Analysis
-
max time kernel
149s -
max time network
83s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
09-05-2021 15:25
Static task
static1
Behavioral task
behavioral1
Sample
810ac81f9724b131623078b016ad7ba79c86d8a9bafa04277c9bf55b4c1d86f5.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
810ac81f9724b131623078b016ad7ba79c86d8a9bafa04277c9bf55b4c1d86f5.exe
Resource
win10v20210410
General
-
Target
810ac81f9724b131623078b016ad7ba79c86d8a9bafa04277c9bf55b4c1d86f5.exe
-
Size
32KB
-
MD5
b8807b7f7d6ab2a736f6fd32f342580d
-
SHA1
0e1ca131e78f88e76365f003d27c150b74a6ab73
-
SHA256
810ac81f9724b131623078b016ad7ba79c86d8a9bafa04277c9bf55b4c1d86f5
-
SHA512
d9f150fc4b1655618046d822e86cecd0ab1a4d1f93818cab71e97b8e6e4e007e2cf5727d14771409506e8683da4106a5662a69aeeca1eb1f319481c1e255ba02
Malware Config
Signatures
-
Upatre
Upatre is a generic malware downloader.
-
Executes dropped EXE 1 IoCs
Processes:
szgfw.exepid process 1668 szgfw.exe -
Loads dropped DLL 2 IoCs
Processes:
810ac81f9724b131623078b016ad7ba79c86d8a9bafa04277c9bf55b4c1d86f5.exepid process 1076 810ac81f9724b131623078b016ad7ba79c86d8a9bafa04277c9bf55b4c1d86f5.exe 1076 810ac81f9724b131623078b016ad7ba79c86d8a9bafa04277c9bf55b4c1d86f5.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
810ac81f9724b131623078b016ad7ba79c86d8a9bafa04277c9bf55b4c1d86f5.exedescription pid process target process PID 1076 wrote to memory of 1668 1076 810ac81f9724b131623078b016ad7ba79c86d8a9bafa04277c9bf55b4c1d86f5.exe szgfw.exe PID 1076 wrote to memory of 1668 1076 810ac81f9724b131623078b016ad7ba79c86d8a9bafa04277c9bf55b4c1d86f5.exe szgfw.exe PID 1076 wrote to memory of 1668 1076 810ac81f9724b131623078b016ad7ba79c86d8a9bafa04277c9bf55b4c1d86f5.exe szgfw.exe PID 1076 wrote to memory of 1668 1076 810ac81f9724b131623078b016ad7ba79c86d8a9bafa04277c9bf55b4c1d86f5.exe szgfw.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\810ac81f9724b131623078b016ad7ba79c86d8a9bafa04277c9bf55b4c1d86f5.exe"C:\Users\Admin\AppData\Local\Temp\810ac81f9724b131623078b016ad7ba79c86d8a9bafa04277c9bf55b4c1d86f5.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\szgfw.exe"C:\Users\Admin\AppData\Local\Temp\szgfw.exe"2⤵
- Executes dropped EXE
PID:1668
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
100b9423579eb0e0e8fdcbb3bcc06b53
SHA1b78999b7220ee457cef44651f186514dc4ad100b
SHA256f719726be26065a1447f1dca1efcd06652c7501178c2c0cebc53d34f2f0052c6
SHA512d1ad87ce55e89dc9f9c6d6be649123c05a8ad3c40944a26f3922a7454e7869165eac5798721df94aa9a27e3a6d6149d41f13c18d6a243b1e7ce1aecbb0c578d3
-
MD5
100b9423579eb0e0e8fdcbb3bcc06b53
SHA1b78999b7220ee457cef44651f186514dc4ad100b
SHA256f719726be26065a1447f1dca1efcd06652c7501178c2c0cebc53d34f2f0052c6
SHA512d1ad87ce55e89dc9f9c6d6be649123c05a8ad3c40944a26f3922a7454e7869165eac5798721df94aa9a27e3a6d6149d41f13c18d6a243b1e7ce1aecbb0c578d3
-
MD5
100b9423579eb0e0e8fdcbb3bcc06b53
SHA1b78999b7220ee457cef44651f186514dc4ad100b
SHA256f719726be26065a1447f1dca1efcd06652c7501178c2c0cebc53d34f2f0052c6
SHA512d1ad87ce55e89dc9f9c6d6be649123c05a8ad3c40944a26f3922a7454e7869165eac5798721df94aa9a27e3a6d6149d41f13c18d6a243b1e7ce1aecbb0c578d3
-
MD5
100b9423579eb0e0e8fdcbb3bcc06b53
SHA1b78999b7220ee457cef44651f186514dc4ad100b
SHA256f719726be26065a1447f1dca1efcd06652c7501178c2c0cebc53d34f2f0052c6
SHA512d1ad87ce55e89dc9f9c6d6be649123c05a8ad3c40944a26f3922a7454e7869165eac5798721df94aa9a27e3a6d6149d41f13c18d6a243b1e7ce1aecbb0c578d3