Analysis
-
max time kernel
135s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
05-05-2023 18:56
Static task
static1
Behavioral task
behavioral1
Sample
quantum_locker/quantum_locker.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
quantum_locker/quantum_locker.exe
Resource
win10v2004-20230220-en
General
-
Target
quantum_locker/quantum_locker.exe
-
Size
75KB
-
MD5
0706764b3963df092079d3bdef787a1f
-
SHA1
73c2460d59f3d0637523ca6d35425aae14358ba1
-
SHA256
b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192
-
SHA512
3af7ff3b2aa689eb4c410562b5ead74ff77417da941521928391c6fac3dcc6a75f6d866f52b12f67a41564cfa81afcda51857c0f208f9e90e8629e0f0b5d5cb4
-
SSDEEP
1536:9aX51pVH9hsgNGLs6BLM1frxz/HTfcKKBaJGp:OfJGLs6BwNxnfTKsG
Malware Config
Extracted
C:\Users\Admin\3D Objects\README_TO_DECRYPT.html
quantum
Signatures
-
Quantum Ransomware
A rebrand of the MountLocker ransomware first seen in August 2021.
-
Modifies extensions of user files 10 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\JoinResolve.crw => \??\c:\Users\Admin\Pictures\JoinResolve.crw.quantum quantum_locker.exe File renamed C:\Users\Admin\Pictures\LockClear.raw => \??\c:\Users\Admin\Pictures\LockClear.raw.quantum quantum_locker.exe File renamed C:\Users\Admin\Pictures\MoveEnter.png => \??\c:\Users\Admin\Pictures\MoveEnter.png.quantum quantum_locker.exe File renamed C:\Users\Admin\Pictures\PublishMount.tif => \??\c:\Users\Admin\Pictures\PublishMount.tif.quantum quantum_locker.exe File renamed C:\Users\Admin\Pictures\FindGet.tif => \??\c:\Users\Admin\Pictures\FindGet.tif.quantum quantum_locker.exe File opened for modification \??\c:\Users\Admin\Pictures\MergeStop.tiff quantum_locker.exe File renamed C:\Users\Admin\Pictures\MergeStop.tiff => \??\c:\Users\Admin\Pictures\MergeStop.tiff.quantum quantum_locker.exe File renamed C:\Users\Admin\Pictures\OpenRename.crw => \??\c:\Users\Admin\Pictures\OpenRename.crw.quantum quantum_locker.exe File renamed C:\Users\Admin\Pictures\OpenUnpublish.tif => \??\c:\Users\Admin\Pictures\OpenUnpublish.tif.quantum quantum_locker.exe File renamed C:\Users\Admin\Pictures\ConvertFromSwitch.raw => \??\c:\Users\Admin\Pictures\ConvertFromSwitch.raw.quantum quantum_locker.exe -
Drops desktop.ini file(s) 25 IoCs
description ioc Process File opened for modification \??\c:\Users\Admin\Pictures\Camera Roll\desktop.ini quantum_locker.exe File opened for modification \??\c:\Users\Public\Documents\desktop.ini quantum_locker.exe File opened for modification \??\c:\Users\Public\Libraries\desktop.ini quantum_locker.exe File opened for modification \??\c:\Users\Public\Music\desktop.ini quantum_locker.exe File opened for modification \??\c:\Users\Admin\Favorites\Links\desktop.ini quantum_locker.exe File opened for modification \??\c:\Users\Admin\Music\desktop.ini quantum_locker.exe File opened for modification \??\c:\Users\Admin\OneDrive\desktop.ini quantum_locker.exe File opened for modification \??\c:\Users\Public\AccountPictures\desktop.ini quantum_locker.exe File opened for modification \??\c:\Users\Public\Pictures\desktop.ini quantum_locker.exe File opened for modification \??\c:\Users\Public\Videos\desktop.ini quantum_locker.exe File opened for modification \??\c:\Users\Admin\3D Objects\desktop.ini quantum_locker.exe File opened for modification \??\c:\Users\Admin\Downloads\desktop.ini quantum_locker.exe File opened for modification \??\c:\Users\Admin\Favorites\desktop.ini quantum_locker.exe File opened for modification \??\c:\Users\Admin\Saved Games\desktop.ini quantum_locker.exe File opened for modification \??\c:\Users\Admin\Searches\desktop.ini quantum_locker.exe File opened for modification \??\c:\Users\Public\Desktop\desktop.ini quantum_locker.exe File opened for modification \??\c:\Users\Public\Downloads\desktop.ini quantum_locker.exe File opened for modification \??\c:\Users\Admin\Contacts\desktop.ini quantum_locker.exe File opened for modification \??\c:\Users\Admin\Documents\desktop.ini quantum_locker.exe File opened for modification \??\c:\Users\Admin\Links\desktop.ini quantum_locker.exe File opened for modification \??\c:\Users\Admin\Pictures\desktop.ini quantum_locker.exe File opened for modification \??\c:\Users\Admin\Pictures\Saved Pictures\desktop.ini quantum_locker.exe File opened for modification \??\c:\Users\Admin\Videos\desktop.ini quantum_locker.exe File opened for modification \??\c:\Users\Public\desktop.ini quantum_locker.exe File opened for modification \??\c:\Users\Admin\Desktop\desktop.ini quantum_locker.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\.quantum\shell\Open\command quantum_locker.exe Key created \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\.quantum quantum_locker.exe Key created \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\.quantum\shell quantum_locker.exe Key created \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\.quantum\shell\Open quantum_locker.exe Set value (str) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\.quantum\shell\Open\command\ = "explorer.exe README_TO_DECRYPT.html" quantum_locker.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2976 quantum_locker.exe 2976 quantum_locker.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 2976 quantum_locker.exe Token: SeDebugPrivilege 2976 quantum_locker.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2976 wrote to memory of 2380 2976 quantum_locker.exe 87 PID 2976 wrote to memory of 2380 2976 quantum_locker.exe 87 PID 2380 wrote to memory of 2460 2380 cmd.exe 89 PID 2380 wrote to memory of 2460 2380 cmd.exe 89 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 2460 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe"C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe"1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\\0E574DD2.bat" "C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Windows\system32\attrib.exeattrib -s -r -h "C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe"3⤵
- Views/modifies file attributes
PID:2460
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5381254e10593ad42a7e96f069305dbbb
SHA17b5ccdf55377b694fe761368f3372899a3c8d1aa
SHA256d19cef6340014cde9a2a60e7b1f57043f338590c64b454c75bf2358cf2c4f256
SHA512fd4db6144cdf2e6774cc20fd1732b9a457572f59c7cd639181da8c7716a1f3b6c35b6ba2447045e65e2ad9ba713ec8ee857ee5695b1d28fa338a613a7c35d2fc
-
Filesize
65B
MD5348cae913e496198548854f5ff2f6d1e
SHA1a07655b9020205bd47084afd62a8bb22b48c0cdc
SHA256c80128f51871eec3ae2057989a025ce244277c1c180498a5aaef45d5214b8506
SHA512799796736d41d3fcb5a7c859571bb025ca2d062c4b86e078302be68c1a932ed4f78e003640df5405274364b5a9a9c0ba5e37177997683ee7ab54e5267590b611