Analysis
-
max time kernel
151s -
max time network
115s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
11-05-2021 14:22
Static task
static1
Behavioral task
behavioral1
Sample
626dfcb96d94d0e0d350a271fd4e74be029171adcec4277e46a0bb44c3b324d4.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
626dfcb96d94d0e0d350a271fd4e74be029171adcec4277e46a0bb44c3b324d4.exe
Resource
win10v20210408
General
-
Target
626dfcb96d94d0e0d350a271fd4e74be029171adcec4277e46a0bb44c3b324d4.exe
-
Size
37KB
-
MD5
b9fe918d9b9265f78f77e7b8c9b4f2f4
-
SHA1
7ca85ba297acdcafb9fd48f316ff4d658ab10d40
-
SHA256
626dfcb96d94d0e0d350a271fd4e74be029171adcec4277e46a0bb44c3b324d4
-
SHA512
c68c914189436c1ac63ba68b31d26c2c0aee075e08243dce8c13d97fc95f15272ee63a790c93335294a531b7e2d3d7b6d3e143f470959f28ea636715caca3310
Malware Config
Signatures
-
Upatre
Upatre is a generic malware downloader.
-
Executes dropped EXE 1 IoCs
Processes:
szgfw.exepid process 1368 szgfw.exe -
Loads dropped DLL 2 IoCs
Processes:
626dfcb96d94d0e0d350a271fd4e74be029171adcec4277e46a0bb44c3b324d4.exepid process 1208 626dfcb96d94d0e0d350a271fd4e74be029171adcec4277e46a0bb44c3b324d4.exe 1208 626dfcb96d94d0e0d350a271fd4e74be029171adcec4277e46a0bb44c3b324d4.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
626dfcb96d94d0e0d350a271fd4e74be029171adcec4277e46a0bb44c3b324d4.exedescription pid process target process PID 1208 wrote to memory of 1368 1208 626dfcb96d94d0e0d350a271fd4e74be029171adcec4277e46a0bb44c3b324d4.exe szgfw.exe PID 1208 wrote to memory of 1368 1208 626dfcb96d94d0e0d350a271fd4e74be029171adcec4277e46a0bb44c3b324d4.exe szgfw.exe PID 1208 wrote to memory of 1368 1208 626dfcb96d94d0e0d350a271fd4e74be029171adcec4277e46a0bb44c3b324d4.exe szgfw.exe PID 1208 wrote to memory of 1368 1208 626dfcb96d94d0e0d350a271fd4e74be029171adcec4277e46a0bb44c3b324d4.exe szgfw.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\626dfcb96d94d0e0d350a271fd4e74be029171adcec4277e46a0bb44c3b324d4.exe"C:\Users\Admin\AppData\Local\Temp\626dfcb96d94d0e0d350a271fd4e74be029171adcec4277e46a0bb44c3b324d4.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\szgfw.exe"C:\Users\Admin\AppData\Local\Temp\szgfw.exe"2⤵
- Executes dropped EXE
PID:1368
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
f227460c96a8fcffef6b1aa2fc6ddb7e
SHA1d28e4ba4a685de5e85415fe1d919fede6f870a79
SHA2563435444e7954cbb7e274466666a3e70ccdc20fbb834557b11c823c0d1577225e
SHA512e12b801f519c77311079db4e64e79b2a170e53732b8fe75b34b0ce4a44d414cb8b699ec71df39e9a35b305a2b8672b2c37ab6c88305500cd425e19bd96de5395
-
MD5
f227460c96a8fcffef6b1aa2fc6ddb7e
SHA1d28e4ba4a685de5e85415fe1d919fede6f870a79
SHA2563435444e7954cbb7e274466666a3e70ccdc20fbb834557b11c823c0d1577225e
SHA512e12b801f519c77311079db4e64e79b2a170e53732b8fe75b34b0ce4a44d414cb8b699ec71df39e9a35b305a2b8672b2c37ab6c88305500cd425e19bd96de5395
-
MD5
f227460c96a8fcffef6b1aa2fc6ddb7e
SHA1d28e4ba4a685de5e85415fe1d919fede6f870a79
SHA2563435444e7954cbb7e274466666a3e70ccdc20fbb834557b11c823c0d1577225e
SHA512e12b801f519c77311079db4e64e79b2a170e53732b8fe75b34b0ce4a44d414cb8b699ec71df39e9a35b305a2b8672b2c37ab6c88305500cd425e19bd96de5395
-
MD5
f227460c96a8fcffef6b1aa2fc6ddb7e
SHA1d28e4ba4a685de5e85415fe1d919fede6f870a79
SHA2563435444e7954cbb7e274466666a3e70ccdc20fbb834557b11c823c0d1577225e
SHA512e12b801f519c77311079db4e64e79b2a170e53732b8fe75b34b0ce4a44d414cb8b699ec71df39e9a35b305a2b8672b2c37ab6c88305500cd425e19bd96de5395