Analysis
-
max time kernel
150s -
max time network
110s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
09-05-2021 15:52
Static task
static1
Behavioral task
behavioral1
Sample
c09b3fb462ff1463c60152469d0dc8a51a21166dc6c98112c36978e1ae079839.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
c09b3fb462ff1463c60152469d0dc8a51a21166dc6c98112c36978e1ae079839.exe
Resource
win10v20210410
General
-
Target
c09b3fb462ff1463c60152469d0dc8a51a21166dc6c98112c36978e1ae079839.exe
-
Size
34KB
-
MD5
ea08eda0ebfe0b8d19eba09b0b10606a
-
SHA1
0d40e71473f63c4af1e3290fa54c7e99340595ef
-
SHA256
c09b3fb462ff1463c60152469d0dc8a51a21166dc6c98112c36978e1ae079839
-
SHA512
4277efb532aae4bc783a199d45ba9203910c72b0ca13c989ca706fe311d3f2342293ac8be7a27d2d5647d9c73c90e76c5c7f9b84d320ff1389c3a8a05714bd45
Malware Config
Signatures
-
Upatre
Upatre is a generic malware downloader.
-
Executes dropped EXE 1 IoCs
Processes:
szgfw.exepid process 3444 szgfw.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
c09b3fb462ff1463c60152469d0dc8a51a21166dc6c98112c36978e1ae079839.exedescription pid process target process PID 2112 wrote to memory of 3444 2112 c09b3fb462ff1463c60152469d0dc8a51a21166dc6c98112c36978e1ae079839.exe szgfw.exe PID 2112 wrote to memory of 3444 2112 c09b3fb462ff1463c60152469d0dc8a51a21166dc6c98112c36978e1ae079839.exe szgfw.exe PID 2112 wrote to memory of 3444 2112 c09b3fb462ff1463c60152469d0dc8a51a21166dc6c98112c36978e1ae079839.exe szgfw.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c09b3fb462ff1463c60152469d0dc8a51a21166dc6c98112c36978e1ae079839.exe"C:\Users\Admin\AppData\Local\Temp\c09b3fb462ff1463c60152469d0dc8a51a21166dc6c98112c36978e1ae079839.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\szgfw.exe"C:\Users\Admin\AppData\Local\Temp\szgfw.exe"2⤵
- Executes dropped EXE
PID:3444
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
a9f2807ac2565d7f73a3c26fbf631ace
SHA1de058a9ea5dd1238dddc36d6b34ddf15e3508d3b
SHA25665c585e701cda3c21a7884fae8f7b3e5492347b48f6e6787a9cc13f5f62b3c5e
SHA512d31c49e58e43b158216843e5aa5e21a2943cacce4cdd4e2ae6efaac1096a44820344713167b14023a1333b3aa041fec801c13f282e8cfcc1e36baa0f46b8a138
-
MD5
a9f2807ac2565d7f73a3c26fbf631ace
SHA1de058a9ea5dd1238dddc36d6b34ddf15e3508d3b
SHA25665c585e701cda3c21a7884fae8f7b3e5492347b48f6e6787a9cc13f5f62b3c5e
SHA512d31c49e58e43b158216843e5aa5e21a2943cacce4cdd4e2ae6efaac1096a44820344713167b14023a1333b3aa041fec801c13f282e8cfcc1e36baa0f46b8a138