Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    11-05-2021 12:51

General

  • Target

    dab7968169cf3106b7252b1272bc39a0403e1649def56d9c60bbc440c89f9c88.exe

  • Size

    37KB

  • MD5

    cc5c88fa08f78645b7c477c8816fa47e

  • SHA1

    e17359cdcde3d266137c685db604dbd9410f6ca9

  • SHA256

    dab7968169cf3106b7252b1272bc39a0403e1649def56d9c60bbc440c89f9c88

  • SHA512

    4bd152218cb3d70fea46080b006c1d75bd45d55eb811d991c382ff99df1340649de9cd7bcacbf84732f6f81ab8024a1127a1270905ab118a81a2be6fe4ad6607

Score
10/10

Malware Config

Signatures

  • Upatre

    Upatre is a generic malware downloader.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dab7968169cf3106b7252b1272bc39a0403e1649def56d9c60bbc440c89f9c88.exe
    "C:\Users\Admin\AppData\Local\Temp\dab7968169cf3106b7252b1272bc39a0403e1649def56d9c60bbc440c89f9c88.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1840
    • C:\Users\Admin\AppData\Local\Temp\szgfw.exe
      "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
      2⤵
      • Executes dropped EXE
      PID:4064

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\szgfw.exe

    MD5

    e65ac4bdd740b1288c96a9b97e551c35

    SHA1

    b3478e3c012adb81c9784e1c87a6fa4f370d296f

    SHA256

    5138b058a56169d153144e15ac44e197d4a69151df35706b958d7d1bc1e2a5d5

    SHA512

    8c8f99962c417cacbe0f29ca8130e0f4c991eddc4e8531884d496543ba040164f63d3c15143a97458909b451a45b86192d8ee4a20e26bae6f6ebe2678b2560e2

  • C:\Users\Admin\AppData\Local\Temp\szgfw.exe

    MD5

    e65ac4bdd740b1288c96a9b97e551c35

    SHA1

    b3478e3c012adb81c9784e1c87a6fa4f370d296f

    SHA256

    5138b058a56169d153144e15ac44e197d4a69151df35706b958d7d1bc1e2a5d5

    SHA512

    8c8f99962c417cacbe0f29ca8130e0f4c991eddc4e8531884d496543ba040164f63d3c15143a97458909b451a45b86192d8ee4a20e26bae6f6ebe2678b2560e2

  • memory/1840-117-0x00000000004F0000-0x000000000063A000-memory.dmp

    Filesize

    1.3MB

  • memory/4064-114-0x0000000000000000-mapping.dmp

  • memory/4064-118-0x0000000000640000-0x0000000000641000-memory.dmp

    Filesize

    4KB