Ransom_MATRIX.FQJ

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It deletes itself after execution.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan creates the following folders:

• %User Profile%\Application Data\WsUu43RNOpZv

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.)

Dropping Routine

This Trojan drops the following files:

• %User Profile%\Application Data\gE14GYdv1jJ3z54h.ast
• %User Profile%\WsUu43RNOpZv\bctKaGOw.cmd
• %User Profile%\WSUU43~1\EW6Bz9XO.exe
• %User Temp%\R7irlaHg.exe
• %User Profile%\Application Data\121F5EE0909DCB17.pek
• %User Profile%\Application Data\121F5EE0909DCB17.sek
• %User Startup%\EW6Bz9XO.lnk
• %Common Startup%\EW6Bz9XO.lnk
• %User Profile%\Application Data\!WhatHappenedWithMyFiles!.rtf
• %User Profile%\WsUu43RNOpZv\ihu3dT40.cmd
• %User Profile%\MICROS~1\CRxWN0vL.exe
• %Application Data%\MICROS~1\XnKjh1cD.exe
• %User Temp%\Cwgafpup.exe
• %User Temp%\5VIrQZje.exe
• %User Profile%\TEMPLA~1\!WhatHappenedWithMyFiles!.rtf
• %User Profile%\Cookies\!WhatHappenedWithMyFiles!.rtf
• %Start Menu%\Programs\WinPcap\!WhatHappenedWithMyFiles!.rtf
• %Favorites%\Links\!WhatHappenedWithMyFiles!.rtf
• %Favorites%\!WhatHappenedWithMyFiles!.rtf
• %User Profile%\WsUu43RNOpZv\kitzUQwF.cmd
• %User Profile%\WsUu43RNOpZv\Zq93Li01.cmd
• %User Profile%\SendTo\!WhatHappenedWithMyFiles!.rtf
• %User Profile%\Templates\!WhatHappenedWithMyFiles!.rtf

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.. %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %User Startup% is the current user's Startup folder, which is usually C:\Documents and Settings\{user}\Start Menu\Programs\Startup on Windows 2000 and XP, and C:\Documents and Settings\{User name}\Start Menu\Programs\Startup on Windows Vista, 7, and 8.. %Common Startup% is the system's shared Startup folder, which is usually C:\Documents and Settings\All Users\Start Menu\Programs\Startup on Windows 2000, XP, and Server 2003, and C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup on Windows Vista, 7, and 8.. %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %Start Menu% is the Start Menu folder, where it usually is C:\Documents and Settings\{user name}\Start Menu on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %Favorites% is the Favorites folder, where it usually is C:\Documents and Settings\{user name}\Favorites on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\Favorites on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Other Details

This Trojan connects to the following possibly malicious URL:

• {BLOCKED}.57.177

It deletes itself after execution.

This report is generated via an automated analysis system.