matrix | 11ce680173c5dc97b727bdefcfcef60c6885ede3444815849efa97750c340ea9

General

Target

11ce680173c5dc97b727bdefcfcef60c6885ede3444815849efa97750c340ea9
Size

606KB
Sample

221103-p68v2scfcm
MD5

9ed03a62b850ea84a46c2dda31d88dd2
SHA1

85c48463b6988774841ad41188e0674c8dc08288
SHA256

11ce680173c5dc97b727bdefcfcef60c6885ede3444815849efa97750c340ea9
SHA512

899dee5db662bd0f1e24609e536ddafa24c264e6ded2c28be4b18f317039194c23e78644893f903b8170b3a027684568fa0d53a6a214557f753f5658ca7883cd
SSDEEP

12288:AMBdnfRfu7z+02UMC/baiV2qQRkjG9H+GPW/+pD10uEOAbv0c56bujHok1m+VvfD:AMe9RFFQLeGPW4D10tOAb0bq7mkvfq0

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

http://myexternalip.com/raw

Targets

- Target
  
  907636b28d162f7110b067a8178fa38c.exe
- Size
  
  1.2MB
- MD5
  
  907636b28d162f7110b067a8178fa38c
- SHA1
  
  048ae4691fe267e7c8d9eda5361663593747142a
- SHA256
  
  6e9060d56e669658b059f25a05f37f4d266658fece36afdb564536607fd9570b
- SHA512
  
  501a7ee7fc8c0869d3cb57be3a75be02f6a17583e524fae9fa29e149a7391a5ed79c45143c09c667eed7d2fe217503121e23edd6f1bac47c8ba7ec7a4ecbe04a
- SSDEEP
  
  24576:R/SA+2lraRrjSJR5ezmT1dM9tZBb5t+wb8fq/81mkvfW:3XlayIsy81hvf
Score

10^/10

matrix discovery evasion persistence ransomware upx
- Matrix Ransomware
  Targeted ransomware with information collection and encryption functionality.
  ransomware matrix
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Blocklisted process makes network request
- Drops file in Drivers directory
- Executes dropped EXE
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Sets service image path in registry
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Modifies file permissions
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2