quantum | 1d64879bf7b1c7aea1d3c2c0171b31a329d026dc4e2f1c876d7ec7cae17bbc58

Analysis

max time kernel
31s
max time network
26s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
22-02-2023 02:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1d64879bf7b1c7aea1d3c2c0171b31a329d026dc4e2f1c876d7ec7cae17bbc58.dll
Size

76KB
MD5

8a132d9eb16ab0a492c7858fa5d6b6fb
SHA1

bb3d3258e9207f9499f3f7dcf53442fc8ddabd45
SHA256

1d64879bf7b1c7aea1d3c2c0171b31a329d026dc4e2f1c876d7ec7cae17bbc58
SHA512

7f74eece1ba22e553f86c151b5364207b06b46ffb58330406021c668e2ee5fa332a8dabcf227278f10dfbc7a6d2593f5d2fb32e344c33fca174874300c9eb985
SSDEEP

1536:PaX1IbkVQJih8Ls2WZYbz+n26HNmAC6UsK4Xe:0KntKmzK2736UsK4

Score

10^/10

quantum ransomware

Malware Config

Extracted

Path

C:\Users\Admin\3D Objects\README_TO_DECRYPT.html

Family

quantum

Ransom Note

<html> <head> <title>Quantum</title> </head> <body> <h1>Your ID:</h1> <pre> 5f9d05e06bea5711acba31a7b1740c807dd89d7c38d74d6648ea0fb0e5dc0d35 </pre> <hr/> This message contains an information how to fix the troubles you've got with your network. Files on the workstations in your network were encrypted and any your attempt to change, decrypt or rename them could destroy the content. The only way to get files back is a decryption with Key, provided by the Quantum Locker. During the period your network was under our control, we downloaded a huge volume of information. Now it is stored on our servers with high-secure access. This information contains a lot of sensitive, private and personal data. Publishing of such data will cause serious consequences and even business disruption. It's not a threat, on the contrary - it's a manual how to get a way out. Quantum team doesn't aim to damage your company, our goals are only financial. After a payment you'll get network decryption, full destruction of downloaded data, information about your network vulnerabilities and penetration points. If you decide not to negotiate, in 48 hours the fact of the attack and all your information will be posted on our site and will be promoted among dozens of cyber forums, news agencies, websites etc. To contact our support and start the negotiations, please visit our support chat. It is simple, secure and you can set a password to avoid intervention of unauthorised persons. <a href="http://iwwbtudyckekvukw7462v32ugqgnzzzaxsyw5yfxhe24ok5hbc46x6qd.onion/?cid=5f9d05e06bea5711acba31a7b1740c807dd89d7c38d74d6648ea0fb0e5dc0d35">http://iwwbtudyckekvukw7462v32ugqgnzzzaxsyw5yfxhe24ok5hbc46x6qd.onion/?cid=5f9d05e06bea5711acba31a7b1740c807dd89d7c38d74d6648ea0fb0e5dc0d35</a> <ul> <li>Password field should be blank for the first login. <li>Note that this server is available via Tor browser only. </ul> P.S. How to get TOR browser - see at https://www.torproject.org </body> </html>

Extracted

Path

C:\Users\Admin\Desktop\README_TO_DECRYPT.html

Family

quantum

Ransom Note

Your ID: This message contains an information how to fix the troubles you've got with your network. Files on the workstations in your network were encrypted and any your attempt to change, decrypt or rename them could destroy the content. The only way to get files back is a decryption with Key, provided by the Quantum Locker. During the period your network was under our control, we downloaded a huge volume of information. Now it is stored on our servers with high-secure access. This information contains a lot of sensitive, private and personal data. Publishing of such data will cause serious consequences and even business disruption. It's not a threat, on the contrary - it's a manual how to get a way out. Quantum team doesn't aim to damage your company, our goals are only financial. After a payment you'll get network decryption, full destruction of downloaded data, information about your network vulnerabilities and penetration points. If you decide not to negotiate, in 48 hours the fact of the attack and all your information will be posted on our site and will be promoted among dozens of cyber forums, news agencies, websites etc. To contact our support and start the negotiations, please visit our support chat. It is simple, secure and you can set a password to avoid intervention of unauthorised persons. http://iwwbtudyckekvukw7462v32ugqgnzzzaxsyw5yfxhe24ok5hbc46x6qd.onion/?cid=5f9d05e06bea5711acba31a7b1740c807dd89d7c38d74d6648ea0fb0e5dc0d35 Password field should be blank for the first login. Note that this server is available via Tor browser only. P.S. How to get TOR browser - see at https://www.torproject.org

URLs

http://iwwbtudyckekvukw7462v32ugqgnzzzaxsyw5yfxhe24ok5hbc46x6qd.onion/?cid=5f9d05e06bea5711acba31a7b1740c807dd89d7c38d74d6648ea0fb0e5dc0d35

Signatures

Quantum Ransomware
A rebrand of the MountLocker ransomware first seen in August 2021.
ransomware quantum

Modifies extensions of user files 13 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

rundll32.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\NewUndo.tiff => \??\c:\Users\Admin\Pictures\NewUndo.tiff.quantum	rundll32.exe
File renamed	C:\Users\Admin\Pictures\UnblockMerge.png => \??\c:\Users\Admin\Pictures\UnblockMerge.png.quantum	rundll32.exe
File renamed	C:\Users\Admin\Pictures\UnlockWait.raw => \??\c:\Users\Admin\Pictures\UnlockWait.raw.quantum	rundll32.exe
File renamed	C:\Users\Admin\Pictures\ConvertUnprotect.crw => \??\c:\Users\Admin\Pictures\ConvertUnprotect.crw.quantum	rundll32.exe
File renamed	C:\Users\Admin\Pictures\CopySend.png => \??\c:\Users\Admin\Pictures\CopySend.png.quantum	rundll32.exe
File renamed	C:\Users\Admin\Pictures\ExpandResume.tif => \??\c:\Users\Admin\Pictures\ExpandResume.tif.quantum	rundll32.exe
File renamed	C:\Users\Admin\Pictures\LockUnblock.raw => \??\c:\Users\Admin\Pictures\LockUnblock.raw.quantum	rundll32.exe
File opened for modification	\??\c:\Users\Admin\Pictures\NewUndo.tiff	rundll32.exe
File opened for modification	\??\c:\Users\Admin\Pictures\UnpublishTrace.tiff	rundll32.exe
File renamed	C:\Users\Admin\Pictures\AddUnpublish.png => \??\c:\Users\Admin\Pictures\AddUnpublish.png.quantum	rundll32.exe
File renamed	C:\Users\Admin\Pictures\PopUnregister.tif => \??\c:\Users\Admin\Pictures\PopUnregister.tif.quantum	rundll32.exe
File renamed	C:\Users\Admin\Pictures\PushNew.png => \??\c:\Users\Admin\Pictures\PushNew.png.quantum	rundll32.exe
File renamed	C:\Users\Admin\Pictures\UnpublishTrace.tiff => \??\c:\Users\Admin\Pictures\UnpublishTrace.tiff.quantum	rundll32.exe

Drops desktop.ini file(s) 25 IoCs

Processes:

rundll32.exe

description	ioc	process
File opened for modification	\??\c:\Users\Public\desktop.ini	rundll32.exe
File opened for modification	\??\c:\Users\Public\Downloads\desktop.ini	rundll32.exe
File opened for modification	\??\c:\Users\Admin\Documents\desktop.ini	rundll32.exe
File opened for modification	\??\c:\Users\Admin\Links\desktop.ini	rundll32.exe
File opened for modification	\??\c:\Users\Admin\OneDrive\desktop.ini	rundll32.exe
File opened for modification	\??\c:\Users\Admin\Pictures\Camera Roll\desktop.ini	rundll32.exe
File opened for modification	\??\c:\Users\Admin\Saved Games\desktop.ini	rundll32.exe
File opened for modification	\??\c:\Users\Admin\Searches\desktop.ini	rundll32.exe
File opened for modification	\??\c:\Users\Public\Pictures\desktop.ini	rundll32.exe
File opened for modification	\??\c:\Users\Admin\Favorites\Links\desktop.ini	rundll32.exe
File opened for modification	\??\c:\Users\Admin\Videos\desktop.ini	rundll32.exe
File opened for modification	\??\c:\Users\Public\Music\desktop.ini	rundll32.exe
File opened for modification	\??\c:\Users\Public\AccountPictures\desktop.ini	rundll32.exe
File opened for modification	\??\c:\Users\Public\Desktop\desktop.ini	rundll32.exe
File opened for modification	\??\c:\Users\Admin\3D Objects\desktop.ini	rundll32.exe
File opened for modification	\??\c:\Users\Admin\Contacts\desktop.ini	rundll32.exe
File opened for modification	\??\c:\Users\Admin\Downloads\desktop.ini	rundll32.exe
File opened for modification	\??\c:\Users\Admin\Favorites\desktop.ini	rundll32.exe
File opened for modification	\??\c:\Users\Admin\Music\desktop.ini	rundll32.exe
File opened for modification	\??\c:\Users\Admin\Pictures\Saved Pictures\desktop.ini	rundll32.exe
File opened for modification	\??\c:\Users\Public\Libraries\desktop.ini	rundll32.exe
File opened for modification	\??\c:\Users\Public\Videos\desktop.ini	rundll32.exe
File opened for modification	\??\c:\Users\Admin\Desktop\desktop.ini	rundll32.exe
File opened for modification	\??\c:\Users\Admin\Pictures\desktop.ini	rundll32.exe
File opened for modification	\??\c:\Users\Public\Documents\desktop.ini	rundll32.exe

Drops file in Program Files directory 2 IoCs

Processes:

setup.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\da14a299-2a38-4ad2-b8df-1d045d7f393d.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230222034240.pma	setup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 6 IoCs

Processes:

rundll32.exemsedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\.quantum	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\.quantum\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\.quantum\shell\Open	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\.quantum\shell\Open\command\ = "explorer.exe README_TO_DECRYPT.html"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\.quantum\shell\Open\command	rundll32.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

rundll32.exemsedge.exemsedge.exeidentity_helper.exe

pid process

2560 rundll32.exe
2560 rundll32.exe
2116 msedge.exe
2116 msedge.exe
4460 msedge.exe
4460 msedge.exe
1932 identity_helper.exe
1932 identity_helper.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

4460 msedge.exe
4460 msedge.exe
4460 msedge.exe
4460 msedge.exe
4460 msedge.exe
4460 msedge.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

rundll32.exe

description pid process

Token: SeRestorePrivilege 2560 rundll32.exe
Token: SeDebugPrivilege 2560 rundll32.exe

pid	process
2560	rundll32.exe
2560	rundll32.exe
2116	msedge.exe
2116	msedge.exe
4460	msedge.exe
4460	msedge.exe
1932	identity_helper.exe
1932	identity_helper.exe

description	pid	process
Token: SeRestorePrivilege	2560	rundll32.exe
Token: SeDebugPrivilege	2560	rundll32.exe

Suspicious use of FindShellTrayWindow 11 IoCs

Processes:

msedge.exe

pid	process
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe

Suspicious use of SendNotifyMessage 8 IoCs

Processes:

msedge.exe

pid process

4460 msedge.exe
4460 msedge.exe
4460 msedge.exe
4460 msedge.exe
4460 msedge.exe
4460 msedge.exe
4460 msedge.exe
4460 msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4460 wrote to memory of 5032	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 5032	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 4856	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 4856	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 4856	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 4856	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 4856	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 4856	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 4856	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 4856	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 4856	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 4856	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 4856	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 4856	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 4856	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 4856	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 4856	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 4856	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 4856	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 4856	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 4856	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 4856	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 4856	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 4856	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 4856	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 4856	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 4856	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 4856	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 4856	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 4856	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 4856	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 4856	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 4856	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 4856	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 4856	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 4856	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 4856	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 4856	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 4856	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 4856	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 4856	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 4856	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 2116	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 2116	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 1708	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 1708	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 1708	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 1708	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 1708	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 1708	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 1708	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 1708	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 1708	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 1708	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 1708	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 1708	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 1708	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 1708	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 1708	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 1708	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 1708	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 1708	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 1708	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 1708	4460	msedge.exe	msedge.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exe

pid process

3884 attrib.exe

pid	process
3884	attrib.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1d64879bf7b1c7aea1d3c2c0171b31a329d026dc4e2f1c876d7ec7cae17bbc58.dll,#1
1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2560
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\\0E56B098.bat" "C:\Users\Admin\AppData\Local\Temp\1d64879bf7b1c7aea1d3c2c0171b31a329d026dc4e2f1c876d7ec7cae17bbc58.dll""
  2⤵
  PID:3272
- - C:\Windows\system32\attrib.exe
    attrib -s -r -h "C:\Users\Admin\AppData\Local\Temp\1d64879bf7b1c7aea1d3c2c0171b31a329d026dc4e2f1c876d7ec7cae17bbc58.dll"
    3⤵
    - Views/modifies file attributes
    PID:3884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\README_TO_DECRYPT.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffcb0d046f8,0x7ffcb0d04708,0x7ffcb0d04718
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,7638857964099825123,12946791027473431277,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,7638857964099825123,12946791027473431277,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,7638857964099825123,12946791027473431277,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:8
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7638857964099825123,12946791027473431277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3584 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7638857964099825123,12946791027473431277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,7638857964099825123,12946791027473431277,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:1760
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff620375460,0x7ff620375470,0x7ff620375480
    3⤵
    PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,7638857964099825123,12946791027473431277,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7638857964099825123,12946791027473431277,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7638857964099825123,12946791027473431277,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7638857964099825123,12946791027473431277,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7638857964099825123,12946791027473431277,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:4124

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1772

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\3D Objects\README_TO_DECRYPT.html

Filesize
2KB

MD5
4bcdbdff387a14d7e1578fbf5c24ece3

SHA1
69efbcb1bc7e0278eb75018c3641ae91a0388a88

SHA256
b2ee0d7a2cd15e91c0bdd9d982b9b4477ba439ef5a394d4d8f2a5d9dac37be3e

SHA512
ca78b0db4df2fbf8c157b1949e55e4add749e749d408e49f4ccbd83f86386ac47ffad846d932940b46412622f8e29e11d5bb52d08088f0983cebbe1c393959ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
aaeb1f5e097ab38083674077b84b8ed6

SHA1
7d9191cb2277c30f1147c9d29d75fc8e6aa0a4f2

SHA256
1654b27bfaeee49bfe56e0c4c0303418f4887f3ea1933f03cafce10352321aef

SHA512
130f1b62134626959f69b13e33c42c3182e343d7f0a5b6291f7bb0c2f64b60885f5e6331e1866a4944e9b7b2e49fe798e073316fde23927ede2c348ba0e56eda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1db53baf44edd6b1bc2b7576e2f01e12

SHA1
e35739fa87978775dcb3d8df5c8d2063631fa8df

SHA256
0d73ba3eea4c552ce3ffa767e4cd5fff4e459e543756987ab5d55f1e6d963f48

SHA512
84f544858803ac14bac962d2df1dbc7ed6e1134ecf16d242d7ee7316648b56b5bc095241363837bf0bf0afd16ca7deebe7afb7d40057604acbf09821fd5a9912

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
4de2bda3268cfe8b7045920ed3efe7d3

SHA1
803655a23e368af2e1130793bd9e96499f76ee69

SHA256
22d224ac43b4df709248e700e9dbfa68bc0c352616bd2602ec95aeea3fceb154

SHA512
9577627fea9313fe195090d4541cb9dd58632e830f646628ed00199f32ec68b3f85a7ddb230228c4b64b8f4e8d5b85a1d4feba8c9986f0d6fbca3239d577f929

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8f2741c71621b9fdd25be3e26b1aa7b0

SHA1
1a07271e511d45000d24a527dcf7e39563b7f4de

SHA256
a1effa1f89138fa96843b2425e1a545f853b01c51e9d679e26d8e66e922e7161

SHA512
6d0e40e73367ed9b6d9290aa3ece1d291a4e6e7e9ccb1ccba3a6fe1e3b65f9bba6d3587d0ddc0ec1d2fde5899cb68db23d2dc0f2e52ddce5351d05169987723e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
2f23b48cc83140816098b4cd96bb2f31

SHA1
39eda00176c453a0892ec470063a552e8385107b

SHA256
6aafb3b2fe667cf9370bc655983cb3ba891d6013ecda19fc3101463468ad4f7b

SHA512
966c1905a1ff65a2d95fdc3daa61ed4e2e713e66a11ae60c6f9d822499e2af8b6b30a190371fc5ca87431f040753406aee465b276dbf044721fef7bc60e4c192

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
47e94a96372e6f095b8a3fd7edc48ec0

SHA1
377b68f34e5964ca8be1b1b0c1507dd7f0e5f005

SHA256
15c77bafd922bd085317fd544d0fa129e3b8c814e3ba0d48936366004427732e

SHA512
5bd63de2e831805b723d7ddf1343c3b721ef5b757d9ab01bf8554ef8e29ac2cc09fa104fc85d530f27d66b67280774b3ebbef6729ea3ab61ce8028ab4ba5bdad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
033cd6ed5a17834914c41e5697de6974

SHA1
0dfb12bfaa32fb5f42acfa560fe7edcb7b970ad0

SHA256
23e3dc6a78f9e7f9507374ffc6efc759ea23927096bf72ec2536e2c3b1e4a152

SHA512
f6c5482132409d84b548813c2081269f412794128145b2fb1a5a7d6b7b4354d1543427d08f3d47afe548c161ff0410487191497d3912f4a93b28980fd9cf65e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
09711146c7e797408805dea1e9726d68

SHA1
cd87f99fc7750c5ee3a0ec3b07d57cb5f97c2283

SHA256
db60c5051af17815fd23777827448738c52094ad183926ded3d852454f0300a6

SHA512
f3b9e00b36a144c933a57002ddce542a7cefcb905fc4cddc7821c7ece88877174b6655359f73b969f362d6ae4ea6efd281313973c239eb6d5204f9d79c7d7d79

Download Submit
C:\Users\Admin\AppData\Local\Temp\0E56B098.bat

Filesize
65B

MD5
348cae913e496198548854f5ff2f6d1e

SHA1
a07655b9020205bd47084afd62a8bb22b48c0cdc

SHA256
c80128f51871eec3ae2057989a025ce244277c1c180498a5aaef45d5214b8506

SHA512
799796736d41d3fcb5a7c859571bb025ca2d062c4b86e078302be68c1a932ed4f78e003640df5405274364b5a9a9c0ba5e37177997683ee7ab54e5267590b611

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
7327bf2be906de55366bbaeee37459a1

SHA1
6f520520cd5fdc84e52d56f6d99ef536ab9714ad

SHA256
53c52e206005863791fef097e52a63a87207c8b613496ecacd2db5aacc70e1ba

SHA512
2d950ea9d77177df1470989c608e81618fdf13df1f8475b03d467832d06ab66ad5db2c58a24054941de9e29aed921349cc148586e12a8e6fbfc20d297701dfa7

Download Submit
C:\Users\Admin\Desktop\README_TO_DECRYPT.html

Filesize
2KB

MD5
4bcdbdff387a14d7e1578fbf5c24ece3

SHA1
69efbcb1bc7e0278eb75018c3641ae91a0388a88

SHA256
b2ee0d7a2cd15e91c0bdd9d982b9b4477ba439ef5a394d4d8f2a5d9dac37be3e

SHA512
ca78b0db4df2fbf8c157b1949e55e4add749e749d408e49f4ccbd83f86386ac47ffad846d932940b46412622f8e29e11d5bb52d08088f0983cebbe1c393959ac

Download Submit
\??\pipe\LOCAL\crashpad_4460_ACOUCBABEIIWNVCS

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/4856-387-0x00007FFCCD380000-0x00007FFCCD381000-memory.dmp

Filesize
4KB

Download