Analysis
-
max time kernel
151s -
max time network
137s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
11-05-2021 14:00
Static task
static1
Behavioral task
behavioral1
Sample
41a99b8fb73ebbba27d7baa76046d4f455dfbe4ddcf75b29dcc46cccdbd53eef.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
41a99b8fb73ebbba27d7baa76046d4f455dfbe4ddcf75b29dcc46cccdbd53eef.exe
Resource
win10v20210408
General
-
Target
41a99b8fb73ebbba27d7baa76046d4f455dfbe4ddcf75b29dcc46cccdbd53eef.exe
-
Size
38KB
-
MD5
38880a6db585fea9044753a1d286416f
-
SHA1
cb74298a8f35e8ffb6874b3e20d40d0a242953ba
-
SHA256
41a99b8fb73ebbba27d7baa76046d4f455dfbe4ddcf75b29dcc46cccdbd53eef
-
SHA512
27b5c9419af515e8ce9f505ad5909e1d19c9ddbd6ad6204036e54d5317b9ab6ef1b3c6079f9bfd4527718027f7c3aaa0c5fa5117ba48b64779d8eed9db7bda2b
Malware Config
Signatures
-
Upatre
Upatre is a generic malware downloader.
-
Executes dropped EXE 1 IoCs
Processes:
szgfw.exepid process 2912 szgfw.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
41a99b8fb73ebbba27d7baa76046d4f455dfbe4ddcf75b29dcc46cccdbd53eef.exedescription pid process target process PID 852 wrote to memory of 2912 852 41a99b8fb73ebbba27d7baa76046d4f455dfbe4ddcf75b29dcc46cccdbd53eef.exe szgfw.exe PID 852 wrote to memory of 2912 852 41a99b8fb73ebbba27d7baa76046d4f455dfbe4ddcf75b29dcc46cccdbd53eef.exe szgfw.exe PID 852 wrote to memory of 2912 852 41a99b8fb73ebbba27d7baa76046d4f455dfbe4ddcf75b29dcc46cccdbd53eef.exe szgfw.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\41a99b8fb73ebbba27d7baa76046d4f455dfbe4ddcf75b29dcc46cccdbd53eef.exe"C:\Users\Admin\AppData\Local\Temp\41a99b8fb73ebbba27d7baa76046d4f455dfbe4ddcf75b29dcc46cccdbd53eef.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Users\Admin\AppData\Local\Temp\szgfw.exe"C:\Users\Admin\AppData\Local\Temp\szgfw.exe"2⤵
- Executes dropped EXE
PID:2912
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
19795c969ff8dec0ef5764b805cf5d94
SHA14b5dfc311a5ee4f2b521ee2fe5232546946c1f94
SHA25612ed90a3620af8df5263a310cc7c59c506c754bc30ead2f0dcdbd8f706fa01a9
SHA5122da6fd68e3c35c73c0381915df9612f1f3ce8e48b13fbdb457b997d4afd27a18cd50085058f066af4771b41de45950f1fad5d575d48bdf8f0883b7b27c085ab7
-
MD5
19795c969ff8dec0ef5764b805cf5d94
SHA14b5dfc311a5ee4f2b521ee2fe5232546946c1f94
SHA25612ed90a3620af8df5263a310cc7c59c506c754bc30ead2f0dcdbd8f706fa01a9
SHA5122da6fd68e3c35c73c0381915df9612f1f3ce8e48b13fbdb457b997d4afd27a18cd50085058f066af4771b41de45950f1fad5d575d48bdf8f0883b7b27c085ab7