Malware Analysis Report

2024-09-11 01:19

Sample ID 240410-sfwdtafc9y
Target faf49653a0f057ed09a75c4dfc01e4d8e6fef203d0102a5947a73db80be0db1d
SHA256 faf49653a0f057ed09a75c4dfc01e4d8e6fef203d0102a5947a73db80be0db1d
Tags
quantum ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

faf49653a0f057ed09a75c4dfc01e4d8e6fef203d0102a5947a73db80be0db1d

Threat Level: Known bad

The file faf49653a0f057ed09a75c4dfc01e4d8e6fef203d0102a5947a73db80be0db1d was found to be: Known bad.

Malicious Activity Summary

quantum ransomware

Quantum Ransomware

Deletes itself

Enumerates connected drives

Drops desktop.ini file(s)

Unsigned PE

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Views/modifies file attributes

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Privilege Escalation
TA0004
Defense Evasion
TA0005
Hide Artifacts
T1564
Hidden Files and Directories
T1564.001
Credential Access
TA0006
Discovery
TA0007
Query Registry
T1012
Peripheral Device Discovery
T1120
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-04-10 15:04

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-10 15:04

Reported

2024-04-10 15:07

Platform

win7-20240221-en

Max time kernel

118s

Max time network

119s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\faf49653a0f057ed09a75c4dfc01e4d8e6fef203d0102a5947a73db80be0db1d.dll,#1

Signatures

Quantum Ransomware

ransomware quantum

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification \??\c:\Users\Admin\Downloads\desktop.ini C:\Windows\system32\rundll32.exe N/A
File opened for modification \??\c:\Users\Admin\Saved Games\desktop.ini C:\Windows\system32\rundll32.exe N/A
File opened for modification \??\c:\Users\Admin\Videos\desktop.ini C:\Windows\system32\rundll32.exe N/A
File opened for modification \??\c:\Users\Admin\Desktop\desktop.ini C:\Windows\system32\rundll32.exe N/A
File opened for modification \??\c:\Users\Admin\Favorites\desktop.ini C:\Windows\system32\rundll32.exe N/A
File opened for modification \??\c:\Users\Admin\Pictures\desktop.ini C:\Windows\system32\rundll32.exe N/A
File opened for modification \??\c:\Users\Admin\Searches\desktop.ini C:\Windows\system32\rundll32.exe N/A
File opened for modification \??\c:\Users\Admin\Music\desktop.ini C:\Windows\system32\rundll32.exe N/A
File opened for modification \??\c:\Users\Public\Pictures\Sample Pictures\desktop.ini C:\Windows\system32\rundll32.exe N/A
File opened for modification \??\c:\Users\Public\desktop.ini C:\Windows\system32\rundll32.exe N/A
File opened for modification \??\c:\Users\Admin\Favorites\Links for United States\desktop.ini C:\Windows\system32\rundll32.exe N/A
File opened for modification \??\c:\Users\Public\Documents\desktop.ini C:\Windows\system32\rundll32.exe N/A
File opened for modification \??\c:\Users\Public\Music\Sample Music\desktop.ini C:\Windows\system32\rundll32.exe N/A
File opened for modification \??\c:\Users\Public\Recorded TV\desktop.ini C:\Windows\system32\rundll32.exe N/A
File opened for modification \??\c:\Users\Public\Videos\Sample Videos\desktop.ini C:\Windows\system32\rundll32.exe N/A
File opened for modification \??\c:\Users\Public\Pictures\desktop.ini C:\Windows\system32\rundll32.exe N/A
File opened for modification \??\c:\Users\Admin\Contacts\desktop.ini C:\Windows\system32\rundll32.exe N/A
File opened for modification \??\c:\Users\Admin\Links\desktop.ini C:\Windows\system32\rundll32.exe N/A
File opened for modification \??\c:\Users\Public\Downloads\desktop.ini C:\Windows\system32\rundll32.exe N/A
File opened for modification \??\c:\Users\Admin\Documents\desktop.ini C:\Windows\system32\rundll32.exe N/A
File opened for modification \??\c:\Users\Admin\Favorites\Links\desktop.ini C:\Windows\system32\rundll32.exe N/A
File opened for modification \??\c:\Users\Public\Desktop\desktop.ini C:\Windows\system32\rundll32.exe N/A
File opened for modification \??\c:\Users\Public\Libraries\desktop.ini C:\Windows\system32\rundll32.exe N/A
File opened for modification \??\c:\Users\Public\Music\desktop.ini C:\Windows\system32\rundll32.exe N/A
File opened for modification \??\c:\Users\Public\Recorded TV\Sample Media\desktop.ini C:\Windows\system32\rundll32.exe N/A
File opened for modification \??\c:\Users\Public\Videos\desktop.ini C:\Windows\system32\rundll32.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\f: C:\Windows\system32\rundll32.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.quantum\shell\Open\command C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.quantum C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.quantum\shell C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.quantum\shell\Open C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.quantum\shell\Open\command\ = "explorer.exe README_TO_DECRYPT.html" C:\Windows\system32\rundll32.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Windows\system32\rundll32.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1972 wrote to memory of 2080 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\cmd.exe
PID 1972 wrote to memory of 2080 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\cmd.exe
PID 1972 wrote to memory of 2080 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\cmd.exe
PID 2080 wrote to memory of 560 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 2080 wrote to memory of 560 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 2080 wrote to memory of 560 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\attrib.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\faf49653a0f057ed09a75c4dfc01e4d8e6fef203d0102a5947a73db80be0db1d.dll,#1

C:\Windows\system32\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\\0F767C03.bat" """

C:\Windows\system32\attrib.exe

attrib -s -r -h ""

Network

N/A

Files

memory/1972-0-0x000007FFFFF90000-0x000007FFFFFA8000-memory.dmp

memory/1972-1-0x000007FFFFF90000-0x000007FFFFFA8000-memory.dmp

memory/1972-2-0x000007FFFFF90000-0x000007FFFFFA8000-memory.dmp

memory/1972-4-0x000007FFFFF90000-0x000007FFFFFA8000-memory.dmp

memory/1972-13-0x000007FFFFF90000-0x000007FFFFFA8000-memory.dmp

C:\Users\Admin\Desktop\README_TO_DECRYPT.html

MD5 da82b0b78f485c1c8613be8987331a1a
SHA1 db9af6da785ea70cf58bddb7fe3fa4f83aa45a03
SHA256 ae0d3c813843e041eddf555635f7c5ca4d55f11e287e20d9d23b5160aacf4f48
SHA512 590165a9e929a83a81208c04eba6a06bd445a2de576a0a3266bd74aa43eed2a9bc26f2bec14e893efb34df113f513c82d0b8063a8b0bca0eb432b6f98b2bbad4

memory/1972-7-0x000007FFFFF90000-0x000007FFFFFA8000-memory.dmp

memory/1972-49-0x000007FFFFF90000-0x000007FFFFFA8000-memory.dmp

memory/1972-48-0x000007FFFFF90000-0x000007FFFFFA8000-memory.dmp

memory/1972-47-0x000007FFFFF90000-0x000007FFFFFA8000-memory.dmp

memory/1972-46-0x000007FFFFF90000-0x000007FFFFFA8000-memory.dmp

memory/1972-290-0x000007FFFFF90000-0x000007FFFFFA8000-memory.dmp

memory/1972-293-0x000007FFFFF90000-0x000007FFFFFA8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\0F767C03.bat

MD5 348cae913e496198548854f5ff2f6d1e
SHA1 a07655b9020205bd47084afd62a8bb22b48c0cdc
SHA256 c80128f51871eec3ae2057989a025ce244277c1c180498a5aaef45d5214b8506
SHA512 799796736d41d3fcb5a7c859571bb025ca2d062c4b86e078302be68c1a932ed4f78e003640df5405274364b5a9a9c0ba5e37177997683ee7ab54e5267590b611

C:\Users\Admin\AppData\Local\Temp\.log

MD5 eb89e99970fa41e2cb582cff33ed7ad1
SHA1 90f435971e95f03e8f155ff1eb73b4f0ee40a8a5
SHA256 1254c41c23286a0162c4b907e56f4ced2972b1fe8381f6011ef4ac7380b2aca9
SHA512 fb4f5c1f5d78e78a0967743ea58d9919ee9cd11bc5a5403c0d0feb0ceaad50f9b0cabba02c26f20f82ba00b63e0569d8f915a85c187e16f0660c3a88a8fb10df

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-10 15:04

Reported

2024-04-10 15:07

Platform

win10v2004-20240226-en

Max time kernel

149s

Max time network

150s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\faf49653a0f057ed09a75c4dfc01e4d8e6fef203d0102a5947a73db80be0db1d.dll,#1

Signatures

Quantum Ransomware

ransomware quantum

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification \??\c:\Users\Admin\Music\desktop.ini C:\Windows\system32\rundll32.exe N/A
File opened for modification \??\c:\Users\Admin\OneDrive\desktop.ini C:\Windows\system32\rundll32.exe N/A
File opened for modification \??\c:\Users\Admin\Pictures\desktop.ini C:\Windows\system32\rundll32.exe N/A
File opened for modification \??\c:\Users\Admin\Contacts\desktop.ini C:\Windows\system32\rundll32.exe N/A
File opened for modification \??\c:\Users\Public\AccountPictures\desktop.ini C:\Windows\system32\rundll32.exe N/A
File opened for modification \??\c:\Users\Public\desktop.ini C:\Windows\system32\rundll32.exe N/A
File opened for modification \??\c:\Users\Admin\3D Objects\desktop.ini C:\Windows\system32\rundll32.exe N/A
File opened for modification \??\c:\Users\Admin\Documents\desktop.ini C:\Windows\system32\rundll32.exe N/A
File opened for modification \??\c:\Users\Admin\Downloads\desktop.ini C:\Windows\system32\rundll32.exe N/A
File opened for modification \??\c:\Users\Admin\Pictures\Camera Roll\desktop.ini C:\Windows\system32\rundll32.exe N/A
File opened for modification \??\c:\Users\Admin\Videos\desktop.ini C:\Windows\system32\rundll32.exe N/A
File opened for modification \??\c:\Users\Public\Music\desktop.ini C:\Windows\system32\rundll32.exe N/A
File opened for modification \??\c:\Users\Admin\Desktop\desktop.ini C:\Windows\system32\rundll32.exe N/A
File opened for modification \??\c:\Users\Admin\Searches\desktop.ini C:\Windows\system32\rundll32.exe N/A
File opened for modification \??\c:\Users\Public\Downloads\desktop.ini C:\Windows\system32\rundll32.exe N/A
File opened for modification \??\c:\Users\Public\Pictures\desktop.ini C:\Windows\system32\rundll32.exe N/A
File opened for modification \??\c:\Users\Admin\Favorites\desktop.ini C:\Windows\system32\rundll32.exe N/A
File opened for modification \??\c:\Users\Admin\Favorites\Links\desktop.ini C:\Windows\system32\rundll32.exe N/A
File opened for modification \??\c:\Users\Public\Documents\desktop.ini C:\Windows\system32\rundll32.exe N/A
File opened for modification \??\c:\Users\Public\Libraries\desktop.ini C:\Windows\system32\rundll32.exe N/A
File opened for modification \??\c:\Users\Public\Videos\desktop.ini C:\Windows\system32\rundll32.exe N/A
File opened for modification \??\c:\Users\Admin\Links\desktop.ini C:\Windows\system32\rundll32.exe N/A
File opened for modification \??\c:\Users\Admin\Pictures\Saved Pictures\desktop.ini C:\Windows\system32\rundll32.exe N/A
File opened for modification \??\c:\Users\Admin\Saved Games\desktop.ini C:\Windows\system32\rundll32.exe N/A
File opened for modification \??\c:\Users\Public\Desktop\desktop.ini C:\Windows\system32\rundll32.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\f: C:\Windows\system32\rundll32.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\.quantum\shell\Open\command\ = "explorer.exe README_TO_DECRYPT.html" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\.quantum\shell\Open\command C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\.quantum C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\.quantum\shell C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\.quantum\shell\Open C:\Windows\system32\rundll32.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Windows\system32\rundll32.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3792 wrote to memory of 4012 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\cmd.exe
PID 3792 wrote to memory of 4012 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\cmd.exe
PID 4012 wrote to memory of 2276 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 4012 wrote to memory of 2276 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\attrib.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\faf49653a0f057ed09a75c4dfc01e4d8e6fef203d0102a5947a73db80be0db1d.dll,#1

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\\0E579C01.bat" """

C:\Windows\system32\attrib.exe

attrib -s -r -h ""

Network

Country Destination Domain Proto
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
US 138.91.171.81:80 tcp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 101.58.20.217.in-addr.arpa udp
US 8.8.8.8:53 159.113.53.23.in-addr.arpa udp
US 8.8.8.8:53 240.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 13.179.89.13.in-addr.arpa udp

Files

memory/3792-0-0x00007FF49A9B0000-0x00007FF49A9C8000-memory.dmp

memory/3792-1-0x00007FF49A9B0000-0x00007FF49A9C8000-memory.dmp

memory/3792-3-0x00007FF49A9B0000-0x00007FF49A9C8000-memory.dmp

C:\Users\Admin\Contacts\README_TO_DECRYPT.html

MD5 8e3ab5ca404a30f215af3d80c4bab347
SHA1 b56eaadcd4e51234e620d13787ec907ef078fed8
SHA256 85764cdf6401897604ec86de5b789176405534f58e179ab1482d77cf9ead3f65
SHA512 2f8bdbd7514c152ba0e1eb8472e55f49ac42e0b92590487291feaebe7c44d9104a5ed0bec895d06b2db375226f7ebb51b8cc5750c4ea89ad632d547083a187c1

memory/3792-45-0x00007FF49A9B0000-0x00007FF49A9C8000-memory.dmp

memory/3792-60-0x00007FF49A9B0000-0x00007FF49A9C8000-memory.dmp

memory/3792-61-0x00007FF49A9B0000-0x00007FF49A9C8000-memory.dmp

memory/3792-52-0x00007FF49A9B0000-0x00007FF49A9C8000-memory.dmp

memory/3792-6-0x00007FF49A9B0000-0x00007FF49A9C8000-memory.dmp

memory/3792-216-0x00007FF49A9B0000-0x00007FF49A9C8000-memory.dmp

memory/3792-219-0x00007FF49A9B0000-0x00007FF49A9C8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\0E579C01.bat

MD5 348cae913e496198548854f5ff2f6d1e
SHA1 a07655b9020205bd47084afd62a8bb22b48c0cdc
SHA256 c80128f51871eec3ae2057989a025ce244277c1c180498a5aaef45d5214b8506
SHA512 799796736d41d3fcb5a7c859571bb025ca2d062c4b86e078302be68c1a932ed4f78e003640df5405274364b5a9a9c0ba5e37177997683ee7ab54e5267590b611

C:\Users\Admin\AppData\Local\Temp\.log

MD5 c8df92496fa02dc0d42827ee26010f71
SHA1 34c766ae6f2338751415131d1a5b0eab76f9c875
SHA256 e45086bbe8d547830a6cf9862f66a876d04a6574cae9b237f4958ae085241964
SHA512 99bf02eda9d7d429d5d3376383a4f8735ef18afb49bab47238e295a34f85ff2c3ee52c2309f0ba70c10b44235c2e5af72d65484fed8c822492997e7422895b85