Analysis

  • max time kernel
    150s
  • max time network
    60s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    15-05-2021 04:02

General

  • Target

    fb39cc980f61715880a96484e377f963a9a9598580e70f43c1ff762cd2355811.exe

  • Size

    36KB

  • MD5

    c95bda00adb0e51860ddd1f7b04c45d8

  • SHA1

    c6d4c43a50a2f9d5c54ec32674d0c6e37154dc99

  • SHA256

    fb39cc980f61715880a96484e377f963a9a9598580e70f43c1ff762cd2355811

  • SHA512

    3f772b5411fd804d28e0116a5ef290533731b9ee0f0da0ac5e5e6038e85e0f48a1c4afb888b92887e7fe43f351d59ea5e70013655480f3426bf0678615e5d6a7

Score
10/10

Malware Config

Signatures

  • Upatre

    Upatre is a generic malware downloader.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fb39cc980f61715880a96484e377f963a9a9598580e70f43c1ff762cd2355811.exe
    "C:\Users\Admin\AppData\Local\Temp\fb39cc980f61715880a96484e377f963a9a9598580e70f43c1ff762cd2355811.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4804
    • C:\Users\Admin\AppData\Local\Temp\szgfw.exe
      "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
      2⤵
      • Executes dropped EXE
      PID:2432

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\szgfw.exe

    MD5

    a147122d6b5c5e82dafa3ddf92bcf002

    SHA1

    9d570d530598df4bd070ea68c5e52c749d50884b

    SHA256

    75b48d654209177407ae2b12165f0bd8238b18e12c1ba51e3453ff6be55760ce

    SHA512

    19fad02cd65b527ae20720293d7612a022052ae3cd504e953ccb0f5d2995c6068e26637504376dbe7c1129d18e3905442d1d6478c6660f014345875ca1f355b2

  • C:\Users\Admin\AppData\Local\Temp\szgfw.exe

    MD5

    a147122d6b5c5e82dafa3ddf92bcf002

    SHA1

    9d570d530598df4bd070ea68c5e52c749d50884b

    SHA256

    75b48d654209177407ae2b12165f0bd8238b18e12c1ba51e3453ff6be55760ce

    SHA512

    19fad02cd65b527ae20720293d7612a022052ae3cd504e953ccb0f5d2995c6068e26637504376dbe7c1129d18e3905442d1d6478c6660f014345875ca1f355b2

  • memory/2432-115-0x0000000000000000-mapping.dmp

  • memory/4804-114-0x0000000002470000-0x0000000002471000-memory.dmp

    Filesize

    4KB