Analysis
- max time kernel
33s - max time network
32s - platform
windows7_x64 - resource
win7-20230220-en - resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system - submitted
28/02/2023, 04:38
Static task
static1
Behavioral task
behavioral1
Sample
c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe
Resource
win7-20230220-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
13 signatures
150 seconds
General
- Target c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe
- Size 75KB
- Sample230228-e9j1zshe93
- SHA256 c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5
- MD5 043d54316b201b92d11df5a5ac76d104
- SHA1 b0b49a9bd4de2f3fa56a4faf612303e68878f751
- SHA512 2a2e63af63d99bc3c0fc27ac6309b57998a4d91355ce680b52faa3447760230cbdebc74e8f8c1bd87957c572a96fb7abf72ed0283744fa929d71213bcb403382
- SSDEEP 1536:9aX51pVH9hsgNGLs6BLM1frxz/HTfcKKBaJG/m6Fcr:OfJGLs6BwNxnfTKsGZc
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Path
-
C:\Users\Admin\Desktop\README_TO_DECRYPT.html
Ransom Note
- ALL YOUR DATA IS ENCRYPTED by QUANTUM What happened? All your files are encrypted on all devices across the network Huge volume of your data including financial, customer, partner and employees data was downloaded to our internal servers What's next? If you don't get in touch with us next 48 hours, we'll start publishing your data to the Data Leaks Portal / TOR Data Leaks Portal How do I recover? There is no way to decrypt your files manually unless we provide a special decryption tool Please download TOR browser and CONTACT US for further instructions Hours Minutes Seconds
Signatures
- Quantum Ransomware
A rebrand of the MountLocker ransomware first seen in August 2021.
- Modifies extensions of user files 3 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\CompareHide.png => \??\c:\Users\Admin\Pictures\CompareHide.png.quantum c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe File renamed C:\Users\Admin\Pictures\RenameSuspend.raw => \??\c:\Users\Admin\Pictures\RenameSuspend.raw.quantum c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe File renamed C:\Users\Admin\Pictures\ResetRepair.tif => \??\c:\Users\Admin\Pictures\ResetRepair.tif.quantum c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe - Deletes itself 1 IoCs
pid Process 812 cmd.exe - Drops desktop.ini file(s) 26 IoCs
description ioc Process File opened for modification \??\c:\Users\Admin\Pictures\desktop.ini c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe File opened for modification \??\c:\Users\Public\Downloads\desktop.ini c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe File opened for modification \??\c:\Users\Public\Music\desktop.ini c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe File opened for modification \??\c:\Users\Public\Music\Sample Music\desktop.ini c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe File opened for modification \??\c:\Users\Public\Pictures\desktop.ini c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe File opened for modification \??\c:\Users\Public\Recorded TV\desktop.ini c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe File opened for modification \??\c:\Users\Admin\Desktop\desktop.ini c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe File opened for modification \??\c:\Users\Admin\Favorites\Links for United States\desktop.ini c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe File opened for modification \??\c:\Users\Public\Videos\desktop.ini c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe File opened for modification \??\c:\Users\Admin\Saved Games\desktop.ini c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe File opened for modification \??\c:\Users\Public\Videos\Sample Videos\desktop.ini c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe File opened for modification \??\c:\Users\Admin\Favorites\Links\desktop.ini c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe File opened for modification \??\c:\Users\Admin\Music\desktop.ini c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe File opened for modification \??\c:\Users\Admin\Videos\desktop.ini c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe File opened for modification \??\c:\Users\Public\Desktop\desktop.ini c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe File opened for modification \??\c:\Users\Public\Documents\desktop.ini c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe File opened for modification \??\c:\Users\Public\Libraries\desktop.ini c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe File opened for modification \??\c:\Users\Public\Pictures\Sample Pictures\desktop.ini c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe File opened for modification \??\c:\Users\Admin\Contacts\desktop.ini c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe File opened for modification \??\c:\Users\Admin\Links\desktop.ini c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe File opened for modification \??\c:\Users\Admin\Favorites\desktop.ini c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe File opened for modification \??\c:\Users\Admin\Searches\desktop.ini c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe File opened for modification \??\c:\Users\Public\desktop.ini c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe File opened for modification \??\c:\Users\Public\Recorded TV\Sample Media\desktop.ini c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe File opened for modification \??\c:\Users\Admin\Documents\desktop.ini c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe File opened for modification \??\c:\Users\Admin\Downloads\desktop.ini c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2C0CC811-B72A-11ED-BDE6-EE84389A6D8F} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000_CLASSES\.quantum c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000_CLASSES\.quantum\shell c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000_CLASSES\.quantum\shell\Open c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe Set value (str) \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000_CLASSES\.quantum\shell\Open\command\ = "explorer.exe README_TO_DECRYPT.html" c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000_CLASSES\.quantum\shell\Open\command c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1624 c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe 1624 c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 1624 c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe Token: SeDebugPrivilege 1624 c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 916 iexplore.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 916 iexplore.exe 916 iexplore.exe 1632 IEXPLORE.EXE 1632 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 1624 wrote to memory of 812 1624 c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe 27 PID 1624 wrote to memory of 812 1624 c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe 27 PID 1624 wrote to memory of 812 1624 c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe 27 PID 812 wrote to memory of 2040 812 cmd.exe 29 PID 812 wrote to memory of 2040 812 cmd.exe 29 PID 812 wrote to memory of 2040 812 cmd.exe 29 PID 916 wrote to memory of 1632 916 iexplore.exe 32 PID 916 wrote to memory of 1632 916 iexplore.exe 32 PID 916 wrote to memory of 1632 916 iexplore.exe 32 PID 916 wrote to memory of 1632 916 iexplore.exe 32 - Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 2040 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe"C:\Users\Admin\AppData\Local\Temp\c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe"1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\\006C9D98.bat" "C:\Users\Admin\AppData\Local\Temp\c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe""2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:812 -
C:\Windows\system32\attrib.exeattrib -s -r -h "C:\Users\Admin\AppData\Local\Temp\c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe"3⤵
- Views/modifies file attributes
PID:2040
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\README_TO_DECRYPT.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:916 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1632
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\006C9D98.bat
- Size 65B
- SHA256 c80128f51871eec3ae2057989a025ce244277c1c180498a5aaef45d5214b8506
- MD5 348cae913e496198548854f5ff2f6d1e
- SHA1 a07655b9020205bd47084afd62a8bb22b48c0cdc
- SHA512 799796736d41d3fcb5a7c859571bb025ca2d062c4b86e078302be68c1a932ed4f78e003640df5405274364b5a9a9c0ba5e37177997683ee7ab54e5267590b611
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\006C9D98.bat
- Size 65B
- SHA256 c80128f51871eec3ae2057989a025ce244277c1c180498a5aaef45d5214b8506
- MD5 348cae913e496198548854f5ff2f6d1e
- SHA1 a07655b9020205bd47084afd62a8bb22b48c0cdc
- SHA512 799796736d41d3fcb5a7c859571bb025ca2d062c4b86e078302be68c1a932ed4f78e003640df5405274364b5a9a9c0ba5e37177997683ee7ab54e5267590b611
- MD5 SHA1 SHA512
- Path C:\Users\Admin\Desktop\README_TO_DECRYPT.html
- Size 7KB
- SHA256 47ee2a808f944af46a58f0eb7ecad1cac787e233631b72bf019739a04fce114b
- MD5 bef6c59862262709c2613495cd1fd47c
- SHA1 42b063d9566b06351c2a4d44b1f7d9246219d7b7
- SHA512 27bcd7e725fd8cc754558eb5093b69aaf7415471b5b155a5eb518ea722479e2bc69c152534aaf07843878f3cec879aa651401ff3f0502de0747fef0782827169
- SSDEEP 192:J1ZpN+H6pGkKwFJQEqN7c+OBCHR/aFPtKvCGl:J1ZHpGkB0vHR0KvCGl
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\Desktop\README_TO_DECRYPT.html
- Size 7KB
- SHA256 47ee2a808f944af46a58f0eb7ecad1cac787e233631b72bf019739a04fce114b
- MD5 bef6c59862262709c2613495cd1fd47c
- SHA1 42b063d9566b06351c2a4d44b1f7d9246219d7b7
- SHA512 27bcd7e725fd8cc754558eb5093b69aaf7415471b5b155a5eb518ea722479e2bc69c152534aaf07843878f3cec879aa651401ff3f0502de0747fef0782827169
- SSDEEP 192:J1ZpN+H6pGkKwFJQEqN7c+OBCHR/aFPtKvCGl:J1ZHpGkB0vHR0KvCGl
- MD5 SHA1 SHA512 SSDEEP