Overview

overview

10

Static

static

10

quantum.exe

windows10-1703-x64

10

Analysis

  • max time kernel
    79s
  • max time network
    80s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    03-08-2024 09:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    quantum.exe

  • Size

    417KB

  • MD5

    3dc9bad7720a01598aa14e55baca7413

  • SHA1

    99668a82a34ec17340fccecbc2ef0985b84704a0

  • SHA256

    a54a38a9aab0bde31b2065d8b88a8e6569cc66c3f6137379b6b5a62361c319f0

  • SHA512

    567581747132d56595c719e4d454bf6e73ba941581701b28287559f899ea5813a0abb7ff2df25cb3d7c99d3203c8a8ab361ea37b3b8e8392748fb855ee4cbaba

  • SSDEEP

    6144:Jr9Zzp4MmFrxodIFRfiM6baHcgrRS8gPFYTdOjbGXypU5:Jp4MmxxhfiMzcyRQFYTdqTa

Score
10/10
chaosransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Admin\Documents\welp.txt

Ransom Note
Hello there! All your files are encrypted, but do not worry, if you're not poor that is. If you send us 50$ worth of Bitcoin, you will get a key that will decrypt all your files! Yipeeeee! Contact us at [email protected] After you send the $50 worth of BTC to the wallet, you will receive the key. Don't try to use any third party software to decrypt your files if you don't want to lose all your data.

Signatures

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos
  • Chaos Ransomware 2 IoCs
  • Drops startup file 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 35 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs
  • Opens file in notepad (likely ransom note) 4 IoCs
    ransomware
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 31 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\quantum.exe
    "C:\Users\Admin\AppData\Local\Temp\quantum.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2872
    • C:\Users\Admin\AppData\Roaming\quantum.exe
      "C:\Users\Admin\AppData\Roaming\quantum.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Drops desktop.ini file(s)
      • Sets desktop wallpaper using registry
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4228
      • C:\Windows\system32\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\welp.txt
        3⤵
        • Opens file in notepad (likely ransom note)
        PID:1192
  • C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\welp.txt
    1⤵
    • Opens file in notepad (likely ransom note)
    PID:2796
  • C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\welp.txt
    1⤵
    • Opens file in notepad (likely ransom note)
    PID:1876
  • C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\welp.txt
    1⤵
    • Opens file in notepad (likely ransom note)
    PID:3124
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2168

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\quantum.exe.log
    Filesize

    226B

    MD5

    d78293ab15ad25b5d6e8740fe5fd3872

    SHA1

    51b70837f90f2bff910daee706e6be8d62a3550e

    SHA256

    4d64746f8d24ec321b1a6c3a743946b66d8317cbc6bac6fed675a4bf6fa181f3

    SHA512

    1127435ef462f52677e1ef4d3b8cfdf9f5d95c832b4c9f41526b7448d315f25d96d3d5454108569b76d66d78d07ea5ba4a1ba8baee108e8c1b452ba19cc04925

    Download Submit

  • C:\Users\Admin\AppData\Roaming\quantum.exe
    Filesize

    417KB

    MD5

    3dc9bad7720a01598aa14e55baca7413

    SHA1

    99668a82a34ec17340fccecbc2ef0985b84704a0

    SHA256

    a54a38a9aab0bde31b2065d8b88a8e6569cc66c3f6137379b6b5a62361c319f0

    SHA512

    567581747132d56595c719e4d454bf6e73ba941581701b28287559f899ea5813a0abb7ff2df25cb3d7c99d3203c8a8ab361ea37b3b8e8392748fb855ee4cbaba

    Download Submit

  • C:\Users\Admin\Documents\welp.txt
    Filesize

    427B

    MD5

    025e685a33afef1bb7772b41f46d5700

    SHA1

    39c246daf9003a7a38cfb2edb5f66b2766c65c39

    SHA256

    fc4d2fe0b5c84f7ffa475e1cf9da6185e8bb162a03899bcfe015df64778cc380

    SHA512

    1d3d29da8bb4390ebe563e046d382ced7e1d4abb7870f4a7bee64683d3ae236375492b7ad7fb3e64c800859cf80da43406243f2e5bd36bc262e7bff1e5168b29

    Download Submit

  • memory/2872-0-0x0000000000C30000-0x0000000000C9E000-memory.dmp

    Filesize

    440KB

    Download

  • memory/2872-1-0x00007FFC02D83000-0x00007FFC02D84000-memory.dmp

    Filesize

    4KB

    Download

  • memory/4228-9-0x00007FFC02D80000-0x00007FFC0376C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/4228-19-0x00007FFC02D80000-0x00007FFC0376C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/4228-449-0x00007FFC02D80000-0x00007FFC0376C000-memory.dmp

    Filesize

    9.9MB

    Download