Analysis
-
max time kernel
4294181s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20220223-en -
submitted
05-03-2022 23:54
Static task
static1
Behavioral task
behavioral1
Sample
5c322c7f3b22aa8c598a875dd9b28917fd1c5b8d20d12ca59cb4074af269269b.exe
Resource
win7-20220223-en
Behavioral task
behavioral2
Sample
5c322c7f3b22aa8c598a875dd9b28917fd1c5b8d20d12ca59cb4074af269269b.exe
Resource
win10v2004-en-20220112
General
-
Target
5c322c7f3b22aa8c598a875dd9b28917fd1c5b8d20d12ca59cb4074af269269b.exe
-
Size
1.5MB
-
MD5
bafc669bbbeecb46825d0970f4e134b5
-
SHA1
39d642ca982ddd4c36eb0561df5da2e03645581d
-
SHA256
5c322c7f3b22aa8c598a875dd9b28917fd1c5b8d20d12ca59cb4074af269269b
-
SHA512
506d11288f5fb3e75663e3314add9253a4e237f8725f34d4c1fdec2bd467274fb5d16cac1ed241fb929e3786eb69d5507317443fcf1fad01cf7ed719e5437033
Malware Config
Extracted
http://myexternalip.com/raw
Signatures
-
Matrix Ransomware 64 IoCs
Targeted ransomware with information collection and encryption functionality.
Processes:
5c322c7f3b22aa8c598a875dd9b28917fd1c5b8d20d12ca59cb4074af269269b.exedescription flow ioc Process File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\#FOX_README#.rtf 5c322c7f3b22aa8c598a875dd9b28917fd1c5b8d20d12ca59cb4074af269269b.exe File created C:\Program Files\Microsoft Games\Minesweeper\en-US\#FOX_README#.rtf 5c322c7f3b22aa8c598a875dd9b28917fd1c5b8d20d12ca59cb4074af269269b.exe File created C:\Program Files\Microsoft Games\More Games\de-DE\#FOX_README#.rtf 5c322c7f3b22aa8c598a875dd9b28917fd1c5b8d20d12ca59cb4074af269269b.exe File created C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\#FOX_README#.rtf 5c322c7f3b22aa8c598a875dd9b28917fd1c5b8d20d12ca59cb4074af269269b.exe File created C:\ProgramData\Package Cache\{7DAD0258-515C-3DD4-8964-BD714199E0F7}v12.0.40660\packages\vcRuntimeAdditional_x86\#FOX_README#.rtf 5c322c7f3b22aa8c598a875dd9b28917fd1c5b8d20d12ca59cb4074af269269b.exe File created C:\Users\Public\Desktop\#FOX_README#.rtf 5c322c7f3b22aa8c598a875dd9b28917fd1c5b8d20d12ca59cb4074af269269b.exe File created C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\#FOX_README#.rtf 5c322c7f3b22aa8c598a875dd9b28917fd1c5b8d20d12ca59cb4074af269269b.exe File created C:\Program Files\VideoLAN\VLC\lua\http\requests\#FOX_README#.rtf 5c322c7f3b22aa8c598a875dd9b28917fd1c5b8d20d12ca59cb4074af269269b.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\#FOX_README#.rtf 5c322c7f3b22aa8c598a875dd9b28917fd1c5b8d20d12ca59cb4074af269269b.exe File created C:\Program Files\Microsoft Games\Mahjong\ja-JP\#FOX_README#.rtf 5c322c7f3b22aa8c598a875dd9b28917fd1c5b8d20d12ca59cb4074af269269b.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\#FOX_README#.rtf 5c322c7f3b22aa8c598a875dd9b28917fd1c5b8d20d12ca59cb4074af269269b.exe File created C:\Program Files\Microsoft Games\Multiplayer\Spades\#FOX_README#.rtf 5c322c7f3b22aa8c598a875dd9b28917fd1c5b8d20d12ca59cb4074af269269b.exe File created C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\#FOX_README#.rtf 5c322c7f3b22aa8c598a875dd9b28917fd1c5b8d20d12ca59cb4074af269269b.exe File created C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\#FOX_README#.rtf 5c322c7f3b22aa8c598a875dd9b28917fd1c5b8d20d12ca59cb4074af269269b.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\#FOX_README#.rtf 5c322c7f3b22aa8c598a875dd9b28917fd1c5b8d20d12ca59cb4074af269269b.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\#FOX_README#.rtf 5c322c7f3b22aa8c598a875dd9b28917fd1c5b8d20d12ca59cb4074af269269b.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\#FOX_README#.rtf 5c322c7f3b22aa8c598a875dd9b28917fd1c5b8d20d12ca59cb4074af269269b.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\#FOX_README#.rtf 5c322c7f3b22aa8c598a875dd9b28917fd1c5b8d20d12ca59cb4074af269269b.exe File created C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\#FOX_README#.rtf 5c322c7f3b22aa8c598a875dd9b28917fd1c5b8d20d12ca59cb4074af269269b.exe File created C:\Program Files\Java\jre7\lib\management\#FOX_README#.rtf 5c322c7f3b22aa8c598a875dd9b28917fd1c5b8d20d12ca59cb4074af269269b.exe File created C:\Program Files\Microsoft Games\FreeCell\ja-JP\#FOX_README#.rtf 5c322c7f3b22aa8c598a875dd9b28917fd1c5b8d20d12ca59cb4074af269269b.exe File created C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\#FOX_README#.rtf 5c322c7f3b22aa8c598a875dd9b28917fd1c5b8d20d12ca59cb4074af269269b.exe File created C:\ProgramData\Microsoft\MF\#FOX_README#.rtf 5c322c7f3b22aa8c598a875dd9b28917fd1c5b8d20d12ca59cb4074af269269b.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\#FOX_README#.rtf 5c322c7f3b22aa8c598a875dd9b28917fd1c5b8d20d12ca59cb4074af269269b.exe File created C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\#FOX_README#.rtf 5c322c7f3b22aa8c598a875dd9b28917fd1c5b8d20d12ca59cb4074af269269b.exe File created C:\Users\Admin\Documents\#FOX_README#.rtf 5c322c7f3b22aa8c598a875dd9b28917fd1c5b8d20d12ca59cb4074af269269b.exe File created C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\#FOX_README#.rtf 5c322c7f3b22aa8c598a875dd9b28917fd1c5b8d20d12ca59cb4074af269269b.exe File created C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\#FOX_README#.rtf 5c322c7f3b22aa8c598a875dd9b28917fd1c5b8d20d12ca59cb4074af269269b.exe File created C:\Program Files\VideoLAN\VLC\lua\intf\#FOX_README#.rtf 5c322c7f3b22aa8c598a875dd9b28917fd1c5b8d20d12ca59cb4074af269269b.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\#FOX_README#.rtf 5c322c7f3b22aa8c598a875dd9b28917fd1c5b8d20d12ca59cb4074af269269b.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\#FOX_README#.rtf 5c322c7f3b22aa8c598a875dd9b28917fd1c5b8d20d12ca59cb4074af269269b.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\#FOX_README#.rtf 5c322c7f3b22aa8c598a875dd9b28917fd1c5b8d20d12ca59cb4074af269269b.exe File created C:\Program Files\Java\jre7\lib\zi\America\#FOX_README#.rtf 5c322c7f3b22aa8c598a875dd9b28917fd1c5b8d20d12ca59cb4074af269269b.exe File created C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\#FOX_README#.rtf 5c322c7f3b22aa8c598a875dd9b28917fd1c5b8d20d12ca59cb4074af269269b.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\#FOX_README#.rtf 5c322c7f3b22aa8c598a875dd9b28917fd1c5b8d20d12ca59cb4074af269269b.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\#FOX_README#.rtf 5c322c7f3b22aa8c598a875dd9b28917fd1c5b8d20d12ca59cb4074af269269b.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\#FOX_README#.rtf 5c322c7f3b22aa8c598a875dd9b28917fd1c5b8d20d12ca59cb4074af269269b.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\#FOX_README#.rtf 5c322c7f3b22aa8c598a875dd9b28917fd1c5b8d20d12ca59cb4074af269269b.exe File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\fr-FR\#FOX_README#.rtf 5c322c7f3b22aa8c598a875dd9b28917fd1c5b8d20d12ca59cb4074af269269b.exe HTTP URL 4 http://fredstat.000webhostapp.com/addrecord.php?apikey=fox_api_key&compuser=GZAATBZA|Admin&sid=LLW6Y6JuICh1EDNY&phase=[ALL]47F328A8747EADE8