Analysis
-
max time kernel
150s -
max time network
112s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
09-05-2021 21:49
Static task
static1
Behavioral task
behavioral1
Sample
7c4c021dd732102212db340d731a2d897d5d5f8d6c1f129fbd0343cadac768d3.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
7c4c021dd732102212db340d731a2d897d5d5f8d6c1f129fbd0343cadac768d3.exe
Resource
win10v20210408
General
-
Target
7c4c021dd732102212db340d731a2d897d5d5f8d6c1f129fbd0343cadac768d3.exe
-
Size
32KB
-
MD5
b0c450521e93ca23de47466c63d203a0
-
SHA1
a5cfb44375f355f93f57cd22ddee987e576a6793
-
SHA256
7c4c021dd732102212db340d731a2d897d5d5f8d6c1f129fbd0343cadac768d3
-
SHA512
e73030462a123e4f34d65a3937b04a1ebd993211c57ef3548e9faa32084621d0411752af96259d546eefed995339be2630786782cf94f0dd8b506b7ac5061e92
Malware Config
Signatures
-
Upatre
Upatre is a generic malware downloader.
-
Executes dropped EXE 1 IoCs
Processes:
szgfw.exepid process 1472 szgfw.exe -
Loads dropped DLL 2 IoCs
Processes:
7c4c021dd732102212db340d731a2d897d5d5f8d6c1f129fbd0343cadac768d3.exepid process 1100 7c4c021dd732102212db340d731a2d897d5d5f8d6c1f129fbd0343cadac768d3.exe 1100 7c4c021dd732102212db340d731a2d897d5d5f8d6c1f129fbd0343cadac768d3.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
7c4c021dd732102212db340d731a2d897d5d5f8d6c1f129fbd0343cadac768d3.exedescription pid process target process PID 1100 wrote to memory of 1472 1100 7c4c021dd732102212db340d731a2d897d5d5f8d6c1f129fbd0343cadac768d3.exe szgfw.exe PID 1100 wrote to memory of 1472 1100 7c4c021dd732102212db340d731a2d897d5d5f8d6c1f129fbd0343cadac768d3.exe szgfw.exe PID 1100 wrote to memory of 1472 1100 7c4c021dd732102212db340d731a2d897d5d5f8d6c1f129fbd0343cadac768d3.exe szgfw.exe PID 1100 wrote to memory of 1472 1100 7c4c021dd732102212db340d731a2d897d5d5f8d6c1f129fbd0343cadac768d3.exe szgfw.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7c4c021dd732102212db340d731a2d897d5d5f8d6c1f129fbd0343cadac768d3.exe"C:\Users\Admin\AppData\Local\Temp\7c4c021dd732102212db340d731a2d897d5d5f8d6c1f129fbd0343cadac768d3.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\szgfw.exe"C:\Users\Admin\AppData\Local\Temp\szgfw.exe"2⤵
- Executes dropped EXE
PID:1472
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
d9dbdd920e1f274eb1cdf86e31cf74ce
SHA12332dd345975671391c7e334e70029ec6de45388
SHA25637121c2bc3331b76264d584939ab564366141568ea30373752d5e34b7c584b29
SHA512d62c4bdd135d4dd532ed7385a5799f49562db4a72c7c08ad3ee67d8656c9aff8426def17994e6b1525fbd40dc6abfaca25d99dbd9fe38a458b35175864f3cf1b
-
MD5
d9dbdd920e1f274eb1cdf86e31cf74ce
SHA12332dd345975671391c7e334e70029ec6de45388
SHA25637121c2bc3331b76264d584939ab564366141568ea30373752d5e34b7c584b29
SHA512d62c4bdd135d4dd532ed7385a5799f49562db4a72c7c08ad3ee67d8656c9aff8426def17994e6b1525fbd40dc6abfaca25d99dbd9fe38a458b35175864f3cf1b
-
MD5
d9dbdd920e1f274eb1cdf86e31cf74ce
SHA12332dd345975671391c7e334e70029ec6de45388
SHA25637121c2bc3331b76264d584939ab564366141568ea30373752d5e34b7c584b29
SHA512d62c4bdd135d4dd532ed7385a5799f49562db4a72c7c08ad3ee67d8656c9aff8426def17994e6b1525fbd40dc6abfaca25d99dbd9fe38a458b35175864f3cf1b
-
MD5
d9dbdd920e1f274eb1cdf86e31cf74ce
SHA12332dd345975671391c7e334e70029ec6de45388
SHA25637121c2bc3331b76264d584939ab564366141568ea30373752d5e34b7c584b29
SHA512d62c4bdd135d4dd532ed7385a5799f49562db4a72c7c08ad3ee67d8656c9aff8426def17994e6b1525fbd40dc6abfaca25d99dbd9fe38a458b35175864f3cf1b