Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
11-05-2021 09:15
Static task
static1
Behavioral task
behavioral1
Sample
d65fbf0bc3551b89b23313cd2c436790b63da1f439bcc1d453beca6e074b3df4.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
d65fbf0bc3551b89b23313cd2c436790b63da1f439bcc1d453beca6e074b3df4.exe
Resource
win10v20210410
General
-
Target
d65fbf0bc3551b89b23313cd2c436790b63da1f439bcc1d453beca6e074b3df4.exe
-
Size
30KB
-
MD5
9134692f22fad4dac2bbca7c8943d147
-
SHA1
805843a4d9694d0105f18bb0dc08c246aae99130
-
SHA256
d65fbf0bc3551b89b23313cd2c436790b63da1f439bcc1d453beca6e074b3df4
-
SHA512
f5472fd3dd872636fa6d98a00b8c875499a434f8cc67afa582ae8d286e401ac1bd8bdc5ece4ee6cb4e1a7e3010bf8e1919051892a4de7f86267b049120d269f8
Malware Config
Signatures
-
Upatre
Upatre is a generic malware downloader.
-
Executes dropped EXE 1 IoCs
Processes:
szgfw.exepid process 196 szgfw.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
d65fbf0bc3551b89b23313cd2c436790b63da1f439bcc1d453beca6e074b3df4.exedescription pid process target process PID 3144 wrote to memory of 196 3144 d65fbf0bc3551b89b23313cd2c436790b63da1f439bcc1d453beca6e074b3df4.exe szgfw.exe PID 3144 wrote to memory of 196 3144 d65fbf0bc3551b89b23313cd2c436790b63da1f439bcc1d453beca6e074b3df4.exe szgfw.exe PID 3144 wrote to memory of 196 3144 d65fbf0bc3551b89b23313cd2c436790b63da1f439bcc1d453beca6e074b3df4.exe szgfw.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d65fbf0bc3551b89b23313cd2c436790b63da1f439bcc1d453beca6e074b3df4.exe"C:\Users\Admin\AppData\Local\Temp\d65fbf0bc3551b89b23313cd2c436790b63da1f439bcc1d453beca6e074b3df4.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\szgfw.exe"C:\Users\Admin\AppData\Local\Temp\szgfw.exe"2⤵
- Executes dropped EXE
PID:196
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
de84d360452c17f7a4945151033c54e5
SHA123b58d48fb331f27ae3b74beb7c2284d0f15c877
SHA256cfe0ec03f468475aea702d52193846b6592ae51146456e9a51d87e3a1af70270
SHA512a42e50cd1e6ce9e07c49797ca65a7a075c8e7d05cc42451da8efe5eb21617c82af6f6ed76975552f5091e2a0a9954a9476ae1512343cc95978e385bceaadc293
-
MD5
de84d360452c17f7a4945151033c54e5
SHA123b58d48fb331f27ae3b74beb7c2284d0f15c877
SHA256cfe0ec03f468475aea702d52193846b6592ae51146456e9a51d87e3a1af70270
SHA512a42e50cd1e6ce9e07c49797ca65a7a075c8e7d05cc42451da8efe5eb21617c82af6f6ed76975552f5091e2a0a9954a9476ae1512343cc95978e385bceaadc293