quantum | 76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0

Analysis

max time kernel
32s
max time network
37s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
28-02-2023 04:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe
Size

64KB
MD5

b0b3acefd8c8ae6f30daf7610cacb78a
SHA1

8b713f8940c1a275eaf8399e6e44967925e46863
SHA256

76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0
SHA512

37cb13a9ff501583f6948d6f427f451ba6d6d7db4067d13146fe75cc4483ce8a5e104c161da3995f88026bc8801ed3750a875222484d8a41895755dcf94e1f0d
SSDEEP

768:GnJ9uwtbJD/QpEdTrArzVpCK1w22TYgNvCJ037FLxZKQJRNz0TqXUNxlEfZf3u0L:G+wr1AB0AwB57F9npz0Ta5fRu0L

Score

10^/10

quantum ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\README_TO_DECRYPT.html

Ransom Note

ALL YOUR DATA IS ENCRYPTED by QUANTUM What happened? All your files are encrypted on all devices across the network Huge volume of your data including financial, customer, partner and employees data was downloaded to our internal servers What's next? If you don't get in touch with us next 48 hours, we'll start publishing your data to the Data Leaks Portal / TOR Data Leaks Portal How do I recover? There is no way to decrypt your files manually unless we provide a special decryption tool Please download TOR browser and CONTACT US for further instructions Hours Minutes Seconds

Signatures

Quantum Ransomware
A rebrand of the MountLocker ransomware first seen in August 2021.
ransomware quantum

Modifies extensions of user files 17 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File renamed	C:\Users\Admin\Pictures\OpenUnlock.tiff => \??\c:\Users\Admin\Pictures\OpenUnlock.tiff.quantum	76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe
File renamed	C:\Users\Admin\Pictures\UnpublishRegister.tif => \??\c:\Users\Admin\Pictures\UnpublishRegister.tif.quantum	76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe
File renamed	C:\Users\Admin\Pictures\UseDebug.crw => \??\c:\Users\Admin\Pictures\UseDebug.crw.quantum	76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe
File opened for modification	\??\c:\Users\Admin\Pictures\ExitGroup.tiff	76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe
File renamed	C:\Users\Admin\Pictures\PushAssert.crw => \??\c:\Users\Admin\Pictures\PushAssert.crw.quantum	76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe
File renamed	C:\Users\Admin\Pictures\GrantImport.tif => \??\c:\Users\Admin\Pictures\GrantImport.tif.quantum	76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe
File opened for modification	\??\c:\Users\Admin\Pictures\OpenUnlock.tiff	76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe
File renamed	C:\Users\Admin\Pictures\ResolveFind.tiff => \??\c:\Users\Admin\Pictures\ResolveFind.tiff.quantum	76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe
File renamed	C:\Users\Admin\Pictures\RestartMerge.png => \??\c:\Users\Admin\Pictures\RestartMerge.png.quantum	76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe
File renamed	C:\Users\Admin\Pictures\SplitUpdate.crw => \??\c:\Users\Admin\Pictures\SplitUpdate.crw.quantum	76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe
File renamed	C:\Users\Admin\Pictures\WaitMeasure.crw => \??\c:\Users\Admin\Pictures\WaitMeasure.crw.quantum	76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe
File renamed	C:\Users\Admin\Pictures\CompleteExport.png => \??\c:\Users\Admin\Pictures\CompleteExport.png.quantum	76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe
File renamed	C:\Users\Admin\Pictures\ExitGroup.tiff => \??\c:\Users\Admin\Pictures\ExitGroup.tiff.quantum	76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe
File renamed	C:\Users\Admin\Pictures\ExpandUnlock.raw => \??\c:\Users\Admin\Pictures\ExpandUnlock.raw.quantum	76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe
File renamed	C:\Users\Admin\Pictures\ExportLock.tif => \??\c:\Users\Admin\Pictures\ExportLock.tif.quantum	76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe
File opened for modification	\??\c:\Users\Admin\Pictures\ResolveFind.tiff	76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe
File renamed	C:\Users\Admin\Pictures\SendStart.crw => \??\c:\Users\Admin\Pictures\SendStart.crw.quantum	76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe

Drops desktop.ini file(s) 25 IoCs

description	ioc	Process
File opened for modification	\??\c:\Users\Admin\Pictures\desktop.ini	76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe
File opened for modification	\??\c:\Users\Admin\Saved Games\desktop.ini	76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe
File opened for modification	\??\c:\Users\Admin\Searches\desktop.ini	76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe
File opened for modification	\??\c:\Users\Public\AccountPictures\desktop.ini	76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe
File opened for modification	\??\c:\Users\Admin\3D Objects\desktop.ini	76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe
File opened for modification	\??\c:\Users\Admin\Documents\desktop.ini	76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe
File opened for modification	\??\c:\Users\Admin\Favorites\desktop.ini	76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe
File opened for modification	\??\c:\Users\Admin\Pictures\Camera Roll\desktop.ini	76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe
File opened for modification	\??\c:\Users\Public\Documents\desktop.ini	76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe
File opened for modification	\??\c:\Users\Public\Music\desktop.ini	76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe
File opened for modification	\??\c:\Users\Public\Videos\desktop.ini	76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe
File opened for modification	\??\c:\Users\Admin\Favorites\Links\desktop.ini	76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe
File opened for modification	\??\c:\Users\Admin\Pictures\Saved Pictures\desktop.ini	76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe
File opened for modification	\??\c:\Users\Public\Libraries\desktop.ini	76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe
File opened for modification	\??\c:\Users\Admin\Contacts\desktop.ini	76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe
File opened for modification	\??\c:\Users\Admin\Videos\desktop.ini	76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe
File opened for modification	\??\c:\Users\Public\Downloads\desktop.ini	76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe
File opened for modification	\??\c:\Users\Public\Pictures\desktop.ini	76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe
File opened for modification	\??\c:\Users\Admin\OneDrive\desktop.ini	76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe
File opened for modification	\??\c:\Users\Public\Desktop\desktop.ini	76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe
File opened for modification	\??\c:\Users\Public\desktop.ini	76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe
File opened for modification	\??\c:\Users\Admin\Desktop\desktop.ini	76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe
File opened for modification	\??\c:\Users\Admin\Downloads\desktop.ini	76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe
File opened for modification	\??\c:\Users\Admin\Links\desktop.ini	76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe
File opened for modification	\??\c:\Users\Admin\Music\desktop.ini	76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\d1009118-a213-4195-9577-92d700b03cfe.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230228052335.pma	setup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 6 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\.quantum\shell\Open\command\ = "explorer.exe README_TO_DECRYPT.html"	76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\.quantum\shell\Open\command	76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\.quantum	76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\.quantum\shell	76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\.quantum\shell\Open	76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3520	76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe
3520	76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe
1180	msedge.exe
1180	msedge.exe
2432	msedge.exe
2432	msedge.exe
3536	identity_helper.exe
3536	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	3520	76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe
Token: SeDebugPrivilege	3520	76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe

Suspicious use of FindShellTrayWindow 11 IoCs

pid	Process
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe

Suspicious use of SendNotifyMessage 8 IoCs

pid	Process
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 4008	2432	msedge.exe	90
PID 2432 wrote to memory of 4008	2432	msedge.exe	90
PID 2432 wrote to memory of 1536	2432	msedge.exe	95
PID 2432 wrote to memory of 1536	2432	msedge.exe	95
PID 2432 wrote to memory of 1536	2432	msedge.exe	95
PID 2432 wrote to memory of 1536	2432	msedge.exe	95
PID 2432 wrote to memory of 1536	2432	msedge.exe	95
PID 2432 wrote to memory of 1536	2432	msedge.exe	95
PID 2432 wrote to memory of 1536	2432	msedge.exe	95
PID 2432 wrote to memory of 1536	2432	msedge.exe	95
PID 2432 wrote to memory of 1536	2432	msedge.exe	95
PID 2432 wrote to memory of 1536	2432	msedge.exe	95
PID 2432 wrote to memory of 1536	2432	msedge.exe	95
PID 2432 wrote to memory of 1536	2432	msedge.exe	95
PID 2432 wrote to memory of 1536	2432	msedge.exe	95
PID 2432 wrote to memory of 1536	2432	msedge.exe	95
PID 2432 wrote to memory of 1536	2432	msedge.exe	95
PID 2432 wrote to memory of 1536	2432	msedge.exe	95
PID 2432 wrote to memory of 1536	2432	msedge.exe	95
PID 2432 wrote to memory of 1536	2432	msedge.exe	95
PID 2432 wrote to memory of 1536	2432	msedge.exe	95
PID 2432 wrote to memory of 1536	2432	msedge.exe	95
PID 2432 wrote to memory of 1536	2432	msedge.exe	95
PID 2432 wrote to memory of 1536	2432	msedge.exe	95
PID 2432 wrote to memory of 1536	2432	msedge.exe	95
PID 2432 wrote to memory of 1536	2432	msedge.exe	95
PID 2432 wrote to memory of 1536	2432	msedge.exe	95
PID 2432 wrote to memory of 1536	2432	msedge.exe	95
PID 2432 wrote to memory of 1536	2432	msedge.exe	95
PID 2432 wrote to memory of 1536	2432	msedge.exe	95
PID 2432 wrote to memory of 1536	2432	msedge.exe	95
PID 2432 wrote to memory of 1536	2432	msedge.exe	95
PID 2432 wrote to memory of 1536	2432	msedge.exe	95
PID 2432 wrote to memory of 1536	2432	msedge.exe	95
PID 2432 wrote to memory of 1536	2432	msedge.exe	95
PID 2432 wrote to memory of 1536	2432	msedge.exe	95
PID 2432 wrote to memory of 1536	2432	msedge.exe	95
PID 2432 wrote to memory of 1536	2432	msedge.exe	95
PID 2432 wrote to memory of 1536	2432	msedge.exe	95
PID 2432 wrote to memory of 1536	2432	msedge.exe	95
PID 2432 wrote to memory of 1536	2432	msedge.exe	95
PID 2432 wrote to memory of 1536	2432	msedge.exe	95
PID 2432 wrote to memory of 1180	2432	msedge.exe	96
PID 2432 wrote to memory of 1180	2432	msedge.exe	96
PID 2432 wrote to memory of 3964	2432	msedge.exe	98
PID 2432 wrote to memory of 3964	2432	msedge.exe	98
PID 2432 wrote to memory of 3964	2432	msedge.exe	98
PID 2432 wrote to memory of 3964	2432	msedge.exe	98
PID 2432 wrote to memory of 3964	2432	msedge.exe	98
PID 2432 wrote to memory of 3964	2432	msedge.exe	98
PID 2432 wrote to memory of 3964	2432	msedge.exe	98
PID 2432 wrote to memory of 3964	2432	msedge.exe	98
PID 2432 wrote to memory of 3964	2432	msedge.exe	98
PID 2432 wrote to memory of 3964	2432	msedge.exe	98
PID 2432 wrote to memory of 3964	2432	msedge.exe	98
PID 2432 wrote to memory of 3964	2432	msedge.exe	98
PID 2432 wrote to memory of 3964	2432	msedge.exe	98
PID 2432 wrote to memory of 3964	2432	msedge.exe	98
PID 2432 wrote to memory of 3964	2432	msedge.exe	98
PID 2432 wrote to memory of 3964	2432	msedge.exe	98
PID 2432 wrote to memory of 3964	2432	msedge.exe	98
PID 2432 wrote to memory of 3964	2432	msedge.exe	98
PID 2432 wrote to memory of 3964	2432	msedge.exe	98
PID 2432 wrote to memory of 3964	2432	msedge.exe	98

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
1316	attrib.exe

C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe
"C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe"
1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3520
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\\0E56B1EF.bat" "C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe""
  2⤵
  PID:964
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -r -h "C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe"
    3⤵
    - Views/modifies file attributes
    PID:1316

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\README_TO_DECRYPT.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa7a3046f8,0x7ffa7a304708,0x7ffa7a304718
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,2498696881479843462,10409687636470896852,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,2498696881479843462,10409687636470896852,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,2498696881479843462,10409687636470896852,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2996 /prefetch:8
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2498696881479843462,10409687636470896852,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2498696881479843462,10409687636470896852,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,2498696881479843462,10409687636470896852,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5104 /prefetch:8
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:2308
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x240,0x244,0x248,0x21c,0x24c,0x7ff73de35460,0x7ff73de35470,0x7ff73de35480
    3⤵
    PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,2498696881479843462,10409687636470896852,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5104 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2498696881479843462,10409687636470896852,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2498696881479843462,10409687636470896852,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2498696881479843462,10409687636470896852,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2498696881479843462,10409687636470896852,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:2816

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3320

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\3D Objects\README_TO_DECRYPT.html

Filesize
7KB

MD5
548ae2481a4f87619a2ce6494ee199fe

SHA1
062dd0f89cf6a29fd5bfa98cc8acbe9222ca37a8

SHA256
c3685c6906143c640c7ba6767ba0415c32d55dba9f0a2840d21324621835389b

SHA512
62e8fa7a34d6c97997c893ea849a7df74aed8117aebe454bbcb47cb93ad1382919f03ab0d5ed7bb1f464c6d7841014e99e82afd3780407dd2f77601b752a5aa4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
78c7656527762ed2977adf983a6f4766

SHA1
21a66d2eefcb059371f4972694057e4b1f827ce6

SHA256
e1000099751602ae1adcec6f1c74e1d65f472936817b45239dfed4b043984296

SHA512
0a8e58ae95163b3cdf8e81b5085887761e73cb7c836a1a6a972e837fb3df69b2ac70cfd6311d06d40656344ec35eb48e512f007561480f0345486ac2b329be0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
099b4ba2787e99b696fc61528100f83f

SHA1
06e1f8b7391e1d548e49a1022f6ce6e7aa61f292

SHA256
cdb1db488e260ed750edfe1c145850b57ee8ab819d75237a167e673116a33ee8

SHA512
4309375e10785564ceb03e0127ced414e366a5b833f16a60d796471d871b479e4c044db5268902d9dfd14715ca577cb26042bab8f7b0f31fe8abf33947feb9d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
f4c031131e068697e8da9d6d8ac6bf73

SHA1
f30d47ef6dbc7289e1a688caf85dbb6d987ab17c

SHA256
9fad70b1600b16d4c032c83d8a6db7d996117e97fd59c30033f62cefe3d1e40b

SHA512
056d0d5385b6a0238ec82076d469b1f4247f43b6ac11e4901874e06d2c8c86b912c48cb9d7918ed0ec8451fa6c77d4fddf16f788832e6fdc46107352df33084b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f1da646167d29e35745661e92ef09be3

SHA1
4bfdd1f9380a4a050e2c4c87d461de24a7b3ad0a

SHA256
3778c9079691688b1a5ad295c2f9c00854be0f4b4c083a0c58e25b91b09f5925

SHA512
ca9c96e3d92c9d2a89ed0dd086aa8c7819f69561a2c48c73d7955406ae6d6163ce585e56bc8598095a6d664068789cf9c6e0d2c50e6e78723122a2b48d21d762

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e8216d34bb5406da510118349c86e3fd

SHA1
48047b7eb9c0bc780ff892d5dbe58158370ce499

SHA256
0462e19159e3f2a7242061eb4a33410278f773ad397691c4fe3ebf5071ccc01c

SHA512
de3002565ca44ca3540a3bf9c3e05eb0fd1fec9ef1a97c407bec58b904fb0cc7d552f73e4b54359cb36b22b2dbdd9f4afc4af60a116d189c46da33963c7eaff6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
02ee7addc9e8a2d07af55556ebf0ff5c

SHA1
020161bb64ecb7c6e6886ccc055908984dc651d8

SHA256
552d3ed359b7a52278ce621674d16428d8a7969f6cd5663df18e240cce66aadc

SHA512
567989543c3848a0c3276d96b96ca761f750e4b71fb74f36d809f590ffe16a72fd5ece251737a8b1ffe65f0051e211bd7ad19d2b8b0b7ca1b7ffc86dd2a52883

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
00a2b81c7d4529e811f4a3ec07e8d92c

SHA1
6af0f0a20ae75f33341d9b011126bb2cf73c0b1e

SHA256
5a0858c32c42c18475e87d2d68907d4f4be8b24bd9d0a0cffb132e7f90c5bde8

SHA512
76db7b137bf4159762e0cfde325f8e549250848512bdef964127a5a801992024b4ce7ff33607537ed7e307a203da40043d2b421d4116eb3ff57fbada877f9afc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
7724d5e6499ba1e428f587231810c858

SHA1
c9031fa86d565f8b454994a6e3513c95c7fb537c

SHA256
50698a2dd5e94a63a6cd4b0bed0e852a436f076b04d25aca55210c6bf554f62c

SHA512
3c7bd3969a2f1466f029bbab64f201de85b5e6fb02b045f882cdb1f82439f35779372f8d8e6511b56053650673cac9e841ba2ac82fbfc8cc882ec6dcf17ffb90

Download Submit
C:\Users\Admin\AppData\Local\Temp\0E56B1EF.bat

Filesize
65B

MD5
348cae913e496198548854f5ff2f6d1e

SHA1
a07655b9020205bd47084afd62a8bb22b48c0cdc

SHA256
c80128f51871eec3ae2057989a025ce244277c1c180498a5aaef45d5214b8506

SHA512
799796736d41d3fcb5a7c859571bb025ca2d062c4b86e078302be68c1a932ed4f78e003640df5405274364b5a9a9c0ba5e37177997683ee7ab54e5267590b611

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
12a512342a9c9c57c00baa255cf04b02

SHA1
797bce3168b7a86ef37ebd4b7227d8ea301483ea

SHA256
98aab88ea4e3a5eed8d52abdce51f4c6db06ead3bdf2f69bb051ad7aa2ac00ad

SHA512
0f635552798316ce7098a7a6fd965dba2e48c65f180dabd3c91aa9fec47f48f0e374222f5c952a44a0006663b76aabc1cc080dfb658f5f14e3482be2b6cc7a3f

Download Submit
C:\Users\Admin\Desktop\README_TO_DECRYPT.html

Filesize
7KB

MD5
548ae2481a4f87619a2ce6494ee199fe

SHA1
062dd0f89cf6a29fd5bfa98cc8acbe9222ca37a8

SHA256
c3685c6906143c640c7ba6767ba0415c32d55dba9f0a2840d21324621835389b

SHA512
62e8fa7a34d6c97997c893ea849a7df74aed8117aebe454bbcb47cb93ad1382919f03ab0d5ed7bb1f464c6d7841014e99e82afd3780407dd2f77601b752a5aa4

Download Submit
memory/1536-391-0x00007FFA97140000-0x00007FFA97141000-memory.dmp

Filesize
4KB

Download