Analysis
-
max time kernel
149s -
max time network
71s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
09-05-2021 15:16
Static task
static1
Behavioral task
behavioral1
Sample
ca3a0078e0749c0480c6010ad9c7f4ce5ee0fbb6ec24c335be26d96676652059.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
ca3a0078e0749c0480c6010ad9c7f4ce5ee0fbb6ec24c335be26d96676652059.exe
Resource
win10v20210408
General
-
Target
ca3a0078e0749c0480c6010ad9c7f4ce5ee0fbb6ec24c335be26d96676652059.exe
-
Size
28KB
-
MD5
b7be004ad524d42e11c674cc2f05c290
-
SHA1
f61a5339a85b9ad918dede30e3658217906d79eb
-
SHA256
ca3a0078e0749c0480c6010ad9c7f4ce5ee0fbb6ec24c335be26d96676652059
-
SHA512
61bf34bb3f84c39aaf74ffda3bc07a01bc09b3ce79cc543ac66bc6429728b2e9bbe0bd837f51e6ac61aa9176dbe33f82a7edb04aab6fb06cba4ac53e9501586c
Malware Config
Signatures
-
Upatre
Upatre is a generic malware downloader.
-
Executes dropped EXE 1 IoCs
Processes:
szgfw.exepid process 2272 szgfw.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
ca3a0078e0749c0480c6010ad9c7f4ce5ee0fbb6ec24c335be26d96676652059.exedescription pid process target process PID 636 wrote to memory of 2272 636 ca3a0078e0749c0480c6010ad9c7f4ce5ee0fbb6ec24c335be26d96676652059.exe szgfw.exe PID 636 wrote to memory of 2272 636 ca3a0078e0749c0480c6010ad9c7f4ce5ee0fbb6ec24c335be26d96676652059.exe szgfw.exe PID 636 wrote to memory of 2272 636 ca3a0078e0749c0480c6010ad9c7f4ce5ee0fbb6ec24c335be26d96676652059.exe szgfw.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ca3a0078e0749c0480c6010ad9c7f4ce5ee0fbb6ec24c335be26d96676652059.exe"C:\Users\Admin\AppData\Local\Temp\ca3a0078e0749c0480c6010ad9c7f4ce5ee0fbb6ec24c335be26d96676652059.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Users\Admin\AppData\Local\Temp\szgfw.exe"C:\Users\Admin\AppData\Local\Temp\szgfw.exe"2⤵
- Executes dropped EXE
PID:2272
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
e2f90a10d1f83106c5e3e348beb08eda
SHA1cb94c61ecaa780cba4424034625cdab8d9939ba6
SHA25662dffa47ae6d5a5d9816f0ca06f6664b3553884102398d458d9b5b3416779ad5
SHA5122849c02adf8cf4d7f65cc87c67ccacd7e8f63aea0926b86fd7903581c7d16a24379f007ff9e22f750e22c323f52924b91a0150ba7c3d5c1b7655f05b4588e727
-
MD5
e2f90a10d1f83106c5e3e348beb08eda
SHA1cb94c61ecaa780cba4424034625cdab8d9939ba6
SHA25662dffa47ae6d5a5d9816f0ca06f6664b3553884102398d458d9b5b3416779ad5
SHA5122849c02adf8cf4d7f65cc87c67ccacd7e8f63aea0926b86fd7903581c7d16a24379f007ff9e22f750e22c323f52924b91a0150ba7c3d5c1b7655f05b4588e727