Analysis

  • max time kernel
    149s
  • max time network
    57s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    15-05-2021 08:00

General

  • Target

    e4e84c5e7336ad0bbf41b623aee4b7956f7a0533b94194ec8fa24b922a9b7b31.exe

  • Size

    33KB

  • MD5

    ba8678187e660eabc6ff6a9201c2c02b

  • SHA1

    e55a172673df0a22b813f559deb7161eaad54883

  • SHA256

    e4e84c5e7336ad0bbf41b623aee4b7956f7a0533b94194ec8fa24b922a9b7b31

  • SHA512

    10473f4ccd35966117326b631c5df4755aceab985a9b389e1ec7125a71e44929a28019d0e8d316062406169bed4fbc8f1ca0cf3225f9a984b4eb288e7e7fe72a

Score
10/10

Malware Config

Signatures

  • Upatre

    Upatre is a generic malware downloader.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e4e84c5e7336ad0bbf41b623aee4b7956f7a0533b94194ec8fa24b922a9b7b31.exe
    "C:\Users\Admin\AppData\Local\Temp\e4e84c5e7336ad0bbf41b623aee4b7956f7a0533b94194ec8fa24b922a9b7b31.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1724
    • C:\Users\Admin\AppData\Local\Temp\szgfw.exe
      "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
      2⤵
      • Executes dropped EXE
      PID:828

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\szgfw.exe

    MD5

    e5a56fdf31338009071c2f2628332a27

    SHA1

    977e6a9833f3d27f6e08df147b9d65baccf6f058

    SHA256

    108b9f3b24eaa8348472e5323b693513084c15e785eedca4749c7b3f9e5e3a9e

    SHA512

    9284e600516aeedd805028943e488df59433f9deaf03e8f797b7bd528468c8c6a4bcce6afaf1b33afc5ee7d923ad045bf0b6a3f428d852113521bc280d9c67c0

  • C:\Users\Admin\AppData\Local\Temp\szgfw.exe

    MD5

    e5a56fdf31338009071c2f2628332a27

    SHA1

    977e6a9833f3d27f6e08df147b9d65baccf6f058

    SHA256

    108b9f3b24eaa8348472e5323b693513084c15e785eedca4749c7b3f9e5e3a9e

    SHA512

    9284e600516aeedd805028943e488df59433f9deaf03e8f797b7bd528468c8c6a4bcce6afaf1b33afc5ee7d923ad045bf0b6a3f428d852113521bc280d9c67c0

  • \Users\Admin\AppData\Local\Temp\szgfw.exe

    MD5

    e5a56fdf31338009071c2f2628332a27

    SHA1

    977e6a9833f3d27f6e08df147b9d65baccf6f058

    SHA256

    108b9f3b24eaa8348472e5323b693513084c15e785eedca4749c7b3f9e5e3a9e

    SHA512

    9284e600516aeedd805028943e488df59433f9deaf03e8f797b7bd528468c8c6a4bcce6afaf1b33afc5ee7d923ad045bf0b6a3f428d852113521bc280d9c67c0

  • \Users\Admin\AppData\Local\Temp\szgfw.exe

    MD5

    e5a56fdf31338009071c2f2628332a27

    SHA1

    977e6a9833f3d27f6e08df147b9d65baccf6f058

    SHA256

    108b9f3b24eaa8348472e5323b693513084c15e785eedca4749c7b3f9e5e3a9e

    SHA512

    9284e600516aeedd805028943e488df59433f9deaf03e8f797b7bd528468c8c6a4bcce6afaf1b33afc5ee7d923ad045bf0b6a3f428d852113521bc280d9c67c0

  • memory/828-62-0x0000000000000000-mapping.dmp

  • memory/1724-59-0x00000000769B1000-0x00000000769B3000-memory.dmp

    Filesize

    8KB

  • memory/1724-65-0x00000000003C0000-0x00000000003C1000-memory.dmp

    Filesize

    4KB