quantum | 511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280

Analysis

max time kernel
87s
max time network
76s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
22-02-2023 02:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
Size

64KB
MD5

0c4c33d99a04d6e47e2338949d470bce
SHA1

eb61609571bf629079f685fb66a931df20b6b12b
SHA256

511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280
SHA512

a7eb1b0489ca94a0ac18ac40b974e9ba3a4082865129eb21001596ef7b37ac4655fdd6dbcb703c193ba2250ee0af620b9c674c52de21feffb51b4be56b3acb56
SSDEEP

768:GnJ9uwtbJD/QpEdTrArzVpCK1w22TYgNvCJ037FLxZKQJRNz0TqXfJCju0L:G+wr1AB0AwB57F9npz0Ta4ju0L

Score

10^/10

quantum ransomware

Malware Config

Extracted

Path

C:\Users\Admin\.oracle_jre_usage\README_TO_DECRYPT.html

Family

quantum

Ransom Note

<html> <head> <title>Quantum</title> </head> <body> <h1>Your ID:</h1> <pre> 5dbde59c615c8fb9346c52ea827b67c562dca20f87bc65dbebdc11b4ec12b452 </pre> <hr/> This message contains an information how to fix the troubles you've got with your network. Files on the workstations in your network were encrypted and any your attempt to change, decrypt or rename them could destroy the content. The only way to get files back is a decryption with Key, provided by the Quantum Locker. During the period your network was under our control, we downloaded a huge volume of information. Now it is stored on our servers with high-secure access. This information contains a lot of sensitive, private and personal data. Publishing of such data will cause serious consequences and even business disruption. It's not a threat, on the contrary - it's a manual how to get a way out. Quantum team doesn't aim to damage your company, our goals are only financial. After a payment you'll get network decryption, full destruction of downloaded data, information about your network vulnerabilities and penetration points. If you decide not to negotiate, in 48 hours the fact of the attack and all your information will be posted on our site and will be promoted among dozens of cyber forums, news agencies, websites etc. To contact our support and start the negotiations, please visit our support chat. It is simple, secure and you can set a password to avoid intervention of unauthorised persons. <a href="http://tijykgureh7kqq5cczzeutaoxvmf6yinpar72o3bxome7b44vwqxadyd.onion/?cid=5dbde59c615c8fb9346c52ea827b67c562dca20f87bc65dbebdc11b4ec12b452">http://tijykgureh7kqq5cczzeutaoxvmf6yinpar72o3bxome7b44vwqxadyd.onion/?cid=5dbde59c615c8fb9346c52ea827b67c562dca20f87bc65dbebdc11b4ec12b452</a> <ul> <li>Password field should be blank for the first login. <li>Note that this server is available via Tor browser only. </ul> P.S. How to get TOR browser - see at https://www.torproject.org </body> </html>

Extracted

Path

C:\Users\Admin\Desktop\README_TO_DECRYPT.html

Family

quantum

Ransom Note

Your ID: This message contains an information how to fix the troubles you've got with your network. Files on the workstations in your network were encrypted and any your attempt to change, decrypt or rename them could destroy the content. The only way to get files back is a decryption with Key, provided by the Quantum Locker. During the period your network was under our control, we downloaded a huge volume of information. Now it is stored on our servers with high-secure access. This information contains a lot of sensitive, private and personal data. Publishing of such data will cause serious consequences and even business disruption. It's not a threat, on the contrary - it's a manual how to get a way out. Quantum team doesn't aim to damage your company, our goals are only financial. After a payment you'll get network decryption, full destruction of downloaded data, information about your network vulnerabilities and penetration points. If you decide not to negotiate, in 48 hours the fact of the attack and all your information will be posted on our site and will be promoted among dozens of cyber forums, news agencies, websites etc. To contact our support and start the negotiations, please visit our support chat. It is simple, secure and you can set a password to avoid intervention of unauthorised persons. http://tijykgureh7kqq5cczzeutaoxvmf6yinpar72o3bxome7b44vwqxadyd.onion/?cid=5dbde59c615c8fb9346c52ea827b67c562dca20f87bc65dbebdc11b4ec12b452 Password field should be blank for the first login. Note that this server is available via Tor browser only. P.S. How to get TOR browser - see at https://www.torproject.org

URLs

http://tijykgureh7kqq5cczzeutaoxvmf6yinpar72o3bxome7b44vwqxadyd.onion/?cid=5dbde59c615c8fb9346c52ea827b67c562dca20f87bc65dbebdc11b4ec12b452

Signatures

Quantum Ransomware
A rebrand of the MountLocker ransomware first seen in August 2021.
ransomware quantum

Modifies extensions of user files 12 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe

description	ioc	Process
File renamed	C:\Users\Admin\Pictures\CopyReset.tif => \??\c:\Users\Admin\Pictures\CopyReset.tif.quantum	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
File opened for modification	\??\c:\Users\Admin\Pictures\CopySuspend.tiff	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
File renamed	C:\Users\Admin\Pictures\CopySuspend.tiff => \??\c:\Users\Admin\Pictures\CopySuspend.tiff.quantum	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
File opened for modification	\??\c:\Users\Admin\Pictures\MergeSubmit.tiff	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
File renamed	C:\Users\Admin\Pictures\MergeSubmit.tiff => \??\c:\Users\Admin\Pictures\MergeSubmit.tiff.quantum	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
File renamed	C:\Users\Admin\Pictures\SaveSkip.png => \??\c:\Users\Admin\Pictures\SaveSkip.png.quantum	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
File renamed	C:\Users\Admin\Pictures\SkipResolve.tiff => \??\c:\Users\Admin\Pictures\SkipResolve.tiff.quantum	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
File renamed	C:\Users\Admin\Pictures\ConnectRevoke.png => \??\c:\Users\Admin\Pictures\ConnectRevoke.png.quantum	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
File opened for modification	\??\c:\Users\Admin\Pictures\UninstallOut.tiff	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
File renamed	C:\Users\Admin\Pictures\UninstallOut.tiff => \??\c:\Users\Admin\Pictures\UninstallOut.tiff.quantum	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
File renamed	C:\Users\Admin\Pictures\WriteRedo.png => \??\c:\Users\Admin\Pictures\WriteRedo.png.quantum	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
File opened for modification	\??\c:\Users\Admin\Pictures\SkipResolve.tiff	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe

Drops desktop.ini file(s) 25 IoCs

Processes:

511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe

description	ioc	Process
File opened for modification	\??\c:\Users\Admin\Searches\desktop.ini	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
File opened for modification	\??\c:\Users\Admin\Videos\desktop.ini	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
File opened for modification	\??\c:\Users\Admin\3D Objects\desktop.ini	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
File opened for modification	\??\c:\Users\Admin\Contacts\desktop.ini	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
File opened for modification	\??\c:\Users\Admin\Documents\desktop.ini	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
File opened for modification	\??\c:\Users\Admin\Favorites\desktop.ini	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
File opened for modification	\??\c:\Users\Admin\Links\desktop.ini	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
File opened for modification	\??\c:\Users\Admin\Pictures\Saved Pictures\desktop.ini	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
File opened for modification	\??\c:\Users\Public\desktop.ini	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
File opened for modification	\??\c:\Users\Public\Documents\desktop.ini	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
File opened for modification	\??\c:\Users\Public\Libraries\desktop.ini	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
File opened for modification	\??\c:\Users\Public\Videos\desktop.ini	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
File opened for modification	\??\c:\Users\Admin\Downloads\desktop.ini	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
File opened for modification	\??\c:\Users\Admin\Favorites\Links\desktop.ini	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
File opened for modification	\??\c:\Users\Admin\OneDrive\desktop.ini	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
File opened for modification	\??\c:\Users\Admin\Pictures\Camera Roll\desktop.ini	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
File opened for modification	\??\c:\Users\Admin\Pictures\desktop.ini	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
File opened for modification	\??\c:\Users\Public\Pictures\desktop.ini	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
File opened for modification	\??\c:\Users\Admin\Desktop\desktop.ini	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
File opened for modification	\??\c:\Users\Admin\Music\desktop.ini	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
File opened for modification	\??\c:\Users\Admin\Saved Games\desktop.ini	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
File opened for modification	\??\c:\Users\Public\AccountPictures\desktop.ini	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
File opened for modification	\??\c:\Users\Public\Music\desktop.ini	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
File opened for modification	\??\c:\Users\Public\Desktop\desktop.ini	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
File opened for modification	\??\c:\Users\Public\Downloads\desktop.ini	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe

Drops file in Program Files directory 2 IoCs

Processes:

setup.exe

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\af48ef3e-6d5c-41ca-8f40-00d4e2ebc3b8.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230222034427.pma	setup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 6 IoCs

Processes:

msedge.exe511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\.quantum\shell\Open\command	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\.quantum	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\.quantum\shell	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\.quantum\shell\Open	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\.quantum\shell\Open\command\ = "explorer.exe README_TO_DECRYPT.html"	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exemsedge.exemsedge.exeidentity_helper.exe

pid	Process
5056	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
5056	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
4616	msedge.exe
4616	msedge.exe
3284	msedge.exe
3284	msedge.exe
1856	identity_helper.exe
1856	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid	Process
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe

description	pid	Process
Token: SeRestorePrivilege	5056	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
Token: SeDebugPrivilege	5056	511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe

Suspicious use of FindShellTrayWindow 10 IoCs

Processes:

msedge.exe

pid	Process
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe

Suspicious use of SendNotifyMessage 8 IoCs

Processes:

msedge.exe

pid	Process
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	Process	procid_target
PID 3284 wrote to memory of 3024	3284	msedge.exe	85
PID 3284 wrote to memory of 3024	3284	msedge.exe	85
PID 3284 wrote to memory of 3040	3284	msedge.exe	86
PID 3284 wrote to memory of 3040	3284	msedge.exe	86
PID 3284 wrote to memory of 3040	3284	msedge.exe	86
PID 3284 wrote to memory of 3040	3284	msedge.exe	86
PID 3284 wrote to memory of 3040	3284	msedge.exe	86
PID 3284 wrote to memory of 3040	3284	msedge.exe	86
PID 3284 wrote to memory of 3040	3284	msedge.exe	86
PID 3284 wrote to memory of 3040	3284	msedge.exe	86
PID 3284 wrote to memory of 3040	3284	msedge.exe	86
PID 3284 wrote to memory of 3040	3284	msedge.exe	86
PID 3284 wrote to memory of 3040	3284	msedge.exe	86
PID 3284 wrote to memory of 3040	3284	msedge.exe	86
PID 3284 wrote to memory of 3040	3284	msedge.exe	86
PID 3284 wrote to memory of 3040	3284	msedge.exe	86
PID 3284 wrote to memory of 3040	3284	msedge.exe	86
PID 3284 wrote to memory of 3040	3284	msedge.exe	86
PID 3284 wrote to memory of 3040	3284	msedge.exe	86
PID 3284 wrote to memory of 3040	3284	msedge.exe	86
PID 3284 wrote to memory of 3040	3284	msedge.exe	86
PID 3284 wrote to memory of 3040	3284	msedge.exe	86
PID 3284 wrote to memory of 3040	3284	msedge.exe	86
PID 3284 wrote to memory of 3040	3284	msedge.exe	86
PID 3284 wrote to memory of 3040	3284	msedge.exe	86
PID 3284 wrote to memory of 3040	3284	msedge.exe	86
PID 3284 wrote to memory of 3040	3284	msedge.exe	86
PID 3284 wrote to memory of 3040	3284	msedge.exe	86
PID 3284 wrote to memory of 3040	3284	msedge.exe	86
PID 3284 wrote to memory of 3040	3284	msedge.exe	86
PID 3284 wrote to memory of 3040	3284	msedge.exe	86
PID 3284 wrote to memory of 3040	3284	msedge.exe	86
PID 3284 wrote to memory of 3040	3284	msedge.exe	86
PID 3284 wrote to memory of 3040	3284	msedge.exe	86
PID 3284 wrote to memory of 3040	3284	msedge.exe	86
PID 3284 wrote to memory of 3040	3284	msedge.exe	86
PID 3284 wrote to memory of 3040	3284	msedge.exe	86
PID 3284 wrote to memory of 3040	3284	msedge.exe	86
PID 3284 wrote to memory of 3040	3284	msedge.exe	86
PID 3284 wrote to memory of 3040	3284	msedge.exe	86
PID 3284 wrote to memory of 3040	3284	msedge.exe	86
PID 3284 wrote to memory of 3040	3284	msedge.exe	86
PID 3284 wrote to memory of 4616	3284	msedge.exe	87
PID 3284 wrote to memory of 4616	3284	msedge.exe	87
PID 3284 wrote to memory of 2396	3284	msedge.exe	88
PID 3284 wrote to memory of 2396	3284	msedge.exe	88
PID 3284 wrote to memory of 2396	3284	msedge.exe	88
PID 3284 wrote to memory of 2396	3284	msedge.exe	88
PID 3284 wrote to memory of 2396	3284	msedge.exe	88
PID 3284 wrote to memory of 2396	3284	msedge.exe	88
PID 3284 wrote to memory of 2396	3284	msedge.exe	88
PID 3284 wrote to memory of 2396	3284	msedge.exe	88
PID 3284 wrote to memory of 2396	3284	msedge.exe	88
PID 3284 wrote to memory of 2396	3284	msedge.exe	88
PID 3284 wrote to memory of 2396	3284	msedge.exe	88
PID 3284 wrote to memory of 2396	3284	msedge.exe	88
PID 3284 wrote to memory of 2396	3284	msedge.exe	88
PID 3284 wrote to memory of 2396	3284	msedge.exe	88
PID 3284 wrote to memory of 2396	3284	msedge.exe	88
PID 3284 wrote to memory of 2396	3284	msedge.exe	88
PID 3284 wrote to memory of 2396	3284	msedge.exe	88
PID 3284 wrote to memory of 2396	3284	msedge.exe	88
PID 3284 wrote to memory of 2396	3284	msedge.exe	88
PID 3284 wrote to memory of 2396	3284	msedge.exe	88

C:\Users\Admin\AppData\Local\Temp\511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe
"C:\Users\Admin\AppData\Local\Temp\511c1021fad76670d6d407139e5fef62b34ca9656fb735bd7d406728568fa280.exe"
1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\README_TO_DECRYPT.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x74,0x7ffb93d046f8,0x7ffb93d04708,0x7ffb93d04718
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,16485669479020393513,1463554804167729830,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,16485669479020393513,1463554804167729830,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,16485669479020393513,1463554804167729830,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16485669479020393513,1463554804167729830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3720 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16485669479020393513,1463554804167729830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3724 /prefetch:1
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16485669479020393513,1463554804167729830,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16485669479020393513,1463554804167729830,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,16485669479020393513,1463554804167729830,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:4708
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x228,0x22c,0x230,0x224,0x234,0x7ff668555460,0x7ff668555470,0x7ff668555480
    3⤵
    PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,16485669479020393513,1463554804167729830,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16485669479020393513,1463554804167729830,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16485669479020393513,1463554804167729830,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:4588

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4920

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\.oracle_jre_usage\README_TO_DECRYPT.html

Filesize
2KB

MD5
9d1ea4a8e30e5d421f810fdcbb25022f

SHA1
f7b7173124d295db4bbfbe7c0c4644662437ea76

SHA256
8ccbac59a2d86a88a9e455228df5e4b49fb3a916d5be6e58e7ef9410d140e32e

SHA512
2fdb323ee4a62c680489dbcfb90402715f8a09f775c4a1e22347f261a73c6ab91d5fff740ed1434f2c97f02132c85a4c18dd3ed996c80a500cf24b72072128d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8c9383861d9295966a7f745d7b76a13

SHA1
d77273648971ec19128c344f78a8ffeb8a246645

SHA256
b75207c223dfc38fbb3dbf03107043a7dce74129d88053c9316350c97ac26d2e

SHA512
094e6978e09a6e762022e8ff57935a26b3171a0627639ca91a373bddd06092241d695b9f3b609ba60bc28e78a5c78cf0f072d79cd5769f1b9f6d873169f0df14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
9ad50c07aa8235d87f46ec474fdeaaca

SHA1
edf3ad0820cbcd2e1febf213b720add9fe0c2142

SHA256
8b88d39f0ea622dfd2ce62a273cf1740067b9597804be379948c27992d778d60

SHA512
f5e664820dff3613dd77742e6b90e0beebd20b6a0dd04528d080de7ec8b45131cf0caf39f2be7b8978a5a500067718cef598302e324f260164cb4101fac05b96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
bad4b833847900837048b1b3e3b63097

SHA1
bc0bb11d9c0fda8dd05a49e6de976b2035170a49

SHA256
56c1a7be6f15c4ddfcb62feb421eb7ae6bf0aa99f604944fb9ef443ed6f9f9d4

SHA512
7415f7a4c1c37a36236727ec1c1aee79c9485400ec567b6fb1e3cb7054c99c517cb33376b59af4f033c8946b42709f23b21e585f07d3f9d93038a58673268ad5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f65e4605ae692f9f0398230f3f3b7c0f

SHA1
c4070dd3d53c3d76224c576ef272af9b39b37a2e

SHA256
29d6994ca3e629c33c26c3cd8c415b3f5e9a953fd263648ec1c78fdd712b82ef

SHA512
17dc4a3c9a2f41187750f47520ca50d2fa7f2441e17eca5911e126328d7705b4a2b4a9c9d5e1cdaec5fb6e7fe94240fae5d4bef4ee389afa884841f89c54cad5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
03fa4950a18299bae774e07d25e64006

SHA1
8412cc82e2eff16d8d136c1f4b3e08f5167a1c7b

SHA256
df8319e35cb878ce7d518e8d1c56a9f2afd86055fcd3553dba463366fe1b363b

SHA512
de5e579e0b148fc882aa0b6675d5ca6db4e27c3a215032f4df0000afbd2477ecacc5a0796722084065816f83bddcf363b4f461c564123b050b59ccc55d9a21bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
60b345592703258c513cb5fc34a2f835

SHA1
39991bd7ea37e2fc394be3b253ef96ce04088a6d

SHA256
7e358b4f7553c9385e8eb2c5692d426bc257bbd4c0213e6c69294459734f6300

SHA512
0346fb4096eb285ab0fdf7e7ec38c4daf7bbb0c506f09975eb2290121d169a34c886fca342c3e06371cb697f2753a697ca4f72af7817ed340eee6063897110a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
b8e1158943f6f925b90ed265eb393d86

SHA1
c1bce45efe64f2cff1086c1f45b6e34a2182c589

SHA256
044c612ef3d1242e0f325beeb6fead17fa4c61eb37e9e957541ba4f2f2e7a1d9

SHA512
ccc3d6adae37c00864ef91485407544ee1cd7d408e8bee9eb022ef889db65bd809b1af82feabd861fa62332e5bff887dadc6b8b8ded82bfb9c78056de4010015

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
b8246a6d1bf1bec996a345f6746a09f6

SHA1
915c7b24708e104dc5cdd2fb4b1191dfe901f575

SHA256
f0d076dbe31bc2b5c74ec9cf80734f12e9d5adb040e52d3a8fe254f527d1e67e

SHA512
12b78c1c94c33109e2dfa48789f1a1f9bc0ebcf74436a331ec8477b3e024e0f1b555ba8f6b9a677c8221f2ac2fe77679c0e01403c1a7cf1ed8a681447f5adc9c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
4f2b91ab3d8f260de5855185ced85953

SHA1
8d6590a11edc9b9df566f03496607171d9140929

SHA256
6edcf6698acf199a420b0e57197904aa3db9e8cfe8d0baacdaf0f3f7ebe64f3c

SHA512
72cbb6ad0a833aa40fbba0c55e2b8f0f60ec2cc7dc7b10e949890031b976c6968b10475b354cb5e9e529a103f3c61a83677a5004f3b2dc1b0849c419188ce8e0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
82c7a1cb8efe2fc562ae229522ee392f

SHA1
9189d056d143d9739b3bc38cd21985716d68619e

SHA256
680a836b371bfaa1ef8b2bcf5df820afe907f6f3fd7eff70618c187e286e5a8e

SHA512
352e2ec8f4f0a04db4253171bddf679698d70ad189c73a052d1a88cf112fbf58519f06a54c73e865509e9e714078bbe9b999cc3a75906c61391ce09074ce982c

Download Submit
C:\Users\Admin\Desktop\README_TO_DECRYPT.html

Filesize
2KB

MD5
9d1ea4a8e30e5d421f810fdcbb25022f

SHA1
f7b7173124d295db4bbfbe7c0c4644662437ea76

SHA256
8ccbac59a2d86a88a9e455228df5e4b49fb3a916d5be6e58e7ef9410d140e32e

SHA512
2fdb323ee4a62c680489dbcfb90402715f8a09f775c4a1e22347f261a73c6ab91d5fff740ed1434f2c97f02132c85a4c18dd3ed996c80a500cf24b72072128d2

Download Submit
\??\pipe\LOCAL\crashpad_3284_VSSHHBSMHPLEENKX

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2396-383-0x00007FFBB01A0000-0x00007FFBB01A1000-memory.dmp

Filesize
4KB

Download