Analysis

  • max time kernel
    150s
  • max time network
    112s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    11-05-2021 14:22

General

  • Target

    626dfcb96d94d0e0d350a271fd4e74be029171adcec4277e46a0bb44c3b324d4.exe

  • Size

    37KB

  • MD5

    b9fe918d9b9265f78f77e7b8c9b4f2f4

  • SHA1

    7ca85ba297acdcafb9fd48f316ff4d658ab10d40

  • SHA256

    626dfcb96d94d0e0d350a271fd4e74be029171adcec4277e46a0bb44c3b324d4

  • SHA512

    c68c914189436c1ac63ba68b31d26c2c0aee075e08243dce8c13d97fc95f15272ee63a790c93335294a531b7e2d3d7b6d3e143f470959f28ea636715caca3310

Score
10/10

Malware Config

Signatures

  • Upatre

    Upatre is a generic malware downloader.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\626dfcb96d94d0e0d350a271fd4e74be029171adcec4277e46a0bb44c3b324d4.exe
    "C:\Users\Admin\AppData\Local\Temp\626dfcb96d94d0e0d350a271fd4e74be029171adcec4277e46a0bb44c3b324d4.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:784
    • C:\Users\Admin\AppData\Local\Temp\szgfw.exe
      "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
      2⤵
      • Executes dropped EXE
      PID:1904

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\szgfw.exe

    MD5

    f227460c96a8fcffef6b1aa2fc6ddb7e

    SHA1

    d28e4ba4a685de5e85415fe1d919fede6f870a79

    SHA256

    3435444e7954cbb7e274466666a3e70ccdc20fbb834557b11c823c0d1577225e

    SHA512

    e12b801f519c77311079db4e64e79b2a170e53732b8fe75b34b0ce4a44d414cb8b699ec71df39e9a35b305a2b8672b2c37ab6c88305500cd425e19bd96de5395

  • C:\Users\Admin\AppData\Local\Temp\szgfw.exe

    MD5

    f227460c96a8fcffef6b1aa2fc6ddb7e

    SHA1

    d28e4ba4a685de5e85415fe1d919fede6f870a79

    SHA256

    3435444e7954cbb7e274466666a3e70ccdc20fbb834557b11c823c0d1577225e

    SHA512

    e12b801f519c77311079db4e64e79b2a170e53732b8fe75b34b0ce4a44d414cb8b699ec71df39e9a35b305a2b8672b2c37ab6c88305500cd425e19bd96de5395

  • memory/784-114-0x0000000000500000-0x000000000064A000-memory.dmp

    Filesize

    1.3MB

  • memory/1904-115-0x0000000000000000-mapping.dmp

  • memory/1904-118-0x0000000000530000-0x0000000000531000-memory.dmp

    Filesize

    4KB