quantum | 4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147

Analysis

max time kernel
148s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
28-02-2023 03:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe
Size

75KB
MD5

0c2798b083fbf6a6e175cc68512d1dcf
SHA1

5e74f28cbc8387bad3a6745f532c3f283d4af9d2
SHA256

4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147
SHA512

415411f85e4facaad08896d7363918834e6abccf7c2661f0f02cdb4bbcf22693353f17831a36aeddf40ba0d93e997981b4f4b7986eea90cd35ed25d6a7febe5e
SSDEEP

1536:9aX51pVH9hsgNGLs6BLM1frxz/HTfcKKBaJG+prBF:OfJGLs6BwNxnfTKsG+prB

Score

10^/10

quantum ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\README_TO_DECRYPT.html

Ransom Note

ALL YOUR DATA IS ENCRYPTED by QUANTUM What happened? All your files are encrypted on all devices across the network Huge volume of your data including financial, customer, partner and employees data was downloaded to our internal servers What's next? If you don't get in touch with us next 48 hours, we'll start publishing your data to the Data Leaks Portal / TOR Data Leaks Portal How do I recover? There is no way to decrypt your files manually unless we provide a special decryption tool Please download TOR browser and CONTACT US for further instructions Hours Minutes Seconds

Signatures

Quantum Ransomware
A rebrand of the MountLocker ransomware first seen in August 2021.
ransomware quantum

Modifies extensions of user files 5 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\RestartRename.tif => \??\c:\Users\Admin\Pictures\RestartRename.tif.quantum	4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe
File renamed	C:\Users\Admin\Pictures\StopPop.tif => \??\c:\Users\Admin\Pictures\StopPop.tif.quantum	4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe
File renamed	C:\Users\Admin\Pictures\BlockMove.png => \??\c:\Users\Admin\Pictures\BlockMove.png.quantum	4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe
File renamed	C:\Users\Admin\Pictures\FindAssert.png => \??\c:\Users\Admin\Pictures\FindAssert.png.quantum	4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe
File renamed	C:\Users\Admin\Pictures\GroupRestart.crw => \??\c:\Users\Admin\Pictures\GroupRestart.crw.quantum	4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe

Drops desktop.ini file(s) 25 IoCs

Processes:

4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe

description	ioc	process
File opened for modification	\??\c:\Users\Admin\Pictures\Saved Pictures\desktop.ini	4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe
File opened for modification	\??\c:\Users\Admin\Saved Games\desktop.ini	4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe
File opened for modification	\??\c:\Users\Admin\Searches\desktop.ini	4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe
File opened for modification	\??\c:\Users\Public\desktop.ini	4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe
File opened for modification	\??\c:\Users\Admin\Contacts\desktop.ini	4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe
File opened for modification	\??\c:\Users\Admin\Downloads\desktop.ini	4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe
File opened for modification	\??\c:\Users\Admin\Favorites\Links\desktop.ini	4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe
File opened for modification	\??\c:\Users\Admin\Links\desktop.ini	4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe
File opened for modification	\??\c:\Users\Public\Libraries\desktop.ini	4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe
File opened for modification	\??\c:\Users\Public\Pictures\desktop.ini	4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe
File opened for modification	\??\c:\Users\Admin\3D Objects\desktop.ini	4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe
File opened for modification	\??\c:\Users\Admin\Desktop\desktop.ini	4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe
File opened for modification	\??\c:\Users\Admin\Music\desktop.ini	4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe
File opened for modification	\??\c:\Users\Admin\Pictures\desktop.ini	4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe
File opened for modification	\??\c:\Users\Public\Music\desktop.ini	4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe
File opened for modification	\??\c:\Users\Public\Videos\desktop.ini	4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe
File opened for modification	\??\c:\Users\Admin\Pictures\Camera Roll\desktop.ini	4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe
File opened for modification	\??\c:\Users\Public\Desktop\desktop.ini	4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe
File opened for modification	\??\c:\Users\Public\Documents\desktop.ini	4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe
File opened for modification	\??\c:\Users\Public\Downloads\desktop.ini	4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe
File opened for modification	\??\c:\Users\Public\AccountPictures\desktop.ini	4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe
File opened for modification	\??\c:\Users\Admin\Documents\desktop.ini	4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe
File opened for modification	\??\c:\Users\Admin\Favorites\desktop.ini	4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe
File opened for modification	\??\c:\Users\Admin\OneDrive\desktop.ini	4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe
File opened for modification	\??\c:\Users\Admin\Videos\desktop.ini	4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe

Drops file in Program Files directory 2 IoCs

Processes:

setup.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230228045713.pma	setup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\ba426732-6653-4196-81fa-dbc60426f4e2.tmp	setup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 6 IoCs

Processes:

4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exemsedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\.quantum\shell\Open\command	4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\.quantum	4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\.quantum\shell	4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\.quantum\shell\Open	4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\.quantum\shell\Open\command\ = "explorer.exe README_TO_DECRYPT.html"	4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exemsedge.exemsedge.exeidentity_helper.exe

pid	process
1272	4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe
1272	4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe
4372	msedge.exe
4372	msedge.exe
996	msedge.exe
996	msedge.exe
896	identity_helper.exe
896	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

996 msedge.exe
996 msedge.exe
996 msedge.exe
996 msedge.exe
996 msedge.exe
996 msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe

description	pid	process
Token: SeRestorePrivilege	1272	4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe
Token: SeDebugPrivilege	1272	4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe

Suspicious use of FindShellTrayWindow 11 IoCs

Processes:

msedge.exe

pid	process
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe

Suspicious use of SendNotifyMessage 8 IoCs

Processes:

msedge.exe

pid process

996 msedge.exe
996 msedge.exe
996 msedge.exe
996 msedge.exe
996 msedge.exe
996 msedge.exe
996 msedge.exe
996 msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.execmd.exemsedge.exe

description	pid	process	target process
PID 1272 wrote to memory of 1352	1272	4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe	cmd.exe
PID 1272 wrote to memory of 1352	1272	4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe	cmd.exe
PID 1352 wrote to memory of 4628	1352	cmd.exe	attrib.exe
PID 1352 wrote to memory of 4628	1352	cmd.exe	attrib.exe
PID 996 wrote to memory of 624	996	msedge.exe	msedge.exe
PID 996 wrote to memory of 624	996	msedge.exe	msedge.exe
PID 996 wrote to memory of 1588	996	msedge.exe	msedge.exe
PID 996 wrote to memory of 1588	996	msedge.exe	msedge.exe
PID 996 wrote to memory of 1588	996	msedge.exe	msedge.exe
PID 996 wrote to memory of 1588	996	msedge.exe	msedge.exe
PID 996 wrote to memory of 1588	996	msedge.exe	msedge.exe
PID 996 wrote to memory of 1588	996	msedge.exe	msedge.exe
PID 996 wrote to memory of 1588	996	msedge.exe	msedge.exe
PID 996 wrote to memory of 1588	996	msedge.exe	msedge.exe
PID 996 wrote to memory of 1588	996	msedge.exe	msedge.exe
PID 996 wrote to memory of 1588	996	msedge.exe	msedge.exe
PID 996 wrote to memory of 1588	996	msedge.exe	msedge.exe
PID 996 wrote to memory of 1588	996	msedge.exe	msedge.exe
PID 996 wrote to memory of 1588	996	msedge.exe	msedge.exe
PID 996 wrote to memory of 1588	996	msedge.exe	msedge.exe
PID 996 wrote to memory of 1588	996	msedge.exe	msedge.exe
PID 996 wrote to memory of 1588	996	msedge.exe	msedge.exe
PID 996 wrote to memory of 1588	996	msedge.exe	msedge.exe
PID 996 wrote to memory of 1588	996	msedge.exe	msedge.exe
PID 996 wrote to memory of 1588	996	msedge.exe	msedge.exe
PID 996 wrote to memory of 1588	996	msedge.exe	msedge.exe
PID 996 wrote to memory of 1588	996	msedge.exe	msedge.exe
PID 996 wrote to memory of 1588	996	msedge.exe	msedge.exe
PID 996 wrote to memory of 1588	996	msedge.exe	msedge.exe
PID 996 wrote to memory of 1588	996	msedge.exe	msedge.exe
PID 996 wrote to memory of 1588	996	msedge.exe	msedge.exe
PID 996 wrote to memory of 1588	996	msedge.exe	msedge.exe
PID 996 wrote to memory of 1588	996	msedge.exe	msedge.exe
PID 996 wrote to memory of 1588	996	msedge.exe	msedge.exe
PID 996 wrote to memory of 1588	996	msedge.exe	msedge.exe
PID 996 wrote to memory of 1588	996	msedge.exe	msedge.exe
PID 996 wrote to memory of 1588	996	msedge.exe	msedge.exe
PID 996 wrote to memory of 1588	996	msedge.exe	msedge.exe
PID 996 wrote to memory of 1588	996	msedge.exe	msedge.exe
PID 996 wrote to memory of 1588	996	msedge.exe	msedge.exe
PID 996 wrote to memory of 1588	996	msedge.exe	msedge.exe
PID 996 wrote to memory of 1588	996	msedge.exe	msedge.exe
PID 996 wrote to memory of 1588	996	msedge.exe	msedge.exe
PID 996 wrote to memory of 1588	996	msedge.exe	msedge.exe
PID 996 wrote to memory of 1588	996	msedge.exe	msedge.exe
PID 996 wrote to memory of 1588	996	msedge.exe	msedge.exe
PID 996 wrote to memory of 4372	996	msedge.exe	msedge.exe
PID 996 wrote to memory of 4372	996	msedge.exe	msedge.exe
PID 996 wrote to memory of 4524	996	msedge.exe	msedge.exe
PID 996 wrote to memory of 4524	996	msedge.exe	msedge.exe
PID 996 wrote to memory of 4524	996	msedge.exe	msedge.exe
PID 996 wrote to memory of 4524	996	msedge.exe	msedge.exe
PID 996 wrote to memory of 4524	996	msedge.exe	msedge.exe
PID 996 wrote to memory of 4524	996	msedge.exe	msedge.exe
PID 996 wrote to memory of 4524	996	msedge.exe	msedge.exe
PID 996 wrote to memory of 4524	996	msedge.exe	msedge.exe
PID 996 wrote to memory of 4524	996	msedge.exe	msedge.exe
PID 996 wrote to memory of 4524	996	msedge.exe	msedge.exe
PID 996 wrote to memory of 4524	996	msedge.exe	msedge.exe
PID 996 wrote to memory of 4524	996	msedge.exe	msedge.exe
PID 996 wrote to memory of 4524	996	msedge.exe	msedge.exe
PID 996 wrote to memory of 4524	996	msedge.exe	msedge.exe
PID 996 wrote to memory of 4524	996	msedge.exe	msedge.exe
PID 996 wrote to memory of 4524	996	msedge.exe	msedge.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exe

pid process

4628 attrib.exe

pid	process
4628	attrib.exe

C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe
"C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe"
1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1272

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\\0E5698F9.bat" "C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe""
2⤵
- Suspicious use of WriteProcessMemory
PID:1352

C:\Windows\system32\attrib.exe
attrib -s -r -h "C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe"
3⤵
- Views/modifies file attributes
PID:4628

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\README_TO_DECRYPT.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:996

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0x118,0x128,0x7ffd4a0246f8,0x7ffd4a024708,0x7ffd4a024718
2⤵
PID:624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,10575617524032124311,2054572146910190080,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
2⤵
PID:1588

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,10575617524032124311,2054572146910190080,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,10575617524032124311,2054572146910190080,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:8
2⤵
PID:4524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,10575617524032124311,2054572146910190080,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3628 /prefetch:1
2⤵
PID:4572

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,10575617524032124311,2054572146910190080,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3636 /prefetch:1
2⤵
PID:736

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,10575617524032124311,2054572146910190080,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8
2⤵
PID:4024

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
2⤵
- Drops file in Program Files directory
PID:4780

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x26c,0x270,0x274,0x248,0x278,0x7ff6005b5460,0x7ff6005b5470,0x7ff6005b5480
3⤵
PID:672

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,10575617524032124311,2054572146910190080,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:896

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,10575617524032124311,2054572146910190080,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
2⤵
PID:1700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,10575617524032124311,2054572146910190080,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
2⤵
PID:2848

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,10575617524032124311,2054572146910190080,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
2⤵
PID:3760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,10575617524032124311,2054572146910190080,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4244 /prefetch:1
2⤵
PID:4744

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4892

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\3D Objects\README_TO_DECRYPT.html
Filesize
7KB

MD5
8b660e8ddf1eb1ea712e14a2b92c1a2b

SHA1
4175a0d10b8dae93d77dc295e67c74e96cbda140

SHA256
22295af10b4143e82d04b8a62e02b6ac606afc82134dcb8cdab55f4323e1d739

SHA512
42e7e6c8eb0816d948cc74c6af7b29b1899927e056f6b0ec8024aac44577b8c1ba736063178b79ae140a87f8dc6a83594ec110358a66ca4b05617eb8ebfcecb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
78c7656527762ed2977adf983a6f4766

SHA1
21a66d2eefcb059371f4972694057e4b1f827ce6

SHA256
e1000099751602ae1adcec6f1c74e1d65f472936817b45239dfed4b043984296

SHA512
0a8e58ae95163b3cdf8e81b5085887761e73cb7c836a1a6a972e837fb3df69b2ac70cfd6311d06d40656344ec35eb48e512f007561480f0345486ac2b329be0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
099b4ba2787e99b696fc61528100f83f

SHA1
06e1f8b7391e1d548e49a1022f6ce6e7aa61f292

SHA256
cdb1db488e260ed750edfe1c145850b57ee8ab819d75237a167e673116a33ee8

SHA512
4309375e10785564ceb03e0127ced414e366a5b833f16a60d796471d871b479e4c044db5268902d9dfd14715ca577cb26042bab8f7b0f31fe8abf33947feb9d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk
Filesize
2KB

MD5
a4dede5dd4cd4c100a4a3e4c9e6c4c20

SHA1
f66ac6d398941b21a6ff98274c149a0e39f33b72

SHA256
b9d275be2fd7385b2317f2ff1b497f303cfbaaba53f88529710aa2320f947f3b

SHA512
5066cd538a84b00148930c4a0f77334f43f9b29c46059282e971dbbee982cecc26dd58a6bcff4476b4d2aa8b679520b03bf04585c7f2db912b4d1ae0b3f7ed0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
65584d02c8f9e126b05bb3ef7369bf26

SHA1
d885b8809f6105c544d614e27babaa628c6c7d53

SHA256
2419640992d394b07c1e656fe8ebc08911873d9ce701d3e631b0da9dd26641af

SHA512
7063edaa3e1c9306143175b88219984e84e7861da27807c9ef787ff322e59afa0a8e54ced891100c19b780057b56c89e7e502b62ff9f5031ad3ee56b952d47ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
4617f94832c685b31f703f8dfe8fdca1

SHA1
1933266775ae809cdd479f1c76ad1580a5cd4171

SHA256
1e0f01ec217feea7b68cb7f2d63b2567e36b7e16dc7405b9a77e95672b95f7f2

SHA512
fab8a62359505fdcc4f639d42abfc0caabe7e4f8d19629988abb7ffb4b25e2175bc3131541910a4a868dc9a0f6a1e03996f211cd7101bec22e5213bb13da7aff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Filesize
24KB

MD5
02ee7addc9e8a2d07af55556ebf0ff5c

SHA1
020161bb64ecb7c6e6886ccc055908984dc651d8

SHA256
552d3ed359b7a52278ce621674d16428d8a7969f6cd5663df18e240cce66aadc

SHA512
567989543c3848a0c3276d96b96ca761f750e4b71fb74f36d809f590ffe16a72fd5ece251737a8b1ffe65f0051e211bd7ad19d2b8b0b7ca1b7ffc86dd2a52883

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000001.dbtmp
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001
Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
3ae615065daa0ee99735442361e9bc4b

SHA1
cbb19c04354709f048186433abb9c34f7e9d913e

SHA256
37e6d27fe2ad97c621023b8a370c7755a9decd8f300f2088daa874204bf7657c

SHA512
8b9f4613385f4b8f5fd6b42c8f867d5a7acdae1ed5831979d5ff5c7aab37c77159d290a2c2044f5318901d4cf51f7dba9b7203d611b066c0777d3ee9ba4cad86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
9KB

MD5
da0380af0d3cfda822bec054a99a6bbd

SHA1
17fa3c201ef034efe221c4692d49b837f50ddadc

SHA256
61d169ed95caf595deb12d6833339c892eb8836c30848c38cc8210c80a17c65b

SHA512
49e708f2ebe08b446eca68cb1f4af1b76f0ea4e85cb7ed50e8113fec89bc300c2eb9af947df70d21b68a1c8877ae4c9a2bbf097d23e88724c21e7d4ff30f759f

Download Submit
C:\Users\Admin\AppData\Local\Temp\0E5698F9.bat
Filesize
65B

MD5
348cae913e496198548854f5ff2f6d1e

SHA1
a07655b9020205bd47084afd62a8bb22b48c0cdc

SHA256
c80128f51871eec3ae2057989a025ce244277c1c180498a5aaef45d5214b8506

SHA512
799796736d41d3fcb5a7c859571bb025ca2d062c4b86e078302be68c1a932ed4f78e003640df5405274364b5a9a9c0ba5e37177997683ee7ab54e5267590b611

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize
3KB

MD5
c66b94d249f60075c9c4df62696202db

SHA1
fe711af485a7cad5adb1afc6458e340ef96c6817

SHA256
0925ab69580d9fb80feda389c0af05d9c01677c1400a7af1a7f8bb95369114ad

SHA512
c4723238ec1d1fa1540f3b985f5f2df7c1995afecfc9202a9a1f0f7908ea4c3abb7c858936f18c08a4d879fbed209afb6bf6783728f1db626d1acbaaf49d44fb

Download Submit
C:\Users\Admin\Desktop\README_TO_DECRYPT.html
Filesize
7KB

MD5
8b660e8ddf1eb1ea712e14a2b92c1a2b

SHA1
4175a0d10b8dae93d77dc295e67c74e96cbda140

SHA256
22295af10b4143e82d04b8a62e02b6ac606afc82134dcb8cdab55f4323e1d739

SHA512
42e7e6c8eb0816d948cc74c6af7b29b1899927e056f6b0ec8024aac44577b8c1ba736063178b79ae140a87f8dc6a83594ec110358a66ca4b05617eb8ebfcecb8

Download Submit
\??\pipe\LOCAL\crashpad_996_BALPCFAQAHWZYJYK
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1588-377-0x00007FFD65AB0000-0x00007FFD65AB1000-memory.dmp

Filesize
4KB

Download