chaos | a54a38a9aab0bde31b2065d8b88a8e6569cc66c3f6137379b6b5a62361c319f0

Analysis

max time kernel
65s
max time network
57s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
03-08-2024 11:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

quantum.exe
Size

417KB
MD5

3dc9bad7720a01598aa14e55baca7413
SHA1

99668a82a34ec17340fccecbc2ef0985b84704a0
SHA256

a54a38a9aab0bde31b2065d8b88a8e6569cc66c3f6137379b6b5a62361c319f0
SHA512

567581747132d56595c719e4d454bf6e73ba941581701b28287559f899ea5813a0abb7ff2df25cb3d7c99d3203c8a8ab361ea37b3b8e8392748fb855ee4cbaba
SSDEEP

6144:Jr9Zzp4MmFrxodIFRfiM6baHcgrRS8gPFYTdOjbGXypU5:Jp4MmxxhfiMzcyRQFYTdqTa

Score

10^/10

chaos discovery ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\Documents\welp.txt

Ransom Note

Hello there! All your files are encrypted, but do not worry, if you're not poor that is. If you send us 50$ worth of Bitcoin, you will get a key that will decrypt all your files! Yipeeeee! Contact us at [email protected] After you send the $50 worth of BTC to the wallet, you will receive the key. Don't try to use any third party software to decrypt your files if you don't want to lose all your data.

Emails

[email protected]

Signatures

Chaos
Ransomware family first seen in June 2021.
ransomware chaos

Chaos Ransomware 2 IoCs

resource	yara_rule
behavioral1/memory/3612-0-0x00000000002B0000-0x000000000031E000-memory.dmp	family_chaos
behavioral1/files/0x000800000001ac42-7.dat	family_chaos

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\welp.txt	quantum.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\quantum.url	quantum.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	quantum.exe

Executes dropped EXE 1 IoCs

pid	Process
3484	quantum.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops desktop.ini file(s) 35 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	quantum.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	quantum.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	quantum.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	quantum.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	quantum.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini	quantum.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	quantum.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	quantum.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini	quantum.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	quantum.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	quantum.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	quantum.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	quantum.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	quantum.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	quantum.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	quantum.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	quantum.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	quantum.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	quantum.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-3968772205-1713802336-1776639840-1000\desktop.ini	quantum.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	quantum.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	quantum.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	quantum.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	quantum.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	quantum.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	quantum.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	quantum.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	quantum.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	quantum.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	quantum.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	quantum.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	quantum.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	quantum.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	quantum.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	quantum.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zo8ocifej.jpg"	quantum.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133671587755737835"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings	quantum.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2888	NOTEPAD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3484	quantum.exe

Suspicious behavior: EnumeratesProcesses 33 IoCs

pid	Process
3612	quantum.exe
3612	quantum.exe
3612	quantum.exe
3612	quantum.exe
3612	quantum.exe
3612	quantum.exe
3612	quantum.exe
3612	quantum.exe
3612	quantum.exe
3612	quantum.exe
3612	quantum.exe
3612	quantum.exe
3612	quantum.exe
3612	quantum.exe
3612	quantum.exe
3484	quantum.exe
3484	quantum.exe
3484	quantum.exe
3484	quantum.exe
3484	quantum.exe
3484	quantum.exe
3484	quantum.exe
3484	quantum.exe
3484	quantum.exe
3484	quantum.exe
3484	quantum.exe
3484	quantum.exe
3484	quantum.exe
3484	quantum.exe
3484	quantum.exe
3484	quantum.exe
3552	chrome.exe
3552	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3612	quantum.exe
Token: SeDebugPrivilege	3484	quantum.exe
Token: SeShutdownPrivilege	3552	chrome.exe
Token: SeCreatePagefilePrivilege	3552	chrome.exe
Token: SeShutdownPrivilege	3552	chrome.exe
Token: SeCreatePagefilePrivilege	3552	chrome.exe
Token: SeShutdownPrivilege	3552	chrome.exe
Token: SeCreatePagefilePrivilege	3552	chrome.exe
Token: SeShutdownPrivilege	3552	chrome.exe
Token: SeCreatePagefilePrivilege	3552	chrome.exe
Token: SeShutdownPrivilege	3552	chrome.exe
Token: SeCreatePagefilePrivilege	3552	chrome.exe
Token: SeShutdownPrivilege	3552	chrome.exe
Token: SeCreatePagefilePrivilege	3552	chrome.exe
Token: SeShutdownPrivilege	3552	chrome.exe
Token: SeCreatePagefilePrivilege	3552	chrome.exe
Token: SeShutdownPrivilege	3552	chrome.exe
Token: SeCreatePagefilePrivilege	3552	chrome.exe
Token: SeShutdownPrivilege	3552	chrome.exe
Token: SeCreatePagefilePrivilege	3552	chrome.exe
Token: SeShutdownPrivilege	3552	chrome.exe
Token: SeCreatePagefilePrivilege	3552	chrome.exe
Token: SeShutdownPrivilege	3552	chrome.exe
Token: SeCreatePagefilePrivilege	3552	chrome.exe
Token: SeShutdownPrivilege	3552	chrome.exe
Token: SeCreatePagefilePrivilege	3552	chrome.exe
Token: SeShutdownPrivilege	3552	chrome.exe
Token: SeCreatePagefilePrivilege	3552	chrome.exe
Token: SeShutdownPrivilege	3552	chrome.exe
Token: SeCreatePagefilePrivilege	3552	chrome.exe
Token: SeShutdownPrivilege	3552	chrome.exe
Token: SeCreatePagefilePrivilege	3552	chrome.exe
Token: SeShutdownPrivilege	3552	chrome.exe
Token: SeCreatePagefilePrivilege	3552	chrome.exe
Token: SeShutdownPrivilege	3552	chrome.exe
Token: SeCreatePagefilePrivilege	3552	chrome.exe
Token: SeShutdownPrivilege	3552	chrome.exe
Token: SeCreatePagefilePrivilege	3552	chrome.exe
Token: SeShutdownPrivilege	3552	chrome.exe
Token: SeCreatePagefilePrivilege	3552	chrome.exe
Token: SeShutdownPrivilege	3552	chrome.exe
Token: SeCreatePagefilePrivilege	3552	chrome.exe
Token: SeShutdownPrivilege	3552	chrome.exe
Token: SeCreatePagefilePrivilege	3552	chrome.exe
Token: SeShutdownPrivilege	3552	chrome.exe
Token: SeCreatePagefilePrivilege	3552	chrome.exe
Token: SeShutdownPrivilege	3552	chrome.exe
Token: SeCreatePagefilePrivilege	3552	chrome.exe
Token: SeShutdownPrivilege	3552	chrome.exe
Token: SeCreatePagefilePrivilege	3552	chrome.exe
Token: SeShutdownPrivilege	3552	chrome.exe
Token: SeCreatePagefilePrivilege	3552	chrome.exe
Token: SeShutdownPrivilege	3552	chrome.exe
Token: SeCreatePagefilePrivilege	3552	chrome.exe
Token: SeShutdownPrivilege	3552	chrome.exe
Token: SeCreatePagefilePrivilege	3552	chrome.exe
Token: SeShutdownPrivilege	3552	chrome.exe
Token: SeCreatePagefilePrivilege	3552	chrome.exe
Token: SeShutdownPrivilege	3552	chrome.exe
Token: SeCreatePagefilePrivilege	3552	chrome.exe
Token: SeShutdownPrivilege	3552	chrome.exe
Token: SeCreatePagefilePrivilege	3552	chrome.exe
Token: SeShutdownPrivilege	3552	chrome.exe
Token: SeCreatePagefilePrivilege	3552	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3612 wrote to memory of 3484	3612	quantum.exe	74
PID 3612 wrote to memory of 3484	3612	quantum.exe	74
PID 3484 wrote to memory of 2888	3484	quantum.exe	76
PID 3484 wrote to memory of 2888	3484	quantum.exe	76
PID 3552 wrote to memory of 2348	3552	chrome.exe	80
PID 3552 wrote to memory of 2348	3552	chrome.exe	80
PID 3552 wrote to memory of 2948	3552	chrome.exe	82
PID 3552 wrote to memory of 2948	3552	chrome.exe	82
PID 3552 wrote to memory of 2948	3552	chrome.exe	82
PID 3552 wrote to memory of 2948	3552	chrome.exe	82
PID 3552 wrote to memory of 2948	3552	chrome.exe	82
PID 3552 wrote to memory of 2948	3552	chrome.exe	82
PID 3552 wrote to memory of 2948	3552	chrome.exe	82
PID 3552 wrote to memory of 2948	3552	chrome.exe	82
PID 3552 wrote to memory of 2948	3552	chrome.exe	82
PID 3552 wrote to memory of 2948	3552	chrome.exe	82
PID 3552 wrote to memory of 2948	3552	chrome.exe	82
PID 3552 wrote to memory of 2948	3552	chrome.exe	82
PID 3552 wrote to memory of 2948	3552	chrome.exe	82
PID 3552 wrote to memory of 2948	3552	chrome.exe	82
PID 3552 wrote to memory of 2948	3552	chrome.exe	82
PID 3552 wrote to memory of 2948	3552	chrome.exe	82
PID 3552 wrote to memory of 2948	3552	chrome.exe	82
PID 3552 wrote to memory of 2948	3552	chrome.exe	82
PID 3552 wrote to memory of 2948	3552	chrome.exe	82
PID 3552 wrote to memory of 2948	3552	chrome.exe	82
PID 3552 wrote to memory of 2948	3552	chrome.exe	82
PID 3552 wrote to memory of 2948	3552	chrome.exe	82
PID 3552 wrote to memory of 2948	3552	chrome.exe	82
PID 3552 wrote to memory of 2948	3552	chrome.exe	82
PID 3552 wrote to memory of 2948	3552	chrome.exe	82
PID 3552 wrote to memory of 2948	3552	chrome.exe	82
PID 3552 wrote to memory of 2948	3552	chrome.exe	82
PID 3552 wrote to memory of 2948	3552	chrome.exe	82
PID 3552 wrote to memory of 2948	3552	chrome.exe	82
PID 3552 wrote to memory of 2948	3552	chrome.exe	82
PID 3552 wrote to memory of 2948	3552	chrome.exe	82
PID 3552 wrote to memory of 2948	3552	chrome.exe	82
PID 3552 wrote to memory of 2948	3552	chrome.exe	82
PID 3552 wrote to memory of 2948	3552	chrome.exe	82
PID 3552 wrote to memory of 2948	3552	chrome.exe	82
PID 3552 wrote to memory of 2948	3552	chrome.exe	82
PID 3552 wrote to memory of 2948	3552	chrome.exe	82
PID 3552 wrote to memory of 2948	3552	chrome.exe	82
PID 3552 wrote to memory of 2904	3552	chrome.exe	83
PID 3552 wrote to memory of 2904	3552	chrome.exe	83
PID 3552 wrote to memory of 3640	3552	chrome.exe	84
PID 3552 wrote to memory of 3640	3552	chrome.exe	84
PID 3552 wrote to memory of 3640	3552	chrome.exe	84
PID 3552 wrote to memory of 3640	3552	chrome.exe	84
PID 3552 wrote to memory of 3640	3552	chrome.exe	84
PID 3552 wrote to memory of 3640	3552	chrome.exe	84
PID 3552 wrote to memory of 3640	3552	chrome.exe	84
PID 3552 wrote to memory of 3640	3552	chrome.exe	84
PID 3552 wrote to memory of 3640	3552	chrome.exe	84
PID 3552 wrote to memory of 3640	3552	chrome.exe	84
PID 3552 wrote to memory of 3640	3552	chrome.exe	84
PID 3552 wrote to memory of 3640	3552	chrome.exe	84
PID 3552 wrote to memory of 3640	3552	chrome.exe	84
PID 3552 wrote to memory of 3640	3552	chrome.exe	84
PID 3552 wrote to memory of 3640	3552	chrome.exe	84
PID 3552 wrote to memory of 3640	3552	chrome.exe	84
PID 3552 wrote to memory of 3640	3552	chrome.exe	84
PID 3552 wrote to memory of 3640	3552	chrome.exe	84

C:\Users\Admin\AppData\Local\Temp\quantum.exe
"C:\Users\Admin\AppData\Local\Temp\quantum.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3612
- C:\Users\Admin\AppData\Roaming\quantum.exe
  "C:\Users\Admin\AppData\Roaming\quantum.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Drops desktop.ini file(s)
  - Sets desktop wallpaper using registry
  - Modifies registry class
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3484
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\welp.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:2888

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --single-argument C:\Users\Admin\Desktop\BackupGrant.shtml
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff8b7d39758,0x7ff8b7d39768,0x7ff8b7d39778
  2⤵
  PID:2348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1548 --field-trial-handle=1720,i,9677004928805898833,9435236942668007698,131072 /prefetch:2
  2⤵
  PID:2948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1844 --field-trial-handle=1720,i,9677004928805898833,9435236942668007698,131072 /prefetch:8
  2⤵
  PID:2904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2140 --field-trial-handle=1720,i,9677004928805898833,9435236942668007698,131072 /prefetch:8
  2⤵
  PID:3640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2872 --field-trial-handle=1720,i,9677004928805898833,9435236942668007698,131072 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2904 --field-trial-handle=1720,i,9677004928805898833,9435236942668007698,131072 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4588 --field-trial-handle=1720,i,9677004928805898833,9435236942668007698,131072 /prefetch:1
  2⤵
  PID:2796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4660 --field-trial-handle=1720,i,9677004928805898833,9435236942668007698,131072 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5100 --field-trial-handle=1720,i,9677004928805898833,9435236942668007698,131072 /prefetch:8
  2⤵
  PID:1832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 --field-trial-handle=1720,i,9677004928805898833,9435236942668007698,131072 /prefetch:8
  2⤵
  PID:4852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5088 --field-trial-handle=1720,i,9677004928805898833,9435236942668007698,131072 /prefetch:8
  2⤵
  PID:3616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3756 --field-trial-handle=1720,i,9677004928805898833,9435236942668007698,131072 /prefetch:1
  2⤵
  PID:2172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5436 --field-trial-handle=1720,i,9677004928805898833,9435236942668007698,131072 /prefetch:8
  2⤵
  PID:236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5484 --field-trial-handle=1720,i,9677004928805898833,9435236942668007698,131072 /prefetch:8
  2⤵
  PID:4876

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001

Filesize
209KB

MD5
3e552d017d45f8fd93b94cfc86f842f2

SHA1
dbeebe83854328e2575ff67259e3fb6704b17a47

SHA256
27d9c4613df7a3c04da0b79c13217aa69992b441acb7e44bf2a7578ca87d97d6

SHA512
e616436f2f15615429c7c5c37de3990c3e86c5e1da7d75a0f524fc458b75d44a5be1a3648a628d63e1cf8aa062e08b538f2f2bc9c6a0b42157beb24f82c571d9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
371B

MD5
59673b63e86bb36943dda42e3045e967

SHA1
a8718aa7bd8da18273cae806f70fa0e6c000f87d

SHA256
02a6574dea73bd3ba1b9d8834f9c8ca45e16fc610d9765a614bb118b7a5f8100

SHA512
d4e248c23203a8f35dcc8fbc7b2a7999bd0db942738d9f1fe8503fb43c19f3d8f8ab118ad7d3c355cf6d536207f365a9bc9e79d3dc8528033ba4db5af13cdfa1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
371B

MD5
1b492140c3434e156da42de1fe0ef592

SHA1
f0d7aa7de8ab0acb0bbf91d18c553e75579eec80

SHA256
18533311cc968d46b23cb71d95805a46d60f4117f3096121aaa455550996d28a

SHA512
0cf0c5050dc40f9d3c3fffc5887e584c62ff1130ad92c62d4ae06c750293aa7c08c2f772782dd9d25472efbfb839cdc0388b6ebf8db2ae89f343f7de21544541

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
fd5ce9aba48280860d2931489824f948

SHA1
9b30ac8a2264bf84904ce42379677c7079c053e4

SHA256
c8661f5bf54f07e095fa81abc6cb98ccd96c79c4c1a4afede807c373f103e294

SHA512
a7ad65b158f7f38ccecb14867fb7094bd336e6e8eaafaf94eb0ab443752d1da00c294cff3e01191b27425de92c6514b74feb6b0f010d7381fcf05c51d46fd8bd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
0bafdae949d725e6c1213e597ce06bc3

SHA1
97dd2ea4ab91416454b8c0db2e1dfffa5bab4468

SHA256
4f1283e648f2ffb2fd279ca64e7eaeb47a5d6232df2838558a496f9d3c088c00

SHA512
2f3f290c177490eb68c4fbdccf2fa48f6633a720a6fb9b60e97f7f773db55dce09a30ac5250aee204f36a2b2ab9d66a015f25b8698d6203b6c0d67c581c74194

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
c67c3ad32280b4470dd344afa7cd380d

SHA1
d92f62c2b1496c583dbb67cea45207d635ddb395

SHA256
5e108db0fa441fa67deb59ce47492d520e8e40a670b74154e7351bff757c1a11

SHA512
00a9ef4d629c2de0055fb12f5375025fbb2562d458019bb439ec8d58ef143acaf961572e889c9a6bfed9bd11f53c38425d0d275ddc7345f45e5515fe865d14a3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
295KB

MD5
69fba6617376a1f9267aba6539884c36

SHA1
4db85ff0326934776420508cb1712ef1320f815b

SHA256
dae5bf14100a15e4e10e09acb26ed5a2d43d56af019e936c1e5ae8117df68935

SHA512
9e3e590db162cb54c43e40d0d3aa7024722de3e35d6402e2eb8aa92e10118bdc0f0a061856900e64088eac1ae7a898e7c5a74f894a0af86e05870342beb93159

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
137KB

MD5
183b089114b06ccdcc01d980c3c3b5c4

SHA1
577f3e4dac0f8d26ede39cdb2934a98cfeab0422

SHA256
748994573aab534fa25bc46ba87e627a1a9d8113e398f8b8312095fe1cca97a6

SHA512
f7b8d4be68bdd359615efcdc6c3f5f7ddf4ab4c907ae439988071fefcf930e8b85baaf6dccce5bfda5f9d63929f6548bdb716b2ee314187006d206daf70fd9d6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\quantum.exe.log

Filesize
226B

MD5
d78293ab15ad25b5d6e8740fe5fd3872

SHA1
51b70837f90f2bff910daee706e6be8d62a3550e

SHA256
4d64746f8d24ec321b1a6c3a743946b66d8317cbc6bac6fed675a4bf6fa181f3

SHA512
1127435ef462f52677e1ef4d3b8cfdf9f5d95c832b4c9f41526b7448d315f25d96d3d5454108569b76d66d78d07ea5ba4a1ba8baee108e8c1b452ba19cc04925

Download Submit
C:\Users\Admin\AppData\Roaming\quantum.exe

Filesize
417KB

MD5
3dc9bad7720a01598aa14e55baca7413

SHA1
99668a82a34ec17340fccecbc2ef0985b84704a0

SHA256
a54a38a9aab0bde31b2065d8b88a8e6569cc66c3f6137379b6b5a62361c319f0

SHA512
567581747132d56595c719e4d454bf6e73ba941581701b28287559f899ea5813a0abb7ff2df25cb3d7c99d3203c8a8ab361ea37b3b8e8392748fb855ee4cbaba

Download Submit
C:\Users\Admin\Documents\welp.txt

Filesize
427B

MD5
025e685a33afef1bb7772b41f46d5700

SHA1
39c246daf9003a7a38cfb2edb5f66b2766c65c39

SHA256
fc4d2fe0b5c84f7ffa475e1cf9da6185e8bb162a03899bcfe015df64778cc380

SHA512
1d3d29da8bb4390ebe563e046d382ced7e1d4abb7870f4a7bee64683d3ae236375492b7ad7fb3e64c800859cf80da43406243f2e5bd36bc262e7bff1e5168b29

Download Submit
memory/3484-10-0x00007FF8D8220000-0x00007FF8D83FB000-memory.dmp

Filesize
1.9MB

Download
memory/3484-434-0x00007FF8D8220000-0x00007FF8D83FB000-memory.dmp

Filesize
1.9MB

Download
memory/3484-13-0x00007FF8D8220000-0x00007FF8D83FB000-memory.dmp

Filesize
1.9MB

Download
memory/3612-0-0x00000000002B0000-0x000000000031E000-memory.dmp

Filesize
440KB

Download
memory/3612-9-0x00007FF8D8220000-0x00007FF8D83FB000-memory.dmp

Filesize
1.9MB

Download
memory/3612-1-0x00007FF8D8220000-0x00007FF8D83FB000-memory.dmp

Filesize
1.9MB

Download