General
-
Target
11ce680173c5dc97b727bdefcfcef60c6885ede3444815849efa97750c340ea9
-
Size
606KB
-
Sample
221103-p68v2scfcm
-
MD5
9ed03a62b850ea84a46c2dda31d88dd2
-
SHA1
85c48463b6988774841ad41188e0674c8dc08288
-
SHA256
11ce680173c5dc97b727bdefcfcef60c6885ede3444815849efa97750c340ea9
-
SHA512
899dee5db662bd0f1e24609e536ddafa24c264e6ded2c28be4b18f317039194c23e78644893f903b8170b3a027684568fa0d53a6a214557f753f5658ca7883cd
-
SSDEEP
12288:AMBdnfRfu7z+02UMC/baiV2qQRkjG9H+GPW/+pD10uEOAbv0c56bujHok1m+VvfD:AMe9RFFQLeGPW4D10tOAb0bq7mkvfq0
Static task
static1
Behavioral task
behavioral1
Sample
907636b28d162f7110b067a8178fa38c.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
907636b28d162f7110b067a8178fa38c.exe
Resource
win10v2004-20220901-en
Malware Config
Extracted
http://myexternalip.com/raw
Targets
-
-
Target
907636b28d162f7110b067a8178fa38c.exe
-
Size
1.2MB
-
MD5
907636b28d162f7110b067a8178fa38c
-
SHA1
048ae4691fe267e7c8d9eda5361663593747142a
-
SHA256
6e9060d56e669658b059f25a05f37f4d266658fece36afdb564536607fd9570b
-
SHA512
501a7ee7fc8c0869d3cb57be3a75be02f6a17583e524fae9fa29e149a7391a5ed79c45143c09c667eed7d2fe217503121e23edd6f1bac47c8ba7ec7a4ecbe04a
-
SSDEEP
24576:R/SA+2lraRrjSJR5ezmT1dM9tZBb5t+wb8fq/81mkvfW:3XlayIsy81hvf
Score10/10-
Matrix Ransomware
Targeted ransomware with information collection and encryption functionality.
-
Modifies boot configuration data using bcdedit
-
Blocklisted process makes network request
-
Drops file in Drivers directory
-
Executes dropped EXE
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Modifies file permissions
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-
Sets desktop wallpaper using registry
-
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
1Registry Run Keys / Startup Folder
1Scheduled Task
1Defense Evasion
File Deletion
2File and Directory Permissions Modification
1Hidden Files and Directories
1Modify Registry
2