quantum | bb6ec92275ec00a69b2c6e0532509222093d7026c8766274a69d985bcc1eb65e

General

Target

bb6ec92275ec00a69b2c6e0532509222093d7026c8766274a69d985bcc1eb65e.exe
Size

75KB
MD5

c53e027bf91d7e8c8da245ccd28279e5
SHA1

4d1fb9ab277f997a63cd42fd76467715b67579e4
SHA256

bb6ec92275ec00a69b2c6e0532509222093d7026c8766274a69d985bcc1eb65e
SHA512

5444f4b9737639dcf3321ae8d8ecea2e8865de3acae50a054136d741911371b4102b7a7f47a66d15d08c63022cb1afd3c00ee3241bb8be38ccfd8adda53a674a
SSDEEP

1536:9aX51pVH9hsgNGLs6BLM1frxz/HTfcKKBaJGff:OfJGLs6BwNxnfTKsGff

Score

10^/10

quantum ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\README_TO_DECRYPT.html

Ransom Note

ALL YOUR DATA IS ENCRYPTED by QUANTUM What happened? All your files are encrypted on all devices across the network Huge volume of your data including financial, customer, partner and employees data was downloaded to our internal servers What's next? If you don't get in touch with us next 48 hours, we'll start publishing your data to the Data Leaks Portal / TOR Data Leaks Portal How do I recover? There is no way to decrypt your files manually unless we provide a special decryption tool Please download TOR browser and CONTACT US for further instructions Hours Minutes Seconds

Signatures

Quantum Ransomware
A rebrand of the MountLocker ransomware first seen in August 2021.
ransomware quantum

Modifies extensions of user files 6 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

bb6ec92275ec00a69b2c6e0532509222093d7026c8766274a69d985bcc1eb65e.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\TraceUnpublish.tiff => \??\c:\Users\Admin\Pictures\TraceUnpublish.tiff.quantum	bb6ec92275ec00a69b2c6e0532509222093d7026c8766274a69d985bcc1eb65e.exe
File renamed	C:\Users\Admin\Pictures\CompareGroup.raw => \??\c:\Users\Admin\Pictures\CompareGroup.raw.quantum	bb6ec92275ec00a69b2c6e0532509222093d7026c8766274a69d985bcc1eb65e.exe
File opened for modification	\??\c:\Users\Admin\Pictures\MergeRepair.tiff	bb6ec92275ec00a69b2c6e0532509222093d7026c8766274a69d985bcc1eb65e.exe
File renamed	C:\Users\Admin\Pictures\MergeRepair.tiff => \??\c:\Users\Admin\Pictures\MergeRepair.tiff.quantum	bb6ec92275ec00a69b2c6e0532509222093d7026c8766274a69d985bcc1eb65e.exe
File renamed	C:\Users\Admin\Pictures\RedoJoin.png => \??\c:\Users\Admin\Pictures\RedoJoin.png.quantum	bb6ec92275ec00a69b2c6e0532509222093d7026c8766274a69d985bcc1eb65e.exe
File opened for modification	\??\c:\Users\Admin\Pictures\TraceUnpublish.tiff	bb6ec92275ec00a69b2c6e0532509222093d7026c8766274a69d985bcc1eb65e.exe

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1136 cmd.exe

pid	process
1136	cmd.exe

Drops desktop.ini file(s) 26 IoCs

Processes:

bb6ec92275ec00a69b2c6e0532509222093d7026c8766274a69d985bcc1eb65e.exe

description	ioc	process
File opened for modification	\??\c:\Users\Admin\Favorites\desktop.ini	bb6ec92275ec00a69b2c6e0532509222093d7026c8766274a69d985bcc1eb65e.exe
File opened for modification	\??\c:\Users\Admin\Music\desktop.ini	bb6ec92275ec00a69b2c6e0532509222093d7026c8766274a69d985bcc1eb65e.exe
File opened for modification	\??\c:\Users\Public\Desktop\desktop.ini	bb6ec92275ec00a69b2c6e0532509222093d7026c8766274a69d985bcc1eb65e.exe
File opened for modification	\??\c:\Users\Public\Downloads\desktop.ini	bb6ec92275ec00a69b2c6e0532509222093d7026c8766274a69d985bcc1eb65e.exe
File opened for modification	\??\c:\Users\Public\Libraries\desktop.ini	bb6ec92275ec00a69b2c6e0532509222093d7026c8766274a69d985bcc1eb65e.exe
File opened for modification	\??\c:\Users\Public\Music\Sample Music\desktop.ini	bb6ec92275ec00a69b2c6e0532509222093d7026c8766274a69d985bcc1eb65e.exe
File opened for modification	\??\c:\Users\Public\Pictures\desktop.ini	bb6ec92275ec00a69b2c6e0532509222093d7026c8766274a69d985bcc1eb65e.exe
File opened for modification	\??\c:\Users\Admin\Desktop\desktop.ini	bb6ec92275ec00a69b2c6e0532509222093d7026c8766274a69d985bcc1eb65e.exe
File opened for modification	\??\c:\Users\Admin\Saved Games\desktop.ini	bb6ec92275ec00a69b2c6e0532509222093d7026c8766274a69d985bcc1eb65e.exe
File opened for modification	\??\c:\Users\Admin\Searches\desktop.ini	bb6ec92275ec00a69b2c6e0532509222093d7026c8766274a69d985bcc1eb65e.exe
File opened for modification	\??\c:\Users\Public\Recorded TV\Sample Media\desktop.ini	bb6ec92275ec00a69b2c6e0532509222093d7026c8766274a69d985bcc1eb65e.exe
File opened for modification	\??\c:\Users\Public\Videos\desktop.ini	bb6ec92275ec00a69b2c6e0532509222093d7026c8766274a69d985bcc1eb65e.exe
File opened for modification	\??\c:\Users\Admin\Pictures\desktop.ini	bb6ec92275ec00a69b2c6e0532509222093d7026c8766274a69d985bcc1eb65e.exe
File opened for modification	\??\c:\Users\Admin\Favorites\Links for United States\desktop.ini	bb6ec92275ec00a69b2c6e0532509222093d7026c8766274a69d985bcc1eb65e.exe
File opened for modification	\??\c:\Users\Admin\Links\desktop.ini	bb6ec92275ec00a69b2c6e0532509222093d7026c8766274a69d985bcc1eb65e.exe
File opened for modification	\??\c:\Users\Public\Documents\desktop.ini	bb6ec92275ec00a69b2c6e0532509222093d7026c8766274a69d985bcc1eb65e.exe
File opened for modification	\??\c:\Users\Public\Pictures\Sample Pictures\desktop.ini	bb6ec92275ec00a69b2c6e0532509222093d7026c8766274a69d985bcc1eb65e.exe
File opened for modification	\??\c:\Users\Public\Recorded TV\desktop.ini	bb6ec92275ec00a69b2c6e0532509222093d7026c8766274a69d985bcc1eb65e.exe
File opened for modification	\??\c:\Users\Admin\Documents\desktop.ini	bb6ec92275ec00a69b2c6e0532509222093d7026c8766274a69d985bcc1eb65e.exe
File opened for modification	\??\c:\Users\Admin\Downloads\desktop.ini	bb6ec92275ec00a69b2c6e0532509222093d7026c8766274a69d985bcc1eb65e.exe
File opened for modification	\??\c:\Users\Admin\Favorites\Links\desktop.ini	bb6ec92275ec00a69b2c6e0532509222093d7026c8766274a69d985bcc1eb65e.exe
File opened for modification	\??\c:\Users\Admin\Videos\desktop.ini	bb6ec92275ec00a69b2c6e0532509222093d7026c8766274a69d985bcc1eb65e.exe
File opened for modification	\??\c:\Users\Public\desktop.ini	bb6ec92275ec00a69b2c6e0532509222093d7026c8766274a69d985bcc1eb65e.exe
File opened for modification	\??\c:\Users\Public\Music\desktop.ini	bb6ec92275ec00a69b2c6e0532509222093d7026c8766274a69d985bcc1eb65e.exe
File opened for modification	\??\c:\Users\Public\Videos\Sample Videos\desktop.ini	bb6ec92275ec00a69b2c6e0532509222093d7026c8766274a69d985bcc1eb65e.exe
File opened for modification	\??\c:\Users\Admin\Contacts\desktop.ini	bb6ec92275ec00a69b2c6e0532509222093d7026c8766274a69d985bcc1eb65e.exe

Modifies Internet Explorer settings 1 TTPs 25 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DE6CEAA1-B26E-11ED-852E-6AEE4B25B7A6} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Modifies registry class 5 IoCs

Processes:

bb6ec92275ec00a69b2c6e0532509222093d7026c8766274a69d985bcc1eb65e.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\.quantum\shell\Open	bb6ec92275ec00a69b2c6e0532509222093d7026c8766274a69d985bcc1eb65e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\.quantum\shell\Open\command\ = "explorer.exe README_TO_DECRYPT.html"	bb6ec92275ec00a69b2c6e0532509222093d7026c8766274a69d985bcc1eb65e.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\.quantum\shell\Open\command	bb6ec92275ec00a69b2c6e0532509222093d7026c8766274a69d985bcc1eb65e.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\.quantum	bb6ec92275ec00a69b2c6e0532509222093d7026c8766274a69d985bcc1eb65e.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\.quantum\shell	bb6ec92275ec00a69b2c6e0532509222093d7026c8766274a69d985bcc1eb65e.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

bb6ec92275ec00a69b2c6e0532509222093d7026c8766274a69d985bcc1eb65e.exe

pid	process
2036	bb6ec92275ec00a69b2c6e0532509222093d7026c8766274a69d985bcc1eb65e.exe
2036	bb6ec92275ec00a69b2c6e0532509222093d7026c8766274a69d985bcc1eb65e.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

bb6ec92275ec00a69b2c6e0532509222093d7026c8766274a69d985bcc1eb65e.exe

description	pid	process
Token: SeRestorePrivilege	2036	bb6ec92275ec00a69b2c6e0532509222093d7026c8766274a69d985bcc1eb65e.exe
Token: SeDebugPrivilege	2036	bb6ec92275ec00a69b2c6e0532509222093d7026c8766274a69d985bcc1eb65e.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1552 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1552 iexplore.exe
1552 iexplore.exe
660 IEXPLORE.EXE
660 IEXPLORE.EXE
660 IEXPLORE.EXE
660 IEXPLORE.EXE

pid	process
1552	iexplore.exe

pid	process
1552	iexplore.exe
1552	iexplore.exe
660	IEXPLORE.EXE
660	IEXPLORE.EXE
660	IEXPLORE.EXE
660	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

bb6ec92275ec00a69b2c6e0532509222093d7026c8766274a69d985bcc1eb65e.execmd.exeiexplore.exe

description	pid	process	target process
PID 2036 wrote to memory of 1136	2036	bb6ec92275ec00a69b2c6e0532509222093d7026c8766274a69d985bcc1eb65e.exe	cmd.exe
PID 2036 wrote to memory of 1136	2036	bb6ec92275ec00a69b2c6e0532509222093d7026c8766274a69d985bcc1eb65e.exe	cmd.exe
PID 2036 wrote to memory of 1136	2036	bb6ec92275ec00a69b2c6e0532509222093d7026c8766274a69d985bcc1eb65e.exe	cmd.exe
PID 1136 wrote to memory of 1520	1136	cmd.exe	attrib.exe
PID 1136 wrote to memory of 1520	1136	cmd.exe	attrib.exe
PID 1136 wrote to memory of 1520	1136	cmd.exe	attrib.exe
PID 1552 wrote to memory of 660	1552	iexplore.exe	IEXPLORE.EXE
PID 1552 wrote to memory of 660	1552	iexplore.exe	IEXPLORE.EXE
PID 1552 wrote to memory of 660	1552	iexplore.exe	IEXPLORE.EXE
PID 1552 wrote to memory of 660	1552	iexplore.exe	IEXPLORE.EXE

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exe

pid process

1520 attrib.exe

pid	process
1520	attrib.exe

C:\Users\Admin\AppData\Local\Temp\bb6ec92275ec00a69b2c6e0532509222093d7026c8766274a69d985bcc1eb65e.exe
"C:\Users\Admin\AppData\Local\Temp\bb6ec92275ec00a69b2c6e0532509222093d7026c8766274a69d985bcc1eb65e.exe"
1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\\006C4951.bat" "C:\Users\Admin\AppData\Local\Temp\bb6ec92275ec00a69b2c6e0532509222093d7026c8766274a69d985bcc1eb65e.exe""
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:1136
- - C:\Windows\system32\attrib.exe
    attrib -s -r -h "C:\Users\Admin\AppData\Local\Temp\bb6ec92275ec00a69b2c6e0532509222093d7026c8766274a69d985bcc1eb65e.exe"
    3⤵
    - Views/modifies file attributes
    PID:1520

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\README_TO_DECRYPT.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1552
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1552 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:660

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\006C4951.bat

Filesize
65B

MD5
348cae913e496198548854f5ff2f6d1e

SHA1
a07655b9020205bd47084afd62a8bb22b48c0cdc

SHA256
c80128f51871eec3ae2057989a025ce244277c1c180498a5aaef45d5214b8506

SHA512
799796736d41d3fcb5a7c859571bb025ca2d062c4b86e078302be68c1a932ed4f78e003640df5405274364b5a9a9c0ba5e37177997683ee7ab54e5267590b611

Download Submit
C:\Users\Admin\AppData\Local\Temp\006C4951.bat

Filesize
65B

MD5
348cae913e496198548854f5ff2f6d1e

SHA1
a07655b9020205bd47084afd62a8bb22b48c0cdc

SHA256
c80128f51871eec3ae2057989a025ce244277c1c180498a5aaef45d5214b8506

SHA512
799796736d41d3fcb5a7c859571bb025ca2d062c4b86e078302be68c1a932ed4f78e003640df5405274364b5a9a9c0ba5e37177997683ee7ab54e5267590b611

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB1F4.tmp

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\Desktop\README_TO_DECRYPT.html

Filesize
7KB

MD5
a3da584ba11f23987f1ac04f66cde76d

SHA1
0590bca012da037aaa046e04d9f24297a20424b0

SHA256
2095578216688023f79063f25f273c638b258d692287bb0f6a80633b77c1242e

SHA512
136703ceb99ff784a45c7cf0308bdede02d57fb1bd8af1cdd461e0508849568e4c02e09062194701d00b2a86bd0b83f31aae366a65ed957a36a34f01b4f528d0

Download Submit
C:\Users\Admin\Desktop\README_TO_DECRYPT.html

Filesize
7KB

MD5
a3da584ba11f23987f1ac04f66cde76d

SHA1
0590bca012da037aaa046e04d9f24297a20424b0

SHA256
2095578216688023f79063f25f273c638b258d692287bb0f6a80633b77c1242e

SHA512
136703ceb99ff784a45c7cf0308bdede02d57fb1bd8af1cdd461e0508849568e4c02e09062194701d00b2a86bd0b83f31aae366a65ed957a36a34f01b4f528d0

Download Submit
memory/660-328-0x0000000002A00000-0x0000000002A02000-memory.dmp

Filesize
8KB

Download
memory/1552-327-0x0000000002910000-0x0000000002920000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads