Analysis

  • max time kernel
    152s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    19-02-2022 18:43

General

  • Target

    f855ae77f9eae20b44e1a9df1cc8f78d5f5e886d70138ca76d624b73844b998b.exe

  • Size

    35KB

  • MD5

    4634508e493e2caa4e329c9757c9ad57

  • SHA1

    b409510960c04881d234065e1c3267686e70916b

  • SHA256

    f855ae77f9eae20b44e1a9df1cc8f78d5f5e886d70138ca76d624b73844b998b

  • SHA512

    708083daf894720de5c0e3d2c1a738d5da09704b8a2e2b5b0d418f99503b161023f2521d53b34c91881f2a90d339410cb851f6d550fcb54cb310b74c195ad0d6

Score
10/10

Malware Config

Signatures

  • Upatre

    Upatre is a generic malware downloader.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f855ae77f9eae20b44e1a9df1cc8f78d5f5e886d70138ca76d624b73844b998b.exe
    "C:\Users\Admin\AppData\Local\Temp\f855ae77f9eae20b44e1a9df1cc8f78d5f5e886d70138ca76d624b73844b998b.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1072
    • C:\Users\Admin\AppData\Local\Temp\szgfw.exe
      "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
      2⤵
      • Executes dropped EXE
      PID:268

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/268-60-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

  • memory/1072-54-0x0000000075D61000-0x0000000075D63000-memory.dmp

    Filesize

    8KB