Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
09-05-2021 15:22
Static task
static1
Behavioral task
behavioral1
Sample
df1934e161093894ea8bfcd0e119f0f81a0c2bd6cbd226eed67d4e5397d9e8c2.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
df1934e161093894ea8bfcd0e119f0f81a0c2bd6cbd226eed67d4e5397d9e8c2.exe
Resource
win10v20210410
General
-
Target
df1934e161093894ea8bfcd0e119f0f81a0c2bd6cbd226eed67d4e5397d9e8c2.exe
-
Size
33KB
-
MD5
b6c6d1633a45c00fafce7342da59af07
-
SHA1
88daf69924f052d93af9fe845317816d8e769453
-
SHA256
df1934e161093894ea8bfcd0e119f0f81a0c2bd6cbd226eed67d4e5397d9e8c2
-
SHA512
b70060e484fcdf1ada388855d98bcc0429fbf5d1e562c3c1d5e4ed70a04579c7810115e140a1cea8210d31740027d26a914cc978e8f714b25a3cfd9322877a17
Malware Config
Signatures
-
Upatre
Upatre is a generic malware downloader.
-
Executes dropped EXE 1 IoCs
Processes:
szgfw.exepid process 1500 szgfw.exe -
Loads dropped DLL 2 IoCs
Processes:
df1934e161093894ea8bfcd0e119f0f81a0c2bd6cbd226eed67d4e5397d9e8c2.exepid process 1268 df1934e161093894ea8bfcd0e119f0f81a0c2bd6cbd226eed67d4e5397d9e8c2.exe 1268 df1934e161093894ea8bfcd0e119f0f81a0c2bd6cbd226eed67d4e5397d9e8c2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
df1934e161093894ea8bfcd0e119f0f81a0c2bd6cbd226eed67d4e5397d9e8c2.exedescription pid process target process PID 1268 wrote to memory of 1500 1268 df1934e161093894ea8bfcd0e119f0f81a0c2bd6cbd226eed67d4e5397d9e8c2.exe szgfw.exe PID 1268 wrote to memory of 1500 1268 df1934e161093894ea8bfcd0e119f0f81a0c2bd6cbd226eed67d4e5397d9e8c2.exe szgfw.exe PID 1268 wrote to memory of 1500 1268 df1934e161093894ea8bfcd0e119f0f81a0c2bd6cbd226eed67d4e5397d9e8c2.exe szgfw.exe PID 1268 wrote to memory of 1500 1268 df1934e161093894ea8bfcd0e119f0f81a0c2bd6cbd226eed67d4e5397d9e8c2.exe szgfw.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\df1934e161093894ea8bfcd0e119f0f81a0c2bd6cbd226eed67d4e5397d9e8c2.exe"C:\Users\Admin\AppData\Local\Temp\df1934e161093894ea8bfcd0e119f0f81a0c2bd6cbd226eed67d4e5397d9e8c2.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\szgfw.exe"C:\Users\Admin\AppData\Local\Temp\szgfw.exe"2⤵
- Executes dropped EXE
PID:1500
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
62cf9fe09f64c66ae8bec043bf007036
SHA18f21beaf55dcd05716db7299a75b2726e6ccc4c5
SHA2562cfc417e559b822198013f3e49cfe1fbc36df7b75c6e29ec2c1b0e6bdf778033
SHA512f1041ef2b9d2a3c6984396857d5b4563bf2d4943fdf9b3679a94c18614b7280548257943ba1e161375bcc1d1395921021f3a5af831ca104f79a130ca07da0997
-
MD5
62cf9fe09f64c66ae8bec043bf007036
SHA18f21beaf55dcd05716db7299a75b2726e6ccc4c5
SHA2562cfc417e559b822198013f3e49cfe1fbc36df7b75c6e29ec2c1b0e6bdf778033
SHA512f1041ef2b9d2a3c6984396857d5b4563bf2d4943fdf9b3679a94c18614b7280548257943ba1e161375bcc1d1395921021f3a5af831ca104f79a130ca07da0997
-
MD5
62cf9fe09f64c66ae8bec043bf007036
SHA18f21beaf55dcd05716db7299a75b2726e6ccc4c5
SHA2562cfc417e559b822198013f3e49cfe1fbc36df7b75c6e29ec2c1b0e6bdf778033
SHA512f1041ef2b9d2a3c6984396857d5b4563bf2d4943fdf9b3679a94c18614b7280548257943ba1e161375bcc1d1395921021f3a5af831ca104f79a130ca07da0997
-
MD5
62cf9fe09f64c66ae8bec043bf007036
SHA18f21beaf55dcd05716db7299a75b2726e6ccc4c5
SHA2562cfc417e559b822198013f3e49cfe1fbc36df7b75c6e29ec2c1b0e6bdf778033
SHA512f1041ef2b9d2a3c6984396857d5b4563bf2d4943fdf9b3679a94c18614b7280548257943ba1e161375bcc1d1395921021f3a5af831ca104f79a130ca07da0997