d7ee7316648b56b5bc095241363837bf0bf0afd16ca7deebe7afb7d40057604acbf09821fd5a9912
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25
MD5 e5e3377341056643b0494b6842c0b544
SHA1 d53fd8e256ec9d5cef8ef5387872e544a2df9108
SHA512 83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef
SSDEEP 1536:vAlMWz7vLDtDSVlXXwpFlorgLUxF+D4n6owPFCawP/:vvuWAUxFaoGw/
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Microsoft Edge.lnk

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk
Size 2KB
SHA256 22d224ac43b4df709248e700e9dbfa68bc0c352616bd2602ec95aeea3fceb154
MD5 4de2bda3268cfe8b7045920ed3efe7d3
SHA1 803655a23e368af2e1130793bd9e96499f76ee69
SHA512 9577627fea9313fe195090d4541cb9dd58632e830f646628ed00199f32ec68b3f85a7ddb230228c4b64b8f4e8d5b85a1d4feba8c9986f0d6fbca3239d577f929
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 a1effa1f89138fa96843b2425e1a545f853b01c51e9d679e26d8e66e922e7161
MD5 8f2741c71621b9fdd25be3e26b1aa7b0
SHA1 1a07271e511d45000d24a527dcf7e39563b7f4de
SHA512 6d0e40e73367ed9b6d9290aa3ece1d291a4e6e7e9ccb1ccba3a6fe1e3b65f9bba6d3587d0ddc0ec1d2fde5899cb68db23d2dc0f2e52ddce5351d05169987723e
SSDEEP 96:nE681hmwpvWMoiVmdeH426tUWQyV+VD7AiEwb:nEXzmGWMXvorg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 4KB
SHA256 6aafb3b2fe667cf9370bc655983cb3ba891d6013ecda19fc3101463468ad4f7b
MD5 2f23b48cc83140816098b4cd96bb2f31
SHA1 39eda00176c453a0892ec470063a552e8385107b
SHA512 966c1905a1ff65a2d95fdc3daa61ed4e2e713e66a11ae60c6f9d822499e2af8b6b30a190371fc5ca87431f040753406aee465b276dbf044721fef7bc60e4c192
SSDEEP 96:nCA81h2wpvWMoiVmdeH426tUWQyV+VDCAia:nCRz2GWMXvore
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 24KB
SHA256 15c77bafd922bd085317fd544d0fa129e3b8c814e3ba0d48936366004427732e
MD5 47e94a96372e6f095b8a3fd7edc48ec0
SHA1 377b68f34e5964ca8be1b1b0c1507dd7f0e5f005
SHA512 5bd63de2e831805b723d7ddf1343c3b721ef5b757d9ab01bf8554ef8e29ac2cc09fa104fc85d530f27d66b67280774b3ebbef6729ea3ab61ce8028ab4ba5bdad
SSDEEP 768:leWQU8F1+UoAYDCx9Tuqh0VfUC9xbog/OVWLlWorUpS:leWQUu1jaXLgQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 23e3dc6a78f9e7f9507374ffc6efc759ea23927096bf72ec2536e2c3b1e4a152
MD5 033cd6ed5a17834914c41e5697de6974
SHA1 0dfb12bfaa32fb5f42acfa560fe7edcb7b970ad0
SHA512 f6c5482132409d84b548813c2081269f412794128145b2fb1a5a7d6b7b4354d1543427d08f3d47afe548c161ff0410487191497d3912f4a93b28980fd9cf65e7
SSDEEP 192:7oCL/Pgu90RZj8g6FA4liIuERzA83h09RZxAzuExd4VtKLe2RUjSEPY/b3uSD:RhiIuERzA83h09RZxmeVwbMYTuSD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 db60c5051af17815fd23777827448738c52094ad183926ded3d852454f0300a6
MD5 09711146c7e797408805dea1e9726d68
SHA1 cd87f99fc7750c5ee3a0ec3b07d57cb5f97c2283
SHA512 f3b9e00b36a144c933a57002ddce542a7cefcb905fc4cddc7821c7ece88877174b6655359f73b969f362d6ae4ea6efd281313973c239eb6d5204f9d79c7d7d79
SSDEEP 384:nhiIuERzA83h09RZxmKIVwbMYTi1DENczqX2+/:IIuERzA83h09RZx/IqwMi3aJ/
MD5 SHA1 SHA512 SSDEEP

Submit Download

0E56B098.bat

Path C:\Users\Admin\AppData\Local\Temp\0E56B098.bat
Size 65B
SHA256 c80128f51871eec3ae2057989a025ce244277c1c180498a5aaef45d5214b8506
MD5 348cae913e496198548854f5ff2f6d1e
SHA1 a07655b9020205bd47084afd62a8bb22b48c0cdc
SHA512 799796736d41d3fcb5a7c859571bb025ca2d062c4b86e078302be68c1a932ed4f78e003640df5405274364b5a9a9c0ba5e37177997683ee7ab54e5267590b611
MD5 SHA1 SHA512

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 3KB
SHA256 53c52e206005863791fef097e52a63a87207c8b613496ecacd2db5aacc70e1ba
MD5 7327bf2be906de55366bbaeee37459a1
SHA1 6f520520cd5fdc84e52d56f6d99ef536ab9714ad
SHA512 2d950ea9d77177df1470989c608e81618fdf13df1f8475b03d467832d06ab66ad5db2c58a24054941de9e29aed921349cc148586e12a8e6fbfc20d297701dfa7
MD5 SHA1 SHA512

Submit Download

README_TO_DECRYPT.html

Path C:\Users\Admin\Desktop\README_TO_DECRYPT.html
Size 2KB
SHA256 b2ee0d7a2cd15e91c0bdd9d982b9b4477ba439ef5a394d4d8f2a5d9dac37be3e
MD5 4bcdbdff387a14d7e1578fbf5c24ece3
SHA1 69efbcb1bc7e0278eb75018c3641ae91a0388a88
SHA512 ca78b0db4df2fbf8c157b1949e55e4add749e749d408e49f4ccbd83f86386ac47ffad846d932940b46412622f8e29e11d5bb52d08088f0983cebbe1c393959ac
MD5 SHA1 SHA512

Submit Download

memory/4856-387-0x00007FFCCD380000-0x00007FFCCD381000-memory.dmp

Download