Analysis

  • max time kernel
    151s
  • max time network
    15s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    09-05-2021 15:36

General

  • Target

    07508b17da408816087926f453eafb243b1d46b3dcfe063e5bb83b35016feb40.exe

  • Size

    35KB

  • MD5

    c178b25d3ce32ddc261128ce1bc81c72

  • SHA1

    789cfce0f4d2ef0b300033161789c78e76b10d9e

  • SHA256

    07508b17da408816087926f453eafb243b1d46b3dcfe063e5bb83b35016feb40

  • SHA512

    799de570503c7afb8006c9055c6ed8807849b8aa79b976455326410143188200fb076fb3585594564695656d05cbefe361e48540c4135c3931c6b87c1c9c725a

Score
10/10

Malware Config

Signatures

  • Upatre

    Upatre is a generic malware downloader.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\07508b17da408816087926f453eafb243b1d46b3dcfe063e5bb83b35016feb40.exe
    "C:\Users\Admin\AppData\Local\Temp\07508b17da408816087926f453eafb243b1d46b3dcfe063e5bb83b35016feb40.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:736
    • C:\Users\Admin\AppData\Local\Temp\szgfw.exe
      "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
      2⤵
      • Executes dropped EXE
      PID:1356

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\szgfw.exe

    MD5

    8a210a2af7fec09525bfcc2a4551e8b1

    SHA1

    9bd10e8026c75d65f195d72d0c9038a9940ab545

    SHA256

    bf6a1af71f156f8cae44f995e101c8db843c82e41318b748a248138dc79c6080

    SHA512

    58e3c538f3f87fc1fa655558e7a26cbad19d9c22a97568851afb9e1b11f198d0d1febb315491eb3cda5e78e54bcf827d66349d1303b09e9ced0d5b9bf9dca9cb

  • C:\Users\Admin\AppData\Local\Temp\szgfw.exe

    MD5

    8a210a2af7fec09525bfcc2a4551e8b1

    SHA1

    9bd10e8026c75d65f195d72d0c9038a9940ab545

    SHA256

    bf6a1af71f156f8cae44f995e101c8db843c82e41318b748a248138dc79c6080

    SHA512

    58e3c538f3f87fc1fa655558e7a26cbad19d9c22a97568851afb9e1b11f198d0d1febb315491eb3cda5e78e54bcf827d66349d1303b09e9ced0d5b9bf9dca9cb

  • \Users\Admin\AppData\Local\Temp\szgfw.exe

    MD5

    8a210a2af7fec09525bfcc2a4551e8b1

    SHA1

    9bd10e8026c75d65f195d72d0c9038a9940ab545

    SHA256

    bf6a1af71f156f8cae44f995e101c8db843c82e41318b748a248138dc79c6080

    SHA512

    58e3c538f3f87fc1fa655558e7a26cbad19d9c22a97568851afb9e1b11f198d0d1febb315491eb3cda5e78e54bcf827d66349d1303b09e9ced0d5b9bf9dca9cb

  • \Users\Admin\AppData\Local\Temp\szgfw.exe

    MD5

    8a210a2af7fec09525bfcc2a4551e8b1

    SHA1

    9bd10e8026c75d65f195d72d0c9038a9940ab545

    SHA256

    bf6a1af71f156f8cae44f995e101c8db843c82e41318b748a248138dc79c6080

    SHA512

    58e3c538f3f87fc1fa655558e7a26cbad19d9c22a97568851afb9e1b11f198d0d1febb315491eb3cda5e78e54bcf827d66349d1303b09e9ced0d5b9bf9dca9cb

  • memory/736-60-0x0000000075891000-0x0000000075893000-memory.dmp

    Filesize

    8KB

  • memory/736-66-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

  • memory/1356-63-0x0000000000000000-mapping.dmp