Overview

overview

10

Static

static

5f156e7a8c...3f.exe

windows7-x64

10

5f156e7a8c...3f.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    188s
  • max time network
    189s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220721-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31-07-2022 18:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5f156e7a8c86f7760b4448e314394c8e6e98cad8e385ec32a047c5b86ead953f.exe

  • Size

    1.3MB

  • MD5

    7bedd0c5e4d5c7a6f5ad69898598b526

  • SHA1

    c0263f12b942d370260cf23eddcbd34abaf8b08e

  • SHA256

    5f156e7a8c86f7760b4448e314394c8e6e98cad8e385ec32a047c5b86ead953f

  • SHA512

    68e4e99155bc17e72b04ce5af4a6b86eab66ef6efae138dcdea420e93b2ccd3a01e5c1dfea278d37a0e6426c656fe5cacd008b983b24740595c647260808fc29

Score
10/10
matrixdiscoveryransomwarespywarestealerupx

Malware Config

Signatures

  • Matrix Ransomware 34 IoCs

    Targeted ransomware with information collection and encryption functionality.

    ransomwarematrix
  • Executes dropped EXE 5 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Modifies file permissions 1 TTPs 2 IoCs
    discovery
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 59 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5f156e7a8c86f7760b4448e314394c8e6e98cad8e385ec32a047c5b86ead953f.exe
    "C:\Users\Admin\AppData\Local\Temp\5f156e7a8c86f7760b4448e314394c8e6e98cad8e385ec32a047c5b86ead953f.exe"
    1⤵
    • Matrix Ransomware
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:2024
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /C copy /V /Y "C:\Users\Admin\AppData\Local\Temp\5f156e7a8c86f7760b4448e314394c8e6e98cad8e385ec32a047c5b86ead953f.exe" "C:\Users\Admin\AppData\Local\Temp\NWKspFWj.exe"
      2⤵
        PID:1632
      • C:\Users\Admin\AppData\Local\Temp\NWKspFWj.exe
        "C:\Users\Admin\AppData\Local\Temp\NWKspFWj.exe" -n
        2⤵
        • Executes dropped EXE
        PID:1944
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\zjkJr1is.bmp" /f & reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f & reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1564
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\zjkJr1is.bmp" /f
          3⤵
          • Sets desktop wallpaper using registry
          PID:1648
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f
          3⤵
            PID:3704
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f
            3⤵
              PID:5028
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /C wscript //B //Nologo "C:\Users\Admin\AppData\Roaming\iEe3PkA2.vbs"
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:4540
            • C:\Windows\SysWOW64\wscript.exe
              wscript //B //Nologo "C:\Users\Admin\AppData\Roaming\iEe3PkA2.vbs"
              3⤵
                PID:5072
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WX8RF1wD.bat" "C:\ProgramData\USOPrivate\UpdateStore\store.db""
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:4420
              • C:\Windows\SysWOW64\cacls.exe
                cacls "C:\ProgramData\USOPrivate\UpdateStore\store.db" /E /G Admin:F /C
                3⤵
                  PID:4992
                • C:\Windows\SysWOW64\takeown.exe
                  takeown /F "C:\ProgramData\USOPrivate\UpdateStore\store.db"
                  3⤵
                  • Modifies file permissions
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4740
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c 1PG6CbfQ.exe -accepteula "store.db" -nobanner
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4452
                  • C:\Users\Admin\AppData\Local\Temp\1PG6CbfQ.exe
                    1PG6CbfQ.exe -accepteula "store.db" -nobanner
                    4⤵
                    • Executes dropped EXE
                    PID:3752
                • C:\Users\Admin\AppData\Local\Temp\1PG6CbfQ.exe
                  1PG6CbfQ.exe -accepteula -c Run -y -p extract -nobanner
                  3⤵
                  • Executes dropped EXE
                  PID:3520
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WX8RF1wD.bat" "C:\Users\All Users\USOPrivate\UpdateStore\store.db""
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:4344
                • C:\Windows\SysWOW64\cacls.exe
                  cacls "C:\Users\All Users\USOPrivate\UpdateStore\store.db" /E /G Admin:F /C
                  3⤵
                    PID:3448
                  • C:\Windows\SysWOW64\takeown.exe
                    takeown /F "C:\Users\All Users\USOPrivate\UpdateStore\store.db"
                    3⤵
                    • Modifies file permissions
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1500
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c 1PG6CbfQ.exe -accepteula "store.db" -nobanner
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1428
                    • C:\Users\Admin\AppData\Local\Temp\1PG6CbfQ.exe
                      1PG6CbfQ.exe -accepteula "store.db" -nobanner
                      4⤵
                      • Executes dropped EXE
                      • Suspicious use of WriteProcessMemory
                      PID:548
                      • C:\Users\Admin\AppData\Local\Temp\1PG6CbfQ64.exe
                        1PG6CbfQ.exe -accepteula "store.db" -nobanner
                        5⤵
                        • Executes dropped EXE
                        PID:2616

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\1PG6CbfQ.exe
                Filesize

                181KB

                MD5

                2f5b509929165fc13ceab9393c3b911d

                SHA1

                b016316132a6a277c5d8a4d7f3d6e2c769984052

                SHA256

                0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

                SHA512

                c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\1PG6CbfQ.exe
                Filesize

                181KB

                MD5

                2f5b509929165fc13ceab9393c3b911d

                SHA1

                b016316132a6a277c5d8a4d7f3d6e2c769984052

                SHA256

                0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

                SHA512

                c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\1PG6CbfQ.exe
                Filesize

                181KB

                MD5

                2f5b509929165fc13ceab9393c3b911d

                SHA1

                b016316132a6a277c5d8a4d7f3d6e2c769984052

                SHA256

                0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

                SHA512

                c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\1PG6CbfQ.exe
                Filesize

                181KB

                MD5

                2f5b509929165fc13ceab9393c3b911d

                SHA1

                b016316132a6a277c5d8a4d7f3d6e2c769984052

                SHA256

                0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

                SHA512

                c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\1PG6CbfQ64.exe
                Filesize

                221KB

                MD5

                3026bc2448763d5a9862d864b97288ff

                SHA1

                7d93a18713ece2e7b93e453739ffd7ad0c646e9e

                SHA256

                7adb21c00d3cc9a1ef081484b58b68f218d7c84a720e16e113943b9f4694d8ec

                SHA512

                d4afd534ed1818f8dc157d754b078e3d2fe4fb6a24ed62d4b30b3a93ebc671d1707cedb3c23473bf3b5aa568901a1e5183da49e41152e352ecfa41bf220ebde6

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\1PG6CbfQ64.exe
                Filesize

                221KB

                MD5

                3026bc2448763d5a9862d864b97288ff

                SHA1

                7d93a18713ece2e7b93e453739ffd7ad0c646e9e

                SHA256

                7adb21c00d3cc9a1ef081484b58b68f218d7c84a720e16e113943b9f4694d8ec

                SHA512

                d4afd534ed1818f8dc157d754b078e3d2fe4fb6a24ed62d4b30b3a93ebc671d1707cedb3c23473bf3b5aa568901a1e5183da49e41152e352ecfa41bf220ebde6

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\NWKspFWj.exe
                Filesize

                1.3MB

                MD5

                7bedd0c5e4d5c7a6f5ad69898598b526

                SHA1

                c0263f12b942d370260cf23eddcbd34abaf8b08e

                SHA256

                5f156e7a8c86f7760b4448e314394c8e6e98cad8e385ec32a047c5b86ead953f

                SHA512

                68e4e99155bc17e72b04ce5af4a6b86eab66ef6efae138dcdea420e93b2ccd3a01e5c1dfea278d37a0e6426c656fe5cacd008b983b24740595c647260808fc29

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\NWKspFWj.exe
                Filesize

                1.3MB

                MD5

                7bedd0c5e4d5c7a6f5ad69898598b526

                SHA1

                c0263f12b942d370260cf23eddcbd34abaf8b08e

                SHA256

                5f156e7a8c86f7760b4448e314394c8e6e98cad8e385ec32a047c5b86ead953f

                SHA512

                68e4e99155bc17e72b04ce5af4a6b86eab66ef6efae138dcdea420e93b2ccd3a01e5c1dfea278d37a0e6426c656fe5cacd008b983b24740595c647260808fc29

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\WX8RF1wD.bat
                Filesize

                226B

                MD5

                69de1257b4e682dcf3edd6ce32d99812

                SHA1

                42d326403865984ca89ae67635fcd419ecfb904b

                SHA256

                b306fb565414bb939ab732e58bbf00a882e768d073c1180b5fed93b39b0cb61f

                SHA512

                25db4553e5a633383035ac439519403af14e82bed57097676ecf9685581be7f4237b31d72404161fcf1a0eff714f82701e06e01824af9040565076ea459373f5

                Download Submit

              • C:\Users\Admin\AppData\Roaming\iEe3PkA2.vbs
                Filesize

                260B

                MD5

                59778bf8167d89eeb9680495af67106c

                SHA1

                5276d2d25878e13572b6ddb22408b90106534604

                SHA256

                fdf3eeebab0362476be3b4f02247f186a5710cb8d8be2bbd2683969968c0de0a

                SHA512

                770bbeb59a7b465a21254e16db4f723fa36a28c67377d77295dc68be122b9b8d4edb2bb2dae418294d3064154b6cc8fccd25bda56fbbf5e1d95c9242c2beb916

                Download Submit

              • memory/3520-162-0x0000000000400000-0x0000000000477000-memory.dmp

                Filesize

                476KB

                Download

              • memory/3752-154-0x0000000000400000-0x0000000000477000-memory.dmp

                Filesize

                476KB

                Download

              • memory/3752-157-0x0000000000400000-0x0000000000477000-memory.dmp

                Filesize

                476KB

                Download