Analysis
-
max time kernel
188s -
max time network
189s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
-
submitted
31-07-2022 18:19
General
-
Target
5f156e7a8c86f7760b4448e314394c8e6e98cad8e385ec32a047c5b86ead953f.exe
-
Size
1.3MB
-
MD5
7bedd0c5e4d5c7a6f5ad69898598b526
-
SHA1
c0263f12b942d370260cf23eddcbd34abaf8b08e
-
SHA256
5f156e7a8c86f7760b4448e314394c8e6e98cad8e385ec32a047c5b86ead953f
-
SHA512
68e4e99155bc17e72b04ce5af4a6b86eab66ef6efae138dcdea420e93b2ccd3a01e5c1dfea278d37a0e6426c656fe5cacd008b983b24740595c647260808fc29
Malware Config
Signatures
-
Matrix Ransomware 34 IoCs
Targeted ransomware with information collection and encryption functionality.
-
Executes dropped EXE 5 IoCs
-
UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Modifies file permissions 1 TTPs 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 1 IoCs
-
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 59 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f156e7a8c86f7760b4448e314394c8e6e98cad8e385ec32a047c5b86ead953f.exe"C:\Users\Admin\AppData\Local\Temp\5f156e7a8c86f7760b4448e314394c8e6e98cad8e385ec32a047c5b86ead953f.exe"1⤵
- Matrix Ransomware
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C copy /V /Y "C:\Users\Admin\AppData\Local\Temp\5f156e7a8c86f7760b4448e314394c8e6e98cad8e385ec32a047c5b86ead953f.exe" "C:\Users\Admin\AppData\Local\Temp\NWKspFWj.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\NWKspFWj.exe"C:\Users\Admin\AppData\Local\Temp\NWKspFWj.exe" -n2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\zjkJr1is.bmp" /f & reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f & reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\zjkJr1is.bmp" /f3⤵
- Sets desktop wallpaper using registry
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f3⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C wscript //B //Nologo "C:\Users\Admin\AppData\Roaming\iEe3PkA2.vbs"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wscript.exewscript //B //Nologo "C:\Users\Admin\AppData\Roaming\iEe3PkA2.vbs"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WX8RF1wD.bat" "C:\ProgramData\USOPrivate\UpdateStore\store.db""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\USOPrivate\UpdateStore\store.db" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\USOPrivate\UpdateStore\store.db"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 1PG6CbfQ.exe -accepteula "store.db" -nobanner3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1PG6CbfQ.exe1PG6CbfQ.exe -accepteula "store.db" -nobanner4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\1PG6CbfQ.exe1PG6CbfQ.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WX8RF1wD.bat" "C:\Users\All Users\USOPrivate\UpdateStore\store.db""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\USOPrivate\UpdateStore\store.db" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\USOPrivate\UpdateStore\store.db"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 1PG6CbfQ.exe -accepteula "store.db" -nobanner3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1PG6CbfQ.exe1PG6CbfQ.exe -accepteula "store.db" -nobanner4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1PG6CbfQ64.exe1PG6CbfQ.exe -accepteula "store.db" -nobanner5⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1PG6CbfQ.exeFilesize
181KB
MD52f5b509929165fc13ceab9393c3b911d
SHA1b016316132a6a277c5d8a4d7f3d6e2c769984052
SHA2560cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4
SHA512c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8
-
C:\Users\Admin\AppData\Local\Temp\1PG6CbfQ.exeFilesize
181KB
MD52f5b509929165fc13ceab9393c3b911d
SHA1b016316132a6a277c5d8a4d7f3d6e2c769984052
SHA2560cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4
SHA512c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8
-
C:\Users\Admin\AppData\Local\Temp\1PG6CbfQ.exeFilesize
181KB
MD52f5b509929165fc13ceab9393c3b911d
SHA1b016316132a6a277c5d8a4d7f3d6e2c769984052
SHA2560cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4
SHA512c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8
-
C:\Users\Admin\AppData\Local\Temp\1PG6CbfQ.exeFilesize
181KB
MD52f5b509929165fc13ceab9393c3b911d
SHA1b016316132a6a277c5d8a4d7f3d6e2c769984052
SHA2560cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4
SHA512c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8
-
C:\Users\Admin\AppData\Local\Temp\1PG6CbfQ64.exeFilesize
221KB
MD53026bc2448763d5a9862d864b97288ff
SHA17d93a18713ece2e7b93e453739ffd7ad0c646e9e
SHA2567adb21c00d3cc9a1ef081484b58b68f218d7c84a720e16e113943b9f4694d8ec
SHA512d4afd534ed1818f8dc157d754b078e3d2fe4fb6a24ed62d4b30b3a93ebc671d1707cedb3c23473bf3b5aa568901a1e5183da49e41152e352ecfa41bf220ebde6
-
C:\Users\Admin\AppData\Local\Temp\1PG6CbfQ64.exeFilesize
221KB
MD53026bc2448763d5a9862d864b97288ff
SHA17d93a18713ece2e7b93e453739ffd7ad0c646e9e
SHA2567adb21c00d3cc9a1ef081484b58b68f218d7c84a720e16e113943b9f4694d8ec
SHA512d4afd534ed1818f8dc157d754b078e3d2fe4fb6a24ed62d4b30b3a93ebc671d1707cedb3c23473bf3b5aa568901a1e5183da49e41152e352ecfa41bf220ebde6
-
C:\Users\Admin\AppData\Local\Temp\NWKspFWj.exeFilesize
1.3MB
MD57bedd0c5e4d5c7a6f5ad69898598b526
SHA1c0263f12b942d370260cf23eddcbd34abaf8b08e
SHA2565f156e7a8c86f7760b4448e314394c8e6e98cad8e385ec32a047c5b86ead953f
SHA51268e4e99155bc17e72b04ce5af4a6b86eab66ef6efae138dcdea420e93b2ccd3a01e5c1dfea278d37a0e6426c656fe5cacd008b983b24740595c647260808fc29
-
C:\Users\Admin\AppData\Local\Temp\NWKspFWj.exeFilesize
1.3MB
MD57bedd0c5e4d5c7a6f5ad69898598b526
SHA1c0263f12b942d370260cf23eddcbd34abaf8b08e
SHA2565f156e7a8c86f7760b4448e314394c8e6e98cad8e385ec32a047c5b86ead953f
SHA51268e4e99155bc17e72b04ce5af4a6b86eab66ef6efae138dcdea420e93b2ccd3a01e5c1dfea278d37a0e6426c656fe5cacd008b983b24740595c647260808fc29
-
C:\Users\Admin\AppData\Local\Temp\WX8RF1wD.batFilesize
226B
MD569de1257b4e682dcf3edd6ce32d99812
SHA142d326403865984ca89ae67635fcd419ecfb904b
SHA256b306fb565414bb939ab732e58bbf00a882e768d073c1180b5fed93b39b0cb61f
SHA51225db4553e5a633383035ac439519403af14e82bed57097676ecf9685581be7f4237b31d72404161fcf1a0eff714f82701e06e01824af9040565076ea459373f5
-
C:\Users\Admin\AppData\Roaming\iEe3PkA2.vbsFilesize
260B
MD559778bf8167d89eeb9680495af67106c
SHA15276d2d25878e13572b6ddb22408b90106534604
SHA256fdf3eeebab0362476be3b4f02247f186a5710cb8d8be2bbd2683969968c0de0a
SHA512770bbeb59a7b465a21254e16db4f723fa36a28c67377d77295dc68be122b9b8d4edb2bb2dae418294d3064154b6cc8fccd25bda56fbbf5e1d95c9242c2beb916
-
memory/548-149-0x0000000000000000-mapping.dmp
-
memory/1428-148-0x0000000000000000-mapping.dmp
-
memory/1500-145-0x0000000000000000-mapping.dmp
-
memory/1564-134-0x0000000000000000-mapping.dmp
-
memory/1632-130-0x0000000000000000-mapping.dmp
-
memory/1648-137-0x0000000000000000-mapping.dmp
-
memory/1944-131-0x0000000000000000-mapping.dmp
-
memory/2616-156-0x0000000000000000-mapping.dmp
-
memory/3448-143-0x0000000000000000-mapping.dmp
-
memory/3520-162-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/3520-160-0x0000000000000000-mapping.dmp
-
memory/3704-141-0x0000000000000000-mapping.dmp
-
memory/3752-154-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/3752-150-0x0000000000000000-mapping.dmp
-
memory/3752-157-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/4344-139-0x0000000000000000-mapping.dmp
-
memory/4420-136-0x0000000000000000-mapping.dmp
-
memory/4452-147-0x0000000000000000-mapping.dmp
-
memory/4540-135-0x0000000000000000-mapping.dmp
-
memory/4740-146-0x0000000000000000-mapping.dmp
-
memory/4992-144-0x0000000000000000-mapping.dmp
-
memory/5028-142-0x0000000000000000-mapping.dmp
-
memory/5072-138-0x0000000000000000-mapping.dmp