Analysis
-
max time kernel
128s -
max time network
121s -
platform
windows7_x64 -
resource
win7v200722 -
submitted
08-10-2020 15:06
Static task
static1
Behavioral task
behavioral1
Sample
ef03ec9954d9643d8d65afc0ace38dae463f1a626584455245f1f733b4991f4a.exe
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
ef03ec9954d9643d8d65afc0ace38dae463f1a626584455245f1f733b4991f4a.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
-
Target
ef03ec9954d9643d8d65afc0ace38dae463f1a626584455245f1f733b4991f4a.exe
-
Size
1.2MB
-
MD5
0e527383dc50b48d63183e1176c4d79e
-
SHA1
c1437130dd774db14dd16c45771e7e1a484d5ee5
-
SHA256
ef03ec9954d9643d8d65afc0ace38dae463f1a626584455245f1f733b4991f4a
-
SHA512
58a3edde62268c34b2577530b520559c8c8f4f085210703c59c75442b9162e396ea38973302afc3e54d6d546ccd7b246650b4e9aef137d7b7787ab3354aec457
Malware Config
Signatures
-
Matrix Ransomware 64 IoCs
Targeted ransomware with information collection and encryption functionality.
Processes:
ef03ec9954d9643d8d65afc0ace38dae463f1a626584455245f1f733b4991f4a.exedescription flow ioc Process File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\!BWNG_INFO!.rtf ef03ec9954d9643d8d65afc0ace38dae463f1a626584455245f1f733b4991f4a.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\!BWNG_INFO!.rtf ef03ec9954d9643d8d65afc0ace38dae463f1a626584455245f1f733b4991f4a.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\!BWNG_INFO!.rtf ef03ec9954d9643d8d65afc0ace38dae463f1a626584455245f1f733b4991f4a.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\!BWNG_INFO!.rtf ef03ec9954d9643d8d65afc0ace38dae463f1a626584455245f1f733b4991f4a.exe File created C:\Users\Public\Desktop\!BWNG_INFO!.rtf ef03ec9954d9643d8d65afc0ace38dae463f1a626584455245f1f733b4991f4a.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\!BWNG_INFO!.rtf ef03ec9954d9643d8d65afc0ace38dae463f1a626584455245f1f733b4991f4a.exe File created C:\Program Files\Java\jre7\lib\management\!BWNG_INFO!.rtf ef03ec9954d9643d8d65afc0ace38dae463f1a626584455245f1f733b4991f4a.exe File created C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\!BWNG_INFO!.rtf ef03ec9954d9643d8d65afc0ace38dae463f1a626584455245f1f733b4991f4a.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\!BWNG_INFO!.rtf ef03ec9954d9643d8d65afc0ace38dae463f1a626584455245f1f733b4991f4a.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Backup\new\!BWNG_INFO!.rtf ef03ec9954d9643d8d65afc0ace38dae463f1a626584455245f1f733b4991f4a.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\!BWNG_INFO!.rtf ef03ec9954d9643d8d65afc0ace38dae463f1a626584455245f1f733b4991f4a.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\!BWNG_INFO!.rtf ef03ec9954d9643d8d65afc0ace38dae463f1a626584455245f1f733b4991f4a.exe File created C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\!BWNG_INFO!.rtf ef03ec9954d9643d8d65afc0ace38dae463f1a626584455245f1f733b4991f4a.exe File created C:\Program Files\VideoLAN\VLC\lua\intf\!BWNG_INFO!.rtf ef03ec9954d9643d8d65afc0ace38dae463f1a626584455245f1f733b4991f4a.exe File created C:\Users\Public\Music\Sample Music\!BWNG_INFO!.rtf ef03ec9954d9643d8d65afc0ace38dae463f1a626584455245f1f733b4991f4a.exe File created C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\f5hc8vjc.default-release\cache2\entries\!BWNG_INFO!.rtf ef03ec9954d9643d8d65afc0ace38dae463f1a626584455245f1f733b4991f4a.exe File created C:\Users\Admin\Favorites\Microsoft Websites\!BWNG_INFO!.rtf ef03ec9954d9643d8d65afc0ace38dae463f1a626584455245f1f733b4991f4a.exe File created C:\Users\Public\Pictures\!BWNG_INFO!.rtf ef03ec9954d9643d8d65afc0ace38dae463f1a626584455245f1f733b4991f4a.exe HTTP URL 2 http://ghb.timerz.org/addrecord.php?apikey=BWNG_api_key&compuser=UCQFZDUI|Admin&sid=vTDARe7q4laQTr0a&phase=START