Analysis
-
max time kernel
152s -
max time network
128s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
19-02-2022 18:43
Static task
static1
Behavioral task
behavioral1
Sample
f855ae77f9eae20b44e1a9df1cc8f78d5f5e886d70138ca76d624b73844b998b.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
f855ae77f9eae20b44e1a9df1cc8f78d5f5e886d70138ca76d624b73844b998b.exe
Resource
win10v2004-en-20220113
General
-
Target
f855ae77f9eae20b44e1a9df1cc8f78d5f5e886d70138ca76d624b73844b998b.exe
-
Size
35KB
-
MD5
4634508e493e2caa4e329c9757c9ad57
-
SHA1
b409510960c04881d234065e1c3267686e70916b
-
SHA256
f855ae77f9eae20b44e1a9df1cc8f78d5f5e886d70138ca76d624b73844b998b
-
SHA512
708083daf894720de5c0e3d2c1a738d5da09704b8a2e2b5b0d418f99503b161023f2521d53b34c91881f2a90d339410cb851f6d550fcb54cb310b74c195ad0d6
Malware Config
Signatures
-
Upatre
Upatre is a generic malware downloader.
-
Executes dropped EXE 1 IoCs
pid Process 268 szgfw.exe -
Loads dropped DLL 2 IoCs
pid Process 1072 f855ae77f9eae20b44e1a9df1cc8f78d5f5e886d70138ca76d624b73844b998b.exe 1072 f855ae77f9eae20b44e1a9df1cc8f78d5f5e886d70138ca76d624b73844b998b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1072 wrote to memory of 268 1072 f855ae77f9eae20b44e1a9df1cc8f78d5f5e886d70138ca76d624b73844b998b.exe 27 PID 1072 wrote to memory of 268 1072 f855ae77f9eae20b44e1a9df1cc8f78d5f5e886d70138ca76d624b73844b998b.exe 27 PID 1072 wrote to memory of 268 1072 f855ae77f9eae20b44e1a9df1cc8f78d5f5e886d70138ca76d624b73844b998b.exe 27 PID 1072 wrote to memory of 268 1072 f855ae77f9eae20b44e1a9df1cc8f78d5f5e886d70138ca76d624b73844b998b.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\f855ae77f9eae20b44e1a9df1cc8f78d5f5e886d70138ca76d624b73844b998b.exe"C:\Users\Admin\AppData\Local\Temp\f855ae77f9eae20b44e1a9df1cc8f78d5f5e886d70138ca76d624b73844b998b.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\szgfw.exe"C:\Users\Admin\AppData\Local\Temp\szgfw.exe"2⤵
- Executes dropped EXE
PID:268
-