quantum | 511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280

Analysis

max time kernel
97s
max time network
99s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
22/02/2023, 02:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
Size

64KB
MD5

0c4c33d99a04d6e47e2338949d470bce
SHA1

eb61609571bf629079f685fb66a931df20b6b12b
SHA256

511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280
SHA512

a7eb1b0489ca94a0ac18ac40b974e9ba3a4082865129eb21001596ef7b37ac4655fdd6dbcb703c193ba2250ee0af620b9c674c52de21feffb51b4be56b3acb56
SSDEEP

768:GnJ9uwtbJD/QpEdTrArzVpCK1w22TYgNvCJ037FLxZKQJRNz0TqXfJCju0L:G+wr1AB0AwB57F9npz0Ta4ju0L

Score

10^/10

quantum ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\README_TO_DECRYPT.html

Family

quantum

Ransom Note

<html> <head> <title>Quantum</title> </head> <body> <h1>Your ID:</h1> <pre> 5dbde59c615c8fb9346c52ea827b67c578d5a31382b27ddcebdc11b4ec12b446 </pre> <hr/> This message contains an information how to fix the troubles you've got with your network. Files on the workstations in your network were encrypted and any your attempt to change, decrypt or rename them could destroy the content. The only way to get files back is a decryption with Key, provided by the Quantum Locker. During the period your network was under our control, we downloaded a huge volume of information. Now it is stored on our servers with high-secure access. This information contains a lot of sensitive, private and personal data. Publishing of such data will cause serious consequences and even business disruption. It's not a threat, on the contrary - it's a manual how to get a way out. Quantum team doesn't aim to damage your company, our goals are only financial. After a payment you'll get network decryption, full destruction of downloaded data, information about your network vulnerabilities and penetration points. If you decide not to negotiate, in 48 hours the fact of the attack and all your information will be posted on our site and will be promoted among dozens of cyber forums, news agencies, websites etc. To contact our support and start the negotiations, please visit our support chat. It is simple, secure and you can set a password to avoid intervention of unauthorised persons. <a href="http://tijykgureh7kqq5cczzeutaoxvmf6yinpar72o3bxome7b44vwqxadyd.onion/?cid=5dbde59c615c8fb9346c52ea827b67c578d5a31382b27ddcebdc11b4ec12b446">http://tijykgureh7kqq5cczzeutaoxvmf6yinpar72o3bxome7b44vwqxadyd.onion/?cid=5dbde59c615c8fb9346c52ea827b67c578d5a31382b27ddcebdc11b4ec12b446</a> <ul> <li>Password field should be blank for the first login. <li>Note that this server is available via Tor browser only. </ul> P.S. How to get TOR browser - see at https://www.torproject.org </body> </html>

Extracted

Path

C:\Users\Admin\Desktop\README_TO_DECRYPT.html

Family

quantum

Ransom Note

Your ID: This message contains an information how to fix the troubles you've got with your network. Files on the workstations in your network were encrypted and any your attempt to change, decrypt or rename them could destroy the content. The only way to get files back is a decryption with Key, provided by the Quantum Locker. During the period your network was under our control, we downloaded a huge volume of information. Now it is stored on our servers with high-secure access. This information contains a lot of sensitive, private and personal data. Publishing of such data will cause serious consequences and even business disruption. It's not a threat, on the contrary - it's a manual how to get a way out. Quantum team doesn't aim to damage your company, our goals are only financial. After a payment you'll get network decryption, full destruction of downloaded data, information about your network vulnerabilities and penetration points. If you decide not to negotiate, in 48 hours the fact of the attack and all your information will be posted on our site and will be promoted among dozens of cyber forums, news agencies, websites etc. To contact our support and start the negotiations, please visit our support chat. It is simple, secure and you can set a password to avoid intervention of unauthorised persons. http://tijykgureh7kqq5cczzeutaoxvmf6yinpar72o3bxome7b44vwqxadyd.onion/?cid=5dbde59c615c8fb9346c52ea827b67c578d5a31382b27ddcebdc11b4ec12b446 Password field should be blank for the first login. Note that this server is available via Tor browser only. P.S. How to get TOR browser - see at https://www.torproject.org

URLs

http://tijykgureh7kqq5cczzeutaoxvmf6yinpar72o3bxome7b44vwqxadyd.onion/?cid=5dbde59c615c8fb9346c52ea827b67c578d5a31382b27ddcebdc11b4ec12b446

Signatures

Quantum Ransomware
A rebrand of the MountLocker ransomware first seen in August 2021.
ransomware quantum

Modifies extensions of user files 11 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File renamed	C:\Users\Admin\Pictures\ApproveNew.png => \??\c:\Users\Admin\Pictures\ApproveNew.png.quantum	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
File renamed	C:\Users\Admin\Pictures\ConfirmRead.tiff => \??\c:\Users\Admin\Pictures\ConfirmRead.tiff.quantum	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
File renamed	C:\Users\Admin\Pictures\UnregisterComplete.tiff => \??\c:\Users\Admin\Pictures\UnregisterComplete.tiff.quantum	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
File opened for modification	\??\c:\Users\Admin\Pictures\RestoreExit.tiff	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
File renamed	C:\Users\Admin\Pictures\RestoreExit.tiff => \??\c:\Users\Admin\Pictures\RestoreExit.tiff.quantum	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
File renamed	C:\Users\Admin\Pictures\UnprotectClose.raw => \??\c:\Users\Admin\Pictures\UnprotectClose.raw.quantum	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
File opened for modification	\??\c:\Users\Admin\Pictures\UnregisterComplete.tiff	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
File renamed	C:\Users\Admin\Pictures\AddUninstall.raw => \??\c:\Users\Admin\Pictures\AddUninstall.raw.quantum	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
File opened for modification	\??\c:\Users\Admin\Pictures\ConfirmRead.tiff	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
File renamed	C:\Users\Admin\Pictures\GetAssert.tif => \??\c:\Users\Admin\Pictures\GetAssert.tif.quantum	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
File renamed	C:\Users\Admin\Pictures\MeasureGrant.raw => \??\c:\Users\Admin\Pictures\MeasureGrant.raw.quantum	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe

Deletes itself 1 IoCs

pid	Process
992	cmd.exe

Drops desktop.ini file(s) 26 IoCs

description	ioc	Process
File opened for modification	\??\c:\Users\Admin\Searches\desktop.ini	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
File opened for modification	\??\c:\Users\Public\desktop.ini	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
File opened for modification	\??\c:\Users\Public\Downloads\desktop.ini	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
File opened for modification	\??\c:\Users\Public\Music\Sample Music\desktop.ini	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
File opened for modification	\??\c:\Users\Public\Recorded TV\desktop.ini	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
File opened for modification	\??\c:\Users\Admin\Links\desktop.ini	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
File opened for modification	\??\c:\Users\Admin\Music\desktop.ini	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
File opened for modification	\??\c:\Users\Admin\Saved Games\desktop.ini	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
File opened for modification	\??\c:\Users\Public\Documents\desktop.ini	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
File opened for modification	\??\c:\Users\Public\Videos\desktop.ini	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
File opened for modification	\??\c:\Users\Admin\Desktop\desktop.ini	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
File opened for modification	\??\c:\Users\Admin\Favorites\Links\desktop.ini	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
File opened for modification	\??\c:\Users\Admin\Pictures\desktop.ini	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
File opened for modification	\??\c:\Users\Public\Libraries\desktop.ini	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
File opened for modification	\??\c:\Users\Public\Music\desktop.ini	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
File opened for modification	\??\c:\Users\Public\Recorded TV\Sample Media\desktop.ini	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
File opened for modification	\??\c:\Users\Public\Videos\Sample Videos\desktop.ini	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
File opened for modification	\??\c:\Users\Admin\Contacts\desktop.ini	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
File opened for modification	\??\c:\Users\Admin\Videos\desktop.ini	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
File opened for modification	\??\c:\Users\Public\Desktop\desktop.ini	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
File opened for modification	\??\c:\Users\Admin\Favorites\Links for United States\desktop.ini	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
File opened for modification	\??\c:\Users\Public\Pictures\desktop.ini	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
File opened for modification	\??\c:\Users\Public\Pictures\Sample Pictures\desktop.ini	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
File opened for modification	\??\c:\Users\Admin\Documents\desktop.ini	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
File opened for modification	\??\c:\Users\Admin\Downloads\desktop.ini	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
File opened for modification	\??\c:\Users\Admin\Favorites\desktop.ini	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 2090ef0f7046d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dbb59ddc676e394a83d3f942d26f43ca00000000020000000000106600000001000020000000981ad87620cfd88d380f0b20f4ba29e81f7dd26e7c032bbd9aa05d812614931a000000000e8000000002000020000000326a76ee2141cd04aab6e0757aaf46427b2990d3acc97a9fe15a1f9d78e1045190000000e64d07533ef67841621dc499c6fad5717ccf3cb7aad6adf0f0c0885b744e243150b2779340bf056b430e35cdbd99ed523f2eb8082970caed67bbff530b1e26761a3c92280346c36bfdb0452310224b310a2d1068fc6305b125f6a77619ff944dc350d4472db96ea81593f896a047769b5f42ecaaf57e5e3431d1d4834cf725c68deef821aeb5ad96eb873265cbe0460a40000000d739660517399c3900ef84f1453be7609d7c268df3bc01c7d2ffbf19c94441c376648fbbe473fc8660219abe9a54bbd878d5d57bb5900bceb67d7807e30e848e	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3893D401-B263-11ED-AC43-E6255E64A624} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "383802449"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dbb59ddc676e394a83d3f942d26f43ca000000000200000000001066000000010000200000000b7bdf8f9d8dd90595898a5024497eb3cd9f672c2b03897aa31ee72643b03d23000000000e80000000020000200000000599c062c0fe8a9b9fad564ce2d86a3a6065880ce1a8123853fd7e428deaeb9c20000000d2f83335ed75ed85944e2b6752539dec82102f2840f95174da9f25bb63185c7e40000000276ce42917b606d12e588fd909fd2d5433bd9c96d8df0e94494f97357d9c0045dd4db73a635da625a02c339ac5d3598913b318e82a9dd34dbcc1fb07bb92d7d4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\.quantum\shell\Open\command	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\.quantum	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\.quantum\shell	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\.quantum\shell\Open	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\.quantum\shell\Open\command\ = "explorer.exe README_TO_DECRYPT.html"	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1188	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
1188	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	1188	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
Token: SeDebugPrivilege	1188	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1636	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1636	iexplore.exe
1636	iexplore.exe
1528	IEXPLORE.EXE
1528	IEXPLORE.EXE
1528	IEXPLORE.EXE
1528	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1188 wrote to memory of 992	1188	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe	29
PID 1188 wrote to memory of 992	1188	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe	29
PID 1188 wrote to memory of 992	1188	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe	29
PID 1188 wrote to memory of 992	1188	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe	29
PID 992 wrote to memory of 1732	992	cmd.exe	31
PID 992 wrote to memory of 1732	992	cmd.exe	31
PID 992 wrote to memory of 1732	992	cmd.exe	31
PID 992 wrote to memory of 1732	992	cmd.exe	31
PID 1636 wrote to memory of 1528	1636	iexplore.exe	34
PID 1636 wrote to memory of 1528	1636	iexplore.exe	34
PID 1636 wrote to memory of 1528	1636	iexplore.exe	34
PID 1636 wrote to memory of 1528	1636	iexplore.exe	34

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
1732	attrib.exe

C:\Users\Admin\AppData\Local\Temp\511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
"C:\Users\Admin\AppData\Local\Temp\511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe"
1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1188
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\\006C364D.bat" "C:\Users\Admin\AppData\Local\Temp\511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe""
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:992
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -r -h "C:\Users\Admin\AppData\Local\Temp\511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe"
    3⤵
    - Views/modifies file attributes
    PID:1732

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\README_TO_DECRYPT.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1636 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1528

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0b391aa89d3dc3036c72b7e65b71c90f

SHA1
67fccab552a52095bd8bee9c3dc1d184e1050381

SHA256
67baef66a414906266bb3e8dd1c8162b258c960ca00ea3810189a6da6709ee84

SHA512
3040492f180f1473dfeaacba7796008c84ffacb03e66a60aa56c4ed33bc59bc704e3b873b92561fdb4aaee0b127830a93b9c863807c802a9e40ae93612abf4be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c1dc39c1d8b7616f69fdd4629855abc

SHA1
00d3df1702abf89e7464e792a1cd56451999c7ea

SHA256
418bb9f8574f460999e31b4359f6cec32f06e0d5d341ec9cd3ca8f3426816174

SHA512
45bc58500c82cfce3f932b4c2f3bd30a231a42219a1e5d57456e8365719c2d17edafd423a3d248c5638b426d2c6f82f1a05898a5df988341cc28095fd8c6b69d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c8708c766de49e8d6cca893630b997b4

SHA1
c09cac77904b45e6a619677dbce600e426d2f7c6

SHA256
dd7ffa3699c5c356251179ec949051178a355b36163589702115cc1c2bf292eb

SHA512
2f920ae884e7b2c0a8c0f25f1c69189377c2adb6aa1f9d6677b5023751e3947005fa542b16d9d997872afcd3c47eb3b39c2fc9bc3a3b3503709e9790d03903cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
71866353eb1b92606c4c9d656e95ce12

SHA1
e53b6cd799cfddd027939851c6211a5777f00ce7

SHA256
59f6680e368bdcc4fa870fc8a2197366e0aede78a07e776121667065ea79c89a

SHA512
2562ea32b3fa60aff97e6eaedd8c2c0a079e15104403fb197939b72b5a9dbb6fefdaf6f6b427ef5d0ed7f1c11075bc53e0b457980239a42a981d21af8ec03d66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4a9c4300026bc9c74b8b3075dfc9e160

SHA1
a67d933427cb9f20069f270c5e7666755dfe0f2b

SHA256
5cb64475ad3a7b9eeddaa67ca26aa3df87842824f1518870ff63535155b28831

SHA512
e49b0f58915a805ae569758c6441ff2c1eac7967ad513212c940c5de03164965f50239feb3e45fb98268248d67b59b48c1b5d5bf439d9e6b4490eb6b9b3b0dac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb705a8d05121bfa636b1cc03002af49

SHA1
7b300f3c9fa9a45e1026f2e9b46a4186908e8840

SHA256
edbb4c1768b59d7640014445dd53e84c00725705ed2a0208c8767e55ab8c8cb8

SHA512
e30d1397fa37f9c6e161cbdc5ef3a83437b73203d3f955106a9e06207c7535ac11ba5049c5f69e66b21b40a27bb00d54506c9439f80ddcc19a9cc0cccf0bdf2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e334e92532e902645aa36aa2b3d89ea6

SHA1
a95f511e7ea7506738b6a6e111813e4270246c92

SHA256
a22f9d2ed22ab35cd5d4eb50246c15bcad5d050570119b139ded39ace5d940fd

SHA512
860e177c7e951ebb55aa039570a932d6a6da2b647e7bad5beb09c5cb664a26dc11fb8968d579a429f4ecc6094a136883ddb2c9ecd7a41267f39a4706b20b414b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
80c127e9baa37c8014088557fa71c0dd

SHA1
ddc81ea7db61a5ed08989801d20b720a29764915

SHA256
797d478846c1687749d5a76fd4782077a9a296e03bedd6c6238249c3ba04c150

SHA512
117f61f9d8540f36d63e20c45491e825728f305def1ccc5bc0b4232e822ef37cf20a71ebd118e29f76e0edd2cc147c022b058f88bb3cd37d6f149589c5b863bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fa9bac2310329b6b404025bedb7b9f57

SHA1
d1a47ed51e0a41cdef178a1d292746cac8da6da9

SHA256
c47ba804773478e5ca2ae9b49ef4593554abf4da8d2cf9d11479446c72a780cd

SHA512
73ffd245cd2fa5dab32aa8e4aa70741e008a7c6e502cc69cb2e464def25a56088bd1df437f9908356df0b704216d546a0ebdc627709657292730239e8680ef6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aa38cd9b64094dc7cb3cbde132987023

SHA1
c35f6d6dbf738e39c4d26f7860e9a7ebb43a6357

SHA256
9b30df0d49310ace1d3d634d8c32e457a609bb1a33213f2b0ee3f1850240b9c3

SHA512
96e654069ce9b76474c76d8c350e76cf0ea5567d7f0e340030225a95f78b674037284bd50297f04c092daa24d7a971dbe52a45ca32b85249fe57fa16463720aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\S7FIT0B8\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\006C364D.bat

Filesize
65B

MD5
348cae913e496198548854f5ff2f6d1e

SHA1
a07655b9020205bd47084afd62a8bb22b48c0cdc

SHA256
c80128f51871eec3ae2057989a025ce244277c1c180498a5aaef45d5214b8506

SHA512
799796736d41d3fcb5a7c859571bb025ca2d062c4b86e078302be68c1a932ed4f78e003640df5405274364b5a9a9c0ba5e37177997683ee7ab54e5267590b611

Download Submit
C:\Users\Admin\AppData\Local\Temp\006C364D.bat

Filesize
65B

MD5
348cae913e496198548854f5ff2f6d1e

SHA1
a07655b9020205bd47084afd62a8bb22b48c0cdc

SHA256
c80128f51871eec3ae2057989a025ce244277c1c180498a5aaef45d5214b8506

SHA512
799796736d41d3fcb5a7c859571bb025ca2d062c4b86e078302be68c1a932ed4f78e003640df5405274364b5a9a9c0ba5e37177997683ee7ab54e5267590b611

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC332.tmp

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC440.tmp

Filesize
161KB

MD5
73b4b714b42fc9a6aaefd0ae59adb009

SHA1
efdaffd5b0ad21913d22001d91bf6c19ecb4ac41

SHA256
c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd

SHA512
73af3c51b15f89237552b1718bef21fd80788fa416bab2cb2e7fb3a60d56249a716eda0d2dd68ab643752272640e7eaaaf57ce64bcb38373ddc3d035fb8d57cd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\S143F6TG.txt

Filesize
601B

MD5
1868976d152db5c1fbf135e28a23247d

SHA1
d074c7d7e61705043722acd1ef09fdf548cff3e2

SHA256
96575a26e260e2aa4aec1188cd5472e0ca9349805590f73ebd7f9b3d6bafd2cd

SHA512
a0b830c816a611c7b600c94992aa1c88f4acc7d0c7805f4b6a3e05588ff72d35b6e6ef7d5e56c3df9135b12fccd4487db38c8e14d4a675844281450fa5b9c488

Download Submit
C:\Users\Admin\Desktop\README_TO_DECRYPT.html

Filesize
2KB

MD5
2e98aa73af7f70b1093ebbadcc159516

SHA1
f8ae4add527887e0e09713653f96e98663196732

SHA256
5abd65d8a846737eda80da5ab5ddfd6771a0e4dee4996690edf47c54ad54bc63

SHA512
875bc7c172a976fd8bb40301e3db424aaa7d1adfb0a8ff1e4c1b24cab40f4a5b5e217f939ccc40af4f12b1dd2860c4a0435667d999b8ab71e733ef1819d09657

Download Submit
C:\Users\Admin\Desktop\README_TO_DECRYPT.html

Filesize
2KB

MD5
2e98aa73af7f70b1093ebbadcc159516

SHA1
f8ae4add527887e0e09713653f96e98663196732

SHA256
5abd65d8a846737eda80da5ab5ddfd6771a0e4dee4996690edf47c54ad54bc63

SHA512
875bc7c172a976fd8bb40301e3db424aaa7d1adfb0a8ff1e4c1b24cab40f4a5b5e217f939ccc40af4f12b1dd2860c4a0435667d999b8ab71e733ef1819d09657

Download Submit
memory/1528-323-0x0000000000E60000-0x0000000000E62000-memory.dmp

Filesize
8KB

Download
memory/1636-322-0x0000000002380000-0x0000000002390000-memory.dmp

Filesize
64KB

Download