matrix | ef03ec9954d9643d8d65afc0ace38dae463f1a626584455245f1f733b4991f4a | Triage

Analysis

max time kernel
128s
max time network
121s
platform
windows7_x64
resource
win7v200722
submitted
08-10-2020 15:06

Sharing

Report Analysis Logs

General

Target

ef03ec9954d9643d8d65afc0ace38dae463f1a626584455245f1f733b4991f4a.exe
Size

1.2MB
MD5

0e527383dc50b48d63183e1176c4d79e
SHA1

c1437130dd774db14dd16c45771e7e1a484d5ee5
SHA256

ef03ec9954d9643d8d65afc0ace38dae463f1a626584455245f1f733b4991f4a
SHA512

58a3edde62268c34b2577530b520559c8c8f4f085210703c59c75442b9162e396ea38973302afc3e54d6d546ccd7b246650b4e9aef137d7b7787ab3354aec457

Score

10^/10

matrix discovery evasion persistence ransomware spyware upx

Malware Config

Signatures

Matrix Ransomware 64 IoCs

Targeted ransomware with information collection and encryption functionality.

ransomware matrix

Processes:

ef03ec9954d9643d8d65afc0ace38dae463f1a626584455245f1f733b4991f4a.exe

description	flow	ioc	Process
File created		C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\!BWNG_INFO!.rtf	ef03ec9954d9643d8d65afc0ace38dae463f1a626584455245f1f733b4991f4a.exe
File created		C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\!BWNG_INFO!.rtf	ef03ec9954d9643d8d65afc0ace38dae463f1a626584455245f1f733b4991f4a.exe
File created		C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\!BWNG_INFO!.rtf	ef03ec9954d9643d8d65afc0ace38dae463f1a626584455245f1f733b4991f4a.exe
File created		C:\Users\Admin\AppData\Local\Google\Chrome\User Data\!BWNG_INFO!.rtf	ef03ec9954d9643d8d65afc0ace38dae463f1a626584455245f1f733b4991f4a.exe
File created		C:\Users\Public\Desktop\!BWNG_INFO!.rtf	ef03ec9954d9643d8d65afc0ace38dae463f1a626584455245f1f733b4991f4a.exe
File created		C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\!BWNG_INFO!.rtf	ef03ec9954d9643d8d65afc0ace38dae463f1a626584455245f1f733b4991f4a.exe
File created		C:\Program Files\Java\jre7\lib\management\!BWNG_INFO!.rtf	ef03ec9954d9643d8d65afc0ace38dae463f1a626584455245f1f733b4991f4a.exe
File created		C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\!BWNG_INFO!.rtf	ef03ec9954d9643d8d65afc0ace38dae463f1a626584455245f1f733b4991f4a.exe
File created		C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\!BWNG_INFO!.rtf	ef03ec9954d9643d8d65afc0ace38dae463f1a626584455245f1f733b4991f4a.exe
File created		C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Backup\new\!BWNG_INFO!.rtf	ef03ec9954d9643d8d65afc0ace38dae463f1a626584455245f1f733b4991f4a.exe
File created		C:\Program Files\Java\jdk1.7.0_80\jre\lib\!BWNG_INFO!.rtf	ef03ec9954d9643d8d65afc0ace38dae463f1a626584455245f1f733b4991f4a.exe
File created		C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\!BWNG_INFO!.rtf	ef03ec9954d9643d8d65afc0ace38dae463f1a626584455245f1f733b4991f4a.exe
File created		C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\!BWNG_INFO!.rtf	ef03ec9954d9643d8d65afc0ace38dae463f1a626584455245f1f733b4991f4a.exe
File created		C:\Program Files\VideoLAN\VLC\lua\intf\!BWNG_INFO!.rtf	ef03ec9954d9643d8d65afc0ace38dae463f1a626584455245f1f733b4991f4a.exe
File created		C:\Users\Public\Music\Sample Music\!BWNG_INFO!.rtf	ef03ec9954d9643d8d65afc0ace38dae463f1a626584455245f1f733b4991f4a.exe
File created		C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\f5hc8vjc.default-release\cache2\entries\!BWNG_INFO!.rtf	ef03ec9954d9643d8d65afc0ace38dae463f1a626584455245f1f733b4991f4a.exe
File created		C:\Users\Admin\Favorites\Microsoft Websites\!BWNG_INFO!.rtf	ef03ec9954d9643d8d65afc0ace38dae463f1a626584455245f1f733b4991f4a.exe
File created		C:\Users\Public\Pictures\!BWNG_INFO!.rtf	ef03ec9954d9643d8d65afc0ace38dae463f1a626584455245f1f733b4991f4a.exe
HTTP URL	2	http://ghb.timerz.org/addrecord.php?apikey=BWNG_api_key&compuser=UCQFZDUI\|Admin&sid=vTDARe7q4laQTr0a&phase=START