Overview

overview

10

Static

static

bdd9dbc6d7...d2.exe

windows7_x64

10

bdd9dbc6d7...d2.exe

windows10_x64

10

Analysis

  • max time kernel
    151s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    08-10-2020 15:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe

  • Size

    1.1MB

  • MD5

    837d96ee65e177210ad77e0b7a3e2ee1

  • SHA1

    9f96a1acbcf006bf9cc61119dc76ca47adf63066

  • SHA256

    bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2

  • SHA512

    3369cccd102ef223a3d3bcb8b7cd11bc409cdb63bbbce33c8bbd05e6b52bc32b2a9c3ff29202e8107da6eab04e61fab0a7645631821d37bc3120dfe86bc26a62

Score
10/10
ransomwareevasionupxpersistencematrixdiscovery

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://myexternalip.com/raw

Signatures

  • Matrix Ransomware 495 IoCs

    Targeted ransomware with information collection and encryption functionality.

    ransomwarematrix
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Blacklisted process makes network request 1 IoCs
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Modifies extensions of user files 2 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Sets service image path in registry 2 TTPs
    persistence
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Loads dropped DLL 4 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 1 IoCs
  • Modifies service 2 TTPs 11 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 7637 IoCs