MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7b5e536827c3bb9f8077aed78726585739bcde796904edd6c4faadc9a8d22eaf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Matrix


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7b5e536827c3bb9f8077aed78726585739bcde796904edd6c4faadc9a8d22eaf
SHA3-384 hash: 029252b0e2e1e405fb718906476d3115c92997e6a90f1d5781f63f2e37632608a147c6a0bac025a8468bdc10afeaa224
SHA1 hash: 028ef1a52c04fce1f8d84e019167d54a9067fc13
MD5 hash: 9c872367555dcd5901651f9c768fca5b
humanhash: thirteen-cardinal-lactose-october
File name:7b5e536827c3bb9f8077aed78726585739bcde796904edd6c4faadc9a8d22eaf
Download: download sample
Signature Matrix
Create hunting rule
File size:1'236'480 bytes
First seen:2020-10-15 17:13:32 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash abb35aa6fcf53f8a382bcada9e52e107 (1 x Matrix)
ssdeep 24576:sxcxFP+OOobRioyJR5ezu413hJE5cx0B7+R5kQMx6NZA:7fzBE6xdynf
Threatray 33 similar samples on MalwareBazaar
TLSH 17457D23B34860BEC8290A3645B7CD54793FB771A9168C1767F0492CEF695813E3AA4F
Reporter Arkbird_SOLG
Tags:Matrix Ransomware


Avatar
ArkbirdDevil
Pattern -> [alexwind46@yahoo.com].[$Filename].AW46
apikey -> AW46

Intelligence

File Origin
# of uploads :
1
# of downloads :
180
Origin country :
n/a
Vendor Threat Intelligence
Detection:
VSSDestroy
Create hunting rule
Link:
https://www.capesandbox.com/analysis/71532/
Detection(s):
Win.Ransomware.Matrix-7530993-0
Create hunting rule

PUA.Win.Adware.Dealply-6840263-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Running batch commands
Creating a process with a hidden window
DNS request
Creating a file
Sending an HTTP GET request
Creating a process from a recently created file
Creating a file in the %AppData% directory
Changing a file
Reading critical registry keys
Modifying an executable file
Moving a file to the %AppData% subdirectory
Moving a file to the Program Files subdirectory
Creating a file in the Program Files subdirectories
Network activity
Connection attempt
Moving a recently created file
Moving a file to the Program Files directory
Launching a process
Stealing user critical data
Creating a file in the mass storage device
Encrypting user's files
Result
Threat name:
Unknown
Detection:
malicious
Classification:
rans.spre.spyw
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/492805
Signature
Antivirus / Scanner detection for submitted sample
Changes the wallpaper picture
Drops batch files with force delete cmd (self deletion)
Drops executable to a common third party application directory
Infects executable files (exe, dll, sys, html)
Machine Learning detection for sample
Modifies existing user documents (likely ransomware behavior)
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to harvest and steal browser information (history, passwords, etc)
Uses schtasks.exe or at.exe to add and modify task schedules
Writes many files with high entropy
Wscript called in batch mode (surpress errors)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 298854 Sample: ToNKWS7M79 Startdate: 15/10/2020 Architecture: WINDOWS Score: 100 64 cdn.onenote.net 2->64 72 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->72 74 Antivirus / Scanner detection for submitted sample 2->74 76 Multi AV Scanner detection for submitted file 2->76 78 3 other signatures 2->78 10 ToNKWS7M79.exe 502 2->10         started        15 cmd.exe 2->15         started        signatures3 process4 dnsIp5 66 ghb.timerz.org 199.59.242.150, 49732, 49861, 50113 BODIS-NJUS United States 10->66 56 C:\Users\user\AppData\...\RE4sQww[1].jpg, DOS 10->56 dropped 58 C:\ProgramData\...\vcredist_x86.exe, COM 10->58 dropped 60 C:\Users\user\Desktop\...\QNCYCDFIJJ.docx, data 10->60 dropped 62 76 other files (65 malicious) 10->62 dropped 80 Drops batch files with force delete cmd (self deletion) 10->80 82 Tries to harvest and steal browser information (history, passwords, etc) 10->82 84 Writes many files with high entropy 10->84 86 3 other signatures 10->86 17 cmd.exe 1 10->17         started        20 cmd.exe 1 10->20         started        22 cmd.exe 1 10->22         started        24 5 other processes 10->24 68 192.168.2.1 unknown unknown 15->68 file6 signatures7 process8 file9 70 Wscript called in batch mode (surpress errors) 17->70 27 wscript.exe 1 17->27         started        29 conhost.exe 17->29         started        31 reg.exe 1 20->31         started        40 2 other processes 20->40 34 conhost.exe 22->34         started        42 2 other processes 22->42 54 C:\Users\user\Desktop54W7qa4l1.exe, PE32 24->54 dropped 36 conhost.exe 24->36         started        38 conhost.exe 24->38         started        44 5 other processes 24->44 signatures10 process11 signatures12 46 cmd.exe 27->46         started        48 cmd.exe 27->48         started        88 Changes the wallpaper picture 31->88 process13 process14 50 conhost.exe 46->50         started        52 schtasks.exe 46->52         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7b5e536827c3bb9f8077aed78726585739bcde796904edd6c4faadc9a8d22eaf/
Threat name:
Win32.Ransomware.Matrix
Create hunting rule
Status:
Malicious
First seen:
2020-09-23 12:43:22 UTC
File Type:
PE (Exe)
Extracted files:
3
AV detection:
28 of 29 (96.55%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
cobaltstrike
Create hunting rule
Similar samples:
095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270
Matrix
242713ef2f372f0d39ca8f01bd09c9f99bcfe850e156621c023dd9e0bfb9bd95
Matrix
4f4037898d619b3b5f1c9fedd3e3940f46d39a57db2cbf9b4d8238d587fd7168
Matrix
517e1659c9d9ee4de266b3ade2d06965b670d17082ae2c2c97b4c694bb29152a
Matrix
5474b58de90ad79d6df4c633fb773053fecc16ad69fb5b86e7a2b640a2a056d6
Matrix
593d037e9fd467ebe80cb0ff28d22be2dbc0fdaad4d626ee2ad30707d8ea23da
Matrix
afca3b84177133ff859d9b9d620b582d913218723bfcf83d119ec125b88a8c40
Matrix
d00ee0e6eab686424f8d383e151d22005f19adbda5b380a75669629e32fe12a6
Matrix
d87d1fbeffe5b18e22f288780bf50b1e7d5af9bbe2480c80ea2a7497a3d52829
Matrix
f9a19835601dc81b94557b0452cbde314a8f856e9d6371b825f39b627dba2949
Matrix
+ 23 additional samples on MalwareBazaar
Result
Malware family:
matrix
Create hunting rule
Score:
  10/10
Tags:
ransomware evasion upx discovery family:matrix spyware persistence
Link:
https://tria.ge/reports/201015-bq2r65scea/
Behaviour
Creates scheduled task(s)
Interacts with shadow copies
Modifies Control Panel
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: LoadsDriver
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Modifies service
Sets desktop wallpaper using registry
Drops desktop.ini file(s)
Enumerates connected drives
Loads dropped DLL
Modifies file permissions
Reads user/profile data of web browsers
Drops file in Drivers directory
Executes dropped EXE
Modifies extensions of user files
Sets service image path in registry
UPX packed file
Deletes shadow copies
Modifies boot configuration data using bcdedit
Matrix Ransomware
Unpacked files
SH256 hash:
7b5e536827c3bb9f8077aed78726585739bcde796904edd6c4faadc9a8d22eaf
MD5 hash:
9c872367555dcd5901651f9c768fca5b
SHA1 hash:
028ef1a52c04fce1f8d84e019167d54a9067fc13
Detections:
win_matrix_ransom_auto
Create hunting rule
Link:
https://www.unpac.me/results/ca26c162-f7b3-4bdd-a6ed-097c3d1fec6a/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Filecoder
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7b5e536827c3bb9f8077aed78726585739bcde796904edd6c4faadc9a8d22eaf

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Link
https://github.com/StrangerealIntel/DailyIOC/blob/master/2020-10-15/MATRIX/RAN_Matrix_Sep_2020_1.yar
  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/71532/

Comments