Analysis

  • max time kernel
    151s
  • max time network
    137s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    11-05-2021 14:00

General

  • Target

    41a99b8fb73ebbba27d7baa76046d4f455dfbe4ddcf75b29dcc46cccdbd53eef.exe

  • Size

    38KB

  • MD5

    38880a6db585fea9044753a1d286416f

  • SHA1

    cb74298a8f35e8ffb6874b3e20d40d0a242953ba

  • SHA256

    41a99b8fb73ebbba27d7baa76046d4f455dfbe4ddcf75b29dcc46cccdbd53eef

  • SHA512

    27b5c9419af515e8ce9f505ad5909e1d19c9ddbd6ad6204036e54d5317b9ab6ef1b3c6079f9bfd4527718027f7c3aaa0c5fa5117ba48b64779d8eed9db7bda2b

Score
10/10

Malware Config

Signatures

  • Upatre

    Upatre is a generic malware downloader.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\41a99b8fb73ebbba27d7baa76046d4f455dfbe4ddcf75b29dcc46cccdbd53eef.exe
    "C:\Users\Admin\AppData\Local\Temp\41a99b8fb73ebbba27d7baa76046d4f455dfbe4ddcf75b29dcc46cccdbd53eef.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:852
    • C:\Users\Admin\AppData\Local\Temp\szgfw.exe
      "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
      2⤵
      • Executes dropped EXE
      PID:2912

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\szgfw.exe

    MD5

    19795c969ff8dec0ef5764b805cf5d94

    SHA1

    4b5dfc311a5ee4f2b521ee2fe5232546946c1f94

    SHA256

    12ed90a3620af8df5263a310cc7c59c506c754bc30ead2f0dcdbd8f706fa01a9

    SHA512

    2da6fd68e3c35c73c0381915df9612f1f3ce8e48b13fbdb457b997d4afd27a18cd50085058f066af4771b41de45950f1fad5d575d48bdf8f0883b7b27c085ab7

  • C:\Users\Admin\AppData\Local\Temp\szgfw.exe

    MD5

    19795c969ff8dec0ef5764b805cf5d94

    SHA1

    4b5dfc311a5ee4f2b521ee2fe5232546946c1f94

    SHA256

    12ed90a3620af8df5263a310cc7c59c506c754bc30ead2f0dcdbd8f706fa01a9

    SHA512

    2da6fd68e3c35c73c0381915df9612f1f3ce8e48b13fbdb457b997d4afd27a18cd50085058f066af4771b41de45950f1fad5d575d48bdf8f0883b7b27c085ab7

  • memory/852-114-0x00000000005F0000-0x00000000005F1000-memory.dmp

    Filesize

    4KB

  • memory/2912-115-0x0000000000000000-mapping.dmp