Analysis
-
max time kernel
149s -
max time network
45s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
17-05-2021 10:34
Static task
static1
Behavioral task
behavioral1
Sample
fa4c429aba5232aa2d98dbf68228746714e50978c8cdb304e766c9b385303308.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
fa4c429aba5232aa2d98dbf68228746714e50978c8cdb304e766c9b385303308.exe
Resource
win10v20210408
General
-
Target
fa4c429aba5232aa2d98dbf68228746714e50978c8cdb304e766c9b385303308.exe
-
Size
42KB
-
MD5
7d927e891d090be9edd8fd45e735261f
-
SHA1
8b8e1bfe925f9af7fedd75a93c2f4f0280903c91
-
SHA256
fa4c429aba5232aa2d98dbf68228746714e50978c8cdb304e766c9b385303308
-
SHA512
5ad97895d7c1f37aa9dcacd161c13978fc4ee34f9baa5e1b985911dc2dd13333f4114e4dc291f1e6d66100ce97d61c4b6ab82e62a1c5c5889c7dca84b2519867
Malware Config
Signatures
-
Upatre
Upatre is a generic malware downloader.
-
Executes dropped EXE 1 IoCs
Processes:
szgfw.exepid process 656 szgfw.exe -
Loads dropped DLL 2 IoCs
Processes:
fa4c429aba5232aa2d98dbf68228746714e50978c8cdb304e766c9b385303308.exepid process 1984 fa4c429aba5232aa2d98dbf68228746714e50978c8cdb304e766c9b385303308.exe 1984 fa4c429aba5232aa2d98dbf68228746714e50978c8cdb304e766c9b385303308.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
fa4c429aba5232aa2d98dbf68228746714e50978c8cdb304e766c9b385303308.exedescription pid process target process PID 1984 wrote to memory of 656 1984 fa4c429aba5232aa2d98dbf68228746714e50978c8cdb304e766c9b385303308.exe szgfw.exe PID 1984 wrote to memory of 656 1984 fa4c429aba5232aa2d98dbf68228746714e50978c8cdb304e766c9b385303308.exe szgfw.exe PID 1984 wrote to memory of 656 1984 fa4c429aba5232aa2d98dbf68228746714e50978c8cdb304e766c9b385303308.exe szgfw.exe PID 1984 wrote to memory of 656 1984 fa4c429aba5232aa2d98dbf68228746714e50978c8cdb304e766c9b385303308.exe szgfw.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fa4c429aba5232aa2d98dbf68228746714e50978c8cdb304e766c9b385303308.exe"C:\Users\Admin\AppData\Local\Temp\fa4c429aba5232aa2d98dbf68228746714e50978c8cdb304e766c9b385303308.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\szgfw.exe"C:\Users\Admin\AppData\Local\Temp\szgfw.exe"2⤵
- Executes dropped EXE
PID:656
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
21a98deccc869e8ecbc39375701b8cb8
SHA15c32f776e4e4c021d0e0bcf2af0cdb508516663b
SHA256ddcb8c12cc1a034c491f2924411bf22dd2ff69282aabf153e9f036de905769ed
SHA512b30cf88f589ffab20323a2502115355db93a99404d05f07255527869dc4fff1d4edc20f906b500abdd64d5e41b63203b64372a8b52620b1f3fb9282ee4b7db96
-
MD5
21a98deccc869e8ecbc39375701b8cb8
SHA15c32f776e4e4c021d0e0bcf2af0cdb508516663b
SHA256ddcb8c12cc1a034c491f2924411bf22dd2ff69282aabf153e9f036de905769ed
SHA512b30cf88f589ffab20323a2502115355db93a99404d05f07255527869dc4fff1d4edc20f906b500abdd64d5e41b63203b64372a8b52620b1f3fb9282ee4b7db96
-
MD5
21a98deccc869e8ecbc39375701b8cb8
SHA15c32f776e4e4c021d0e0bcf2af0cdb508516663b
SHA256ddcb8c12cc1a034c491f2924411bf22dd2ff69282aabf153e9f036de905769ed
SHA512b30cf88f589ffab20323a2502115355db93a99404d05f07255527869dc4fff1d4edc20f906b500abdd64d5e41b63203b64372a8b52620b1f3fb9282ee4b7db96
-
MD5
21a98deccc869e8ecbc39375701b8cb8
SHA15c32f776e4e4c021d0e0bcf2af0cdb508516663b
SHA256ddcb8c12cc1a034c491f2924411bf22dd2ff69282aabf153e9f036de905769ed
SHA512b30cf88f589ffab20323a2502115355db93a99404d05f07255527869dc4fff1d4edc20f906b500abdd64d5e41b63203b64372a8b52620b1f3fb9282ee4b7db96