Analysis
-
max time kernel
154s -
max time network
153s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
09-05-2021 21:41
Static task
static1
Behavioral task
behavioral1
Sample
8580d74afbec2e72276337a8ff5b1115bec88eba2fd2163b1e14585ec62a850e.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
8580d74afbec2e72276337a8ff5b1115bec88eba2fd2163b1e14585ec62a850e.exe
Resource
win10v20210408
General
-
Target
8580d74afbec2e72276337a8ff5b1115bec88eba2fd2163b1e14585ec62a850e.exe
-
Size
29KB
-
MD5
ad9ff9464f72456d9d4405acd40777f8
-
SHA1
3270f3f666507c363cc0c5089e835a9922217c80
-
SHA256
8580d74afbec2e72276337a8ff5b1115bec88eba2fd2163b1e14585ec62a850e
-
SHA512
dbec00ba7ef56dbf999c07df05330cae94889acb39f7267357349ddf68f8c34c1333403174df5413ccd0c0a1b163331799235ce39ecfd185320b4ceffa66322c
Malware Config
Signatures
-
Upatre
Upatre is a generic malware downloader.
-
Executes dropped EXE 1 IoCs
Processes:
szgfw.exepid process 4200 szgfw.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
8580d74afbec2e72276337a8ff5b1115bec88eba2fd2163b1e14585ec62a850e.exedescription pid process target process PID 4652 wrote to memory of 4200 4652 8580d74afbec2e72276337a8ff5b1115bec88eba2fd2163b1e14585ec62a850e.exe szgfw.exe PID 4652 wrote to memory of 4200 4652 8580d74afbec2e72276337a8ff5b1115bec88eba2fd2163b1e14585ec62a850e.exe szgfw.exe PID 4652 wrote to memory of 4200 4652 8580d74afbec2e72276337a8ff5b1115bec88eba2fd2163b1e14585ec62a850e.exe szgfw.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8580d74afbec2e72276337a8ff5b1115bec88eba2fd2163b1e14585ec62a850e.exe"C:\Users\Admin\AppData\Local\Temp\8580d74afbec2e72276337a8ff5b1115bec88eba2fd2163b1e14585ec62a850e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\szgfw.exe"C:\Users\Admin\AppData\Local\Temp\szgfw.exe"2⤵
- Executes dropped EXE
PID:4200
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
c0f95eabcd62311c871391c2cb43b63a
SHA1dd09f553ec80f979cea25a15023aa2b81bc82e27
SHA2565b8c0414ce355d8798811d313bd301f40d5955fcac3bdfd34b0609528a0bce10
SHA5127799365d19a01a6e4a6f9bedf13c3ce63347e134dc2f1848650ad7c1ada96f49138813939f48c273b5d61b257fc7a5e2b3d8414c78106f46a05fb7f513507554
-
MD5
c0f95eabcd62311c871391c2cb43b63a
SHA1dd09f553ec80f979cea25a15023aa2b81bc82e27
SHA2565b8c0414ce355d8798811d313bd301f40d5955fcac3bdfd34b0609528a0bce10
SHA5127799365d19a01a6e4a6f9bedf13c3ce63347e134dc2f1848650ad7c1ada96f49138813939f48c273b5d61b257fc7a5e2b3d8414c78106f46a05fb7f513507554