Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
11-05-2021 15:28
Static task
static1
Behavioral task
behavioral1
Sample
23476fefcdea958721e286472dd3f7a9aa647b6f8c122eeb427971cfc8d210f4.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
23476fefcdea958721e286472dd3f7a9aa647b6f8c122eeb427971cfc8d210f4.exe
Resource
win10v20210408
General
-
Target
23476fefcdea958721e286472dd3f7a9aa647b6f8c122eeb427971cfc8d210f4.exe
-
Size
51KB
-
MD5
1c564a1bdbd1fa3aea6714f9369e43f5
-
SHA1
7071ea8082ab1ddb272dc601d74b63e321785731
-
SHA256
23476fefcdea958721e286472dd3f7a9aa647b6f8c122eeb427971cfc8d210f4
-
SHA512
bb02be66dd61bcfa0a31eb31083e20bab1c1486bc4defb02a9a7ce36e26fb5d880deca7b157de7e223d9c3834f0f925cf2442b15b2e064a25a33d7a5dfe3ab69
Malware Config
Signatures
-
Upatre
Upatre is a generic malware downloader.
-
Executes dropped EXE 1 IoCs
Processes:
szgfw.exepid process 1988 szgfw.exe -
Loads dropped DLL 2 IoCs
Processes:
23476fefcdea958721e286472dd3f7a9aa647b6f8c122eeb427971cfc8d210f4.exepid process 296 23476fefcdea958721e286472dd3f7a9aa647b6f8c122eeb427971cfc8d210f4.exe 296 23476fefcdea958721e286472dd3f7a9aa647b6f8c122eeb427971cfc8d210f4.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
23476fefcdea958721e286472dd3f7a9aa647b6f8c122eeb427971cfc8d210f4.exedescription pid process target process PID 296 wrote to memory of 1988 296 23476fefcdea958721e286472dd3f7a9aa647b6f8c122eeb427971cfc8d210f4.exe szgfw.exe PID 296 wrote to memory of 1988 296 23476fefcdea958721e286472dd3f7a9aa647b6f8c122eeb427971cfc8d210f4.exe szgfw.exe PID 296 wrote to memory of 1988 296 23476fefcdea958721e286472dd3f7a9aa647b6f8c122eeb427971cfc8d210f4.exe szgfw.exe PID 296 wrote to memory of 1988 296 23476fefcdea958721e286472dd3f7a9aa647b6f8c122eeb427971cfc8d210f4.exe szgfw.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\23476fefcdea958721e286472dd3f7a9aa647b6f8c122eeb427971cfc8d210f4.exe"C:\Users\Admin\AppData\Local\Temp\23476fefcdea958721e286472dd3f7a9aa647b6f8c122eeb427971cfc8d210f4.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:296 -
C:\Users\Admin\AppData\Local\Temp\szgfw.exe"C:\Users\Admin\AppData\Local\Temp\szgfw.exe"2⤵
- Executes dropped EXE
PID:1988
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
62aba4e648e29105f81f089eb660cbf0
SHA1531c17187675a2b4e244ef6e81e43ef471064386
SHA2569db5c6f179c371a1efe3afcb8a29128108948d26189a1327d742d650984712c1
SHA51293014a01765c20b052de03d2b47fe3ecc582c9ddf7b60b8b09f47a79c49045456212f54fbd25e65057ce6d877665bb8a5d2c022dcfbc8d34f4f1cff1854080f0
-
MD5
62aba4e648e29105f81f089eb660cbf0
SHA1531c17187675a2b4e244ef6e81e43ef471064386
SHA2569db5c6f179c371a1efe3afcb8a29128108948d26189a1327d742d650984712c1
SHA51293014a01765c20b052de03d2b47fe3ecc582c9ddf7b60b8b09f47a79c49045456212f54fbd25e65057ce6d877665bb8a5d2c022dcfbc8d34f4f1cff1854080f0
-
MD5
62aba4e648e29105f81f089eb660cbf0
SHA1531c17187675a2b4e244ef6e81e43ef471064386
SHA2569db5c6f179c371a1efe3afcb8a29128108948d26189a1327d742d650984712c1
SHA51293014a01765c20b052de03d2b47fe3ecc582c9ddf7b60b8b09f47a79c49045456212f54fbd25e65057ce6d877665bb8a5d2c022dcfbc8d34f4f1cff1854080f0
-
MD5
62aba4e648e29105f81f089eb660cbf0
SHA1531c17187675a2b4e244ef6e81e43ef471064386
SHA2569db5c6f179c371a1efe3afcb8a29128108948d26189a1327d742d650984712c1
SHA51293014a01765c20b052de03d2b47fe3ecc582c9ddf7b60b8b09f47a79c49045456212f54fbd25e65057ce6d877665bb8a5d2c022dcfbc8d34f4f1cff1854080f0