Analysis

  • max time kernel
    150s
  • max time network
    140s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    11-05-2021 16:37

General

  • Target

    ad2e1f20fe9d1eecc926c5cf395c4387958dda6f88ec9ab139bb28dcfefc40f6.exe

  • Size

    33KB

  • MD5

    c691b4b4639c68dd1220bcf522546ed2

  • SHA1

    38474810e3c4921205e7e6f50db744d12adaee8c

  • SHA256

    ad2e1f20fe9d1eecc926c5cf395c4387958dda6f88ec9ab139bb28dcfefc40f6

  • SHA512

    bb894ad6ff1a363a4a5a0c84a04ae8dcbf8aa5ed929029ed21f9f245083b781a3ba6cfe0839ad6ca2113cd2b081d3bfaa17b8bfcd6300fb61c1ea14f4b1b923b

Score
10/10

Malware Config

Signatures

  • Upatre

    Upatre is a generic malware downloader.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ad2e1f20fe9d1eecc926c5cf395c4387958dda6f88ec9ab139bb28dcfefc40f6.exe
    "C:\Users\Admin\AppData\Local\Temp\ad2e1f20fe9d1eecc926c5cf395c4387958dda6f88ec9ab139bb28dcfefc40f6.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1808
    • C:\Users\Admin\AppData\Local\Temp\szgfw.exe
      "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
      2⤵
      • Executes dropped EXE
      PID:2788

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\szgfw.exe

    MD5

    459923b0346f5d12b9285f2c1efbc966

    SHA1

    674adbfbb581e7fa79318438aabcf390e9c2f14f

    SHA256

    64595694b056483dc34a5c432beb83a5003682f12c4893fe2d33d90a4eb1f521

    SHA512

    3f96eae2e0107dcb1fd9995d2002c9f5e96895879cb5d57f9e9b44cfb1a5ae9f66c3a9559d0ba222bf02ea92dbded6e98a7557b1a99e4b5feb845961b18807c6

  • C:\Users\Admin\AppData\Local\Temp\szgfw.exe

    MD5

    459923b0346f5d12b9285f2c1efbc966

    SHA1

    674adbfbb581e7fa79318438aabcf390e9c2f14f

    SHA256

    64595694b056483dc34a5c432beb83a5003682f12c4893fe2d33d90a4eb1f521

    SHA512

    3f96eae2e0107dcb1fd9995d2002c9f5e96895879cb5d57f9e9b44cfb1a5ae9f66c3a9559d0ba222bf02ea92dbded6e98a7557b1a99e4b5feb845961b18807c6

  • memory/1808-117-0x0000000000640000-0x0000000000641000-memory.dmp

    Filesize

    4KB

  • memory/2788-114-0x0000000000000000-mapping.dmp

  • memory/2788-118-0x0000000000460000-0x000000000050E000-memory.dmp

    Filesize

    696KB