Analysis

  • max time kernel
    150s
  • max time network
    41s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    15-05-2021 05:42

General

  • Target

    8186e6a8a8747a1b8f79b38fe39e7b408ea2aa35af176db36431b15dacf0d636.exe

  • Size

    35KB

  • MD5

    cfcd8e2d980e20e7ef68af9183b662f9

  • SHA1

    ac274727613272df00140e018f972ace602949fa

  • SHA256

    8186e6a8a8747a1b8f79b38fe39e7b408ea2aa35af176db36431b15dacf0d636

  • SHA512

    d5b25190dcbb84b23958df7152289e93d568984fd0625b42c35f8ae32dd9858d8bbbb02e360e124b2c18388747db55d799c7c8ab866071f1c5f3658d480b47ad

Score
10/10

Malware Config

Signatures

  • Upatre

    Upatre is a generic malware downloader.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8186e6a8a8747a1b8f79b38fe39e7b408ea2aa35af176db36431b15dacf0d636.exe
    "C:\Users\Admin\AppData\Local\Temp\8186e6a8a8747a1b8f79b38fe39e7b408ea2aa35af176db36431b15dacf0d636.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1976
    • C:\Users\Admin\AppData\Local\Temp\szgfw.exe
      "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
      2⤵
      • Executes dropped EXE
      PID:1420

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\szgfw.exe

    MD5

    a29de8212861a037729520db0eaa8c51

    SHA1

    bb0a2d14bd8a3385862c883009c3ad71e2c88918

    SHA256

    f42fcc49aed6ccbb6d2e2710b686a4c81f89bfa19af71a2225ee7f6c358004d4

    SHA512

    49926fcaa3899ac66453228310b4683843872a1fa2997b794fda120ebe76d43abed05f801f3d8f3505b77e17c31419f524edab09d4d2f8a8e4074b1f1271bcad

  • C:\Users\Admin\AppData\Local\Temp\szgfw.exe

    MD5

    a29de8212861a037729520db0eaa8c51

    SHA1

    bb0a2d14bd8a3385862c883009c3ad71e2c88918

    SHA256

    f42fcc49aed6ccbb6d2e2710b686a4c81f89bfa19af71a2225ee7f6c358004d4

    SHA512

    49926fcaa3899ac66453228310b4683843872a1fa2997b794fda120ebe76d43abed05f801f3d8f3505b77e17c31419f524edab09d4d2f8a8e4074b1f1271bcad

  • \Users\Admin\AppData\Local\Temp\szgfw.exe

    MD5

    a29de8212861a037729520db0eaa8c51

    SHA1

    bb0a2d14bd8a3385862c883009c3ad71e2c88918

    SHA256

    f42fcc49aed6ccbb6d2e2710b686a4c81f89bfa19af71a2225ee7f6c358004d4

    SHA512

    49926fcaa3899ac66453228310b4683843872a1fa2997b794fda120ebe76d43abed05f801f3d8f3505b77e17c31419f524edab09d4d2f8a8e4074b1f1271bcad

  • \Users\Admin\AppData\Local\Temp\szgfw.exe

    MD5

    a29de8212861a037729520db0eaa8c51

    SHA1

    bb0a2d14bd8a3385862c883009c3ad71e2c88918

    SHA256

    f42fcc49aed6ccbb6d2e2710b686a4c81f89bfa19af71a2225ee7f6c358004d4

    SHA512

    49926fcaa3899ac66453228310b4683843872a1fa2997b794fda120ebe76d43abed05f801f3d8f3505b77e17c31419f524edab09d4d2f8a8e4074b1f1271bcad

  • memory/1420-62-0x0000000000000000-mapping.dmp

  • memory/1976-59-0x0000000075DA1000-0x0000000075DA3000-memory.dmp

    Filesize

    8KB

  • memory/1976-65-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB