Analysis

  • max time kernel
    150s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    15-05-2021 14:45

General

  • Target

    cc6894249ef6551a1acc49084a5c8258fbeb86f65822f4bae9323dbe82b6ede6.exe

  • Size

    37KB

  • MD5

    be3ae3f329e4b10558bae1155b346fae

  • SHA1

    829259d0ad637af5c1251148477c67a02cd47dc0

  • SHA256

    cc6894249ef6551a1acc49084a5c8258fbeb86f65822f4bae9323dbe82b6ede6

  • SHA512

    dfdbfd2f5264f1904958fa32e46e375b5f081061bf546a19c809fa116327b9130665753a9100df03e9e9011ac9ec63f51d7cfbf220479383631ed21ace5363aa

Score
10/10

Malware Config

Signatures

  • Upatre

    Upatre is a generic malware downloader.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cc6894249ef6551a1acc49084a5c8258fbeb86f65822f4bae9323dbe82b6ede6.exe
    "C:\Users\Admin\AppData\Local\Temp\cc6894249ef6551a1acc49084a5c8258fbeb86f65822f4bae9323dbe82b6ede6.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1104
    • C:\Users\Admin\AppData\Local\Temp\szgfw.exe
      "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
      2⤵
      • Executes dropped EXE
      PID:1280

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\szgfw.exe

    MD5

    3039487b99a1683bd3dcdec6ff5078b1

    SHA1

    879298705c35b511d2705fb9f612b33c1d394c88

    SHA256

    28b750c806c8eaa665ef1cc0a939525e760f21480099114ad69a024f4037489e

    SHA512

    8f471c9e33dcc76a5baef53cf46310ca681db9ed93567d7428bf86a4f0f869be9cdb131908bd78dc885fe2d85a1ec56ddbb8ee3d1a5ee143756dee324aaa6a90

  • C:\Users\Admin\AppData\Local\Temp\szgfw.exe

    MD5

    3039487b99a1683bd3dcdec6ff5078b1

    SHA1

    879298705c35b511d2705fb9f612b33c1d394c88

    SHA256

    28b750c806c8eaa665ef1cc0a939525e760f21480099114ad69a024f4037489e

    SHA512

    8f471c9e33dcc76a5baef53cf46310ca681db9ed93567d7428bf86a4f0f869be9cdb131908bd78dc885fe2d85a1ec56ddbb8ee3d1a5ee143756dee324aaa6a90

  • \Users\Admin\AppData\Local\Temp\szgfw.exe

    MD5

    3039487b99a1683bd3dcdec6ff5078b1

    SHA1

    879298705c35b511d2705fb9f612b33c1d394c88

    SHA256

    28b750c806c8eaa665ef1cc0a939525e760f21480099114ad69a024f4037489e

    SHA512

    8f471c9e33dcc76a5baef53cf46310ca681db9ed93567d7428bf86a4f0f869be9cdb131908bd78dc885fe2d85a1ec56ddbb8ee3d1a5ee143756dee324aaa6a90

  • \Users\Admin\AppData\Local\Temp\szgfw.exe

    MD5

    3039487b99a1683bd3dcdec6ff5078b1

    SHA1

    879298705c35b511d2705fb9f612b33c1d394c88

    SHA256

    28b750c806c8eaa665ef1cc0a939525e760f21480099114ad69a024f4037489e

    SHA512

    8f471c9e33dcc76a5baef53cf46310ca681db9ed93567d7428bf86a4f0f869be9cdb131908bd78dc885fe2d85a1ec56ddbb8ee3d1a5ee143756dee324aaa6a90

  • memory/1104-60-0x0000000076E11000-0x0000000076E13000-memory.dmp

    Filesize

    8KB

  • memory/1104-66-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

  • memory/1280-63-0x0000000000000000-mapping.dmp