Analysis

  • max time kernel
    150s
  • max time network
    143s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    09-05-2021 20:28

General

  • Target

    1a6a9aeb2eef75b21cac85039ee9eac6231343ffb77ffcc92c1737e8fb6a665d.exe

  • Size

    38KB

  • MD5

    c3feaa7366830f6916b11f696febef02

  • SHA1

    65df843afac7852bc20dd4472d137f0b6eed7ae8

  • SHA256

    1a6a9aeb2eef75b21cac85039ee9eac6231343ffb77ffcc92c1737e8fb6a665d

  • SHA512

    b3622fd0a91c1321c852bf9c2a6b3d51cd3aac75ff7f64134646c6998f455667b1429b9f514c4b0b7d97904d4e860e96748fde2b986dca1fd240edbd83d76eac

Score
10/10

Malware Config

Signatures

  • Upatre

    Upatre is a generic malware downloader.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1a6a9aeb2eef75b21cac85039ee9eac6231343ffb77ffcc92c1737e8fb6a665d.exe
    "C:\Users\Admin\AppData\Local\Temp\1a6a9aeb2eef75b21cac85039ee9eac6231343ffb77ffcc92c1737e8fb6a665d.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3872
    • C:\Users\Admin\AppData\Local\Temp\szgfw.exe
      "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
      2⤵
      • Executes dropped EXE
      PID:3300

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\szgfw.exe

    MD5

    c577de90f2f9f0e45d388c181072ee40

    SHA1

    98cf9b0896c4bc7156963ae9e8b0ad97379af4a2

    SHA256

    b872fd44193e83f1057d72adc87f3b6c34ddc167097ca128668430cb33fb8307

    SHA512

    f133412aa5c661095ea2d6fbf5984d18ad3cfb6a2d033ab28eb4220fb3defdd2cca20d262bf3f26e4e635c1e8c211759bff6735e4d29d2f4d442de839cae9fc5

  • C:\Users\Admin\AppData\Local\Temp\szgfw.exe

    MD5

    c577de90f2f9f0e45d388c181072ee40

    SHA1

    98cf9b0896c4bc7156963ae9e8b0ad97379af4a2

    SHA256

    b872fd44193e83f1057d72adc87f3b6c34ddc167097ca128668430cb33fb8307

    SHA512

    f133412aa5c661095ea2d6fbf5984d18ad3cfb6a2d033ab28eb4220fb3defdd2cca20d262bf3f26e4e635c1e8c211759bff6735e4d29d2f4d442de839cae9fc5

  • memory/3300-114-0x0000000000000000-mapping.dmp

  • memory/3300-118-0x0000000000410000-0x000000000055A000-memory.dmp

    Filesize

    1.3MB

  • memory/3872-117-0x0000000000410000-0x000000000055A000-memory.dmp

    Filesize

    1.3MB