quantum | b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192

Analysis

max time kernel
49s
max time network
36s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
28-02-2023 14:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
Size

75KB
MD5

0706764b3963df092079d3bdef787a1f
SHA1

73c2460d59f3d0637523ca6d35425aae14358ba1
SHA256

b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192
SHA512

3af7ff3b2aa689eb4c410562b5ead74ff77417da941521928391c6fac3dcc6a75f6d866f52b12f67a41564cfa81afcda51857c0f208f9e90e8629e0f0b5d5cb4
SSDEEP

1536:9aX51pVH9hsgNGLs6BLM1frxz/HTfcKKBaJGp:OfJGLs6BwNxnfTKsG

Score

10^/10

quantum ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\README_TO_DECRYPT.html

Family

quantum

Ransom Note

<html> <head> <title>Quantum</title> </head> <body> <h1>Your ID:</h1> <pre> 9064d8b148a0f19a9e3598a6e0b0aeb16d21da8260218355164eefdf45b6ef60 </pre> <hr/> This message contains an information how to fix the troubles you've got with your network. Files on the workstations in your network were encrypted and any your attempt to change, decrypt or rename them could destroy the content. The only way to get files back is a decryption with Key, provided by the Quantum Locker. During the period your network was under our control, we downloaded a huge volume of information. Now it is stored on our servers with high-secure access. This information contains a lot of sensitive, private and personal data. Publishing of such data will cause serious consequences and even business disruption. It's not a threat, on the contrary - it's a manual how to get a way out. Quantum team doesn't aim to damage your company, our goals are only financial. After a payment you'll get network decryption, full destruction of downloaded data, information about your network vulnerabilities and penetration points. If you decide not to negotiate, in 48 hours the fact of the attack and all your information will be posted on our site and will be promoted among dozens of cyber forums, news agencies, websites etc. To contact our support and start the negotiations, please visit our support chat. It is simple, secure and you can set a password to avoid intervention of unauthorised persons. <a href="http://tijykgureh7kqq5cczzeutaoxvmf6yinpar72o3bxome7b44vwqxadyd.onion/?cid=9064d8b148a0f19a9e3598a6e0b0aeb16d21da8260218355164eefdf45b6ef60">http://tijykgureh7kqq5cczzeutaoxvmf6yinpar72o3bxome7b44vwqxadyd.onion/?cid=9064d8b148a0f19a9e3598a6e0b0aeb16d21da8260218355164eefdf45b6ef60</a> <ul> <li>Password field should be blank for the first login. <li>Note that this server is available via Tor browser only. </ul> P.S. How to get TOR browser - see at https://www.torproject.org </body> </html>

Extracted

Path

C:\Users\Admin\Desktop\README_TO_DECRYPT.html

Family

quantum

Ransom Note

Your ID: This message contains an information how to fix the troubles you've got with your network. Files on the workstations in your network were encrypted and any your attempt to change, decrypt or rename them could destroy the content. The only way to get files back is a decryption with Key, provided by the Quantum Locker. During the period your network was under our control, we downloaded a huge volume of information. Now it is stored on our servers with high-secure access. This information contains a lot of sensitive, private and personal data. Publishing of such data will cause serious consequences and even business disruption. It's not a threat, on the contrary - it's a manual how to get a way out. Quantum team doesn't aim to damage your company, our goals are only financial. After a payment you'll get network decryption, full destruction of downloaded data, information about your network vulnerabilities and penetration points. If you decide not to negotiate, in 48 hours the fact of the attack and all your information will be posted on our site and will be promoted among dozens of cyber forums, news agencies, websites etc. To contact our support and start the negotiations, please visit our support chat. It is simple, secure and you can set a password to avoid intervention of unauthorised persons. http://tijykgureh7kqq5cczzeutaoxvmf6yinpar72o3bxome7b44vwqxadyd.onion/?cid=9064d8b148a0f19a9e3598a6e0b0aeb16d21da8260218355164eefdf45b6ef60 Password field should be blank for the first login. Note that this server is available via Tor browser only. P.S. How to get TOR browser - see at https://www.torproject.org

URLs

http://tijykgureh7kqq5cczzeutaoxvmf6yinpar72o3bxome7b44vwqxadyd.onion/?cid=9064d8b148a0f19a9e3598a6e0b0aeb16d21da8260218355164eefdf45b6ef60

Signatures

Quantum Ransomware
A rebrand of the MountLocker ransomware first seen in August 2021.
ransomware quantum

Modifies extensions of user files 4 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File renamed	C:\Users\Admin\Pictures\DebugConnect.png => \??\c:\Users\Admin\Pictures\DebugConnect.png.quantum	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File renamed	C:\Users\Admin\Pictures\DisableRestart.crw => \??\c:\Users\Admin\Pictures\DisableRestart.crw.quantum	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File renamed	C:\Users\Admin\Pictures\ResumeSave.png => \??\c:\Users\Admin\Pictures\ResumeSave.png.quantum	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File renamed	C:\Users\Admin\Pictures\SyncUndo.tif => \??\c:\Users\Admin\Pictures\SyncUndo.tif.quantum	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe

Drops desktop.ini file(s) 26 IoCs

description	ioc	Process
File opened for modification	\??\c:\Users\Public\Recorded TV\Sample Media\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File opened for modification	\??\c:\Users\Admin\Searches\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File opened for modification	\??\c:\Users\Public\Music\Sample Music\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File opened for modification	\??\c:\Users\Public\Recorded TV\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File opened for modification	\??\c:\Users\Admin\Music\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File opened for modification	\??\c:\Users\Admin\Saved Games\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File opened for modification	\??\c:\Users\Public\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File opened for modification	\??\c:\Users\Public\Videos\Sample Videos\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File opened for modification	\??\c:\Users\Admin\Documents\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File opened for modification	\??\c:\Users\Admin\Favorites\Links\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File opened for modification	\??\c:\Users\Admin\Links\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File opened for modification	\??\c:\Users\Admin\Videos\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File opened for modification	\??\c:\Users\Public\Desktop\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File opened for modification	\??\c:\Users\Public\Libraries\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File opened for modification	\??\c:\Users\Public\Pictures\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File opened for modification	\??\c:\Users\Public\Pictures\Sample Pictures\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File opened for modification	\??\c:\Users\Admin\Contacts\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File opened for modification	\??\c:\Users\Admin\Downloads\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File opened for modification	\??\c:\Users\Admin\Favorites\Links for United States\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File opened for modification	\??\c:\Users\Public\Videos\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File opened for modification	\??\c:\Users\Public\Documents\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File opened for modification	\??\c:\Users\Public\Downloads\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File opened for modification	\??\c:\Users\Public\Music\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File opened for modification	\??\c:\Users\Admin\Desktop\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File opened for modification	\??\c:\Users\Admin\Favorites\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File opened for modification	\??\c:\Users\Admin\Pictures\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe

Modifies Internet Explorer settings 1 TTPs 37 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\LinksExplorer\LinksType = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\LinksExplorer\Width = "290"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60e8918d8a4bd901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c8a3886e844ee04ca528537b5bc4589900000000020000000000106600000001000020000000914ce719af6d5e6c528ae684b40c0ef33f1f6e754d285dbe98bf1280a0820603000000000e8000000002000020000000ac947f75e7fe056ec650bd2732bd95ca5d93fea586efcec80d2cd978a748bd639000000009b18a2ab764c2d07a6017d5723c5a3f4dd2d00a9d754e8ca617c689d9063a91f900f35d418316543123aa227ead8e27dd138f8058c750075520d715c5d60e70717af65c9c58469d4552e38b3ba208b30756da65316a7f55744dbd16ad2b4db481efc4097873ea42664a8874ad6e10ae7717c13336b4c3af26fbc36e9c00143eb871c814f97e0288c22e3e04744a38ce4000000094c29c4e085c3d633099318ea3418443e75491f0ead0d95014392088df957764e2a01b25a7753cd5ae8bdd336aac27fc1ce3b9eab007c2f3dae9b0440bbef971	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\LinksExplorer	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B5D93761-B77D-11ED-89CC-52C255710AF6} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c8a3886e844ee04ca528537b5bc45899000000000200000000001066000000010000200000008d047de2f9523a6c17ff442e741f6bb151e1c091e271090bc99e204384aa1618000000000e8000000002000020000000e7ab28bfdebe98b9f9a58737189394d2ad9ce8bd04db17bdb68c6c24ab0f0bed20000000c366be607af867d154a59a51e2b75a28442c86417858becace7ccaf74a5cd4bf4000000083de1d2e1b8be1dfc0f8da7bad969873499acde722f85bdf8bb91eb2aa577b580a861ce79631eb2558b9c268881327870de02508c59110d2b7ab46fed8dec175	iexplore.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mhtml	IEXPLORE.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mhtml\OpenWithList	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\.quantum\shell\Open\command	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\.quantum\shell	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\.quantum\shell\Open	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_Classes\Local Settings	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	IEXPLORE.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mhtml\OpenWithList\WINWORD.EXE	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\.quantum	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\.quantum\shell\Open\command\ = "explorer.exe README_TO_DECRYPT.html"	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WINWORD.EXE	IEXPLORE.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1384	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
1384	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	1384	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
Token: SeDebugPrivilege	1384	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
568	iexplore.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
568	iexplore.exe
568	iexplore.exe
588	IEXPLORE.EXE
588	IEXPLORE.EXE
588	IEXPLORE.EXE
588	IEXPLORE.EXE
568	iexplore.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1384 wrote to memory of 1008	1384	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe	29
PID 1384 wrote to memory of 1008	1384	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe	29
PID 1384 wrote to memory of 1008	1384	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe	29
PID 568 wrote to memory of 588	568	iexplore.exe	34
PID 568 wrote to memory of 588	568	iexplore.exe	34
PID 568 wrote to memory of 588	568	iexplore.exe	34
PID 568 wrote to memory of 588	568	iexplore.exe	34

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
2024	attrib.exe

C:\Users\Admin\AppData\Local\Temp\b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
"C:\Users\Admin\AppData\Local\Temp\b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe"
1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1384
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\\006C3209.bat" "C:\Users\Admin\AppData\Local\Temp\b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe""
  2⤵
  PID:1008
- - C:\Windows\system32\attrib.exe
    attrib -s -r -h "C:\Users\Admin\AppData\Local\Temp\b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe"
    3⤵
    - Views/modifies file attributes
    PID:2024

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\README_TO_DECRYPT.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:568
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:568 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:588

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
441982728b0966b019be8b810da15a2d

SHA1
2608885d711cea33609d32a028f48b6eaa5a0a0f

SHA256
c885adf1eb643ef1edc103493cb3f2345e2837ad10e7cf7930d00c2dfbb8ca39

SHA512
72bd283c26a780d3c6ee55ce00510413bf376be2386eb4bb4bb6fd3f67aa4a578f3ebe5a4e8784946b3733411414492b3ca5534272a030ac9f478c630436a62c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4e08d0259e4e7d34283f9d1562f03536

SHA1
913154e942d18e695367b6d2c625bef76d1ee2fe

SHA256
effd0831ce4ffe999ab729a612472dff583d240f0eabd924107bfc4f01c06c2d

SHA512
fecb6d4f8458f7685964eb9daae3931e8f83755b9215cef5d77c95e22476a69c35a8dc2ab76aee176f913ffe3af65ace541dd0e5b568c56a1ce1f0e77fb364ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
94c6cdeeb2b111cf6c17c6792a53aa68

SHA1
6f420a578d125cd67793249cc31d38a5775ea239

SHA256
8556620773692e71e581b848ea955af5b68593afcad55ac1d10ce07443b73bd1

SHA512
69472b0bca1aeb489f804999d1b1b4794c3ccb43246b6fbd84b769aba541a2e78ee4866e1c29f27b95092d0a66fb700644f858eeef6fde05ec12661ec7a5da6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
daa6467fd75694763008ad1df57d42ba

SHA1
188ccb5fa3a3dd2529b926d30b4c038f4bb8355c

SHA256
693a85b14413238cd0bf5c1db7e1dc3db4c6a7f0e6422c1d5b28a5c09a135f85

SHA512
21694be8ccd38abde48b873b4451825aaa96a1a25d3b8300b34e40780cca64630761dba2a4b8414948187a27dd8d4e51b52990976662d833e99f58a711ad5b17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
792da1938eea2f88df5d632e7f81fa7a

SHA1
27f2ed7b636e9856f9193c94496ced8606eaf9d0

SHA256
229f5c4a1c0c6799c616aad3ee47723be6674d59d5cb50ec680f8ff1983e8dc9

SHA512
87e34e1d6d6124fb2637959900def72d7e36b36eea2153093280dea89779788db2c6a1268872c6badc889ed295140d355f71b60c38783627b58e40287ba4e1d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fb86caefa90e9deeffcbf0e096f3ddae

SHA1
e40a6d503084d06f5b9fbff80fff7282e48f709e

SHA256
521b105fbebde5537c04f0a3efb3bafe8a08ec9803c0466e70bfdd76e18ef0b6

SHA512
014465dbc8b330f7fb1b874c48b7c7c7e95145b937d5e2b0c35ab04343f69403395f4182ba54353571d15e94cd7f02784312510ed586e159067de6a4ec0b37e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2bad106deea04bf8f0be0ce52502c719

SHA1
fc06d7c1a6dd1c4a237453c86e8c4d62cc06970b

SHA256
15fc4eb2a738562f9fecf1f643ac4974d1844c403db55dde098dadfb88d0dc09

SHA512
fb8259fc499e75c12fd213d7d7f81018b67cedfc24afd1f3a3e8d7018e94494021a4d8676c9e407b174dbf5eb97c51ca701e7b62511c114ccaf3511ce9e7ed60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d8321a5477b8f33e96e3285ad0113d71

SHA1
df16121f4f9cdb049a251a1e3f7381def4dbf5dd

SHA256
5fcd374ada1fec205d7fda582fe122f492d5ffe8ac3eb41511999cd9b880e4ee

SHA512
9d516202b19e61e7c955a5e7990254fb0e9b0660e79a0ac59593926f677da238bd9f009eae67f2badf011e9f15e8dbe8afcf3db964496b5c656ce985d60e4e0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\006C3209.bat

Filesize
65B

MD5
348cae913e496198548854f5ff2f6d1e

SHA1
a07655b9020205bd47084afd62a8bb22b48c0cdc

SHA256
c80128f51871eec3ae2057989a025ce244277c1c180498a5aaef45d5214b8506

SHA512
799796736d41d3fcb5a7c859571bb025ca2d062c4b86e078302be68c1a932ed4f78e003640df5405274364b5a9a9c0ba5e37177997683ee7ab54e5267590b611

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7B7A.tmp

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7C39.tmp

Filesize
161KB

MD5
73b4b714b42fc9a6aaefd0ae59adb009

SHA1
efdaffd5b0ad21913d22001d91bf6c19ecb4ac41

SHA256
c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd

SHA512
73af3c51b15f89237552b1718bef21fd80788fa416bab2cb2e7fb3a60d56249a716eda0d2dd68ab643752272640e7eaaaf57ce64bcb38373ddc3d035fb8d57cd

Download Submit
C:\Users\Admin\Desktop\README_TO_DECRYPT.html

Filesize
2KB

MD5
466d9ecfe8602b940a0463764fd07b78

SHA1
7b77fc2d4308a1ee0102a4a352e2d5ea402b5a98

SHA256
a5bacdaf1f6b4f8c0e21266d797e81c58d29cc1363b7a28b012eb24e1cb99455

SHA512
058e74c4b94303202e8546abe09dbb8ec3b685dee908cb95a849902b71b8bc16405312dc16ee361afbc7178702d1eff9833295276de9b6d501af4403a03568a7

Download Submit
C:\Users\Admin\Desktop\README_TO_DECRYPT.html

Filesize
2KB

MD5
466d9ecfe8602b940a0463764fd07b78

SHA1
7b77fc2d4308a1ee0102a4a352e2d5ea402b5a98

SHA256
a5bacdaf1f6b4f8c0e21266d797e81c58d29cc1363b7a28b012eb24e1cb99455

SHA512
058e74c4b94303202e8546abe09dbb8ec3b685dee908cb95a849902b71b8bc16405312dc16ee361afbc7178702d1eff9833295276de9b6d501af4403a03568a7

Download Submit
C:\Users\Admin\Favorites\README_TO_DECRYPT.html

Filesize
2KB

MD5
466d9ecfe8602b940a0463764fd07b78

SHA1
7b77fc2d4308a1ee0102a4a352e2d5ea402b5a98

SHA256
a5bacdaf1f6b4f8c0e21266d797e81c58d29cc1363b7a28b012eb24e1cb99455

SHA512
058e74c4b94303202e8546abe09dbb8ec3b685dee908cb95a849902b71b8bc16405312dc16ee361afbc7178702d1eff9833295276de9b6d501af4403a03568a7

Download Submit
memory/568-321-0x0000000002B80000-0x0000000002B90000-memory.dmp

Filesize
64KB

Download
memory/588-322-0x0000000002D50000-0x0000000002D52000-memory.dmp

Filesize
8KB

Download