Analysis

  • max time kernel
    153s
  • max time network
    10s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    09-05-2021 15:59

General

  • Target

    1d8dca13d26cc8cdb4d463bfef8844341924dbffe556e573f30ef5bfd01692bf.exe

  • Size

    37KB

  • MD5

    e78fb687164911c5d5286a1c2b6b37d6

  • SHA1

    f4d4b53ab351105ba59f02ca95cd4dd87366048c

  • SHA256

    1d8dca13d26cc8cdb4d463bfef8844341924dbffe556e573f30ef5bfd01692bf

  • SHA512

    c2c22cdba07c8ca2bd1fbcedd0e3cd304c5508d814316c13d5cf3c581df98cd6799bcb01ee211473cb3619d4faea2abba35168a31fd9805ffcc925da387803ca

Score
10/10

Malware Config

Signatures

  • Upatre

    Upatre is a generic malware downloader.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1d8dca13d26cc8cdb4d463bfef8844341924dbffe556e573f30ef5bfd01692bf.exe
    "C:\Users\Admin\AppData\Local\Temp\1d8dca13d26cc8cdb4d463bfef8844341924dbffe556e573f30ef5bfd01692bf.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:684
    • C:\Users\Admin\AppData\Local\Temp\szgfw.exe
      "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
      2⤵
      • Executes dropped EXE
      PID:1500

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\szgfw.exe

    MD5

    67beba019ff85297906cca3842444494

    SHA1

    37a177d838de662a8043c0fd80f447f8595e2ac6

    SHA256

    d887f10b870f507538bc507214252c7ed490ea322743c5ab5a65067436417d82

    SHA512

    b7aa4fad2f67f44f9ca3021183258487ae40c4d32c1589854e7baa78b565c6bdd7aca347dcda6db72fe5c49d3bb5b9766ff5c7353721dd7da00037f992572704

  • C:\Users\Admin\AppData\Local\Temp\szgfw.exe

    MD5

    67beba019ff85297906cca3842444494

    SHA1

    37a177d838de662a8043c0fd80f447f8595e2ac6

    SHA256

    d887f10b870f507538bc507214252c7ed490ea322743c5ab5a65067436417d82

    SHA512

    b7aa4fad2f67f44f9ca3021183258487ae40c4d32c1589854e7baa78b565c6bdd7aca347dcda6db72fe5c49d3bb5b9766ff5c7353721dd7da00037f992572704

  • \Users\Admin\AppData\Local\Temp\szgfw.exe

    MD5

    67beba019ff85297906cca3842444494

    SHA1

    37a177d838de662a8043c0fd80f447f8595e2ac6

    SHA256

    d887f10b870f507538bc507214252c7ed490ea322743c5ab5a65067436417d82

    SHA512

    b7aa4fad2f67f44f9ca3021183258487ae40c4d32c1589854e7baa78b565c6bdd7aca347dcda6db72fe5c49d3bb5b9766ff5c7353721dd7da00037f992572704

  • \Users\Admin\AppData\Local\Temp\szgfw.exe

    MD5

    67beba019ff85297906cca3842444494

    SHA1

    37a177d838de662a8043c0fd80f447f8595e2ac6

    SHA256

    d887f10b870f507538bc507214252c7ed490ea322743c5ab5a65067436417d82

    SHA512

    b7aa4fad2f67f44f9ca3021183258487ae40c4d32c1589854e7baa78b565c6bdd7aca347dcda6db72fe5c49d3bb5b9766ff5c7353721dd7da00037f992572704

  • memory/684-60-0x0000000075C71000-0x0000000075C73000-memory.dmp

    Filesize

    8KB

  • memory/684-61-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

  • memory/1500-64-0x0000000000000000-mapping.dmp