Analysis
-
max time kernel
154s -
max time network
108s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
09-05-2021 21:41
Static task
static1
Behavioral task
behavioral1
Sample
8580d74afbec2e72276337a8ff5b1115bec88eba2fd2163b1e14585ec62a850e.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
8580d74afbec2e72276337a8ff5b1115bec88eba2fd2163b1e14585ec62a850e.exe
Resource
win10v20210408
General
-
Target
8580d74afbec2e72276337a8ff5b1115bec88eba2fd2163b1e14585ec62a850e.exe
-
Size
29KB
-
MD5
ad9ff9464f72456d9d4405acd40777f8
-
SHA1
3270f3f666507c363cc0c5089e835a9922217c80
-
SHA256
8580d74afbec2e72276337a8ff5b1115bec88eba2fd2163b1e14585ec62a850e
-
SHA512
dbec00ba7ef56dbf999c07df05330cae94889acb39f7267357349ddf68f8c34c1333403174df5413ccd0c0a1b163331799235ce39ecfd185320b4ceffa66322c
Malware Config
Signatures
-
Upatre
Upatre is a generic malware downloader.
-
Executes dropped EXE 1 IoCs
Processes:
szgfw.exepid process 1764 szgfw.exe -
Loads dropped DLL 2 IoCs
Processes:
8580d74afbec2e72276337a8ff5b1115bec88eba2fd2163b1e14585ec62a850e.exepid process 756 8580d74afbec2e72276337a8ff5b1115bec88eba2fd2163b1e14585ec62a850e.exe 756 8580d74afbec2e72276337a8ff5b1115bec88eba2fd2163b1e14585ec62a850e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
8580d74afbec2e72276337a8ff5b1115bec88eba2fd2163b1e14585ec62a850e.exedescription pid process target process PID 756 wrote to memory of 1764 756 8580d74afbec2e72276337a8ff5b1115bec88eba2fd2163b1e14585ec62a850e.exe szgfw.exe PID 756 wrote to memory of 1764 756 8580d74afbec2e72276337a8ff5b1115bec88eba2fd2163b1e14585ec62a850e.exe szgfw.exe PID 756 wrote to memory of 1764 756 8580d74afbec2e72276337a8ff5b1115bec88eba2fd2163b1e14585ec62a850e.exe szgfw.exe PID 756 wrote to memory of 1764 756 8580d74afbec2e72276337a8ff5b1115bec88eba2fd2163b1e14585ec62a850e.exe szgfw.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8580d74afbec2e72276337a8ff5b1115bec88eba2fd2163b1e14585ec62a850e.exe"C:\Users\Admin\AppData\Local\Temp\8580d74afbec2e72276337a8ff5b1115bec88eba2fd2163b1e14585ec62a850e.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Users\Admin\AppData\Local\Temp\szgfw.exe"C:\Users\Admin\AppData\Local\Temp\szgfw.exe"2⤵
- Executes dropped EXE
PID:1764
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
c0f95eabcd62311c871391c2cb43b63a
SHA1dd09f553ec80f979cea25a15023aa2b81bc82e27
SHA2565b8c0414ce355d8798811d313bd301f40d5955fcac3bdfd34b0609528a0bce10
SHA5127799365d19a01a6e4a6f9bedf13c3ce63347e134dc2f1848650ad7c1ada96f49138813939f48c273b5d61b257fc7a5e2b3d8414c78106f46a05fb7f513507554
-
MD5
c0f95eabcd62311c871391c2cb43b63a
SHA1dd09f553ec80f979cea25a15023aa2b81bc82e27
SHA2565b8c0414ce355d8798811d313bd301f40d5955fcac3bdfd34b0609528a0bce10
SHA5127799365d19a01a6e4a6f9bedf13c3ce63347e134dc2f1848650ad7c1ada96f49138813939f48c273b5d61b257fc7a5e2b3d8414c78106f46a05fb7f513507554
-
MD5
c0f95eabcd62311c871391c2cb43b63a
SHA1dd09f553ec80f979cea25a15023aa2b81bc82e27
SHA2565b8c0414ce355d8798811d313bd301f40d5955fcac3bdfd34b0609528a0bce10
SHA5127799365d19a01a6e4a6f9bedf13c3ce63347e134dc2f1848650ad7c1ada96f49138813939f48c273b5d61b257fc7a5e2b3d8414c78106f46a05fb7f513507554
-
MD5
c0f95eabcd62311c871391c2cb43b63a
SHA1dd09f553ec80f979cea25a15023aa2b81bc82e27
SHA2565b8c0414ce355d8798811d313bd301f40d5955fcac3bdfd34b0609528a0bce10
SHA5127799365d19a01a6e4a6f9bedf13c3ce63347e134dc2f1848650ad7c1ada96f49138813939f48c273b5d61b257fc7a5e2b3d8414c78106f46a05fb7f513507554