Analysis

  • max time kernel
    151s
  • max time network
    8s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    11-05-2021 12:51

General

  • Target

    dab7968169cf3106b7252b1272bc39a0403e1649def56d9c60bbc440c89f9c88.exe

  • Size

    37KB

  • MD5

    cc5c88fa08f78645b7c477c8816fa47e

  • SHA1

    e17359cdcde3d266137c685db604dbd9410f6ca9

  • SHA256

    dab7968169cf3106b7252b1272bc39a0403e1649def56d9c60bbc440c89f9c88

  • SHA512

    4bd152218cb3d70fea46080b006c1d75bd45d55eb811d991c382ff99df1340649de9cd7bcacbf84732f6f81ab8024a1127a1270905ab118a81a2be6fe4ad6607

Score
10/10

Malware Config

Signatures

  • Upatre

    Upatre is a generic malware downloader.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dab7968169cf3106b7252b1272bc39a0403e1649def56d9c60bbc440c89f9c88.exe
    "C:\Users\Admin\AppData\Local\Temp\dab7968169cf3106b7252b1272bc39a0403e1649def56d9c60bbc440c89f9c88.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:788
    • C:\Users\Admin\AppData\Local\Temp\szgfw.exe
      "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
      2⤵
      • Executes dropped EXE
      PID:1528

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\szgfw.exe

    MD5

    e65ac4bdd740b1288c96a9b97e551c35

    SHA1

    b3478e3c012adb81c9784e1c87a6fa4f370d296f

    SHA256

    5138b058a56169d153144e15ac44e197d4a69151df35706b958d7d1bc1e2a5d5

    SHA512

    8c8f99962c417cacbe0f29ca8130e0f4c991eddc4e8531884d496543ba040164f63d3c15143a97458909b451a45b86192d8ee4a20e26bae6f6ebe2678b2560e2

  • C:\Users\Admin\AppData\Local\Temp\szgfw.exe

    MD5

    e65ac4bdd740b1288c96a9b97e551c35

    SHA1

    b3478e3c012adb81c9784e1c87a6fa4f370d296f

    SHA256

    5138b058a56169d153144e15ac44e197d4a69151df35706b958d7d1bc1e2a5d5

    SHA512

    8c8f99962c417cacbe0f29ca8130e0f4c991eddc4e8531884d496543ba040164f63d3c15143a97458909b451a45b86192d8ee4a20e26bae6f6ebe2678b2560e2

  • \Users\Admin\AppData\Local\Temp\szgfw.exe

    MD5

    e65ac4bdd740b1288c96a9b97e551c35

    SHA1

    b3478e3c012adb81c9784e1c87a6fa4f370d296f

    SHA256

    5138b058a56169d153144e15ac44e197d4a69151df35706b958d7d1bc1e2a5d5

    SHA512

    8c8f99962c417cacbe0f29ca8130e0f4c991eddc4e8531884d496543ba040164f63d3c15143a97458909b451a45b86192d8ee4a20e26bae6f6ebe2678b2560e2

  • \Users\Admin\AppData\Local\Temp\szgfw.exe

    MD5

    e65ac4bdd740b1288c96a9b97e551c35

    SHA1

    b3478e3c012adb81c9784e1c87a6fa4f370d296f

    SHA256

    5138b058a56169d153144e15ac44e197d4a69151df35706b958d7d1bc1e2a5d5

    SHA512

    8c8f99962c417cacbe0f29ca8130e0f4c991eddc4e8531884d496543ba040164f63d3c15143a97458909b451a45b86192d8ee4a20e26bae6f6ebe2678b2560e2

  • memory/788-60-0x0000000075551000-0x0000000075553000-memory.dmp

    Filesize

    8KB

  • memory/788-66-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

  • memory/1528-63-0x0000000000000000-mapping.dmp