Analysis
-
max time kernel
150s -
max time network
114s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
15-05-2021 14:45
Static task
static1
Behavioral task
behavioral1
Sample
cc6894249ef6551a1acc49084a5c8258fbeb86f65822f4bae9323dbe82b6ede6.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
cc6894249ef6551a1acc49084a5c8258fbeb86f65822f4bae9323dbe82b6ede6.exe
Resource
win10v20210410
General
-
Target
cc6894249ef6551a1acc49084a5c8258fbeb86f65822f4bae9323dbe82b6ede6.exe
-
Size
37KB
-
MD5
be3ae3f329e4b10558bae1155b346fae
-
SHA1
829259d0ad637af5c1251148477c67a02cd47dc0
-
SHA256
cc6894249ef6551a1acc49084a5c8258fbeb86f65822f4bae9323dbe82b6ede6
-
SHA512
dfdbfd2f5264f1904958fa32e46e375b5f081061bf546a19c809fa116327b9130665753a9100df03e9e9011ac9ec63f51d7cfbf220479383631ed21ace5363aa
Malware Config
Signatures
-
Upatre
Upatre is a generic malware downloader.
-
Executes dropped EXE 1 IoCs
Processes:
szgfw.exepid process 3044 szgfw.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
cc6894249ef6551a1acc49084a5c8258fbeb86f65822f4bae9323dbe82b6ede6.exedescription pid process target process PID 3904 wrote to memory of 3044 3904 cc6894249ef6551a1acc49084a5c8258fbeb86f65822f4bae9323dbe82b6ede6.exe szgfw.exe PID 3904 wrote to memory of 3044 3904 cc6894249ef6551a1acc49084a5c8258fbeb86f65822f4bae9323dbe82b6ede6.exe szgfw.exe PID 3904 wrote to memory of 3044 3904 cc6894249ef6551a1acc49084a5c8258fbeb86f65822f4bae9323dbe82b6ede6.exe szgfw.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cc6894249ef6551a1acc49084a5c8258fbeb86f65822f4bae9323dbe82b6ede6.exe"C:\Users\Admin\AppData\Local\Temp\cc6894249ef6551a1acc49084a5c8258fbeb86f65822f4bae9323dbe82b6ede6.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\szgfw.exe"C:\Users\Admin\AppData\Local\Temp\szgfw.exe"2⤵
- Executes dropped EXE
PID:3044
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
3039487b99a1683bd3dcdec6ff5078b1
SHA1879298705c35b511d2705fb9f612b33c1d394c88
SHA25628b750c806c8eaa665ef1cc0a939525e760f21480099114ad69a024f4037489e
SHA5128f471c9e33dcc76a5baef53cf46310ca681db9ed93567d7428bf86a4f0f869be9cdb131908bd78dc885fe2d85a1ec56ddbb8ee3d1a5ee143756dee324aaa6a90
-
MD5
3039487b99a1683bd3dcdec6ff5078b1
SHA1879298705c35b511d2705fb9f612b33c1d394c88
SHA25628b750c806c8eaa665ef1cc0a939525e760f21480099114ad69a024f4037489e
SHA5128f471c9e33dcc76a5baef53cf46310ca681db9ed93567d7428bf86a4f0f869be9cdb131908bd78dc885fe2d85a1ec56ddbb8ee3d1a5ee143756dee324aaa6a90