Malware Analysis Report

2024-09-11 01:28

Sample ID 230608-dv79labe29
Target quantum_locker.zip
SHA256 652c394928687ed453c34befbbe373f78a0258a40b0f40db425ad232ad761b85
Tags
quantum ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

652c394928687ed453c34befbbe373f78a0258a40b0f40db425ad232ad761b85

Threat Level: Known bad

The file quantum_locker.zip was found to be: Known bad.

Malicious Activity Summary

quantum ransomware

Quantum Ransomware

Modifies extensions of user files

Deletes itself

Drops desktop.ini file(s)

Unsigned PE

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Views/modifies file attributes

MITRE ATT&CK Matrix V6

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Hidden Files and Directories
T1158
Privilege Escalation
TA0004
Defense Evasion
TA0005
Hidden Files and Directories
T1158
Credential Access
TA0006
Discovery
TA0007
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040

Analysis: static1

Detonation Overview

Reported

2023-06-08 03:20

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral4

Detonation Overview

Submitted

2023-06-08 03:20

Reported

2023-06-08 03:23

Platform

win10v2004-20230220-en

Max time kernel

135s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe"

Signatures

Quantum Ransomware

ransomware quantum

Modifies extensions of user files

ransomware
Description Indicator Process Target
File renamed C:\Users\Admin\Pictures\SwitchEnter.raw => \??\c:\Users\Admin\Pictures\SwitchEnter.raw.quantum C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification \??\c:\Users\Admin\Pictures\Saved Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File opened for modification \??\c:\Users\Admin\Saved Games\desktop.ini C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File opened for modification \??\c:\Users\Public\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File opened for modification \??\c:\Users\Public\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File opened for modification \??\c:\Users\Admin\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File opened for modification \??\c:\Users\Admin\OneDrive\desktop.ini C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File opened for modification \??\c:\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File opened for modification \??\c:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File opened for modification \??\c:\Users\Public\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File opened for modification \??\c:\Users\Public\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File opened for modification \??\c:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File opened for modification \??\c:\Users\Admin\Favorites\desktop.ini C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File opened for modification \??\c:\Users\Admin\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File opened for modification \??\c:\Users\Public\AccountPictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File opened for modification \??\c:\Users\Public\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File opened for modification \??\c:\Users\Public\desktop.ini C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File opened for modification \??\c:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File opened for modification \??\c:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File opened for modification \??\c:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File opened for modification \??\c:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File opened for modification \??\c:\Users\Admin\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File opened for modification \??\c:\Users\Public\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File opened for modification \??\c:\Users\Admin\3D Objects\desktop.ini C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File opened for modification \??\c:\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File opened for modification \??\c:\Users\Admin\Pictures\Camera Roll\desktop.ini C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\.quantum\shell C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\.quantum\shell\Open C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\.quantum\shell\Open\command\ = "explorer.exe README_TO_DECRYPT.html" C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\.quantum\shell\Open\command C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\.quantum C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4440 wrote to memory of 3912 N/A C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe C:\Windows\system32\cmd.exe
PID 4440 wrote to memory of 3912 N/A C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe C:\Windows\system32\cmd.exe
PID 3912 wrote to memory of 3424 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 3912 wrote to memory of 3424 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe

"C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\\0E56B626.bat" "C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe""

C:\Windows\system32\attrib.exe

attrib -s -r -h "C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 52.152.110.14:443 tcp
US 20.42.73.27:443 tcp
US 52.152.110.14:443 tcp
US 8.8.8.8:53 62.13.109.52.in-addr.arpa udp
NL 173.223.113.164:443 tcp
NL 173.223.113.131:80 tcp
US 204.79.197.203:80 tcp
US 93.184.221.240:80 tcp
US 93.184.221.240:80 tcp
NL 173.223.113.131:80 tcp
US 52.152.110.14:443 tcp
US 52.152.110.14:443 tcp
US 52.152.110.14:443 tcp
US 52.152.110.14:443 tcp

Files

C:\Users\Admin\Contacts\README_TO_DECRYPT.html

MD5 701afd391301bccef3de9558c8aa86ea
SHA1 5e7c84ee4a8ac22a83b10ff5f0c274f53fc70bec
SHA256 5bf44eec39e6085e9ae20188bdf213a2c2edc8ec4afef09c687ff90b79bda428
SHA512 70a931424cd6d2e5b773124586658f707f9ab5f93fc46ffe807613a556088cb97ad7dae7c4abb08713b79135cc87f545626e676fb04b21db6998d78d908b4f87

C:\Users\Admin\AppData\Local\Temp\0E56B626.bat

MD5 348cae913e496198548854f5ff2f6d1e
SHA1 a07655b9020205bd47084afd62a8bb22b48c0cdc
SHA256 c80128f51871eec3ae2057989a025ce244277c1c180498a5aaef45d5214b8506
SHA512 799796736d41d3fcb5a7c859571bb025ca2d062c4b86e078302be68c1a932ed4f78e003640df5405274364b5a9a9c0ba5e37177997683ee7ab54e5267590b611

Analysis: behavioral1

Detonation Overview

Submitted

2023-06-08 03:20

Reported

2023-06-08 03:23

Platform

win7-20230220-en

Max time kernel

28s

Max time network

30s

Command Line

C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\quantum_locker.zip

Signatures

N/A

Processes

C:\Windows\Explorer.exe

C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\quantum_locker.zip

Network

N/A

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2023-06-08 03:20

Reported

2023-06-08 03:23

Platform

win10v2004-20230220-en

Max time kernel

121s

Max time network

149s

Command Line

C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\quantum_locker.zip

Signatures

N/A

Processes

C:\Windows\Explorer.exe

C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\quantum_locker.zip

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.3.197.209.in-addr.arpa udp
US 8.8.8.8:53 254.109.26.67.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
NL 20.190.160.22:443 tcp
US 8.8.8.8:53 126.22.238.8.in-addr.arpa udp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 52.242.101.226:443 tcp
NL 20.190.160.17:443 tcp
US 52.242.101.226:443 tcp
US 8.8.8.8:53 63.13.109.52.in-addr.arpa udp
NL 20.190.160.20:443 tcp
US 93.184.220.29:80 tcp
NL 84.53.175.11:80 tcp
NL 173.223.113.164:443 tcp
NL 173.223.113.131:80 tcp
US 204.79.197.203:80 tcp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 52.242.97.97:443 tcp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 2.36.159.162.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral3

Detonation Overview

Submitted

2023-06-08 03:20

Reported

2023-06-08 03:23

Platform

win7-20230220-en

Max time kernel

31s

Max time network

34s

Command Line

"C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe"

Signatures

Quantum Ransomware

ransomware quantum

Modifies extensions of user files

ransomware
Description Indicator Process Target
File renamed C:\Users\Admin\Pictures\ConnectPublish.raw => \??\c:\Users\Admin\Pictures\ConnectPublish.raw.quantum C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File renamed C:\Users\Admin\Pictures\MergeResolve.tiff => \??\c:\Users\Admin\Pictures\MergeResolve.tiff.quantum C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File opened for modification \??\c:\Users\Admin\Pictures\ProtectEnter.tiff C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File renamed C:\Users\Admin\Pictures\ProtectEnter.tiff => \??\c:\Users\Admin\Pictures\ProtectEnter.tiff.quantum C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File renamed C:\Users\Admin\Pictures\SelectStart.raw => \??\c:\Users\Admin\Pictures\SelectStart.raw.quantum C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File renamed C:\Users\Admin\Pictures\AssertSelect.crw => \??\c:\Users\Admin\Pictures\AssertSelect.crw.quantum C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File renamed C:\Users\Admin\Pictures\HideRestore.tif => \??\c:\Users\Admin\Pictures\HideRestore.tif.quantum C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File opened for modification \??\c:\Users\Admin\Pictures\MergeResolve.tiff C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File renamed C:\Users\Admin\Pictures\SaveConvertFrom.crw => \??\c:\Users\Admin\Pictures\SaveConvertFrom.crw.quantum C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File renamed C:\Users\Admin\Pictures\SendExpand.png => \??\c:\Users\Admin\Pictures\SendExpand.png.quantum C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification \??\c:\Users\Admin\Saved Games\desktop.ini C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File opened for modification \??\c:\Users\Public\desktop.ini C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File opened for modification \??\c:\Users\Public\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File opened for modification \??\c:\Users\Public\Videos\Sample Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File opened for modification \??\c:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File opened for modification \??\c:\Users\Admin\Favorites\Links for United States\desktop.ini C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File opened for modification \??\c:\Users\Admin\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File opened for modification \??\c:\Users\Admin\Favorites\desktop.ini C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File opened for modification \??\c:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File opened for modification \??\c:\Users\Public\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File opened for modification \??\c:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File opened for modification \??\c:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File opened for modification \??\c:\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File opened for modification \??\c:\Users\Public\Music\Sample Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File opened for modification \??\c:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File opened for modification \??\c:\Users\Public\Pictures\Sample Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File opened for modification \??\c:\Users\Public\Recorded TV\desktop.ini C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File opened for modification \??\c:\Users\Admin\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File opened for modification \??\c:\Users\Admin\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File opened for modification \??\c:\Users\Public\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File opened for modification \??\c:\Users\Public\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File opened for modification \??\c:\Users\Public\Recorded TV\Sample Media\desktop.ini C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File opened for modification \??\c:\Users\Public\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File opened for modification \??\c:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File opened for modification \??\c:\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
File opened for modification \??\c:\Users\Public\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000_CLASSES\.quantum\shell C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000_CLASSES\.quantum\shell\Open C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000_CLASSES\.quantum\shell\Open\command\ = "explorer.exe README_TO_DECRYPT.html" C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000_CLASSES\.quantum\shell\Open\command C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000_CLASSES\.quantum C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1352 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe C:\Windows\system32\cmd.exe
PID 1352 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe C:\Windows\system32\cmd.exe
PID 1352 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe C:\Windows\system32\cmd.exe
PID 1604 wrote to memory of 1584 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 1604 wrote to memory of 1584 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 1604 wrote to memory of 1584 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe

"C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe"

C:\Windows\system32\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\\006C2DD5.bat" "C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe""

C:\Windows\system32\attrib.exe

attrib -s -r -h "C:\Users\Admin\AppData\Local\Temp\quantum_locker\quantum_locker.exe"

Network

N/A

Files

C:\Users\Admin\Desktop\README_TO_DECRYPT.html

MD5 e0ee6e7df64f93e12e3ecf246323524d
SHA1 47664f0e931cc2916e0933dc419c423447eda67c
SHA256 4ec867d231198a5b8a4d65d2fc1256af31e9cfe220fd0f8525ecc92217914591
SHA512 3087710bad5be25d35297cb9d74ab67fca55774d2914d1203ac546d8df54c7c41bd041b3e0157a0466296ee3c5511ec6e08af94b2ec8831523b7c9545b806569

C:\Users\Admin\AppData\Local\Temp\006C2DD5.bat

MD5 348cae913e496198548854f5ff2f6d1e
SHA1 a07655b9020205bd47084afd62a8bb22b48c0cdc
SHA256 c80128f51871eec3ae2057989a025ce244277c1c180498a5aaef45d5214b8506
SHA512 799796736d41d3fcb5a7c859571bb025ca2d062c4b86e078302be68c1a932ed4f78e003640df5405274364b5a9a9c0ba5e37177997683ee7ab54e5267590b611

C:\Users\Admin\AppData\Local\Temp\006C2DD5.bat

MD5 348cae913e496198548854f5ff2f6d1e
SHA1 a07655b9020205bd47084afd62a8bb22b48c0cdc
SHA256 c80128f51871eec3ae2057989a025ce244277c1c180498a5aaef45d5214b8506
SHA512 799796736d41d3fcb5a7c859571bb025ca2d062c4b86e078302be68c1a932ed4f78e003640df5405274364b5a9a9c0ba5e37177997683ee7ab54e5267590b611