Analysis
-
max time kernel
149s -
max time network
136s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
15-05-2021 11:27
Static task
static1
Behavioral task
behavioral1
Sample
a3d45e61a9ced1862ec30979b63d8dd56db07777336d1845b80b5ac70577e143.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
a3d45e61a9ced1862ec30979b63d8dd56db07777336d1845b80b5ac70577e143.exe
Resource
win10v20210408
General
-
Target
a3d45e61a9ced1862ec30979b63d8dd56db07777336d1845b80b5ac70577e143.exe
-
Size
36KB
-
MD5
ce9dde5bf38fb9b4d5ac7da86e4afa5a
-
SHA1
5d7c38210b2e4780db39c28fc842ab702908491e
-
SHA256
a3d45e61a9ced1862ec30979b63d8dd56db07777336d1845b80b5ac70577e143
-
SHA512
f9a2d0e6e7756a22b346eed5363bf2492b0627dbdd2aba7a975b4b3c219d289fdba56368b757445f8121ff7eb5b9a0690516019012030d800d550931b9b55126
Malware Config
Signatures
-
Upatre
Upatre is a generic malware downloader.
-
Executes dropped EXE 1 IoCs
Processes:
szgfw.exepid process 3948 szgfw.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
a3d45e61a9ced1862ec30979b63d8dd56db07777336d1845b80b5ac70577e143.exedescription pid process target process PID 2544 wrote to memory of 3948 2544 a3d45e61a9ced1862ec30979b63d8dd56db07777336d1845b80b5ac70577e143.exe szgfw.exe PID 2544 wrote to memory of 3948 2544 a3d45e61a9ced1862ec30979b63d8dd56db07777336d1845b80b5ac70577e143.exe szgfw.exe PID 2544 wrote to memory of 3948 2544 a3d45e61a9ced1862ec30979b63d8dd56db07777336d1845b80b5ac70577e143.exe szgfw.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a3d45e61a9ced1862ec30979b63d8dd56db07777336d1845b80b5ac70577e143.exe"C:\Users\Admin\AppData\Local\Temp\a3d45e61a9ced1862ec30979b63d8dd56db07777336d1845b80b5ac70577e143.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\szgfw.exe"C:\Users\Admin\AppData\Local\Temp\szgfw.exe"2⤵
- Executes dropped EXE
PID:3948
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
6ae7161c76a4ef112144024764edea7f
SHA17b73dc93df6cc9b99b75524989a7164903420f65
SHA256de41f88b412eef0eeaedd204655736184cafad2e88c60532cd4b97394fbb1219
SHA512e25582579657212eac3c6fd3b46ac8125a295d43be93dc5695ab04a6264cab0b0e2cc025e9be24a3c319ecdce2ddf936a10c59258e7270f16922b38aca4744e6
-
MD5
6ae7161c76a4ef112144024764edea7f
SHA17b73dc93df6cc9b99b75524989a7164903420f65
SHA256de41f88b412eef0eeaedd204655736184cafad2e88c60532cd4b97394fbb1219
SHA512e25582579657212eac3c6fd3b46ac8125a295d43be93dc5695ab04a6264cab0b0e2cc025e9be24a3c319ecdce2ddf936a10c59258e7270f16922b38aca4744e6