Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    11-05-2021 09:15

General

  • Target

    d65fbf0bc3551b89b23313cd2c436790b63da1f439bcc1d453beca6e074b3df4.exe

  • Size

    30KB

  • MD5

    9134692f22fad4dac2bbca7c8943d147

  • SHA1

    805843a4d9694d0105f18bb0dc08c246aae99130

  • SHA256

    d65fbf0bc3551b89b23313cd2c436790b63da1f439bcc1d453beca6e074b3df4

  • SHA512

    f5472fd3dd872636fa6d98a00b8c875499a434f8cc67afa582ae8d286e401ac1bd8bdc5ece4ee6cb4e1a7e3010bf8e1919051892a4de7f86267b049120d269f8

Score
10/10

Malware Config

Signatures

  • Upatre

    Upatre is a generic malware downloader.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d65fbf0bc3551b89b23313cd2c436790b63da1f439bcc1d453beca6e074b3df4.exe
    "C:\Users\Admin\AppData\Local\Temp\d65fbf0bc3551b89b23313cd2c436790b63da1f439bcc1d453beca6e074b3df4.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3144
    • C:\Users\Admin\AppData\Local\Temp\szgfw.exe
      "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
      2⤵
      • Executes dropped EXE
      PID:196

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\szgfw.exe

    MD5

    de84d360452c17f7a4945151033c54e5

    SHA1

    23b58d48fb331f27ae3b74beb7c2284d0f15c877

    SHA256

    cfe0ec03f468475aea702d52193846b6592ae51146456e9a51d87e3a1af70270

    SHA512

    a42e50cd1e6ce9e07c49797ca65a7a075c8e7d05cc42451da8efe5eb21617c82af6f6ed76975552f5091e2a0a9954a9476ae1512343cc95978e385bceaadc293

  • C:\Users\Admin\AppData\Local\Temp\szgfw.exe

    MD5

    de84d360452c17f7a4945151033c54e5

    SHA1

    23b58d48fb331f27ae3b74beb7c2284d0f15c877

    SHA256

    cfe0ec03f468475aea702d52193846b6592ae51146456e9a51d87e3a1af70270

    SHA512

    a42e50cd1e6ce9e07c49797ca65a7a075c8e7d05cc42451da8efe5eb21617c82af6f6ed76975552f5091e2a0a9954a9476ae1512343cc95978e385bceaadc293

  • memory/196-114-0x0000000000000000-mapping.dmp

  • memory/196-118-0x0000000000470000-0x000000000051E000-memory.dmp

    Filesize

    696KB

  • memory/3144-117-0x0000000000410000-0x00000000004BE000-memory.dmp

    Filesize

    696KB