Analysis

  • max time kernel
    150s
  • max time network
    11s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    13-05-2021 02:28

General

  • Target

    e5b03b94b3a30c6cbc2239052edfe92cc4b7456fcaf664b32e439c5e571c7e50.exe

  • Size

    37KB

  • MD5

    28c86684494054977a80990f240b0cdb

  • SHA1

    027fa7ed6b914f37f8c9b516be0622da80a8e582

  • SHA256

    e5b03b94b3a30c6cbc2239052edfe92cc4b7456fcaf664b32e439c5e571c7e50

  • SHA512

    164ba7d2a8e123862539e2b7fe58c84be8604344aba9acf7df57bc140c9be964847d1653d69f65dfdbe40ff1f5a3db0f00dc13e41cce7a8b7b1cf3ed0b877615

Score
10/10

Malware Config

Signatures

  • Upatre

    Upatre is a generic malware downloader.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e5b03b94b3a30c6cbc2239052edfe92cc4b7456fcaf664b32e439c5e571c7e50.exe
    "C:\Users\Admin\AppData\Local\Temp\e5b03b94b3a30c6cbc2239052edfe92cc4b7456fcaf664b32e439c5e571c7e50.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1072
    • C:\Users\Admin\AppData\Local\Temp\szgfw.exe
      "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
      2⤵
      • Executes dropped EXE
      PID:1524

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\szgfw.exe

    MD5

    68a937a939d8fe3a7d2c7af3fee09ec5

    SHA1

    d15870e5ec02147cfdb6d0f64fa636c901b04a80

    SHA256

    ca71c461156986927795d42f3f256a5f43ba040e107ffe5c7e5ec2835ee1e9f7

    SHA512

    2bee0b9b8802ee3a9b2393425bc8a390bfed41f58e642ff83da43333af426d6a9cfb5efdff22e418f690973aa69949919a9104e2dacb64257a3f0b86919f42d4

  • C:\Users\Admin\AppData\Local\Temp\szgfw.exe

    MD5

    68a937a939d8fe3a7d2c7af3fee09ec5

    SHA1

    d15870e5ec02147cfdb6d0f64fa636c901b04a80

    SHA256

    ca71c461156986927795d42f3f256a5f43ba040e107ffe5c7e5ec2835ee1e9f7

    SHA512

    2bee0b9b8802ee3a9b2393425bc8a390bfed41f58e642ff83da43333af426d6a9cfb5efdff22e418f690973aa69949919a9104e2dacb64257a3f0b86919f42d4

  • \Users\Admin\AppData\Local\Temp\szgfw.exe

    MD5

    68a937a939d8fe3a7d2c7af3fee09ec5

    SHA1

    d15870e5ec02147cfdb6d0f64fa636c901b04a80

    SHA256

    ca71c461156986927795d42f3f256a5f43ba040e107ffe5c7e5ec2835ee1e9f7

    SHA512

    2bee0b9b8802ee3a9b2393425bc8a390bfed41f58e642ff83da43333af426d6a9cfb5efdff22e418f690973aa69949919a9104e2dacb64257a3f0b86919f42d4

  • \Users\Admin\AppData\Local\Temp\szgfw.exe

    MD5

    68a937a939d8fe3a7d2c7af3fee09ec5

    SHA1

    d15870e5ec02147cfdb6d0f64fa636c901b04a80

    SHA256

    ca71c461156986927795d42f3f256a5f43ba040e107ffe5c7e5ec2835ee1e9f7

    SHA512

    2bee0b9b8802ee3a9b2393425bc8a390bfed41f58e642ff83da43333af426d6a9cfb5efdff22e418f690973aa69949919a9104e2dacb64257a3f0b86919f42d4

  • memory/1072-60-0x0000000075411000-0x0000000075413000-memory.dmp

    Filesize

    8KB

  • memory/1072-66-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

  • memory/1524-63-0x0000000000000000-mapping.dmp