Analysis

  • max time kernel
    185s
  • max time network
    198s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220112
  • submitted
    01-02-2022 08:39

General

  • Target

    FoxRansomware/941af29a59f8d5960af161b9116bbc7d574a9af6f69a47cf0d3daeb31cba6eb1.exe

  • Size

    1.2MB

  • MD5

    c82d64850d35cc6a536c11adbd261cf6

  • SHA1

    9f4d070a1b4668d110b57c167c4527fa2752c1fe

  • SHA256

    941af29a59f8d5960af161b9116bbc7d574a9af6f69a47cf0d3daeb31cba6eb1

  • SHA512

    777a06d73e70a881d5b3872236ba8b53aa4d42f94ad247c109980847ccd6d0c531d30afef10315d7b5fe70c7fe4496f932aaac41f6aec76e98474c44bb781002

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://myexternalip.com/raw

Signatures

  • Matrix Ransomware 3 IoCs

    Targeted ransomware with information collection and encryption functionality.

  • suricata: ET MALWARE MSIL/Matrix Ransomware CnC Activity

    suricata: ET MALWARE MSIL/Matrix Ransomware CnC Activity

  • Executes dropped EXE 1 IoCs
  • Sets service image path in registry 2 TTPs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies data under HKEY_USERS 41 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\941af29a59f8d5960af161b9116bbc7d574a9af6f69a47cf0d3daeb31cba6eb1.exe
    "C:\Users\Admin\AppData\Local\Temp\FoxRansomware\941af29a59f8d5960af161b9116bbc7d574a9af6f69a47cf0d3daeb31cba6eb1.exe"
    1⤵
    • Enumerates connected drives
    • Suspicious use of WriteProcessMemory
    PID:3644
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /C copy /V /Y "C:\Users\Admin\AppData\Local\Temp\FoxRansomware\941af29a59f8d5960af161b9116bbc7d574a9af6f69a47cf0d3daeb31cba6eb1.exe" "C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NWirsMaE.exe"
      2⤵
        PID:4080
      • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NWirsMaE.exe
        "C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NWirsMaE.exe" -n
        2⤵
        • Executes dropped EXE
        PID:3760
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C powershell "$webClient = New-Object -TypeName System.Net.WebClient; $webClient.DownloadString('http://myexternalip.com/raw')">"C:\Users\Admin\AppData\Local\Temp\FoxRansomware\xQbU4gZ5.txt"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2560
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell "$webClient = New-Object -TypeName System.Net.WebClient; $webClient.DownloadString('http://myexternalip.com/raw')"
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2852
    • C:\Windows\System32\WaaSMedicAgent.exe
      C:\Windows\System32\WaaSMedicAgent.exe 7c76e82263c1398765609c363be66a9a r0ohSL2Ws0SN2Pjcvoljkw.0.1.0.0.0
      1⤵
      • Modifies data under HKEY_USERS
      PID:372

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2852-134-0x0000000004C80000-0x0000000004CB6000-memory.dmp

      Filesize

      216KB

    • memory/2852-135-0x0000000004C20000-0x0000000004C21000-memory.dmp

      Filesize

      4KB

    • memory/2852-136-0x0000000004C22000-0x0000000004C23000-memory.dmp

      Filesize

      4KB

    • memory/2852-137-0x00000000077B0000-0x0000000007DD8000-memory.dmp

      Filesize

      6.2MB

    • memory/2852-138-0x00000000075C0000-0x00000000075E2000-memory.dmp

      Filesize

      136KB

    • memory/2852-139-0x0000000007F10000-0x0000000007F76000-memory.dmp

      Filesize

      408KB

    • memory/2852-140-0x0000000007F80000-0x0000000007FE6000-memory.dmp

      Filesize

      408KB

    • memory/2852-141-0x0000000008580000-0x000000000859E000-memory.dmp

      Filesize

      120KB

    • memory/2852-142-0x0000000004C25000-0x0000000004C27000-memory.dmp

      Filesize

      8KB