quantum | 1854def3463ceba21ad0d86592424845ce932e826419525bbbc543682fd2f9c9

Analysis

max time kernel
48s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
22-02-2023 04:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1854def3463ceba21ad0d86592424845ce932e826419525bbbc543682fd2f9c9.exe
Size

75KB
MD5

47f3e71a1b1eb4a939d5f17639514334
SHA1

d0c6afe81342ee81389864791c67e9b29e2939f2
SHA256

1854def3463ceba21ad0d86592424845ce932e826419525bbbc543682fd2f9c9
SHA512

26744d0164366fa3786f449b9fb0971c57b5b526e2cfff907e4077c1e6337c4a9ff7529248fae084b68a6abbc11a68b6ccda6d01b1dfb1526e3bcd4dd6f209fa
SSDEEP

1536:9aX51pVH9hsgNGLs6BLM1frxz/HTfcKKBaJGbf:OfJGLs6BwNxnfTKsGbf

Score

10^/10

quantum ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\README_TO_DECRYPT.html

Ransom Note

ALL YOUR DATA IS ENCRYPTED by QUANTUM What happened? All your files are encrypted on all devices across the network Huge volume of your data including financial, customer, partner and employees data was downloaded to our internal servers What's next? If you don't get in touch with us next 48 hours, we'll start publishing your data to the Data Leaks Portal / TOR Data Leaks Portal How do I recover? There is no way to decrypt your files manually unless we provide a special decryption tool Please download TOR browser and CONTACT US for further instructions Hours Minutes Seconds

Signatures

Quantum Ransomware
A rebrand of the MountLocker ransomware first seen in August 2021.
ransomware quantum

Modifies extensions of user files 3 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

1854def3463ceba21ad0d86592424845ce932e826419525bbbc543682fd2f9c9.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\CompressRead.crw => \??\c:\Users\Admin\Pictures\CompressRead.crw.quantum	1854def3463ceba21ad0d86592424845ce932e826419525bbbc543682fd2f9c9.exe
File renamed	C:\Users\Admin\Pictures\HideDismount.tif => \??\c:\Users\Admin\Pictures\HideDismount.tif.quantum	1854def3463ceba21ad0d86592424845ce932e826419525bbbc543682fd2f9c9.exe
File renamed	C:\Users\Admin\Pictures\InstallMount.tif => \??\c:\Users\Admin\Pictures\InstallMount.tif.quantum	1854def3463ceba21ad0d86592424845ce932e826419525bbbc543682fd2f9c9.exe

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1992 cmd.exe

pid	process
1992	cmd.exe

Drops desktop.ini file(s) 26 IoCs

Processes:

1854def3463ceba21ad0d86592424845ce932e826419525bbbc543682fd2f9c9.exe

description	ioc	process
File opened for modification	\??\c:\Users\Public\Pictures\Sample Pictures\desktop.ini	1854def3463ceba21ad0d86592424845ce932e826419525bbbc543682fd2f9c9.exe
File opened for modification	\??\c:\Users\Public\Recorded TV\Sample Media\desktop.ini	1854def3463ceba21ad0d86592424845ce932e826419525bbbc543682fd2f9c9.exe
File opened for modification	\??\c:\Users\Admin\Desktop\desktop.ini	1854def3463ceba21ad0d86592424845ce932e826419525bbbc543682fd2f9c9.exe
File opened for modification	\??\c:\Users\Admin\Downloads\desktop.ini	1854def3463ceba21ad0d86592424845ce932e826419525bbbc543682fd2f9c9.exe
File opened for modification	\??\c:\Users\Admin\Music\desktop.ini	1854def3463ceba21ad0d86592424845ce932e826419525bbbc543682fd2f9c9.exe
File opened for modification	\??\c:\Users\Admin\Saved Games\desktop.ini	1854def3463ceba21ad0d86592424845ce932e826419525bbbc543682fd2f9c9.exe
File opened for modification	\??\c:\Users\Public\Music\desktop.ini	1854def3463ceba21ad0d86592424845ce932e826419525bbbc543682fd2f9c9.exe
File opened for modification	\??\c:\Users\Admin\Searches\desktop.ini	1854def3463ceba21ad0d86592424845ce932e826419525bbbc543682fd2f9c9.exe
File opened for modification	\??\c:\Users\Public\Desktop\desktop.ini	1854def3463ceba21ad0d86592424845ce932e826419525bbbc543682fd2f9c9.exe
File opened for modification	\??\c:\Users\Public\Music\Sample Music\desktop.ini	1854def3463ceba21ad0d86592424845ce932e826419525bbbc543682fd2f9c9.exe
File opened for modification	\??\c:\Users\Admin\Documents\desktop.ini	1854def3463ceba21ad0d86592424845ce932e826419525bbbc543682fd2f9c9.exe
File opened for modification	\??\c:\Users\Admin\Favorites\desktop.ini	1854def3463ceba21ad0d86592424845ce932e826419525bbbc543682fd2f9c9.exe
File opened for modification	\??\c:\Users\Admin\Favorites\Links\desktop.ini	1854def3463ceba21ad0d86592424845ce932e826419525bbbc543682fd2f9c9.exe
File opened for modification	\??\c:\Users\Admin\Favorites\Links for United States\desktop.ini	1854def3463ceba21ad0d86592424845ce932e826419525bbbc543682fd2f9c9.exe
File opened for modification	\??\c:\Users\Admin\Links\desktop.ini	1854def3463ceba21ad0d86592424845ce932e826419525bbbc543682fd2f9c9.exe
File opened for modification	\??\c:\Users\Admin\Contacts\desktop.ini	1854def3463ceba21ad0d86592424845ce932e826419525bbbc543682fd2f9c9.exe
File opened for modification	\??\c:\Users\Admin\Pictures\desktop.ini	1854def3463ceba21ad0d86592424845ce932e826419525bbbc543682fd2f9c9.exe
File opened for modification	\??\c:\Users\Public\desktop.ini	1854def3463ceba21ad0d86592424845ce932e826419525bbbc543682fd2f9c9.exe
File opened for modification	\??\c:\Users\Public\Downloads\desktop.ini	1854def3463ceba21ad0d86592424845ce932e826419525bbbc543682fd2f9c9.exe
File opened for modification	\??\c:\Users\Public\Videos\desktop.ini	1854def3463ceba21ad0d86592424845ce932e826419525bbbc543682fd2f9c9.exe
File opened for modification	\??\c:\Users\Public\Videos\Sample Videos\desktop.ini	1854def3463ceba21ad0d86592424845ce932e826419525bbbc543682fd2f9c9.exe
File opened for modification	\??\c:\Users\Admin\Videos\desktop.ini	1854def3463ceba21ad0d86592424845ce932e826419525bbbc543682fd2f9c9.exe
File opened for modification	\??\c:\Users\Public\Documents\desktop.ini	1854def3463ceba21ad0d86592424845ce932e826419525bbbc543682fd2f9c9.exe
File opened for modification	\??\c:\Users\Public\Libraries\desktop.ini	1854def3463ceba21ad0d86592424845ce932e826419525bbbc543682fd2f9c9.exe
File opened for modification	\??\c:\Users\Public\Pictures\desktop.ini	1854def3463ceba21ad0d86592424845ce932e826419525bbbc543682fd2f9c9.exe
File opened for modification	\??\c:\Users\Public\Recorded TV\desktop.ini	1854def3463ceba21ad0d86592424845ce932e826419525bbbc543682fd2f9c9.exe

Modifies Internet Explorer settings 1 TTPs 33 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9B1F5D01-B26E-11ED-AAC7-CED2106B5FC8} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 608dd5727b46d901	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dbb59ddc676e394a83d3f942d26f43ca000000000200000000001066000000010000200000007d8418a0c33e08d1cd4d67ed04e3f8ca70db62a64ad1f96e39963cb5198e23bd000000000e800000000200002000000064a212fc984dc6430096f86d98e97aabfbea280b8dff47114918abc57788e25d20000000d0d79849b7037e30b1a04ee0c95c077bdf6238b97cce22cdea04fe40a22f8d36400000003bd78ba26375f6481e442d1f2154a019147110d70c11e9fc885c27c7fdb6e9d8eea404fb6e98fa63ff34f4bb60ca86f2e875968ee3d871e42670fb7498993e4d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dbb59ddc676e394a83d3f942d26f43ca000000000200000000001066000000010000200000002f16aebc1188d0f919463d98eccdb28a906d41d0421c18f487b49d903facda1f000000000e800000000200002000000092ef2ba2cc3248fe96cf2c4a9dbb905a4448c3281bfeeacbd48a1e3bcd090352900000004e252ab5491391272eca7955e88bc6b2937feaba062d38e7cf02652b1442cee69caa6826863a148cfd7054481091c5a95fba304081ea477803eca47dac732e9e2801d7d1be4c3765f129e6f74966266fb321eab01ae470206f23b0efc85520ed1da76e8f6a032f535249a2993467c1a2a45e3a6d5e4b9804c851672ed0960cfaf4e4f5703cbd88c4af902f24f78b4962400000009c5143adcafb402d7240d32683e0a8cfbe99a1304f6caca79e0f52ba92e2dd96aa0067fe500338d26374972f5c339e81bc7915596dbe82316faa72c21228b3ca	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Modifies registry class 5 IoCs

Processes:

1854def3463ceba21ad0d86592424845ce932e826419525bbbc543682fd2f9c9.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\.quantum\shell\Open\command	1854def3463ceba21ad0d86592424845ce932e826419525bbbc543682fd2f9c9.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\.quantum	1854def3463ceba21ad0d86592424845ce932e826419525bbbc543682fd2f9c9.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\.quantum\shell	1854def3463ceba21ad0d86592424845ce932e826419525bbbc543682fd2f9c9.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\.quantum\shell\Open	1854def3463ceba21ad0d86592424845ce932e826419525bbbc543682fd2f9c9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\.quantum\shell\Open\command\ = "explorer.exe README_TO_DECRYPT.html"	1854def3463ceba21ad0d86592424845ce932e826419525bbbc543682fd2f9c9.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

1854def3463ceba21ad0d86592424845ce932e826419525bbbc543682fd2f9c9.exe

pid	process
1232	1854def3463ceba21ad0d86592424845ce932e826419525bbbc543682fd2f9c9.exe
1232	1854def3463ceba21ad0d86592424845ce932e826419525bbbc543682fd2f9c9.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

1854def3463ceba21ad0d86592424845ce932e826419525bbbc543682fd2f9c9.exe

description	pid	process
Token: SeRestorePrivilege	1232	1854def3463ceba21ad0d86592424845ce932e826419525bbbc543682fd2f9c9.exe
Token: SeDebugPrivilege	1232	1854def3463ceba21ad0d86592424845ce932e826419525bbbc543682fd2f9c9.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1564 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1564 iexplore.exe
1564 iexplore.exe
1588 IEXPLORE.EXE
1588 IEXPLORE.EXE
1588 IEXPLORE.EXE
1588 IEXPLORE.EXE

pid	process
1564	iexplore.exe

pid	process
1564	iexplore.exe
1564	iexplore.exe
1588	IEXPLORE.EXE
1588	IEXPLORE.EXE
1588	IEXPLORE.EXE
1588	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

1854def3463ceba21ad0d86592424845ce932e826419525bbbc543682fd2f9c9.execmd.exeiexplore.exe

description	pid	process	target process
PID 1232 wrote to memory of 1992	1232	1854def3463ceba21ad0d86592424845ce932e826419525bbbc543682fd2f9c9.exe	cmd.exe
PID 1232 wrote to memory of 1992	1232	1854def3463ceba21ad0d86592424845ce932e826419525bbbc543682fd2f9c9.exe	cmd.exe
PID 1232 wrote to memory of 1992	1232	1854def3463ceba21ad0d86592424845ce932e826419525bbbc543682fd2f9c9.exe	cmd.exe
PID 1992 wrote to memory of 592	1992	cmd.exe	attrib.exe
PID 1992 wrote to memory of 592	1992	cmd.exe	attrib.exe
PID 1992 wrote to memory of 592	1992	cmd.exe	attrib.exe
PID 1564 wrote to memory of 1588	1564	iexplore.exe	IEXPLORE.EXE
PID 1564 wrote to memory of 1588	1564	iexplore.exe	IEXPLORE.EXE
PID 1564 wrote to memory of 1588	1564	iexplore.exe	IEXPLORE.EXE
PID 1564 wrote to memory of 1588	1564	iexplore.exe	IEXPLORE.EXE

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exe

pid process

592 attrib.exe

pid	process
592	attrib.exe

C:\Users\Admin\AppData\Local\Temp\1854def3463ceba21ad0d86592424845ce932e826419525bbbc543682fd2f9c9.exe
"C:\Users\Admin\AppData\Local\Temp\1854def3463ceba21ad0d86592424845ce932e826419525bbbc543682fd2f9c9.exe"
1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1232

C:\Windows\system32\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\\006C29B0.bat" "C:\Users\Admin\AppData\Local\Temp\1854def3463ceba21ad0d86592424845ce932e826419525bbbc543682fd2f9c9.exe""
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1992

C:\Windows\system32\attrib.exe
attrib -s -r -h "C:\Users\Admin\AppData\Local\Temp\1854def3463ceba21ad0d86592424845ce932e826419525bbbc543682fd2f9c9.exe"
3⤵
- Views/modifies file attributes
PID:592

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\README_TO_DECRYPT.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1564

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1564 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1588

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Hidden Files and Directories

T1158

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
c3fe71c759f708f409a81c9d27684d40

SHA1
9952269107e4c33a3c26d533e10eaef6dabc893c

SHA256
9e3d640a6b667ac8f1161db3d89c3e0983ba00bdcf7a7367d1c02d096593f3d2

SHA512
749fc8346cbf5b5b59eeb820755babb9b7f2bb87c12aa918fa65dae1119a4b17e26c62f7daee36c7531dcafcbd20a4b57572ced061cf484263921c6b5784bb7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
604b82f7d17ef1cf38aaede38ef8ad94

SHA1
bf193c5544abbcbbe9a57d717b258f0cb1fdf8cd

SHA256
e4eb542b4e0c46e35037b3dc3e0ddec5a512817bda6e17989d148b68ca766029

SHA512
6294e6c7c418162cadebc5c653b15cd72b07e31a2601d22cb461738273619d737cc58eb55792e1ed5a82a227707b90ea50d7f4d3d42c80a2720f7fa07987b685

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
848ffc77b21eaee388d9f8e6adb27a56

SHA1
25406145c2444a3e8f0264b9b3f2f324ac239240

SHA256
a8388c2404d1c724fb2bcc138449daa0b12deb3ee2d4b3dc36420aca1119b5d2

SHA512
c261ee1c32191b0b57b1a184fec61275dcb92ee83a0aa261145d3ec3a91bd9d0c0aa7c186f58dfac555cefd5a10cc27ebb010ab3c775785f6a97e696e3d32fc3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
fa8a90b39c2105c6087dff202087d34a

SHA1
8f8c89fec3745e2616c5ed548a6024b8289276b4

SHA256
851326fa084404c690970cdc08bacdfa3c54cbeef48211c109af034830cebdc6

SHA512
f6bda1e96f4df411e49a333b07982f4b9c8c2202bde5d2a826185b24e7963d30373d6ea2c7cf0c70dab877985a70b2913abd145df39e86df86c018d7b3f245b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
efa4d1e191c7d8b73546730c4cc78564

SHA1
21b3eba241fbad5eab112627f6cbc71431796492

SHA256
b9bf8ea0aa75b9bd53117a3be16e82ffa4be89f50b880a61fcbb9daaf8ec2008

SHA512
0b04f578a5653e41d14ad245e80625264b0dbdbca806c86d286982d3792d416843f858c47dd0f5651765ed18ccd64038f2473d1bcbfb8176758e591b0aa8e976

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
c42cb38503dd44f150e54dd1f4fe2cc4

SHA1
5a276e48596c2574d842d0734e70e712bd1fd386

SHA256
a31abbf762698d431da98127e79f92016aabdcca00c44faa7b6458ccf363241a

SHA512
24b32106b883cdea59ebb58cfa24005283bebe8e5068bf4d231b3b7a6fd01f440b3cade5b7446d5afaba3682b56c9c958ae624c01f8c8e17860dddacbd4c3206

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
72c33d3a27534f64a22f7d7422b1480c

SHA1
4218073fc402c17d401d10e4c882183e811ffdc2

SHA256
b1dd1ce691d5720f1755288037b4f0939e1ce51896de10ef873c52c999d88b81

SHA512
16e904c98ece8fd662e113134573d56baa0c70bcde7109cbf6854056a3ece8b35742c5b6279e9e054b7f7bff687483984735e7bf46a8c63f39db511bb92480ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
5c5ebd7a4ba6e21966405a3a21ed5b99

SHA1
f6350b2294b380e06e4ad77a34a535a5d5a3cd83

SHA256
e7e17b40da382f792d27389d0b9ecc0429e640e14c5cd6973857f3b1a236d5e4

SHA512
aa1f1b5a673c08d9e411210624d153f64b4bdced8944fc324829148991b092bdabe4f4e710d0ccdf6921a128e8fbb96e19e07d58b1f892475f419300a6bfcec1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
69d4263e5b978137b1a5ab7572e2713b

SHA1
9eb515dd604481cbb99a7e6a2158cf6a25731154

SHA256
5142048718ae365e77b546008bbf049cbe866681ce547c67185d697fbfe15941

SHA512
178a69560ef5e2469c1b9fc3b85f8638d182c6a37850b45258a5696d70b9fe272277d92b3ab58561a51ebceba724f626b858e1f103e26bbfb430e7b1091eef29

Download Submit
C:\Users\Admin\AppData\Local\Temp\006C29B0.bat
Filesize
65B

MD5
348cae913e496198548854f5ff2f6d1e

SHA1
a07655b9020205bd47084afd62a8bb22b48c0cdc

SHA256
c80128f51871eec3ae2057989a025ce244277c1c180498a5aaef45d5214b8506

SHA512
799796736d41d3fcb5a7c859571bb025ca2d062c4b86e078302be68c1a932ed4f78e003640df5405274364b5a9a9c0ba5e37177997683ee7ab54e5267590b611

Download Submit
C:\Users\Admin\AppData\Local\Temp\006C29B0.bat
Filesize
65B

MD5
348cae913e496198548854f5ff2f6d1e

SHA1
a07655b9020205bd47084afd62a8bb22b48c0cdc

SHA256
c80128f51871eec3ae2057989a025ce244277c1c180498a5aaef45d5214b8506

SHA512
799796736d41d3fcb5a7c859571bb025ca2d062c4b86e078302be68c1a932ed4f78e003640df5405274364b5a9a9c0ba5e37177997683ee7ab54e5267590b611

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab72C3.tmp
Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7383.tmp
Filesize
161KB

MD5
73b4b714b42fc9a6aaefd0ae59adb009

SHA1
efdaffd5b0ad21913d22001d91bf6c19ecb4ac41

SHA256
c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd

SHA512
73af3c51b15f89237552b1718bef21fd80788fa416bab2cb2e7fb3a60d56249a716eda0d2dd68ab643752272640e7eaaaf57ce64bcb38373ddc3d035fb8d57cd

Download Submit
C:\Users\Admin\Desktop\README_TO_DECRYPT.html
Filesize
7KB

MD5
3f6a8aa8547d92754f0a0082fe56507e

SHA1
f457d1a3e6b62a1e3d57ec4a8da1ec44f60344f9

SHA256
5d1b55e0d5f48d1215656c9ee319112219dd03b33364825118d89c2f856c7fa1

SHA512
2656588d522b78fd741addd096e6dbbf29b54b8ff2c09899b48ad53aed98e45aad34aa6e2947e59e4c60e0e1123c237e9f7c2a27feeeec8bf02960c3502c05f8

Download Submit
C:\Users\Admin\Desktop\README_TO_DECRYPT.html
Filesize
7KB

MD5
3f6a8aa8547d92754f0a0082fe56507e

SHA1
f457d1a3e6b62a1e3d57ec4a8da1ec44f60344f9

SHA256
5d1b55e0d5f48d1215656c9ee319112219dd03b33364825118d89c2f856c7fa1

SHA512
2656588d522b78fd741addd096e6dbbf29b54b8ff2c09899b48ad53aed98e45aad34aa6e2947e59e4c60e0e1123c237e9f7c2a27feeeec8bf02960c3502c05f8

Download Submit
memory/1564-293-0x0000000002F00000-0x0000000002F10000-memory.dmp

Filesize
64KB

Download
memory/1588-294-0x0000000003110000-0x0000000003112000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads