Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    09-05-2021 15:22

General

  • Target

    df1934e161093894ea8bfcd0e119f0f81a0c2bd6cbd226eed67d4e5397d9e8c2.exe

  • Size

    33KB

  • MD5

    b6c6d1633a45c00fafce7342da59af07

  • SHA1

    88daf69924f052d93af9fe845317816d8e769453

  • SHA256

    df1934e161093894ea8bfcd0e119f0f81a0c2bd6cbd226eed67d4e5397d9e8c2

  • SHA512

    b70060e484fcdf1ada388855d98bcc0429fbf5d1e562c3c1d5e4ed70a04579c7810115e140a1cea8210d31740027d26a914cc978e8f714b25a3cfd9322877a17

Score
10/10

Malware Config

Signatures

  • Upatre

    Upatre is a generic malware downloader.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\df1934e161093894ea8bfcd0e119f0f81a0c2bd6cbd226eed67d4e5397d9e8c2.exe
    "C:\Users\Admin\AppData\Local\Temp\df1934e161093894ea8bfcd0e119f0f81a0c2bd6cbd226eed67d4e5397d9e8c2.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1268
    • C:\Users\Admin\AppData\Local\Temp\szgfw.exe
      "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
      2⤵
      • Executes dropped EXE
      PID:1500

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\szgfw.exe

    MD5

    62cf9fe09f64c66ae8bec043bf007036

    SHA1

    8f21beaf55dcd05716db7299a75b2726e6ccc4c5

    SHA256

    2cfc417e559b822198013f3e49cfe1fbc36df7b75c6e29ec2c1b0e6bdf778033

    SHA512

    f1041ef2b9d2a3c6984396857d5b4563bf2d4943fdf9b3679a94c18614b7280548257943ba1e161375bcc1d1395921021f3a5af831ca104f79a130ca07da0997

  • C:\Users\Admin\AppData\Local\Temp\szgfw.exe

    MD5

    62cf9fe09f64c66ae8bec043bf007036

    SHA1

    8f21beaf55dcd05716db7299a75b2726e6ccc4c5

    SHA256

    2cfc417e559b822198013f3e49cfe1fbc36df7b75c6e29ec2c1b0e6bdf778033

    SHA512

    f1041ef2b9d2a3c6984396857d5b4563bf2d4943fdf9b3679a94c18614b7280548257943ba1e161375bcc1d1395921021f3a5af831ca104f79a130ca07da0997

  • \Users\Admin\AppData\Local\Temp\szgfw.exe

    MD5

    62cf9fe09f64c66ae8bec043bf007036

    SHA1

    8f21beaf55dcd05716db7299a75b2726e6ccc4c5

    SHA256

    2cfc417e559b822198013f3e49cfe1fbc36df7b75c6e29ec2c1b0e6bdf778033

    SHA512

    f1041ef2b9d2a3c6984396857d5b4563bf2d4943fdf9b3679a94c18614b7280548257943ba1e161375bcc1d1395921021f3a5af831ca104f79a130ca07da0997

  • \Users\Admin\AppData\Local\Temp\szgfw.exe

    MD5

    62cf9fe09f64c66ae8bec043bf007036

    SHA1

    8f21beaf55dcd05716db7299a75b2726e6ccc4c5

    SHA256

    2cfc417e559b822198013f3e49cfe1fbc36df7b75c6e29ec2c1b0e6bdf778033

    SHA512

    f1041ef2b9d2a3c6984396857d5b4563bf2d4943fdf9b3679a94c18614b7280548257943ba1e161375bcc1d1395921021f3a5af831ca104f79a130ca07da0997

  • memory/1268-60-0x0000000075591000-0x0000000075593000-memory.dmp

    Filesize

    8KB

  • memory/1268-66-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

  • memory/1500-63-0x0000000000000000-mapping.dmp