Malware Analysis Report

2024-09-11 01:17

Sample ID 230401-hl63dsge48
Target quantum_locker.zip
SHA256 652c394928687ed453c34befbbe373f78a0258a40b0f40db425ad232ad761b85
Tags
quantum ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

652c394928687ed453c34befbbe373f78a0258a40b0f40db425ad232ad761b85

Threat Level: Known bad

The file quantum_locker.zip was found to be: Known bad.

Malicious Activity Summary

quantum ransomware

Quantum Ransomware

Modifies extensions of user files

Drops desktop.ini file(s)

Suspicious use of WriteProcessMemory

Views/modifies file attributes

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK Matrix V6

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Hidden Files and Directories
T1158
Privilege Escalation
TA0004
Defense Evasion
TA0005
Hidden Files and Directories
T1158
Credential Access
TA0006
Discovery
TA0007
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040

Analysis: static1

Detonation Overview

Reported

2023-04-01 06:50

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-04-01 06:50

Reported

2023-04-01 06:53

Platform

win10v2004-20230221-en

Max time kernel

156s

Max time network

158s

Command Line

"C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe"

Signatures

Quantum Ransomware

ransomware quantum

Modifies extensions of user files

ransomware
Description Indicator Process Target
File renamed C:\Users\Admin\Pictures\CompareUpdate.png => \??\c:\Users\Admin\Pictures\CompareUpdate.png.quantum C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File renamed C:\Users\Admin\Pictures\ConvertConnect.png => \??\c:\Users\Admin\Pictures\ConvertConnect.png.quantum C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File opened for modification \??\c:\Users\Admin\Pictures\DisconnectApprove.tiff C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File renamed C:\Users\Admin\Pictures\DisconnectApprove.tiff => \??\c:\Users\Admin\Pictures\DisconnectApprove.tiff.quantum C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File renamed C:\Users\Admin\Pictures\GroupTest.crw => \??\c:\Users\Admin\Pictures\GroupTest.crw.quantum C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File renamed C:\Users\Admin\Pictures\ReceiveCheckpoint.raw => \??\c:\Users\Admin\Pictures\ReceiveCheckpoint.raw.quantum C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File renamed C:\Users\Admin\Pictures\SearchAdd.tif => \??\c:\Users\Admin\Pictures\SearchAdd.tif.quantum C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File renamed C:\Users\Admin\Pictures\BlockWait.raw => \??\c:\Users\Admin\Pictures\BlockWait.raw.quantum C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification \??\c:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File opened for modification \??\c:\Users\Admin\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File opened for modification \??\c:\Users\Admin\Pictures\Saved Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File opened for modification \??\c:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File opened for modification \??\c:\Users\Public\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File opened for modification \??\c:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File opened for modification \??\c:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File opened for modification \??\c:\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File opened for modification \??\c:\Users\Public\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File opened for modification \??\c:\Users\Public\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File opened for modification \??\c:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File opened for modification \??\c:\Users\Admin\Favorites\desktop.ini C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File opened for modification \??\c:\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File opened for modification \??\c:\Users\Public\desktop.ini C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File opened for modification \??\c:\Users\Admin\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File opened for modification \??\c:\Users\Public\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File opened for modification \??\c:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File opened for modification \??\c:\Users\Admin\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File opened for modification \??\c:\Users\Admin\Saved Games\desktop.ini C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File opened for modification \??\c:\Users\Public\AccountPictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File opened for modification \??\c:\Users\Public\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File opened for modification \??\c:\Users\Public\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File opened for modification \??\c:\Users\Admin\3D Objects\desktop.ini C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File opened for modification \??\c:\Users\Admin\OneDrive\desktop.ini C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File opened for modification \??\c:\Users\Admin\Pictures\Camera Roll\desktop.ini C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\.quantum\shell\Open\command C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\.quantum C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\.quantum\shell C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\.quantum\shell\Open C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\.quantum\shell\Open\command\ = "explorer.exe README_TO_DECRYPT.html" C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3524 wrote to memory of 5032 N/A C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe C:\Windows\system32\cmd.exe
PID 3524 wrote to memory of 5032 N/A C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe C:\Windows\system32\cmd.exe
PID 5032 wrote to memory of 448 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 5032 wrote to memory of 448 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe

"C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\\0E56D314.bat" "C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe""

C:\Windows\system32\attrib.exe

attrib -s -r -h "C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe"

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 8.3.197.209.in-addr.arpa udp
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 76.38.195.152.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 assets.msn.com udp
GB 95.101.143.155:443 assets.msn.com tcp
US 8.8.8.8:53 155.143.101.95.in-addr.arpa udp
US 52.152.110.14:443 tcp
IE 20.50.73.9:443 tcp
US 52.152.110.14:443 tcp
US 8.8.8.8:53 44.8.109.52.in-addr.arpa udp
US 8.248.3.254:80 tcp
US 52.152.110.14:443 tcp
US 8.248.3.254:80 tcp
US 52.152.110.14:443 tcp
NL 173.223.113.164:443 tcp
NL 173.223.113.131:80 tcp
US 204.79.197.203:80 api.msn.com tcp
US 52.152.110.14:443 tcp
US 52.152.110.14:443 tcp
US 52.152.110.14:443 tcp

Files

C:\Users\Admin\3D Objects\README_TO_DECRYPT.html

MD5 ae5e2bd72ca26e9c3012eee3289bdfa8
SHA1 a1692fd070847fbf2802f31fddc22437620d159d
SHA256 be878ad961e9ddac9425c39627f21106dfe56efaf281b47056fffee6c3ea21f6
SHA512 f997353ad332afa5ad1844c7a330208ea6b2cbef4eb16444e787f6b26da265e459fd02f8f41bd542a3cab5a676748304ee7350c3bc0222d5a1995bc5188f96b0

C:\Users\Admin\AppData\Local\Temp\0E56D314.bat

MD5 348cae913e496198548854f5ff2f6d1e
SHA1 a07655b9020205bd47084afd62a8bb22b48c0cdc
SHA256 c80128f51871eec3ae2057989a025ce244277c1c180498a5aaef45d5214b8506
SHA512 799796736d41d3fcb5a7c859571bb025ca2d062c4b86e078302be68c1a932ed4f78e003640df5405274364b5a9a9c0ba5e37177997683ee7ab54e5267590b611