Analysis

  • max time kernel
    152s
  • max time network
    138s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    09-05-2021 22:38

General

  • Target

    eff106657d6db5868729c08737d816c7e63aa954c17831229ba8047a1c1e1c0e.exe

  • Size

    36KB

  • MD5

    e64f3eee3e25211dc2d982afcf3889b8

  • SHA1

    f1748873f7f02373e4b620337179680cb2daff1f

  • SHA256

    eff106657d6db5868729c08737d816c7e63aa954c17831229ba8047a1c1e1c0e

  • SHA512

    f7bd265a569c587892da23db0ce68fc61ba65edbec7511651540856854a46a214e4834f7b7baf5319511113a3373146ec16b9ce308b009c97429e73a9f698149

Score
10/10

Malware Config

Signatures

  • Upatre

    Upatre is a generic malware downloader.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eff106657d6db5868729c08737d816c7e63aa954c17831229ba8047a1c1e1c0e.exe
    "C:\Users\Admin\AppData\Local\Temp\eff106657d6db5868729c08737d816c7e63aa954c17831229ba8047a1c1e1c0e.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:856
    • C:\Users\Admin\AppData\Local\Temp\szgfw.exe
      "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
      2⤵
      • Executes dropped EXE
      PID:3064

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\szgfw.exe

    MD5

    38096fb4a12694fd25a1345d37947b54

    SHA1

    1faebacf5bd603fd691059183cd0c476e0391d59

    SHA256

    a5bc2d13080cf9ee70bcf19a878d4105aaa96ad2068fc38bb5bdb8c3cac643f5

    SHA512

    28c3f1e46f638c495e361a116f6f5e7da5ded1795968577e3dc20c0a31faec0754a9a3002fede3fd0ad7a643e8326faf1788792b21e4304347c29765a245e7e7

  • C:\Users\Admin\AppData\Local\Temp\szgfw.exe

    MD5

    38096fb4a12694fd25a1345d37947b54

    SHA1

    1faebacf5bd603fd691059183cd0c476e0391d59

    SHA256

    a5bc2d13080cf9ee70bcf19a878d4105aaa96ad2068fc38bb5bdb8c3cac643f5

    SHA512

    28c3f1e46f638c495e361a116f6f5e7da5ded1795968577e3dc20c0a31faec0754a9a3002fede3fd0ad7a643e8326faf1788792b21e4304347c29765a245e7e7

  • memory/856-114-0x0000000002470000-0x0000000002471000-memory.dmp

    Filesize

    4KB

  • memory/3064-115-0x0000000000000000-mapping.dmp