Overview
overview
10Static
static
100225a30270...24.exe
windows10-1703-x64
30225a30270...24.exe
windows7-x64
70225a30270...24.exe
windows10-2004-x64
30225a30270...24.exe
windows11-21h2-x64
305072a7ec4...7f.exe
windows10-1703-x64
1005072a7ec4...7f.exe
windows7-x64
1005072a7ec4...7f.exe
windows10-2004-x64
1005072a7ec4...7f.exe
windows11-21h2-x64
101fca1cd049...77.exe
windows10-1703-x64
11fca1cd049...77.exe
windows7-x64
11fca1cd049...77.exe
windows10-2004-x64
11fca1cd049...77.exe
windows11-21h2-x64
120bab94e6d...52.exe
windows10-1703-x64
120bab94e6d...52.exe
windows7-x64
120bab94e6d...52.exe
windows10-2004-x64
120bab94e6d...52.exe
windows11-21h2-x64
12704e269fb...66.exe
windows10-1703-x64
102704e269fb...66.exe
windows7-x64
102704e269fb...66.exe
windows10-2004-x64
102704e269fb...66.exe
windows11-21h2-x64
102cbb3497bf...2d.dll
windows10-1703-x64
102cbb3497bf...2d.dll
windows7-x64
102cbb3497bf...2d.dll
windows10-2004-x64
102cbb3497bf...2d.dll
windows11-21h2-x64
1037546b811e...f6.exe
windows10-1703-x64
1037546b811e...f6.exe
windows7-x64
1037546b811e...f6.exe
windows10-2004-x64
1037546b811e...f6.exe
windows11-21h2-x64
1049d828087c...2d.exe
windows10-1703-x64
149d828087c...2d.exe
windows7-x64
149d828087c...2d.exe
windows10-2004-x64
149d828087c...2d.exe
windows11-21h2-x64
1Analysis
-
max time kernel
1562s -
max time network
1564s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 15:47
Behavioral task
behavioral1
Sample
0225a30270e5361e410453d4fb0501eb759612f6048ad43591b559d835720224.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
0225a30270e5361e410453d4fb0501eb759612f6048ad43591b559d835720224.exe
Resource
win7-20240221-en
Behavioral task
behavioral3
Sample
0225a30270e5361e410453d4fb0501eb759612f6048ad43591b559d835720224.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral4
Sample
0225a30270e5361e410453d4fb0501eb759612f6048ad43591b559d835720224.exe
Resource
win11-20240426-en
Behavioral task
behavioral5
Sample
05072a7ec455fdf0977f69d49dcaaf012c403c9d39861fa2216eae19c160527f.exe
Resource
win10-20240404-en
Behavioral task
behavioral6
Sample
05072a7ec455fdf0977f69d49dcaaf012c403c9d39861fa2216eae19c160527f.exe
Resource
win7-20240221-en
Behavioral task
behavioral7
Sample
05072a7ec455fdf0977f69d49dcaaf012c403c9d39861fa2216eae19c160527f.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral8
Sample
05072a7ec455fdf0977f69d49dcaaf012c403c9d39861fa2216eae19c160527f.exe
Resource
win11-20240426-en
Behavioral task
behavioral9
Sample
1fca1cd04992e0fcaa714d9dfa97323d81d7e3d43a024ec37d1c7a2767a17577.exe
Resource
win10-20240404-en
Behavioral task
behavioral10
Sample
1fca1cd04992e0fcaa714d9dfa97323d81d7e3d43a024ec37d1c7a2767a17577.exe
Resource
win7-20240215-en
Behavioral task
behavioral11
Sample
1fca1cd04992e0fcaa714d9dfa97323d81d7e3d43a024ec37d1c7a2767a17577.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral12
Sample
1fca1cd04992e0fcaa714d9dfa97323d81d7e3d43a024ec37d1c7a2767a17577.exe
Resource
win11-20240426-en
Behavioral task
behavioral13
Sample
20bab94e6d9c8ed4832ce3b58f9150b16f9e5f40ffdcb747e10366cab5a30352.exe
Resource
win10-20240404-en
Behavioral task
behavioral14
Sample
20bab94e6d9c8ed4832ce3b58f9150b16f9e5f40ffdcb747e10366cab5a30352.exe
Resource
win7-20240221-en
Behavioral task
behavioral15
Sample
20bab94e6d9c8ed4832ce3b58f9150b16f9e5f40ffdcb747e10366cab5a30352.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral16
Sample
20bab94e6d9c8ed4832ce3b58f9150b16f9e5f40ffdcb747e10366cab5a30352.exe
Resource
win11-20240508-en
Behavioral task
behavioral17
Sample
2704e269fb5cf9a02070a0ea07d82dc9d87f2cb95e60cb71d6c6d38b01869f66.exe
Resource
win10-20240404-en
Behavioral task
behavioral18
Sample
2704e269fb5cf9a02070a0ea07d82dc9d87f2cb95e60cb71d6c6d38b01869f66.exe
Resource
win7-20240508-en
Behavioral task
behavioral19
Sample
2704e269fb5cf9a02070a0ea07d82dc9d87f2cb95e60cb71d6c6d38b01869f66.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral20
Sample
2704e269fb5cf9a02070a0ea07d82dc9d87f2cb95e60cb71d6c6d38b01869f66.exe
Resource
win11-20240508-en
Behavioral task
behavioral21
Sample
2cbb3497bfa28d9966c1feeae96d452d.dll
Resource
win10-20240404-en
Behavioral task
behavioral22
Sample
2cbb3497bfa28d9966c1feeae96d452d.dll
Resource
win7-20240508-en
Behavioral task
behavioral23
Sample
2cbb3497bfa28d9966c1feeae96d452d.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral24
Sample
2cbb3497bfa28d9966c1feeae96d452d.dll
Resource
win11-20240426-en
Behavioral task
behavioral25
Sample
37546b811e369547c8bd631fa4399730d3bdaff635e744d83632b74f44f56cf6.exe
Resource
win10-20240404-en
Behavioral task
behavioral26
Sample
37546b811e369547c8bd631fa4399730d3bdaff635e744d83632b74f44f56cf6.exe
Resource
win7-20240508-en
Behavioral task
behavioral27
Sample
37546b811e369547c8bd631fa4399730d3bdaff635e744d83632b74f44f56cf6.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral28
Sample
37546b811e369547c8bd631fa4399730d3bdaff635e744d83632b74f44f56cf6.exe
Resource
win11-20240426-en
Behavioral task
behavioral29
Sample
49d828087ca77abc8d3ac2e4719719ca48578b265bbb632a1a7a36560ec47f2d.exe
Resource
win10-20240404-en
Behavioral task
behavioral30
Sample
49d828087ca77abc8d3ac2e4719719ca48578b265bbb632a1a7a36560ec47f2d.exe
Resource
win7-20240508-en
Behavioral task
behavioral31
Sample
49d828087ca77abc8d3ac2e4719719ca48578b265bbb632a1a7a36560ec47f2d.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral32
Sample
49d828087ca77abc8d3ac2e4719719ca48578b265bbb632a1a7a36560ec47f2d.exe
Resource
win11-20240426-en
General
-
Target
2cbb3497bfa28d9966c1feeae96d452d.dll
-
Size
1.6MB
-
MD5
2cbb3497bfa28d9966c1feeae96d452d
-
SHA1
9ef94c7d3fedc71bb3ed1abf542dfc7ec692883d
-
SHA256
85c3b718090144dadeb8035ac287d46b9d3458f9de409229217d42a475f42868
-
SHA512
eed7b210655030b3855f7a20f3bc7aecf8b927a33dfdaefe1d769fa42cbf7c88b1e8ab625f7258a79d2625e06005d25b03691fe911330876ae9e7f916ab2fe4c
-
SSDEEP
24576:KlQyNmMnq70NDxLOd0+UU1Thef1HrmP1D2:KlQyNmMq70NDROd0+UU1ThoHrA
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\README_TO_DECRYPT.html
quantum
Signatures
-
Quantum Ransomware
A rebrand of the MountLocker ransomware first seen in August 2021.
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 308 cmd.exe -
Drops desktop.ini file(s) 32 IoCs
Processes:
rundll32.exedescription ioc process File opened for modification \??\c:\Users\Public\Pictures\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Admin\Saved Games\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Public\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Public\Desktop\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\94JSLQ0Q\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Admin\Favorites\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\RI1YAXDZ\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini rundll32.exe File opened for modification \??\c:\Users\Admin\Contacts\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Public\Music\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\4BMSK8RG\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Public\Libraries\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Admin\Documents\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Admin\Downloads\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Public\Music\Sample Music\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Admin\Videos\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Public\Documents\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Admin\Music\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Admin\Searches\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Public\Pictures\Sample Pictures\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Public\Recorded TV\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Public\Recorded TV\Sample Media\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Public\Videos\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Admin\Favorites\Links\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Admin\Links\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Public\Videos\Sample Videos\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Admin\Favorites\Links for United States\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Admin\Pictures\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Public\Downloads\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\D4RBNUS7\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Admin\Desktop\desktop.ini rundll32.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
rundll32.exedescription ioc process File opened (read-only) \??\f: rundll32.exe -
Drops file in Program Files directory 3 IoCs
Processes:
rundll32.exedescription ioc process File created \??\c:\Program Files\README_TO_DECRYPT.html rundll32.exe File created \??\c:\Program Files (x86)\README_TO_DECRYPT.html rundll32.exe File created \??\c:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\README_TO_DECRYPT.html rundll32.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a096d8ee3aa9da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000040adcaca798bc5419d4f2cdcc2c701650000000002000000000010660000000100002000000096c8013c694a2fa2fb3be4a4281bbc024fb6c1bd2466a36af67bf6c2a85b41eb000000000e8000000002000020000000e958d7fc052d1488fba8878312843f71710865cf55f2bae4ba4697431de063b79000000002541eab1fdd4f99ec82a20434e831722709cd2d57b89a3e57b43322aa67cd85363b82d38ec77163a9f1ed3f3c4ad211b932104f83b583365de2b7fa589e3f954084485293a28809620a06a0bbcbb6f525517e1c0be3ef210912312fbce51c7f6569738f46384854332b77cae7a89a230ec0b36b57f4d7d89a0e93fad512c5b9bbd38d553558aafa4cb08d878b810fc540000000758003feed1cf92954b5ffde9c512570b61b9c7b514528c027a45df4b3fc1b40f77a3a46338789fb3ceff6f0b43b1c1bb56e582f116f5d137c8697f6fcaf1af9 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000040adcaca798bc5419d4f2cdcc2c70165000000000200000000001066000000010000200000003901c92e7d82beab0f4e608711f116a518b52b7a990b27d67def51be2f5ab4c7000000000e8000000002000020000000c79501bd9001454fd65d2d40f5b2be0bd84c41869128467a52947eb7799b62f9200000003360c4a3728661cc501d4367b2d223ffb1f3e05b587f8d33a58be5bd81aadb514000000048f8c4e5c130f4232e7797b59a3913817f0475b5dba1ddc59a7836a319c6bf26aec4eff924e56160ab5fd980f3bd9aa93d0b7f9b9f476e97f090e4760674bf68 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422209190" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1A65D171-152E-11EF-A18A-FED6C5E8D4AB} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe -
Modifies registry class 5 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\.quantum\shell\Open\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\.quantum rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\.quantum\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\.quantum\shell\Open rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\.quantum\shell\Open\command\ = "explorer.exe README_TO_DECRYPT.html" rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exepid process 2228 rundll32.exe 2228 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
rundll32.exedescription pid process Token: SeRestorePrivilege 2228 rundll32.exe Token: SeDebugPrivilege 2228 rundll32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 924 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 924 iexplore.exe 924 iexplore.exe 3068 IEXPLORE.EXE 3068 IEXPLORE.EXE 3068 IEXPLORE.EXE 3068 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
rundll32.exerundll32.execmd.exeiexplore.exedescription pid process target process PID 1944 wrote to memory of 2228 1944 rundll32.exe rundll32.exe PID 1944 wrote to memory of 2228 1944 rundll32.exe rundll32.exe PID 1944 wrote to memory of 2228 1944 rundll32.exe rundll32.exe PID 1944 wrote to memory of 2228 1944 rundll32.exe rundll32.exe PID 1944 wrote to memory of 2228 1944 rundll32.exe rundll32.exe PID 1944 wrote to memory of 2228 1944 rundll32.exe rundll32.exe PID 1944 wrote to memory of 2228 1944 rundll32.exe rundll32.exe PID 2228 wrote to memory of 308 2228 rundll32.exe cmd.exe PID 2228 wrote to memory of 308 2228 rundll32.exe cmd.exe PID 2228 wrote to memory of 308 2228 rundll32.exe cmd.exe PID 2228 wrote to memory of 308 2228 rundll32.exe cmd.exe PID 308 wrote to memory of 316 308 cmd.exe attrib.exe PID 308 wrote to memory of 316 308 cmd.exe attrib.exe PID 308 wrote to memory of 316 308 cmd.exe attrib.exe PID 308 wrote to memory of 316 308 cmd.exe attrib.exe PID 924 wrote to memory of 3068 924 iexplore.exe IEXPLORE.EXE PID 924 wrote to memory of 3068 924 iexplore.exe IEXPLORE.EXE PID 924 wrote to memory of 3068 924 iexplore.exe IEXPLORE.EXE PID 924 wrote to memory of 3068 924 iexplore.exe IEXPLORE.EXE -
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2cbb3497bfa28d9966c1feeae96d452d.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2cbb3497bfa28d9966c1feeae96d452d.dll,#12⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\\0F76422E.bat" "C:\Users\Admin\AppData\Local\Temp\2cbb3497bfa28d9966c1feeae96d452d.dll""3⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:308 -
C:\Windows\SysWOW64\attrib.exeattrib -s -r -h "C:\Users\Admin\AppData\Local\Temp\2cbb3497bfa28d9966c1feeae96d452d.dll"4⤵
- Views/modifies file attributes
PID:316
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\README_TO_DECRYPT.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:924 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3068
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5620625e0cb79821d9b7cc0a85158040c
SHA16452e37091706336207405ac05ff20fe7eaa9b56
SHA2560ea9471ede3b6796552b902b778279ba63feec0ca3fa4252041cc9e848bbac7e
SHA51249f03f8cd52e841528732b5e1f98d96482f7e7cceb334f269e9d2d362dc67d676532d4eb15e0394ba4ab0245a764c5d447b158fb648b0d48a033a0121897b71e
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD50d88c7593e7ee1ed4cb8855a382f0b97
SHA1e4c008aaf4c7f75aa876974ff88111d8281ab7ef
SHA25620b196f667986edcbff20296d8adbd25853dd509a9a26343afce3a6b187aeff8
SHA51278de5bc0708e6cfe56e4f5be0f2fcbdadcea304b5d5c47ee877fe85b671965eb95becca119b78516df220019200b4d7e566a4eb9111e7cb3a55f9b27ee9fce65
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD517f252a616b0d201ce08e1336b0d8e25
SHA117a09bf31d1373b8f4e30e4e5e18bbd5240c5c27
SHA2561c223986eebfb0c67192450dbd1be4fbe98244cc0720b14449f617f4e1c3e6e3
SHA5121c4f94c9b86dcd033c7e714a35f09584c3a803fff2972a4bee393adb05a3e2e42aadeb824ccd278d0e64e237c288c1da92e65802014e643a71241836e82f84ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58d9993b0c583ee7b8312ed233ccfe92e
SHA14b227d221aabc85094574fb0fa43b1ecc7ce6118
SHA2567fd7475b87ad0413b31fcce8de511f98a6689ecee111cf78332efe68bccfaab5
SHA512f36173f8c4f60681420fabc4a2215780c198b1cc7264bebc7c5e620baef9c9bb3f7fc83d819ca8d22633fb77eee4a2b54b7357299d17d4c1d35d8868ccc62ecb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5651860e32ef191458015a39961d94a0c
SHA184b33e6e3e727bc1afd0946a2bca5acfb504b6e6
SHA256089d82866093bf4a1bbde6be0747be695ba3f0fa752c964782ec0e7a3b1dfbc6
SHA512fd48e6935731ac159438532cec8013fe8fc7296fa8fd42a56926f4c5e677eabb8c2ebc3badcc114144fbfb6ff324147b0a62c17f1a0ade72477347d7ca47efb3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD597258f954caab577cb14baa4f87f345b
SHA1cfd661766548d03d988697c8322e110b3cebf39d
SHA2560986a8d27b1063095158286e58a755969b532c87dc78bac7df408bbf0cead1c0
SHA512d58b7bb5365060e09755f1331aeeac5c22c8a53c9c78aa734f1c26062a4903315bbe78da70e8a7d723abc9be3bf83a5a9b26a51c2b7e43478a22dc3a0dd2f5a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54be62decc98ef21fcd02a00c5577861e
SHA1c70d0f03f75209f65df2b21e6985814b94eb6b65
SHA256c58432b9011599a4fc42d0b5028b7e08ec45e162f1dc7289d22bd286306347ca
SHA512076efda733e3a33e4c67f53dd33e5434a79ee438b3d0b3e830c3ed9a84bd96379242e728d510e0dcd97e161cba23ab82737a0ea50a81ab70d74a1cdc1054e425
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51648ff5d81885abce59ced464242f4bd
SHA19d0824ae1d17d15deed08c2cdc36e3da319e89c2
SHA256afd857a0f46568dbb62b4f4b8c0a426a8a916f5443212c2b2639ae2933cd3019
SHA5122c50eab1f2d86aa90b241da921eafe59cb8da8f5fbc49f815141973a1bea341846b9dfa570fda2658fce1a1bf9ab8afd4d3ba71821eeda4a213b376b1bf14081
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51d6045780d68bd75ea76793305728c3d
SHA15dfb4a0fa3e237843f4b6a45fb5efda89dd28c12
SHA256d457151cb61981ef8df48c9bb155ca9f392dd201c0add2e0141d36450a5e1529
SHA512c2f091020b538c905d8906772acdd1d618f1ecdd814174a29f899f14a2a05f629655ca734b22f808a62d3ec8c56483c6115e594e6360c5874f7cbeac76c4bf98
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d6b3b3ab7bdd84d2ba0b9c5b37c262d8
SHA1c8af200d7de8284d6f26dd21512fa72a4f983488
SHA256d0df687a511caa2f23013bef0703b8cc4255e0dab7b9a1efc3719b281372c792
SHA512e5f81d327b2465426ff0ee229b652e589724c682c882d292eb623c5e36fcd4e65d2c95470e245dd0d92dcd1afbb70769b3157a1762a88802a16b1fa0f1193763
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5674cafa224996fc20daa721c21f7c398
SHA17d8c7e8a65c5c1231b3512378549277951b98219
SHA2563017aa950a1171f5994985195d83f90918defc7db439d0ea612918e6bf6d7990
SHA51218a19e2d96f79fd7f30c10d1621855d5835c535553f9f6d0f9eb89901515244c814b4824971a73debe294dff89a1538a90e88d95eca06745e24c95afda5b6e87
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD594a15fb70fb4f23f769ea54a5e14d646
SHA14220a4523a2a2e6542cfaa0da1be55a0e31b4cfa
SHA256f98c4d28d2f0743067191724b5ba77a8c325ab80d93bb215426caec47313f977
SHA512cd9dfe889b92466dd20ea8492c1fd86b927e81d206415e86e7a9902762d40e4a99d780d9586867167874df998dc20dbdbb5c933fdbc25b0e3129568bdf61499d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dc8ca58811f9aea3014c0067c1eb81b8
SHA11398aaeb33c24319f023eacc90ef43940bc107ac
SHA256d9228edd5a6ab186260ce400d03d2057f73e0d45d37d5318776b36bc7487b689
SHA512bcaa74cbe8c930553da62d8cb7129a736801bd505fa69abb5794a388c93a774c6320316d32a6cfa57901f5032cc895d7a4d4cbc80bc8b01e8fbfd5e6b61d2746
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d04af38667371a0826cfbb502ce6ffd7
SHA18520c41b0b771b678bd7ddfd813b3ff29cb9adf5
SHA2565a6db173197b6317a68d84f65612428ed22bcded2937d5b001bfb0c31e116730
SHA5122188cbb4448dba90a0ad72182f9fd0df75dd162dae451db5695fd522ea35b91749d405c922635472926d9ae891fc71192ac6cd4442caf56e0b21d04dbc3f4a58
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52d18a5c4373b6323798ca11242cbefcc
SHA14720bbf654358dd2abb321182719d4b06335ff82
SHA2562d3b459883a948ca05144073aaf8d9330c2cbd9f1d2b35dcc9d5a2eaea0f6955
SHA512dc416aa7ec72bfab51b7718c59e88f45462d1cf596de7ad2fbdf45572784d8df562acbbe685b0f2db9abb0cbc7f522ad983f41fe92371b06de59937a2bc1c421
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59354fc1c5f8aeefb0484e3e0e73621f0
SHA1b0d019dc61d8debd64727a2137f341f58eb25f12
SHA2568818bef03de45c8c7b480c63a796e9385cf1c53c4ca736e8a3b535ccbbb47ee6
SHA512380ef47c9ea9f1492acb6a799c712b19cfc5a543374db9da46c6fa72cd4f69dd25fad0b856cbede47860238487dca9f6b19624064e906fdc08728b0949ba606e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cbb296ddb5b4d856c165ed95a762028c
SHA1b7d6511920ff508ba5c0ba004aae06d0d36fa05f
SHA2560d8c3899eac70c33824b8e99cacfcd287dc09ae45807dd3faa7c6677d143cbdf
SHA5121e54cfd8981e5564ea75f5599ff11cad66e53004b0e0a4ce85994d631212804718b82d0b35857767ea7e7647dcb60f7be6cba28467b23656e02acef6077dd067
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f5f60c4e6c02bb4848f0886a04119afd
SHA122cf312be77a35fe3a0f36e48f86c3f17a18b150
SHA2567bdc020c874ac5b20da1c485a67a4119efc6ce1ae6a00aeb695f7f95621195c9
SHA5120f8f578041059b5a8dfef83f11dd9e9eec7fbe138606a6c8fcca2b15f06e24d7cd2d368da22cc65809be7df9bf7ac64d511c20c1eaa7ce3ee1e0ccfe24a40e45
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d56cfacc8d5ab1861f2e59c61b1e86c0
SHA1dda403a75b8d4a696fcafb775ab52f11084064e3
SHA256f89cec43dc1e80e95fcc548154986e187272a86e89e256d66c23de16f29201cc
SHA5127b6319558768d2a2cebc8f24958e1447a9a21bc55082f6db192d0dc0605e0dc24c0b01f34a77700a16fb744c583524a97f71fd7b6bf317d4d84fa43040527c94
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD519fe22d2277e69a1d2348191377b3413
SHA15039e17b220bf1367deab09a139d03e6b076931c
SHA2563385b429632dd3e6fa89340b8f3b61ca47552fdbeed8e36e34ffdf60926ae537
SHA51267628d0bfefba11ce2b22951eb279685c0867ba1c9b8853d78cb776db8e0da2b5b76503e680d54dd0e4a2e3edcdf4c0b960c30b07c70b06b48f5632ed8477eed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56278266f8fb9d5966c161971d87156da
SHA17d555a7dca05cc7e8716eb87a1f4f833e605abd3
SHA25614a97fb8fa7d107a1bd82fb1132a891ef60a927781465bba027b94c51ae21374
SHA512e2a803ded318c1848681a69e6e2d8d7eca40f96e99592caec7d4fc59ae240f7410cfc047f84ea039d83e0ae9da81d4e99cf4bfba32fa7beefbabe34b184dfd2c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5eccab0cde231b66ce8d9ca2db3348dc9
SHA1db6ffa5ad61f708e81169a6f14a3821faeec7158
SHA25612eead3d6e6b5a3b82599d2dfe894db5d17ba727dc4fb727641de45c1d5034d3
SHA5124d9dee172829ff03dbfd799a43c7c19ee7390a13ad43d556ad91674b8c7ead2bc8870aee2b0a897e228f124b61e0f8d4e6cffcbec65bb46b34b428f8464a2779
-
Filesize
65B
MD5348cae913e496198548854f5ff2f6d1e
SHA1a07655b9020205bd47084afd62a8bb22b48c0cdc
SHA256c80128f51871eec3ae2057989a025ce244277c1c180498a5aaef45d5214b8506
SHA512799796736d41d3fcb5a7c859571bb025ca2d062c4b86e078302be68c1a932ed4f78e003640df5405274364b5a9a9c0ba5e37177997683ee7ab54e5267590b611
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a