quantum | c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5

General

Target

c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe
Size

75KB
MD5

043d54316b201b92d11df5a5ac76d104
SHA1

b0b49a9bd4de2f3fa56a4faf612303e68878f751
SHA256

c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5
SHA512

2a2e63af63d99bc3c0fc27ac6309b57998a4d91355ce680b52faa3447760230cbdebc74e8f8c1bd87957c572a96fb7abf72ed0283744fa929d71213bcb403382
SSDEEP

1536:9aX51pVH9hsgNGLs6BLM1frxz/HTfcKKBaJG/m6Fcr:OfJGLs6BwNxnfTKsGZc

Score

10^/10

quantum ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\README_TO_DECRYPT.html

Ransom Note

ALL YOUR DATA IS ENCRYPTED by QUANTUM What happened? All your files are encrypted on all devices across the network Huge volume of your data including financial, customer, partner and employees data was downloaded to our internal servers What's next? If you don't get in touch with us next 48 hours, we'll start publishing your data to the Data Leaks Portal / TOR Data Leaks Portal How do I recover? There is no way to decrypt your files manually unless we provide a special decryption tool Please download TOR browser and CONTACT US for further instructions Hours Minutes Seconds

Signatures

Quantum Ransomware
A rebrand of the MountLocker ransomware first seen in August 2021.
ransomware quantum

Modifies extensions of user files 3 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\CompareHide.png => \??\c:\Users\Admin\Pictures\CompareHide.png.quantum	c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe
File renamed	C:\Users\Admin\Pictures\RenameSuspend.raw => \??\c:\Users\Admin\Pictures\RenameSuspend.raw.quantum	c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe
File renamed	C:\Users\Admin\Pictures\ResetRepair.tif => \??\c:\Users\Admin\Pictures\ResetRepair.tif.quantum	c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

812 cmd.exe

pid	process
812	cmd.exe

Drops desktop.ini file(s) 26 IoCs

Processes:

c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe

description	ioc	process
File opened for modification	\??\c:\Users\Admin\Pictures\desktop.ini	c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe
File opened for modification	\??\c:\Users\Public\Downloads\desktop.ini	c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe
File opened for modification	\??\c:\Users\Public\Music\desktop.ini	c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe
File opened for modification	\??\c:\Users\Public\Music\Sample Music\desktop.ini	c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe
File opened for modification	\??\c:\Users\Public\Pictures\desktop.ini	c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe
File opened for modification	\??\c:\Users\Public\Recorded TV\desktop.ini	c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe
File opened for modification	\??\c:\Users\Admin\Desktop\desktop.ini	c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe
File opened for modification	\??\c:\Users\Admin\Favorites\Links for United States\desktop.ini	c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe
File opened for modification	\??\c:\Users\Public\Videos\desktop.ini	c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe
File opened for modification	\??\c:\Users\Admin\Saved Games\desktop.ini	c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe
File opened for modification	\??\c:\Users\Public\Videos\Sample Videos\desktop.ini	c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe
File opened for modification	\??\c:\Users\Admin\Favorites\Links\desktop.ini	c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe
File opened for modification	\??\c:\Users\Admin\Music\desktop.ini	c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe
File opened for modification	\??\c:\Users\Admin\Videos\desktop.ini	c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe
File opened for modification	\??\c:\Users\Public\Desktop\desktop.ini	c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe
File opened for modification	\??\c:\Users\Public\Documents\desktop.ini	c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe
File opened for modification	\??\c:\Users\Public\Libraries\desktop.ini	c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe
File opened for modification	\??\c:\Users\Public\Pictures\Sample Pictures\desktop.ini	c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe
File opened for modification	\??\c:\Users\Admin\Contacts\desktop.ini	c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe
File opened for modification	\??\c:\Users\Admin\Links\desktop.ini	c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe
File opened for modification	\??\c:\Users\Admin\Favorites\desktop.ini	c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe
File opened for modification	\??\c:\Users\Admin\Searches\desktop.ini	c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe
File opened for modification	\??\c:\Users\Public\desktop.ini	c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe
File opened for modification	\??\c:\Users\Public\Recorded TV\Sample Media\desktop.ini	c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe
File opened for modification	\??\c:\Users\Admin\Documents\desktop.ini	c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe
File opened for modification	\??\c:\Users\Admin\Downloads\desktop.ini	c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe

Modifies Internet Explorer settings 1 TTPs 25 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2C0CC811-B72A-11ED-BDE6-EE84389A6D8F} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Modifies registry class 5 IoCs

Processes:

c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000_CLASSES\.quantum	c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000_CLASSES\.quantum\shell	c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000_CLASSES\.quantum\shell\Open	c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000_CLASSES\.quantum\shell\Open\command\ = "explorer.exe README_TO_DECRYPT.html"	c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000_CLASSES\.quantum\shell\Open\command	c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe

pid	process
1624	c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe
1624	c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe

description	pid	process
Token: SeRestorePrivilege	1624	c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe
Token: SeDebugPrivilege	1624	c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

916 iexplore.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

916 iexplore.exe
916 iexplore.exe
1632 IEXPLORE.EXE
1632 IEXPLORE.EXE

pid	process
916	iexplore.exe

pid	process
916	iexplore.exe
916	iexplore.exe
1632	IEXPLORE.EXE
1632	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.execmd.exeiexplore.exe

description	pid	process	target process
PID 1624 wrote to memory of 812	1624	c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe	cmd.exe
PID 1624 wrote to memory of 812	1624	c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe	cmd.exe
PID 1624 wrote to memory of 812	1624	c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe	cmd.exe
PID 812 wrote to memory of 2040	812	cmd.exe	attrib.exe
PID 812 wrote to memory of 2040	812	cmd.exe	attrib.exe
PID 812 wrote to memory of 2040	812	cmd.exe	attrib.exe
PID 916 wrote to memory of 1632	916	iexplore.exe	IEXPLORE.EXE
PID 916 wrote to memory of 1632	916	iexplore.exe	IEXPLORE.EXE
PID 916 wrote to memory of 1632	916	iexplore.exe	IEXPLORE.EXE
PID 916 wrote to memory of 1632	916	iexplore.exe	IEXPLORE.EXE

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exe

pid process

2040 attrib.exe

pid	process
2040	attrib.exe

C:\Users\Admin\AppData\Local\Temp\c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe
"C:\Users\Admin\AppData\Local\Temp\c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe"
1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\\006C9D98.bat" "C:\Users\Admin\AppData\Local\Temp\c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe""
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:812
- - C:\Windows\system32\attrib.exe
    attrib -s -r -h "C:\Users\Admin\AppData\Local\Temp\c227041d6e889f67413f2e669e1a8c027dfa1c6f40e13889faaee3cd87633cd5.exe"
    3⤵
    - Views/modifies file attributes
    PID:2040

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\README_TO_DECRYPT.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:916
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:916 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1632

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\006C9D98.bat

Filesize
65B

MD5
348cae913e496198548854f5ff2f6d1e

SHA1
a07655b9020205bd47084afd62a8bb22b48c0cdc

SHA256
c80128f51871eec3ae2057989a025ce244277c1c180498a5aaef45d5214b8506

SHA512
799796736d41d3fcb5a7c859571bb025ca2d062c4b86e078302be68c1a932ed4f78e003640df5405274364b5a9a9c0ba5e37177997683ee7ab54e5267590b611

Download Submit
C:\Users\Admin\AppData\Local\Temp\006C9D98.bat

Filesize
65B

MD5
348cae913e496198548854f5ff2f6d1e

SHA1
a07655b9020205bd47084afd62a8bb22b48c0cdc

SHA256
c80128f51871eec3ae2057989a025ce244277c1c180498a5aaef45d5214b8506

SHA512
799796736d41d3fcb5a7c859571bb025ca2d062c4b86e078302be68c1a932ed4f78e003640df5405274364b5a9a9c0ba5e37177997683ee7ab54e5267590b611

Download Submit
C:\Users\Admin\Desktop\README_TO_DECRYPT.html

Filesize
7KB

MD5
bef6c59862262709c2613495cd1fd47c

SHA1
42b063d9566b06351c2a4d44b1f7d9246219d7b7

SHA256
47ee2a808f944af46a58f0eb7ecad1cac787e233631b72bf019739a04fce114b

SHA512
27bcd7e725fd8cc754558eb5093b69aaf7415471b5b155a5eb518ea722479e2bc69c152534aaf07843878f3cec879aa651401ff3f0502de0747fef0782827169

Download Submit
C:\Users\Admin\Desktop\README_TO_DECRYPT.html

Filesize
7KB

MD5
bef6c59862262709c2613495cd1fd47c

SHA1
42b063d9566b06351c2a4d44b1f7d9246219d7b7

SHA256
47ee2a808f944af46a58f0eb7ecad1cac787e233631b72bf019739a04fce114b

SHA512
27bcd7e725fd8cc754558eb5093b69aaf7415471b5b155a5eb518ea722479e2bc69c152534aaf07843878f3cec879aa651401ff3f0502de0747fef0782827169

Download Submit
memory/916-318-0x0000000002280000-0x0000000002290000-memory.dmp

Filesize
64KB

Download
memory/1632-319-0x0000000000500000-0x0000000000502000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads