Analysis
-
max time kernel
154s -
max time network
135s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
19-02-2022 18:44
Static task
static1
Behavioral task
behavioral1
Sample
f5d4c6500dd5d2614f795f8bd0c6259e43a3af3cbc86dfce1fc2576dafac1cb3.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
f5d4c6500dd5d2614f795f8bd0c6259e43a3af3cbc86dfce1fc2576dafac1cb3.exe
Resource
win10v2004-en-20220113
General
-
Target
f5d4c6500dd5d2614f795f8bd0c6259e43a3af3cbc86dfce1fc2576dafac1cb3.exe
-
Size
266KB
-
MD5
fea7b2e06e4bdf93a5c6b22507c4105e
-
SHA1
9ecc6ed6111cf7447427752b04fef412c0c8b6d7
-
SHA256
f5d4c6500dd5d2614f795f8bd0c6259e43a3af3cbc86dfce1fc2576dafac1cb3
-
SHA512
e5a7bc24a6a4cb03afe416bf87e85b753137193dea176f4f2f874082df748c9a24446c363365eb30ff2b043908f10628d5f48df0a46746206e8bc1ac9b8dea65
Malware Config
Signatures
-
Upatre
Upatre is a generic malware downloader.
-
Executes dropped EXE 1 IoCs
Processes:
szgfw.exepid process 652 szgfw.exe -
Loads dropped DLL 2 IoCs
Processes:
f5d4c6500dd5d2614f795f8bd0c6259e43a3af3cbc86dfce1fc2576dafac1cb3.exepid process 1276 f5d4c6500dd5d2614f795f8bd0c6259e43a3af3cbc86dfce1fc2576dafac1cb3.exe 1276 f5d4c6500dd5d2614f795f8bd0c6259e43a3af3cbc86dfce1fc2576dafac1cb3.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
f5d4c6500dd5d2614f795f8bd0c6259e43a3af3cbc86dfce1fc2576dafac1cb3.exedescription pid process target process PID 1276 wrote to memory of 652 1276 f5d4c6500dd5d2614f795f8bd0c6259e43a3af3cbc86dfce1fc2576dafac1cb3.exe szgfw.exe PID 1276 wrote to memory of 652 1276 f5d4c6500dd5d2614f795f8bd0c6259e43a3af3cbc86dfce1fc2576dafac1cb3.exe szgfw.exe PID 1276 wrote to memory of 652 1276 f5d4c6500dd5d2614f795f8bd0c6259e43a3af3cbc86dfce1fc2576dafac1cb3.exe szgfw.exe PID 1276 wrote to memory of 652 1276 f5d4c6500dd5d2614f795f8bd0c6259e43a3af3cbc86dfce1fc2576dafac1cb3.exe szgfw.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f5d4c6500dd5d2614f795f8bd0c6259e43a3af3cbc86dfce1fc2576dafac1cb3.exe"C:\Users\Admin\AppData\Local\Temp\f5d4c6500dd5d2614f795f8bd0c6259e43a3af3cbc86dfce1fc2576dafac1cb3.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\szgfw.exe"C:\Users\Admin\AppData\Local\Temp\szgfw.exe"2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\szgfw.exeMD5
a9885f652bdc5db3bff27fd61f0db71e
SHA1808fbd982a286df50857376a4d6617e6d871cd65
SHA25639198fe098a2f24271146a998d91b76a6da8a13fcfee4349e9f6cef504352cd2
SHA512d164f204ff668f5315107459eca2f34464428262acd32e18ebc4bcd3be9a742fe4bc347f64ab881fc56a78b65de1b299ceed886868a43716dbcf905d56a65637
-
C:\Users\Admin\AppData\Local\Temp\szgfw.exeMD5
a9885f652bdc5db3bff27fd61f0db71e
SHA1808fbd982a286df50857376a4d6617e6d871cd65
SHA25639198fe098a2f24271146a998d91b76a6da8a13fcfee4349e9f6cef504352cd2
SHA512d164f204ff668f5315107459eca2f34464428262acd32e18ebc4bcd3be9a742fe4bc347f64ab881fc56a78b65de1b299ceed886868a43716dbcf905d56a65637
-
\Users\Admin\AppData\Local\Temp\szgfw.exeMD5
a9885f652bdc5db3bff27fd61f0db71e
SHA1808fbd982a286df50857376a4d6617e6d871cd65
SHA25639198fe098a2f24271146a998d91b76a6da8a13fcfee4349e9f6cef504352cd2
SHA512d164f204ff668f5315107459eca2f34464428262acd32e18ebc4bcd3be9a742fe4bc347f64ab881fc56a78b65de1b299ceed886868a43716dbcf905d56a65637
-
\Users\Admin\AppData\Local\Temp\szgfw.exeMD5
a9885f652bdc5db3bff27fd61f0db71e
SHA1808fbd982a286df50857376a4d6617e6d871cd65
SHA25639198fe098a2f24271146a998d91b76a6da8a13fcfee4349e9f6cef504352cd2
SHA512d164f204ff668f5315107459eca2f34464428262acd32e18ebc4bcd3be9a742fe4bc347f64ab881fc56a78b65de1b299ceed886868a43716dbcf905d56a65637
-
memory/1276-54-0x0000000076041000-0x0000000076043000-memory.dmpFilesize
8KB
-
memory/1276-55-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB