Analysis

  • max time kernel
    150s
  • max time network
    9s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    09-05-2021 15:45

General

  • Target

    29842678dfaba53fedcf6506ab2c72c4e260be59ae624c00a0902b8f9704a7d6.exe

  • Size

    600KB

  • MD5

    b9235f95acf17a9708b1341a3bd886aa

  • SHA1

    1fd6ab9a7bdb1f5b05e3e07695036aa83de32fe2

  • SHA256

    29842678dfaba53fedcf6506ab2c72c4e260be59ae624c00a0902b8f9704a7d6

  • SHA512

    e765c3398353265fb4a3adfee8a4e111ddac32e76fd59b35de5e283ceea788e0ab31a60e0e2fc24f82515bb062f0c526529a09f401cbbd09085b3b02ce223f8d

Score
10/10

Malware Config

Signatures

  • Upatre

    Upatre is a generic malware downloader.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\29842678dfaba53fedcf6506ab2c72c4e260be59ae624c00a0902b8f9704a7d6.exe
    "C:\Users\Admin\AppData\Local\Temp\29842678dfaba53fedcf6506ab2c72c4e260be59ae624c00a0902b8f9704a7d6.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:540
    • C:\Users\Admin\AppData\Local\Temp\szgfw.exe
      "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
      2⤵
      • Executes dropped EXE
      PID:1192

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\szgfw.exe

    MD5

    78d8ff0dfb37b14be3c6cdec97a50eb1

    SHA1

    ceb00f5bf84f972aa37df2b06abe0ad02d1098be

    SHA256

    c764e5457d467822d93aa0baeaa942dabd14b26c85b6e1ba0c11a3cfb378b462

    SHA512

    63aeee097b53f791e508c8d9e4c09a988f92bc5cd25d3f9fa292a37f75ac2608720d219e1ee8eddd086b508b8223b63d96d0659075dea9d022c2e59d40abce82

  • C:\Users\Admin\AppData\Local\Temp\szgfw.exe

    MD5

    78d8ff0dfb37b14be3c6cdec97a50eb1

    SHA1

    ceb00f5bf84f972aa37df2b06abe0ad02d1098be

    SHA256

    c764e5457d467822d93aa0baeaa942dabd14b26c85b6e1ba0c11a3cfb378b462

    SHA512

    63aeee097b53f791e508c8d9e4c09a988f92bc5cd25d3f9fa292a37f75ac2608720d219e1ee8eddd086b508b8223b63d96d0659075dea9d022c2e59d40abce82

  • \Users\Admin\AppData\Local\Temp\szgfw.exe

    MD5

    78d8ff0dfb37b14be3c6cdec97a50eb1

    SHA1

    ceb00f5bf84f972aa37df2b06abe0ad02d1098be

    SHA256

    c764e5457d467822d93aa0baeaa942dabd14b26c85b6e1ba0c11a3cfb378b462

    SHA512

    63aeee097b53f791e508c8d9e4c09a988f92bc5cd25d3f9fa292a37f75ac2608720d219e1ee8eddd086b508b8223b63d96d0659075dea9d022c2e59d40abce82

  • \Users\Admin\AppData\Local\Temp\szgfw.exe

    MD5

    78d8ff0dfb37b14be3c6cdec97a50eb1

    SHA1

    ceb00f5bf84f972aa37df2b06abe0ad02d1098be

    SHA256

    c764e5457d467822d93aa0baeaa942dabd14b26c85b6e1ba0c11a3cfb378b462

    SHA512

    63aeee097b53f791e508c8d9e4c09a988f92bc5cd25d3f9fa292a37f75ac2608720d219e1ee8eddd086b508b8223b63d96d0659075dea9d022c2e59d40abce82

  • memory/540-60-0x0000000075A71000-0x0000000075A73000-memory.dmp

    Filesize

    8KB

  • memory/540-66-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

  • memory/1192-63-0x0000000000000000-mapping.dmp