Overview

overview

10

Static

static

91d07adbf3...53.exe

windows7_x64

10

91d07adbf3...53.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    01-02-2022 08:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe

  • Size

    1.2MB

  • MD5

    1fa1b6d4b3ed867c1d4baffc77417611

  • SHA1

    afb5e385f9cc8910d7a970b6c32b8d79295579da

  • SHA256

    91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53

  • SHA512

    0600b92914a7489a6428b8e4217e5f24e1d149fc5807d86cc4de91b43be2470a1ddf77093c8732d4371a87fd163cc556e09d11a2c6655382a35a5f5741ae05a5

Score
10/10
matrixdiscoverypersistenceransomwarespywarestealerupx

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://myexternalip.com/raw

Signatures

  • Matrix Ransomware 64 IoCs

    Targeted ransomware with information collection and encryption functionality.

    ransomwarematrix
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Blocklisted process makes network request 1 IoCs
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Sets service image path in registry 2 TTPs
    persistence
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Loads dropped DLL 4 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 11 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
    "C:\Users\Admin\AppData\Local\Temp\91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe"
    1⤵
    • Matrix Ransomware
    • Loads dropped DLL
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Drops file in Program Files directory
    • NTFS ADS
    • Suspicious use of WriteProcessMemory
    PID:948
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /C copy /V /Y "C:\Users\Admin\AppData\Local\Temp\91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe" "C:\Users\Admin\AppData\Local\Temp\NWT8mgGv.exe"
      2⤵
        PID:1216
      • C:\Users\Admin\AppData\Local\Temp\NWT8mgGv.exe
        "C:\Users\Admin\AppData\Local\Temp\NWT8mgGv.exe" -n
        2⤵
        • Executes dropped EXE
        PID:1560
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C powershell "$webClient = New-Object -TypeName System.Net.WebClient; $webClient.DownloadString('http://myexternalip.com/raw')">"C:\Users\Admin\AppData\Local\Temp\dyIamQJ3.txt"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:856
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell "$webClient = New-Object -TypeName System.Net.WebClient; $webClient.DownloadString('http://myexternalip.com/raw')"
          3⤵
          • Blocklisted process makes network request
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:680
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\HiIVS5gu.bmp" /f & reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f & reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:572
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\HiIVS5gu.bmp" /f
          3⤵
          • Sets desktop wallpaper using registry
          PID:2040
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f
          3⤵
            PID:1680
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f
            3⤵
              PID:1620
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /C wscript //B //Nologo "C:\Users\Admin\AppData\Roaming\Gh5PhlUb.vbs"
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:668
            • C:\Windows\SysWOW64\wscript.exe
              wscript //B //Nologo "C:\Users\Admin\AppData\Roaming\Gh5PhlUb.vbs"
              3⤵
                PID:1800
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C schtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\stqSto8E.bat" /sc minute /mo 5 /RL HIGHEST /F
                  4⤵
                    PID:1388
                    • C:\Windows\SysWOW64\schtasks.exe
                      schtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\stqSto8E.bat" /sc minute /mo 5 /RL HIGHEST /F
                      5⤵
                      • Creates scheduled task(s)
                      PID:1584
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /C schtasks /Run /I /tn DSHCA
                    4⤵
                      PID:1600
                      • C:\Windows\SysWOW64\schtasks.exe
                        schtasks /Run /I /tn DSHCA
                        5⤵
                          PID:1512
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c ""C:\Users\Admin\AppData\Local\Temp\SEdIePiD.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf""
                    2⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1624
                    • C:\Windows\SysWOW64\attrib.exe
                      attrib -R -A -S "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf"
                      3⤵
                      • Views/modifies file attributes
                      PID:1360
                    • C:\Windows\SysWOW64\cacls.exe
                      cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf" /E /G Admin:F /C
                      3⤵
                        PID:844
                      • C:\Windows\SysWOW64\takeown.exe
                        takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf"
                        3⤵
                        • Modifies file permissions
                        PID:1740
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c HxaI1Av6.exe -accepteula "SignHere.pdf" -nobanner
                        3⤵
                        • Loads dropped DLL
                        • Suspicious use of WriteProcessMemory
                        PID:516
                        • C:\Users\Admin\AppData\Local\Temp\HxaI1Av6.exe
                          HxaI1Av6.exe -accepteula "SignHere.pdf" -nobanner
                          4⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          PID:1560
                          • C:\Users\Admin\AppData\Local\Temp\HxaI1Av664.exe
                            HxaI1Av6.exe -accepteula "SignHere.pdf" -nobanner
                            5⤵
                            • Drops file in Drivers directory
                            • Executes dropped EXE
                            • Enumerates connected drives
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious behavior: LoadsDriver
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1928
                  • C:\Windows\system32\taskeng.exe
                    taskeng.exe {0E5202AE-8861-4FC1-BA19-D9B8B63C1702} S-1-5-21-2329389628-4064185017-3901522362-1000:QSKGHMYQ\Admin:Interactive:[1]
                    1⤵
                      PID:1276
                      • C:\Windows\SYSTEM32\cmd.exe
                        C:\Windows\SYSTEM32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\stqSto8E.bat"
                        2⤵
                          PID:540
                          • C:\Windows\system32\vssadmin.exe
                            vssadmin Delete Shadows /All /Quiet
                            3⤵
                            • Interacts with shadow copies
                            PID:1668
                      • C:\Windows\system32\vssvc.exe
                        C:\Windows\system32\vssvc.exe
                        1⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:572

                      Network

                      MITRE ATT&CK Enterprise v6

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\$Recycle.Bin\S-1-5-21-2329389628-4064185017-3901522362-1000\desktop.ini
                        MD5

                        1714ad017e2be71759926fcdeb4349dd

                        SHA1

                        2386a5003a44b5120d67cf0244ee399f8543551c

                        SHA256

                        13c0a746fbe5d304ca19e7c89a553e6ad785e8b4dce5c3e4db4dfc19dc2a8809

                        SHA512

                        ad3a62afaacb21467d04109aa92d6e74a6f6f929cfbdf5c89e6a1bebbb095de0155758a4285cd410d307dd762a2d2756310df7332df978cc6f582f0ca23febed

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\HxaI1Av6.exe
                        MD5

                        2f5b509929165fc13ceab9393c3b911d

                        SHA1

                        b016316132a6a277c5d8a4d7f3d6e2c769984052

                        SHA256

                        0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

                        SHA512

                        c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\HxaI1Av6.exe
                        MD5

                        2f5b509929165fc13ceab9393c3b911d

                        SHA1

                        b016316132a6a277c5d8a4d7f3d6e2c769984052

                        SHA256

                        0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

                        SHA512

                        c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\HxaI1Av664.exe
                        MD5

                        3026bc2448763d5a9862d864b97288ff

                        SHA1

                        7d93a18713ece2e7b93e453739ffd7ad0c646e9e

                        SHA256

                        7adb21c00d3cc9a1ef081484b58b68f218d7c84a720e16e113943b9f4694d8ec

                        SHA512

                        d4afd534ed1818f8dc157d754b078e3d2fe4fb6a24ed62d4b30b3a93ebc671d1707cedb3c23473bf3b5aa568901a1e5183da49e41152e352ecfa41bf220ebde6

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\NWT8mgGv.exe
                        MD5

                        1fa1b6d4b3ed867c1d4baffc77417611

                        SHA1

                        afb5e385f9cc8910d7a970b6c32b8d79295579da

                        SHA256

                        91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53

                        SHA512

                        0600b92914a7489a6428b8e4217e5f24e1d149fc5807d86cc4de91b43be2470a1ddf77093c8732d4371a87fd163cc556e09d11a2c6655382a35a5f5741ae05a5

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\NWT8mgGv.exe
                        MD5

                        1fa1b6d4b3ed867c1d4baffc77417611

                        SHA1

                        afb5e385f9cc8910d7a970b6c32b8d79295579da

                        SHA256

                        91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53

                        SHA512

                        0600b92914a7489a6428b8e4217e5f24e1d149fc5807d86cc4de91b43be2470a1ddf77093c8732d4371a87fd163cc556e09d11a2c6655382a35a5f5741ae05a5

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\SEdIePiD.bat
                        MD5

                        f061a5903d3561800ee2d6b0668656e1

                        SHA1

                        16fd519c45a8373a60784d74104e2d546d4dda07

                        SHA256

                        8299949673b53b63dc602ea9e471bb775ecc3341831e74cd479ed1345b8dabc5

                        SHA512

                        fcbd3d778ed2a35a464e4a0db6cc5c64ebc6b479df1fb356265288dda09fca9dc5db987d66b0c13119dd2bae324ae2ae6e7cc23a93ef4748e5d57611b4e94616

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\dyIamQJ3.txt
                        MD5

                        b978a6077d3a5c82c5795b424a05db0d

                        SHA1

                        e73bf32f4857a7cf4a231d4ba0d82175cfce4db1

                        SHA256

                        f582d4144b7fd0a3618dce325bc361ebbc012c279b229785e1ac39c5dde4eb2c

                        SHA512

                        5eb360c2df9ea13f14645710329a884732daee904328a469c67a8bb9a0139e169e25089e137b42f9f7af022d5dbb7d57af78247d1c79db344be4256b5a4e07d2

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Gh5PhlUb.vbs
                        MD5

                        93f9eafcf39f90f7ddc1499d102ccf36

                        SHA1

                        e13df49512e808fee5f6073e77528e256f29ffff

                        SHA256

                        26fa47b3c8d6325e7da5aca86e212e37c079f3b839650afbda579b811cf0681c

                        SHA512

                        f45cc3b6b124b3c7031bd5d78fb41579faf0baf9c819aedbd82effc54bd0aba3e4edb8ad9d40898a3fa8f88c9f21359ca15fa234f079444db3cd6ebe8276369b

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\stqSto8E.bat
                        MD5

                        78688dad6339a89dff0017e0a7c712ad

                        SHA1

                        f8a2c814fdbc4a34e950c5716c74ed79220b4b49

                        SHA256

                        9de019147b8f7eca6c8fe73805ceb3d6bd8c8890ea646b0c55a50c0b8193451a

                        SHA512

                        438fd1a7592e3d04435a32f9f82c62ac512791f83ecc1c63f2db299c2be288a9ee3df2bd35c7c7400f3b2da63e645cc7867f3d90c091cfda874fc74fd134e779

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\HxaI1Av6.exe
                        MD5

                        2f5b509929165fc13ceab9393c3b911d

                        SHA1

                        b016316132a6a277c5d8a4d7f3d6e2c769984052

                        SHA256

                        0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

                        SHA512

                        c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\HxaI1Av664.exe
                        MD5

                        3026bc2448763d5a9862d864b97288ff

                        SHA1

                        7d93a18713ece2e7b93e453739ffd7ad0c646e9e

                        SHA256

                        7adb21c00d3cc9a1ef081484b58b68f218d7c84a720e16e113943b9f4694d8ec

                        SHA512

                        d4afd534ed1818f8dc157d754b078e3d2fe4fb6a24ed62d4b30b3a93ebc671d1707cedb3c23473bf3b5aa568901a1e5183da49e41152e352ecfa41bf220ebde6

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\NWT8mgGv.exe
                        MD5

                        1fa1b6d4b3ed867c1d4baffc77417611

                        SHA1

                        afb5e385f9cc8910d7a970b6c32b8d79295579da

                        SHA256

                        91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53

                        SHA512

                        0600b92914a7489a6428b8e4217e5f24e1d149fc5807d86cc4de91b43be2470a1ddf77093c8732d4371a87fd163cc556e09d11a2c6655382a35a5f5741ae05a5

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\NWT8mgGv.exe
                        MD5

                        1fa1b6d4b3ed867c1d4baffc77417611

                        SHA1

                        afb5e385f9cc8910d7a970b6c32b8d79295579da

                        SHA256

                        91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53

                        SHA512

                        0600b92914a7489a6428b8e4217e5f24e1d149fc5807d86cc4de91b43be2470a1ddf77093c8732d4371a87fd163cc556e09d11a2c6655382a35a5f5741ae05a5

                        Download Submit

                      • memory/680-64-0x00000000021F2000-0x00000000021F4000-memory.dmp

                        Filesize

                        8KB

                        Download

                      • memory/680-63-0x00000000021F1000-0x00000000021F2000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/680-62-0x00000000021F0000-0x00000000021F1000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/948-55-0x0000000075F91000-0x0000000075F93000-memory.dmp

                        Filesize

                        8KB

                        Download