Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    17-05-2021 10:22

General

  • Target

    1254e16dc1a1c14b05173579267b82136ae16b0fe0d707d44e93f5979c9a3587.exe

  • Size

    7KB

  • MD5

    43bfc90edef02538f0833f1695f80970

  • SHA1

    b1e0702bfdf600fbc1f75c05066791887e43f2f8

  • SHA256

    1254e16dc1a1c14b05173579267b82136ae16b0fe0d707d44e93f5979c9a3587

  • SHA512

    87b258550920f4b8938183b14dc3e6e10e03da321ff7ec150094767ce10f99975db14af044d5e0f9fbade9868c068c8aa0a7372f3bd704cfe06fe3b495642064

Score
10/10

Malware Config

Signatures

  • Upatre

    Upatre is a generic malware downloader.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1254e16dc1a1c14b05173579267b82136ae16b0fe0d707d44e93f5979c9a3587.exe
    "C:\Users\Admin\AppData\Local\Temp\1254e16dc1a1c14b05173579267b82136ae16b0fe0d707d44e93f5979c9a3587.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4024
    • C:\Users\Admin\AppData\Local\Temp\szgfw.exe
      "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
      2⤵
      • Executes dropped EXE
      PID:692

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\szgfw.exe

    MD5

    9b2f70a1dd5f12e300da836364e2bfb6

    SHA1

    a69e373c122fb1cb1f7eac3cfb1508f117778176

    SHA256

    715335709bdb668cf50fa54ab2dd4738b0c42dc81351bc4fed774c72760a7f57

    SHA512

    7640648782e6f9dece84aa820ee3596646557444e1b04f244802f8537a6a220fee4e4dee17f2be1f7b5c53355f963dfef3a6ce11d423621209ab73a3efb9bc4f

  • C:\Users\Admin\AppData\Local\Temp\szgfw.exe

    MD5

    9b2f70a1dd5f12e300da836364e2bfb6

    SHA1

    a69e373c122fb1cb1f7eac3cfb1508f117778176

    SHA256

    715335709bdb668cf50fa54ab2dd4738b0c42dc81351bc4fed774c72760a7f57

    SHA512

    7640648782e6f9dece84aa820ee3596646557444e1b04f244802f8537a6a220fee4e4dee17f2be1f7b5c53355f963dfef3a6ce11d423621209ab73a3efb9bc4f

  • memory/692-114-0x0000000000000000-mapping.dmp