General
-
Target
matrix.zip
-
Size
1.9MB
-
Sample
230901-fxgwjace5w
-
MD5
017fcc77006656fda5f4465276f0a129
-
SHA1
4057792d96839268b4ee6476c67f987dcab37232
-
SHA256
0dd9abb0081f113cd3adc5670f8b0f826cf1047b6e713a3c76451a55673ff705
-
SHA512
20847352c2c0226ed564544b8ba535b9445d872d283c620ab14e942e4840a1c5c58e3a26feeba9ac2ed242cd21f3d2acadf4b311ee700c3e4c1d077461464231
-
SSDEEP
49152:pePZd/lqFNIbCx5J8cxFJvX2oFqAXF2PpoovABIjZ/4exRQOQ:peBd/YF6bCx9xjzdQC1IKaRQOQ
Static task
static1
Behavioral task
behavioral1
Sample
3eff2f818a0dac4bd17d8da95962be78bca0b466e4325d2c2fd718ec54668f63.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
3eff2f818a0dac4bd17d8da95962be78bca0b466e4325d2c2fd718ec54668f63.exe
Resource
win10v2004-20230831-en
Malware Config
Extracted
http://myexternalip.com/raw
Extracted
C:\Program Files\Google\Chrome\Application\#ANN_README#.rtf
https://bitmsg.me
https://bitmsg.me/users/sign_up
https://bitmsg.me/users/sign_in
Extracted
C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\#ANN_README#.rtf
https://bitmsg.me
https://bitmsg.me/users/sign_up
https://bitmsg.me/users/sign_in
Targets
-
-
Target
3eff2f818a0dac4bd17d8da95962be78bca0b466e4325d2c2fd718ec54668f63
-
Size
3.8MB
-
MD5
ac42a9b2338847bb398152b1bf6401fd
-
SHA1
02daf9ff6773da4d134c94fdb7630af2cc01e399
-
SHA256
3eff2f818a0dac4bd17d8da95962be78bca0b466e4325d2c2fd718ec54668f63
-
SHA512
016c848cf8c2ffc1343d9242eaae19e9d41488f752282787f4f62cb841c121583f7673b21ddd7b624f39ef775c167fd2733eba495c84ebdf20103f09400e0ac1
-
SSDEEP
49152:PXlOslYQt+5oXlabPyyNHb/GMO6d+5M+HKo:PEUYQtXQFC6s5M+HH
-
Matrix Ransomware
Targeted ransomware with information collection and encryption functionality.
-
Modifies boot configuration data using bcdedit
-
Blocklisted process makes network request
-
Drops file in Drivers directory
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies file permissions
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Sets desktop wallpaper using registry
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Defense Evasion
File and Directory Permissions Modification
1Hide Artifacts
1Hidden Files and Directories
1Indicator Removal
2File Deletion
2Modify Registry
2