Analysis
-
max time kernel
150s -
max time network
49s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
13-05-2021 12:40
Static task
static1
Behavioral task
behavioral1
Sample
52a4325b439b3bfb5bb9dddf9c01c6c9b27a7f2c3fb372d68d8570c7c270c6c2.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
52a4325b439b3bfb5bb9dddf9c01c6c9b27a7f2c3fb372d68d8570c7c270c6c2.exe
Resource
win10v20210410
General
-
Target
52a4325b439b3bfb5bb9dddf9c01c6c9b27a7f2c3fb372d68d8570c7c270c6c2.exe
-
Size
33KB
-
MD5
ba32b6d1dc15af8c3420a0a7059f065d
-
SHA1
86e306bbea4a35841aa55d01660b1ea63d4f13e9
-
SHA256
52a4325b439b3bfb5bb9dddf9c01c6c9b27a7f2c3fb372d68d8570c7c270c6c2
-
SHA512
843b5814325c2bf29b379ff5649a4c1f4c843efccb6f3fd9d014ffbabcacb70dff4eb17a3280fb8fdc0688709c8f637996f77e439184c576178684c5365a1464
Malware Config
Signatures
-
Upatre
Upatre is a generic malware downloader.
-
Executes dropped EXE 1 IoCs
Processes:
szgfw.exepid process 604 szgfw.exe -
Loads dropped DLL 2 IoCs
Processes:
52a4325b439b3bfb5bb9dddf9c01c6c9b27a7f2c3fb372d68d8570c7c270c6c2.exepid process 1656 52a4325b439b3bfb5bb9dddf9c01c6c9b27a7f2c3fb372d68d8570c7c270c6c2.exe 1656 52a4325b439b3bfb5bb9dddf9c01c6c9b27a7f2c3fb372d68d8570c7c270c6c2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
52a4325b439b3bfb5bb9dddf9c01c6c9b27a7f2c3fb372d68d8570c7c270c6c2.exedescription pid process target process PID 1656 wrote to memory of 604 1656 52a4325b439b3bfb5bb9dddf9c01c6c9b27a7f2c3fb372d68d8570c7c270c6c2.exe szgfw.exe PID 1656 wrote to memory of 604 1656 52a4325b439b3bfb5bb9dddf9c01c6c9b27a7f2c3fb372d68d8570c7c270c6c2.exe szgfw.exe PID 1656 wrote to memory of 604 1656 52a4325b439b3bfb5bb9dddf9c01c6c9b27a7f2c3fb372d68d8570c7c270c6c2.exe szgfw.exe PID 1656 wrote to memory of 604 1656 52a4325b439b3bfb5bb9dddf9c01c6c9b27a7f2c3fb372d68d8570c7c270c6c2.exe szgfw.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\52a4325b439b3bfb5bb9dddf9c01c6c9b27a7f2c3fb372d68d8570c7c270c6c2.exe"C:\Users\Admin\AppData\Local\Temp\52a4325b439b3bfb5bb9dddf9c01c6c9b27a7f2c3fb372d68d8570c7c270c6c2.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\szgfw.exe"C:\Users\Admin\AppData\Local\Temp\szgfw.exe"2⤵
- Executes dropped EXE
PID:604
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
3e2f8ae8f8d807e1522e211ec591faef
SHA1ed7025603d05de8d137f2dce2a315d46dfb6f8e9
SHA256d914e5d8b11aea1c72d8e03527e2a0313a1624b0f272e7a58154ab45e985dac0
SHA512d3af6ca32b2dbed07c36e2ea48bf1250028fed5c33ea44a0c1792c6523627854efb2e8fe99b0cd89eca415b4b03f0d83d7d675ec5bc49e01af3030e93af6a1bb
-
MD5
3e2f8ae8f8d807e1522e211ec591faef
SHA1ed7025603d05de8d137f2dce2a315d46dfb6f8e9
SHA256d914e5d8b11aea1c72d8e03527e2a0313a1624b0f272e7a58154ab45e985dac0
SHA512d3af6ca32b2dbed07c36e2ea48bf1250028fed5c33ea44a0c1792c6523627854efb2e8fe99b0cd89eca415b4b03f0d83d7d675ec5bc49e01af3030e93af6a1bb
-
MD5
3e2f8ae8f8d807e1522e211ec591faef
SHA1ed7025603d05de8d137f2dce2a315d46dfb6f8e9
SHA256d914e5d8b11aea1c72d8e03527e2a0313a1624b0f272e7a58154ab45e985dac0
SHA512d3af6ca32b2dbed07c36e2ea48bf1250028fed5c33ea44a0c1792c6523627854efb2e8fe99b0cd89eca415b4b03f0d83d7d675ec5bc49e01af3030e93af6a1bb
-
MD5
3e2f8ae8f8d807e1522e211ec591faef
SHA1ed7025603d05de8d137f2dce2a315d46dfb6f8e9
SHA256d914e5d8b11aea1c72d8e03527e2a0313a1624b0f272e7a58154ab45e985dac0
SHA512d3af6ca32b2dbed07c36e2ea48bf1250028fed5c33ea44a0c1792c6523627854efb2e8fe99b0cd89eca415b4b03f0d83d7d675ec5bc49e01af3030e93af6a1bb