Malware

SaveTheQueen

SaveTheQueen is a ransomware family observed in public malware submissions, including samples seen on AnyRun in December 2019. The analyzed sample was identified as a .NET application and appears to wrap a PowerShell script using PS2EXE; embedded Base64-encoded and gzip-compressed content reportedly reveals an additional portable executable. The malware targets the C: drive and, after encryption, drops a log file named SaveTheQueen.LOG in C:\ProgramData. A notable characteristic is that it does not leave a ransom note or provide victim contact information. Reported host artifacts include registry modifications under HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session00xx, including values such as Owner, SessionHash, RegFiles0000, and RegFilesHash; the RegFiles0000 value reportedly contains files to be encrypted or stolen. The behavior was compared to LockerGoga due to similar use of Restart Manager-related registry keys, although SaveTheQueen differs in implementation language and logging behavior. One analyzed sample was associated with SHA-256 3c9f777654a45eb6219f12c2ad10082043814389a4504c27e5aec752a8ee4ded, and a new variant was reportedly noted by MalwareHunterTeam on 2019-12-19.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

6 distinct techniques documented for this family, organized by ATT&CK tactic.

Persistence

1 technique

T1112Modify RegistryEvidence1

T1112 --> Modify Registry --> Defense Evasion

Privilege Escalation

1 technique

T1055Process InjectionEvidence1

T1055 --> Process Injection --> Privilege Escalation ... T1055 --> Process Injection --> Defense Evasion

Stealth

1 technique

T1055Process InjectionEvidence1

T1055 --> Process Injection --> Privilege Escalation ... T1055 --> Process Injection --> Defense Evasion

Defense Impairment

1 technique

T1112Modify RegistryEvidence1

T1112 --> Modify Registry --> Defense Evasion

Discovery

4 techniques

T1012Query RegistryEvidence1

T1012 --> Query Registry --> Discovery

T1046Network Service DiscoveryEvidence1

T1046 --> Network Service Scanning --> Discovery

T1057Process DiscoveryEvidence1

T1057 --> Process Discovery --> Discovery

T1120Peripheral Device DiscoveryEvidence1

T1120 --> Peripheral Device Discovery --> Discovery

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

1 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app7 years ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

dissecting malware blogNews

Dec 5, 2019

A B C, easy as один, два, три - Lockbit (ABCD) Ransomware

Referenced as another ransomware sample or family previously observed using IPLogger-related infrastructure.

dissecting malware blogNews

Dec 2, 2019

God save the Queen [...] 'cause Ransom is money - SaveTheQueen Encryptor

A .NET ransomware sample wrapped from PowerShell via PS2EXE that encrypts files, drops a log file at C:\ProgramData\SaveTheQueen.LOG, and modifies RestartManager registry keys related to files targeted for encryption.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping6

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

SaveTheQueen