Analysis

  • max time kernel
    150s
  • max time network
    111s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    11-05-2021 16:37

General

  • Target

    ad2e1f20fe9d1eecc926c5cf395c4387958dda6f88ec9ab139bb28dcfefc40f6.exe

  • Size

    33KB

  • MD5

    c691b4b4639c68dd1220bcf522546ed2

  • SHA1

    38474810e3c4921205e7e6f50db744d12adaee8c

  • SHA256

    ad2e1f20fe9d1eecc926c5cf395c4387958dda6f88ec9ab139bb28dcfefc40f6

  • SHA512

    bb894ad6ff1a363a4a5a0c84a04ae8dcbf8aa5ed929029ed21f9f245083b781a3ba6cfe0839ad6ca2113cd2b081d3bfaa17b8bfcd6300fb61c1ea14f4b1b923b

Score
10/10

Malware Config

Signatures

  • Upatre

    Upatre is a generic malware downloader.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ad2e1f20fe9d1eecc926c5cf395c4387958dda6f88ec9ab139bb28dcfefc40f6.exe
    "C:\Users\Admin\AppData\Local\Temp\ad2e1f20fe9d1eecc926c5cf395c4387958dda6f88ec9ab139bb28dcfefc40f6.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1852
    • C:\Users\Admin\AppData\Local\Temp\szgfw.exe
      "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
      2⤵
      • Executes dropped EXE
      PID:1640

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\szgfw.exe

    MD5

    459923b0346f5d12b9285f2c1efbc966

    SHA1

    674adbfbb581e7fa79318438aabcf390e9c2f14f

    SHA256

    64595694b056483dc34a5c432beb83a5003682f12c4893fe2d33d90a4eb1f521

    SHA512

    3f96eae2e0107dcb1fd9995d2002c9f5e96895879cb5d57f9e9b44cfb1a5ae9f66c3a9559d0ba222bf02ea92dbded6e98a7557b1a99e4b5feb845961b18807c6

  • C:\Users\Admin\AppData\Local\Temp\szgfw.exe

    MD5

    459923b0346f5d12b9285f2c1efbc966

    SHA1

    674adbfbb581e7fa79318438aabcf390e9c2f14f

    SHA256

    64595694b056483dc34a5c432beb83a5003682f12c4893fe2d33d90a4eb1f521

    SHA512

    3f96eae2e0107dcb1fd9995d2002c9f5e96895879cb5d57f9e9b44cfb1a5ae9f66c3a9559d0ba222bf02ea92dbded6e98a7557b1a99e4b5feb845961b18807c6

  • \Users\Admin\AppData\Local\Temp\szgfw.exe

    MD5

    459923b0346f5d12b9285f2c1efbc966

    SHA1

    674adbfbb581e7fa79318438aabcf390e9c2f14f

    SHA256

    64595694b056483dc34a5c432beb83a5003682f12c4893fe2d33d90a4eb1f521

    SHA512

    3f96eae2e0107dcb1fd9995d2002c9f5e96895879cb5d57f9e9b44cfb1a5ae9f66c3a9559d0ba222bf02ea92dbded6e98a7557b1a99e4b5feb845961b18807c6

  • \Users\Admin\AppData\Local\Temp\szgfw.exe

    MD5

    459923b0346f5d12b9285f2c1efbc966

    SHA1

    674adbfbb581e7fa79318438aabcf390e9c2f14f

    SHA256

    64595694b056483dc34a5c432beb83a5003682f12c4893fe2d33d90a4eb1f521

    SHA512

    3f96eae2e0107dcb1fd9995d2002c9f5e96895879cb5d57f9e9b44cfb1a5ae9f66c3a9559d0ba222bf02ea92dbded6e98a7557b1a99e4b5feb845961b18807c6

  • memory/1640-62-0x0000000000000000-mapping.dmp

  • memory/1852-59-0x0000000076A81000-0x0000000076A83000-memory.dmp

    Filesize

    8KB

  • memory/1852-65-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB