Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    11-05-2021 10:55

General

  • Target

    79e782e636beec54717d2244f16b677f10969bdb42633599a5a0f26f36c7460b.exe

  • Size

    36KB

  • MD5

    b17ab3bb0a553e09c1f0e8092c8e1e7e

  • SHA1

    d179576442e11cf7db07531e86c14317a39ef286

  • SHA256

    79e782e636beec54717d2244f16b677f10969bdb42633599a5a0f26f36c7460b

  • SHA512

    06896d08e205e63a30a0a16d075711b50a56cb737f27611896e8c707a6b95899f08d180bfe56dea2674d25ca22f9ccb45aab469fe40e426eb06fc50b56c3284c

Score
10/10

Malware Config

Signatures

  • Upatre

    Upatre is a generic malware downloader.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\79e782e636beec54717d2244f16b677f10969bdb42633599a5a0f26f36c7460b.exe
    "C:\Users\Admin\AppData\Local\Temp\79e782e636beec54717d2244f16b677f10969bdb42633599a5a0f26f36c7460b.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:904
    • C:\Users\Admin\AppData\Local\Temp\szgfw.exe
      "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
      2⤵
      • Executes dropped EXE
      PID:940

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\szgfw.exe

    MD5

    4ee2705fb4abb3c709a2e8d95bc3ac97

    SHA1

    f8c5f34fbe77de39ee3059bfe8362d14b7009184

    SHA256

    92bd2e43391e16158fd930f22706e22c5c3e7dd9b71e21c3f515da71b401f4cf

    SHA512

    a865fdb7ca7f71243921373c5e17a5110ac93f0eb76b441625173228e6de84c1e35f57dd11714973333cd0a763348f448cdbd56f146114312725656f76104324

  • C:\Users\Admin\AppData\Local\Temp\szgfw.exe

    MD5

    4ee2705fb4abb3c709a2e8d95bc3ac97

    SHA1

    f8c5f34fbe77de39ee3059bfe8362d14b7009184

    SHA256

    92bd2e43391e16158fd930f22706e22c5c3e7dd9b71e21c3f515da71b401f4cf

    SHA512

    a865fdb7ca7f71243921373c5e17a5110ac93f0eb76b441625173228e6de84c1e35f57dd11714973333cd0a763348f448cdbd56f146114312725656f76104324

  • memory/904-114-0x00000000001E0000-0x00000000001E1000-memory.dmp

    Filesize

    4KB

  • memory/940-115-0x0000000000000000-mapping.dmp

  • memory/940-118-0x0000000000410000-0x000000000055A000-memory.dmp

    Filesize

    1.3MB