Analysis
-
max time kernel
150s -
max time network
116s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
09-05-2021 15:59
Static task
static1
Behavioral task
behavioral1
Sample
1d8dca13d26cc8cdb4d463bfef8844341924dbffe556e573f30ef5bfd01692bf.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
1d8dca13d26cc8cdb4d463bfef8844341924dbffe556e573f30ef5bfd01692bf.exe
Resource
win10v20210410
General
-
Target
1d8dca13d26cc8cdb4d463bfef8844341924dbffe556e573f30ef5bfd01692bf.exe
-
Size
37KB
-
MD5
e78fb687164911c5d5286a1c2b6b37d6
-
SHA1
f4d4b53ab351105ba59f02ca95cd4dd87366048c
-
SHA256
1d8dca13d26cc8cdb4d463bfef8844341924dbffe556e573f30ef5bfd01692bf
-
SHA512
c2c22cdba07c8ca2bd1fbcedd0e3cd304c5508d814316c13d5cf3c581df98cd6799bcb01ee211473cb3619d4faea2abba35168a31fd9805ffcc925da387803ca
Malware Config
Signatures
-
Upatre
Upatre is a generic malware downloader.
-
Executes dropped EXE 1 IoCs
Processes:
szgfw.exepid process 3332 szgfw.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
1d8dca13d26cc8cdb4d463bfef8844341924dbffe556e573f30ef5bfd01692bf.exedescription pid process target process PID 2112 wrote to memory of 3332 2112 1d8dca13d26cc8cdb4d463bfef8844341924dbffe556e573f30ef5bfd01692bf.exe szgfw.exe PID 2112 wrote to memory of 3332 2112 1d8dca13d26cc8cdb4d463bfef8844341924dbffe556e573f30ef5bfd01692bf.exe szgfw.exe PID 2112 wrote to memory of 3332 2112 1d8dca13d26cc8cdb4d463bfef8844341924dbffe556e573f30ef5bfd01692bf.exe szgfw.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1d8dca13d26cc8cdb4d463bfef8844341924dbffe556e573f30ef5bfd01692bf.exe"C:\Users\Admin\AppData\Local\Temp\1d8dca13d26cc8cdb4d463bfef8844341924dbffe556e573f30ef5bfd01692bf.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\szgfw.exe"C:\Users\Admin\AppData\Local\Temp\szgfw.exe"2⤵
- Executes dropped EXE
PID:3332
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
67beba019ff85297906cca3842444494
SHA137a177d838de662a8043c0fd80f447f8595e2ac6
SHA256d887f10b870f507538bc507214252c7ed490ea322743c5ab5a65067436417d82
SHA512b7aa4fad2f67f44f9ca3021183258487ae40c4d32c1589854e7baa78b565c6bdd7aca347dcda6db72fe5c49d3bb5b9766ff5c7353721dd7da00037f992572704
-
MD5
67beba019ff85297906cca3842444494
SHA137a177d838de662a8043c0fd80f447f8595e2ac6
SHA256d887f10b870f507538bc507214252c7ed490ea322743c5ab5a65067436417d82
SHA512b7aa4fad2f67f44f9ca3021183258487ae40c4d32c1589854e7baa78b565c6bdd7aca347dcda6db72fe5c49d3bb5b9766ff5c7353721dd7da00037f992572704