Analysis

  • max time kernel
    149s
  • max time network
    45s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    17-05-2021 10:34

General

  • Target

    fa4c429aba5232aa2d98dbf68228746714e50978c8cdb304e766c9b385303308.exe

  • Size

    42KB

  • MD5

    7d927e891d090be9edd8fd45e735261f

  • SHA1

    8b8e1bfe925f9af7fedd75a93c2f4f0280903c91

  • SHA256

    fa4c429aba5232aa2d98dbf68228746714e50978c8cdb304e766c9b385303308

  • SHA512

    5ad97895d7c1f37aa9dcacd161c13978fc4ee34f9baa5e1b985911dc2dd13333f4114e4dc291f1e6d66100ce97d61c4b6ab82e62a1c5c5889c7dca84b2519867

Score
10/10

Malware Config

Signatures

  • Upatre

    Upatre is a generic malware downloader.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fa4c429aba5232aa2d98dbf68228746714e50978c8cdb304e766c9b385303308.exe
    "C:\Users\Admin\AppData\Local\Temp\fa4c429aba5232aa2d98dbf68228746714e50978c8cdb304e766c9b385303308.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1984
    • C:\Users\Admin\AppData\Local\Temp\szgfw.exe
      "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
      2⤵
      • Executes dropped EXE
      PID:656

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\szgfw.exe

    MD5

    21a98deccc869e8ecbc39375701b8cb8

    SHA1

    5c32f776e4e4c021d0e0bcf2af0cdb508516663b

    SHA256

    ddcb8c12cc1a034c491f2924411bf22dd2ff69282aabf153e9f036de905769ed

    SHA512

    b30cf88f589ffab20323a2502115355db93a99404d05f07255527869dc4fff1d4edc20f906b500abdd64d5e41b63203b64372a8b52620b1f3fb9282ee4b7db96

  • C:\Users\Admin\AppData\Local\Temp\szgfw.exe

    MD5

    21a98deccc869e8ecbc39375701b8cb8

    SHA1

    5c32f776e4e4c021d0e0bcf2af0cdb508516663b

    SHA256

    ddcb8c12cc1a034c491f2924411bf22dd2ff69282aabf153e9f036de905769ed

    SHA512

    b30cf88f589ffab20323a2502115355db93a99404d05f07255527869dc4fff1d4edc20f906b500abdd64d5e41b63203b64372a8b52620b1f3fb9282ee4b7db96

  • \Users\Admin\AppData\Local\Temp\szgfw.exe

    MD5

    21a98deccc869e8ecbc39375701b8cb8

    SHA1

    5c32f776e4e4c021d0e0bcf2af0cdb508516663b

    SHA256

    ddcb8c12cc1a034c491f2924411bf22dd2ff69282aabf153e9f036de905769ed

    SHA512

    b30cf88f589ffab20323a2502115355db93a99404d05f07255527869dc4fff1d4edc20f906b500abdd64d5e41b63203b64372a8b52620b1f3fb9282ee4b7db96

  • \Users\Admin\AppData\Local\Temp\szgfw.exe

    MD5

    21a98deccc869e8ecbc39375701b8cb8

    SHA1

    5c32f776e4e4c021d0e0bcf2af0cdb508516663b

    SHA256

    ddcb8c12cc1a034c491f2924411bf22dd2ff69282aabf153e9f036de905769ed

    SHA512

    b30cf88f589ffab20323a2502115355db93a99404d05f07255527869dc4fff1d4edc20f906b500abdd64d5e41b63203b64372a8b52620b1f3fb9282ee4b7db96

  • memory/656-62-0x0000000000000000-mapping.dmp

  • memory/1984-59-0x0000000075AD1000-0x0000000075AD3000-memory.dmp

    Filesize

    8KB

  • memory/1984-65-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB