Analysis

  • max time kernel
    150s
  • max time network
    110s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    11-05-2021 17:02

General

  • Target

    09211ba367c0996bfdfe286794fc5cdcd2d925b132dd60beb7775765f5a4ee8f.exe

  • Size

    131KB

  • MD5

    8cf7d4d6ba709db12eb5774027148544

  • SHA1

    c7e3435c7960cb306a9ff82766f150c42e758f88

  • SHA256

    09211ba367c0996bfdfe286794fc5cdcd2d925b132dd60beb7775765f5a4ee8f

  • SHA512

    a048e8071ddba74ada9328f317bf7480bf96acdf2899d131c4495926ebd586bbcd3ff22ca8e3b227cd4e2f425c11d0baf606769269e2a6c99c85e688cf4242f1

Score
10/10

Malware Config

Signatures

  • Upatre

    Upatre is a generic malware downloader.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\09211ba367c0996bfdfe286794fc5cdcd2d925b132dd60beb7775765f5a4ee8f.exe
    "C:\Users\Admin\AppData\Local\Temp\09211ba367c0996bfdfe286794fc5cdcd2d925b132dd60beb7775765f5a4ee8f.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:796
    • C:\Users\Admin\AppData\Local\Temp\szgfw.exe
      "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
      2⤵
      • Executes dropped EXE
      PID:3636

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\szgfw.exe

    MD5

    86282e7d0513a3b113dca86b2987f4a9

    SHA1

    d880b4dc8d79bb61bb412c52449c66dd157a468c

    SHA256

    91234c2dc8677d19cd5f5d2dc62ce3292081a0fe663c1c959a0ef343ae3c5bca

    SHA512

    6e8d8eaf7dfa85af66b137dccd45b687983c20c0f90288c11cc6e660f255b74730fa9e1eab46fb47ea326f6312e682d168da07683823b5bbf6c2ff9cc23c3dc9

  • C:\Users\Admin\AppData\Local\Temp\szgfw.exe

    MD5

    86282e7d0513a3b113dca86b2987f4a9

    SHA1

    d880b4dc8d79bb61bb412c52449c66dd157a468c

    SHA256

    91234c2dc8677d19cd5f5d2dc62ce3292081a0fe663c1c959a0ef343ae3c5bca

    SHA512

    6e8d8eaf7dfa85af66b137dccd45b687983c20c0f90288c11cc6e660f255b74730fa9e1eab46fb47ea326f6312e682d168da07683823b5bbf6c2ff9cc23c3dc9

  • memory/796-114-0x00000000004A0000-0x00000000004A1000-memory.dmp

    Filesize

    4KB

  • memory/3636-115-0x0000000000000000-mapping.dmp

  • memory/3636-118-0x0000000000460000-0x000000000050E000-memory.dmp

    Filesize

    696KB