Analysis
-
max time kernel
154s -
max time network
127s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
19-02-2022 19:53
Static task
static1
Behavioral task
behavioral1
Sample
8fb5bb6e9859732b8c4f0accb086cff88aab31a4050c8bd66da04ccf3bb2cfb3.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
8fb5bb6e9859732b8c4f0accb086cff88aab31a4050c8bd66da04ccf3bb2cfb3.exe
Resource
win10v2004-en-20220113
General
-
Target
8fb5bb6e9859732b8c4f0accb086cff88aab31a4050c8bd66da04ccf3bb2cfb3.exe
-
Size
31KB
-
MD5
ec04f3f4850e52e9d852374502beb39f
-
SHA1
00ba0a57045736c252d16e78ed89a8025f7152ab
-
SHA256
8fb5bb6e9859732b8c4f0accb086cff88aab31a4050c8bd66da04ccf3bb2cfb3
-
SHA512
9089b0bc8dc05b9f79b660dd13732ef03fbab9928e18f21a2995c0d59b4964d675e6b0a620ac2e6820330b780e844432eaea565f0302f9c877554d91c7d58ee4
Malware Config
Signatures
-
Upatre
Upatre is a generic malware downloader.
-
Executes dropped EXE 1 IoCs
Processes:
szgfw.exepid process 568 szgfw.exe -
Loads dropped DLL 2 IoCs
Processes:
8fb5bb6e9859732b8c4f0accb086cff88aab31a4050c8bd66da04ccf3bb2cfb3.exepid process 1632 8fb5bb6e9859732b8c4f0accb086cff88aab31a4050c8bd66da04ccf3bb2cfb3.exe 1632 8fb5bb6e9859732b8c4f0accb086cff88aab31a4050c8bd66da04ccf3bb2cfb3.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
8fb5bb6e9859732b8c4f0accb086cff88aab31a4050c8bd66da04ccf3bb2cfb3.exedescription pid process target process PID 1632 wrote to memory of 568 1632 8fb5bb6e9859732b8c4f0accb086cff88aab31a4050c8bd66da04ccf3bb2cfb3.exe szgfw.exe PID 1632 wrote to memory of 568 1632 8fb5bb6e9859732b8c4f0accb086cff88aab31a4050c8bd66da04ccf3bb2cfb3.exe szgfw.exe PID 1632 wrote to memory of 568 1632 8fb5bb6e9859732b8c4f0accb086cff88aab31a4050c8bd66da04ccf3bb2cfb3.exe szgfw.exe PID 1632 wrote to memory of 568 1632 8fb5bb6e9859732b8c4f0accb086cff88aab31a4050c8bd66da04ccf3bb2cfb3.exe szgfw.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8fb5bb6e9859732b8c4f0accb086cff88aab31a4050c8bd66da04ccf3bb2cfb3.exe"C:\Users\Admin\AppData\Local\Temp\8fb5bb6e9859732b8c4f0accb086cff88aab31a4050c8bd66da04ccf3bb2cfb3.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\szgfw.exe"C:\Users\Admin\AppData\Local\Temp\szgfw.exe"2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\szgfw.exeMD5
a747b5b803378610701d8484b32ff044
SHA14b713334ce5fc9e661d5c9e75030661f92854c51
SHA2564a18c99738e4e6d3c93e73fad07d54f6cbceeca3a7a9d606c429c1897d1c71c9
SHA5121273a26747d3214376ceb5e10fd296f261c36eb4ffd0844368d9176fa863d8d94cc9eb9f9fa4b855023b644906af2bcae885ca75fe3e9b04b103612e154b7393
-
C:\Users\Admin\AppData\Local\Temp\szgfw.exeMD5
a747b5b803378610701d8484b32ff044
SHA14b713334ce5fc9e661d5c9e75030661f92854c51
SHA2564a18c99738e4e6d3c93e73fad07d54f6cbceeca3a7a9d606c429c1897d1c71c9
SHA5121273a26747d3214376ceb5e10fd296f261c36eb4ffd0844368d9176fa863d8d94cc9eb9f9fa4b855023b644906af2bcae885ca75fe3e9b04b103612e154b7393
-
\Users\Admin\AppData\Local\Temp\szgfw.exeMD5
a747b5b803378610701d8484b32ff044
SHA14b713334ce5fc9e661d5c9e75030661f92854c51
SHA2564a18c99738e4e6d3c93e73fad07d54f6cbceeca3a7a9d606c429c1897d1c71c9
SHA5121273a26747d3214376ceb5e10fd296f261c36eb4ffd0844368d9176fa863d8d94cc9eb9f9fa4b855023b644906af2bcae885ca75fe3e9b04b103612e154b7393
-
\Users\Admin\AppData\Local\Temp\szgfw.exeMD5
a747b5b803378610701d8484b32ff044
SHA14b713334ce5fc9e661d5c9e75030661f92854c51
SHA2564a18c99738e4e6d3c93e73fad07d54f6cbceeca3a7a9d606c429c1897d1c71c9
SHA5121273a26747d3214376ceb5e10fd296f261c36eb4ffd0844368d9176fa863d8d94cc9eb9f9fa4b855023b644906af2bcae885ca75fe3e9b04b103612e154b7393
-
memory/1632-54-0x0000000076421000-0x0000000076423000-memory.dmpFilesize
8KB
-
memory/1632-55-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB