Analysis
-
max time kernel
151s -
max time network
14s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
09-05-2021 22:38
Static task
static1
Behavioral task
behavioral1
Sample
eff106657d6db5868729c08737d816c7e63aa954c17831229ba8047a1c1e1c0e.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
eff106657d6db5868729c08737d816c7e63aa954c17831229ba8047a1c1e1c0e.exe
Resource
win10v20210408
General
-
Target
eff106657d6db5868729c08737d816c7e63aa954c17831229ba8047a1c1e1c0e.exe
-
Size
36KB
-
MD5
e64f3eee3e25211dc2d982afcf3889b8
-
SHA1
f1748873f7f02373e4b620337179680cb2daff1f
-
SHA256
eff106657d6db5868729c08737d816c7e63aa954c17831229ba8047a1c1e1c0e
-
SHA512
f7bd265a569c587892da23db0ce68fc61ba65edbec7511651540856854a46a214e4834f7b7baf5319511113a3373146ec16b9ce308b009c97429e73a9f698149
Malware Config
Signatures
-
Upatre
Upatre is a generic malware downloader.
-
Executes dropped EXE 1 IoCs
Processes:
szgfw.exepid process 848 szgfw.exe -
Loads dropped DLL 2 IoCs
Processes:
eff106657d6db5868729c08737d816c7e63aa954c17831229ba8047a1c1e1c0e.exepid process 360 eff106657d6db5868729c08737d816c7e63aa954c17831229ba8047a1c1e1c0e.exe 360 eff106657d6db5868729c08737d816c7e63aa954c17831229ba8047a1c1e1c0e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
eff106657d6db5868729c08737d816c7e63aa954c17831229ba8047a1c1e1c0e.exedescription pid process target process PID 360 wrote to memory of 848 360 eff106657d6db5868729c08737d816c7e63aa954c17831229ba8047a1c1e1c0e.exe szgfw.exe PID 360 wrote to memory of 848 360 eff106657d6db5868729c08737d816c7e63aa954c17831229ba8047a1c1e1c0e.exe szgfw.exe PID 360 wrote to memory of 848 360 eff106657d6db5868729c08737d816c7e63aa954c17831229ba8047a1c1e1c0e.exe szgfw.exe PID 360 wrote to memory of 848 360 eff106657d6db5868729c08737d816c7e63aa954c17831229ba8047a1c1e1c0e.exe szgfw.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\eff106657d6db5868729c08737d816c7e63aa954c17831229ba8047a1c1e1c0e.exe"C:\Users\Admin\AppData\Local\Temp\eff106657d6db5868729c08737d816c7e63aa954c17831229ba8047a1c1e1c0e.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:360 -
C:\Users\Admin\AppData\Local\Temp\szgfw.exe"C:\Users\Admin\AppData\Local\Temp\szgfw.exe"2⤵
- Executes dropped EXE
PID:848
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
38096fb4a12694fd25a1345d37947b54
SHA11faebacf5bd603fd691059183cd0c476e0391d59
SHA256a5bc2d13080cf9ee70bcf19a878d4105aaa96ad2068fc38bb5bdb8c3cac643f5
SHA51228c3f1e46f638c495e361a116f6f5e7da5ded1795968577e3dc20c0a31faec0754a9a3002fede3fd0ad7a643e8326faf1788792b21e4304347c29765a245e7e7
-
MD5
38096fb4a12694fd25a1345d37947b54
SHA11faebacf5bd603fd691059183cd0c476e0391d59
SHA256a5bc2d13080cf9ee70bcf19a878d4105aaa96ad2068fc38bb5bdb8c3cac643f5
SHA51228c3f1e46f638c495e361a116f6f5e7da5ded1795968577e3dc20c0a31faec0754a9a3002fede3fd0ad7a643e8326faf1788792b21e4304347c29765a245e7e7
-
MD5
38096fb4a12694fd25a1345d37947b54
SHA11faebacf5bd603fd691059183cd0c476e0391d59
SHA256a5bc2d13080cf9ee70bcf19a878d4105aaa96ad2068fc38bb5bdb8c3cac643f5
SHA51228c3f1e46f638c495e361a116f6f5e7da5ded1795968577e3dc20c0a31faec0754a9a3002fede3fd0ad7a643e8326faf1788792b21e4304347c29765a245e7e7
-
MD5
38096fb4a12694fd25a1345d37947b54
SHA11faebacf5bd603fd691059183cd0c476e0391d59
SHA256a5bc2d13080cf9ee70bcf19a878d4105aaa96ad2068fc38bb5bdb8c3cac643f5
SHA51228c3f1e46f638c495e361a116f6f5e7da5ded1795968577e3dc20c0a31faec0754a9a3002fede3fd0ad7a643e8326faf1788792b21e4304347c29765a245e7e7