Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
09-05-2021 21:31
Static task
static1
Behavioral task
behavioral1
Sample
553b571b59962b5ec12d33b905fc6637116a000ee0885fde30507b747bbe9637.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
553b571b59962b5ec12d33b905fc6637116a000ee0885fde30507b747bbe9637.exe
Resource
win10v20210410
General
-
Target
553b571b59962b5ec12d33b905fc6637116a000ee0885fde30507b747bbe9637.exe
-
Size
40KB
-
MD5
892d0ab3e1d48140e2e11790cfa37fe1
-
SHA1
27aeed4299d9996065fea1cbc7e431f709faa5d9
-
SHA256
553b571b59962b5ec12d33b905fc6637116a000ee0885fde30507b747bbe9637
-
SHA512
6e7c72819ca73f6c297e4d8bfbd6b1d3acc79c1e00d0c15854188621f211a21939efe332411ed6a4924c5e2fcc4aafbde105660ebd5ed36007da7b24518120b4
Malware Config
Signatures
-
Upatre
Upatre is a generic malware downloader.
-
Executes dropped EXE 1 IoCs
Processes:
szgfw.exepid process 2356 szgfw.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
553b571b59962b5ec12d33b905fc6637116a000ee0885fde30507b747bbe9637.exedescription pid process target process PID 3944 wrote to memory of 2356 3944 553b571b59962b5ec12d33b905fc6637116a000ee0885fde30507b747bbe9637.exe szgfw.exe PID 3944 wrote to memory of 2356 3944 553b571b59962b5ec12d33b905fc6637116a000ee0885fde30507b747bbe9637.exe szgfw.exe PID 3944 wrote to memory of 2356 3944 553b571b59962b5ec12d33b905fc6637116a000ee0885fde30507b747bbe9637.exe szgfw.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\553b571b59962b5ec12d33b905fc6637116a000ee0885fde30507b747bbe9637.exe"C:\Users\Admin\AppData\Local\Temp\553b571b59962b5ec12d33b905fc6637116a000ee0885fde30507b747bbe9637.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\szgfw.exe"C:\Users\Admin\AppData\Local\Temp\szgfw.exe"2⤵
- Executes dropped EXE
PID:2356
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
cccdf999601bf2813458a3bf89437925
SHA14238a56411d9399db9cd9fc8a857bec87ccb5c7f
SHA256830eb7df0b6a7ae6b36c9af22e0f06c00fff2f1abf10090ee60ba2fb714f9193
SHA51219c848c81200b1119c8b74bc9cf926f15255d079009609f8104d6da7910654329c8a56be2d09c71ce9ead7b9e04abbf395c44b8ed4b2b65cbae75e2609e97b7a
-
MD5
cccdf999601bf2813458a3bf89437925
SHA14238a56411d9399db9cd9fc8a857bec87ccb5c7f
SHA256830eb7df0b6a7ae6b36c9af22e0f06c00fff2f1abf10090ee60ba2fb714f9193
SHA51219c848c81200b1119c8b74bc9cf926f15255d079009609f8104d6da7910654329c8a56be2d09c71ce9ead7b9e04abbf395c44b8ed4b2b65cbae75e2609e97b7a