Quantum Ransomware

We have observed WMI in a large number of cases for various tasks. WMI is very flexible and has been used for enumeration, lateral movement, and persistence.

LNK files are based on the Shell Link Binary file format, also known as Windows shortcuts . But what seems a relatively simple ability to execute other binaries on the system can inflict great harm when abused by threat actors.

It allows other criminals to create malicious files with extra capabilities such as UAC bypass, delayed execution, post-execution hiding, and a variety of double extensions.

Emotet used this technique in a phishing email they sent to the victims, including a password-protected zip file that contained an LNK file disguised as a Word document

The two most common ways threat actors execute exports from these DLLs is via rundll32 and regsvr32.

From there, the threat actors began connecting to other hosts via RDP, including the a backup server.

In the cases we observed ransomware deployment a combination of SMB was used with either WMI or PsExec. SMB is generally used for the propagation of the ransomware payload to target hosts, while WMI or PsExec are used to execute the ransomware payload.

We’ve extensively tracked IcedID C2 infrastructure... our focus is on the Stage 1 T1 C2s... C2 communication with T2 infrastructure occurs for an overall average of six days before ending.

These capabilities enable IcedID to download and deploy additional malware like Cobalt Strike, with recent infections leading to Quantum ransomware.

The threat actors final actions included data exfiltration using Rclone and domain wide deployment of Quantum Ransomware.