Analysis
-
max time kernel
150s -
max time network
12s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
10-05-2021 15:59
Static task
static1
Behavioral task
behavioral1
Sample
e00723670720268a4b82ab204a7c159e6bcd7b63770042a8db8bba8989613ed4.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
e00723670720268a4b82ab204a7c159e6bcd7b63770042a8db8bba8989613ed4.exe
Resource
win10v20210408
General
-
Target
e00723670720268a4b82ab204a7c159e6bcd7b63770042a8db8bba8989613ed4.exe
-
Size
30KB
-
MD5
d683cf8dd1371eed3665bd25cdb51b68
-
SHA1
20995582dc04836a054b32e7fcb06ae0a9b82a16
-
SHA256
e00723670720268a4b82ab204a7c159e6bcd7b63770042a8db8bba8989613ed4
-
SHA512
91eb291d9c2f45340ee87da20a3a42b8b0cdb54421d51a66eaa52cc5125dd83f90ef48589963a6812738d14e507a5f9a2c2cf619813b7f77178e622b6bd334a8
Malware Config
Signatures
-
Upatre
Upatre is a generic malware downloader.
-
Executes dropped EXE 1 IoCs
Processes:
szgfw.exepid process 1344 szgfw.exe -
Loads dropped DLL 2 IoCs
Processes:
e00723670720268a4b82ab204a7c159e6bcd7b63770042a8db8bba8989613ed4.exepid process 788 e00723670720268a4b82ab204a7c159e6bcd7b63770042a8db8bba8989613ed4.exe 788 e00723670720268a4b82ab204a7c159e6bcd7b63770042a8db8bba8989613ed4.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
e00723670720268a4b82ab204a7c159e6bcd7b63770042a8db8bba8989613ed4.exedescription pid process target process PID 788 wrote to memory of 1344 788 e00723670720268a4b82ab204a7c159e6bcd7b63770042a8db8bba8989613ed4.exe szgfw.exe PID 788 wrote to memory of 1344 788 e00723670720268a4b82ab204a7c159e6bcd7b63770042a8db8bba8989613ed4.exe szgfw.exe PID 788 wrote to memory of 1344 788 e00723670720268a4b82ab204a7c159e6bcd7b63770042a8db8bba8989613ed4.exe szgfw.exe PID 788 wrote to memory of 1344 788 e00723670720268a4b82ab204a7c159e6bcd7b63770042a8db8bba8989613ed4.exe szgfw.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e00723670720268a4b82ab204a7c159e6bcd7b63770042a8db8bba8989613ed4.exe"C:\Users\Admin\AppData\Local\Temp\e00723670720268a4b82ab204a7c159e6bcd7b63770042a8db8bba8989613ed4.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:788 -
C:\Users\Admin\AppData\Local\Temp\szgfw.exe"C:\Users\Admin\AppData\Local\Temp\szgfw.exe"2⤵
- Executes dropped EXE
PID:1344
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
804fea57c8fac0fe447713d0e65b8e66
SHA14081ab2c39602f9054d9fafc3b8a70707a2d50ee
SHA25607d4beb9814bdd020fd2d9d34232ad2cceff91f828e4630e295080241bc285bb
SHA512fdb199666d1802b4b812fe4370ff27c849208f8e79517e9603fd027fc511325f40c72332ad20f9e1750b905c02164ee28e79603f005f051a56b825b5d491f684
-
MD5
804fea57c8fac0fe447713d0e65b8e66
SHA14081ab2c39602f9054d9fafc3b8a70707a2d50ee
SHA25607d4beb9814bdd020fd2d9d34232ad2cceff91f828e4630e295080241bc285bb
SHA512fdb199666d1802b4b812fe4370ff27c849208f8e79517e9603fd027fc511325f40c72332ad20f9e1750b905c02164ee28e79603f005f051a56b825b5d491f684
-
MD5
804fea57c8fac0fe447713d0e65b8e66
SHA14081ab2c39602f9054d9fafc3b8a70707a2d50ee
SHA25607d4beb9814bdd020fd2d9d34232ad2cceff91f828e4630e295080241bc285bb
SHA512fdb199666d1802b4b812fe4370ff27c849208f8e79517e9603fd027fc511325f40c72332ad20f9e1750b905c02164ee28e79603f005f051a56b825b5d491f684
-
MD5
804fea57c8fac0fe447713d0e65b8e66
SHA14081ab2c39602f9054d9fafc3b8a70707a2d50ee
SHA25607d4beb9814bdd020fd2d9d34232ad2cceff91f828e4630e295080241bc285bb
SHA512fdb199666d1802b4b812fe4370ff27c849208f8e79517e9603fd027fc511325f40c72332ad20f9e1750b905c02164ee28e79603f005f051a56b825b5d491f684