Analysis

  • max time kernel
    151s
  • max time network
    101s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    09-05-2021 19:36

General

  • Target

    3b74f9386a3733e782c3c1451cba710af21497bdcb0e49073d6e8bd7d4b3ed19.exe

  • Size

    30KB

  • MD5

    e7412fbd2a0809d22a08caefb982dc1c

  • SHA1

    1ed6bbdd2f2487aff5dfaac2ed82d19621018c4a

  • SHA256

    3b74f9386a3733e782c3c1451cba710af21497bdcb0e49073d6e8bd7d4b3ed19

  • SHA512

    b59750b413651759b60fd91eef6cd6a83a36e9fb053033d5ce0ec19b237a0c02d887b0d6e3be5616642b16ba8106d7fc07d38d0496da59d702d5fefddfbaee6c

Score
10/10

Malware Config

Signatures

  • Upatre

    Upatre is a generic malware downloader.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3b74f9386a3733e782c3c1451cba710af21497bdcb0e49073d6e8bd7d4b3ed19.exe
    "C:\Users\Admin\AppData\Local\Temp\3b74f9386a3733e782c3c1451cba710af21497bdcb0e49073d6e8bd7d4b3ed19.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1032
    • C:\Users\Admin\AppData\Local\Temp\szgfw.exe
      "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
      2⤵
      • Executes dropped EXE
      PID:2184

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\szgfw.exe

    MD5

    ba72edd51f827af181e6ffbc437c2101

    SHA1

    3227428babd73f47349477c768b4454240aeaf78

    SHA256

    394f378c89ae1b0242a7c3da89190e64187eba684763fc65f163437a8fcac3c6

    SHA512

    3b1cd500f775cb5177c82a95cbc479da77c156db8f0c20f07811e690f98b86f14c05d18bff2049a2bb351e53133a4d373b851cbcbecf34f60f71c27348273ded

  • C:\Users\Admin\AppData\Local\Temp\szgfw.exe

    MD5

    ba72edd51f827af181e6ffbc437c2101

    SHA1

    3227428babd73f47349477c768b4454240aeaf78

    SHA256

    394f378c89ae1b0242a7c3da89190e64187eba684763fc65f163437a8fcac3c6

    SHA512

    3b1cd500f775cb5177c82a95cbc479da77c156db8f0c20f07811e690f98b86f14c05d18bff2049a2bb351e53133a4d373b851cbcbecf34f60f71c27348273ded

  • memory/1032-114-0x0000000000570000-0x0000000000571000-memory.dmp

    Filesize

    4KB

  • memory/2184-115-0x0000000000000000-mapping.dmp

  • memory/2184-118-0x00000000004F0000-0x000000000063A000-memory.dmp

    Filesize

    1.3MB