Analysis
-
max time kernel
150s -
max time network
9s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
09-05-2021 15:45
Static task
static1
Behavioral task
behavioral1
Sample
29842678dfaba53fedcf6506ab2c72c4e260be59ae624c00a0902b8f9704a7d6.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
29842678dfaba53fedcf6506ab2c72c4e260be59ae624c00a0902b8f9704a7d6.exe
Resource
win10v20210410
General
-
Target
29842678dfaba53fedcf6506ab2c72c4e260be59ae624c00a0902b8f9704a7d6.exe
-
Size
600KB
-
MD5
b9235f95acf17a9708b1341a3bd886aa
-
SHA1
1fd6ab9a7bdb1f5b05e3e07695036aa83de32fe2
-
SHA256
29842678dfaba53fedcf6506ab2c72c4e260be59ae624c00a0902b8f9704a7d6
-
SHA512
e765c3398353265fb4a3adfee8a4e111ddac32e76fd59b35de5e283ceea788e0ab31a60e0e2fc24f82515bb062f0c526529a09f401cbbd09085b3b02ce223f8d
Malware Config
Signatures
-
Upatre
Upatre is a generic malware downloader.
-
Executes dropped EXE 1 IoCs
Processes:
szgfw.exepid process 1192 szgfw.exe -
Loads dropped DLL 2 IoCs
Processes:
29842678dfaba53fedcf6506ab2c72c4e260be59ae624c00a0902b8f9704a7d6.exepid process 540 29842678dfaba53fedcf6506ab2c72c4e260be59ae624c00a0902b8f9704a7d6.exe 540 29842678dfaba53fedcf6506ab2c72c4e260be59ae624c00a0902b8f9704a7d6.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
29842678dfaba53fedcf6506ab2c72c4e260be59ae624c00a0902b8f9704a7d6.exedescription pid process target process PID 540 wrote to memory of 1192 540 29842678dfaba53fedcf6506ab2c72c4e260be59ae624c00a0902b8f9704a7d6.exe szgfw.exe PID 540 wrote to memory of 1192 540 29842678dfaba53fedcf6506ab2c72c4e260be59ae624c00a0902b8f9704a7d6.exe szgfw.exe PID 540 wrote to memory of 1192 540 29842678dfaba53fedcf6506ab2c72c4e260be59ae624c00a0902b8f9704a7d6.exe szgfw.exe PID 540 wrote to memory of 1192 540 29842678dfaba53fedcf6506ab2c72c4e260be59ae624c00a0902b8f9704a7d6.exe szgfw.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\29842678dfaba53fedcf6506ab2c72c4e260be59ae624c00a0902b8f9704a7d6.exe"C:\Users\Admin\AppData\Local\Temp\29842678dfaba53fedcf6506ab2c72c4e260be59ae624c00a0902b8f9704a7d6.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Users\Admin\AppData\Local\Temp\szgfw.exe"C:\Users\Admin\AppData\Local\Temp\szgfw.exe"2⤵
- Executes dropped EXE
PID:1192
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
78d8ff0dfb37b14be3c6cdec97a50eb1
SHA1ceb00f5bf84f972aa37df2b06abe0ad02d1098be
SHA256c764e5457d467822d93aa0baeaa942dabd14b26c85b6e1ba0c11a3cfb378b462
SHA51263aeee097b53f791e508c8d9e4c09a988f92bc5cd25d3f9fa292a37f75ac2608720d219e1ee8eddd086b508b8223b63d96d0659075dea9d022c2e59d40abce82
-
MD5
78d8ff0dfb37b14be3c6cdec97a50eb1
SHA1ceb00f5bf84f972aa37df2b06abe0ad02d1098be
SHA256c764e5457d467822d93aa0baeaa942dabd14b26c85b6e1ba0c11a3cfb378b462
SHA51263aeee097b53f791e508c8d9e4c09a988f92bc5cd25d3f9fa292a37f75ac2608720d219e1ee8eddd086b508b8223b63d96d0659075dea9d022c2e59d40abce82
-
MD5
78d8ff0dfb37b14be3c6cdec97a50eb1
SHA1ceb00f5bf84f972aa37df2b06abe0ad02d1098be
SHA256c764e5457d467822d93aa0baeaa942dabd14b26c85b6e1ba0c11a3cfb378b462
SHA51263aeee097b53f791e508c8d9e4c09a988f92bc5cd25d3f9fa292a37f75ac2608720d219e1ee8eddd086b508b8223b63d96d0659075dea9d022c2e59d40abce82
-
MD5
78d8ff0dfb37b14be3c6cdec97a50eb1
SHA1ceb00f5bf84f972aa37df2b06abe0ad02d1098be
SHA256c764e5457d467822d93aa0baeaa942dabd14b26c85b6e1ba0c11a3cfb378b462
SHA51263aeee097b53f791e508c8d9e4c09a988f92bc5cd25d3f9fa292a37f75ac2608720d219e1ee8eddd086b508b8223b63d96d0659075dea9d022c2e59d40abce82