Analysis
-
max time kernel
157s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
19-02-2022 19:53
Static task
static1
Behavioral task
behavioral1
Sample
8fb5bb6e9859732b8c4f0accb086cff88aab31a4050c8bd66da04ccf3bb2cfb3.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
8fb5bb6e9859732b8c4f0accb086cff88aab31a4050c8bd66da04ccf3bb2cfb3.exe
Resource
win10v2004-en-20220113
General
-
Target
8fb5bb6e9859732b8c4f0accb086cff88aab31a4050c8bd66da04ccf3bb2cfb3.exe
-
Size
31KB
-
MD5
ec04f3f4850e52e9d852374502beb39f
-
SHA1
00ba0a57045736c252d16e78ed89a8025f7152ab
-
SHA256
8fb5bb6e9859732b8c4f0accb086cff88aab31a4050c8bd66da04ccf3bb2cfb3
-
SHA512
9089b0bc8dc05b9f79b660dd13732ef03fbab9928e18f21a2995c0d59b4964d675e6b0a620ac2e6820330b780e844432eaea565f0302f9c877554d91c7d58ee4
Malware Config
Signatures
-
Upatre
Upatre is a generic malware downloader.
-
Executes dropped EXE 1 IoCs
Processes:
szgfw.exepid process 3064 szgfw.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
8fb5bb6e9859732b8c4f0accb086cff88aab31a4050c8bd66da04ccf3bb2cfb3.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 8fb5bb6e9859732b8c4f0accb086cff88aab31a4050c8bd66da04ccf3bb2cfb3.exe -
Drops file in Windows directory 6 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
svchost.exedescription pid process Token: SeShutdownPrivilege 804 svchost.exe Token: SeCreatePagefilePrivilege 804 svchost.exe Token: SeShutdownPrivilege 804 svchost.exe Token: SeCreatePagefilePrivilege 804 svchost.exe Token: SeShutdownPrivilege 804 svchost.exe Token: SeCreatePagefilePrivilege 804 svchost.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
8fb5bb6e9859732b8c4f0accb086cff88aab31a4050c8bd66da04ccf3bb2cfb3.exedescription pid process target process PID 2108 wrote to memory of 3064 2108 8fb5bb6e9859732b8c4f0accb086cff88aab31a4050c8bd66da04ccf3bb2cfb3.exe szgfw.exe PID 2108 wrote to memory of 3064 2108 8fb5bb6e9859732b8c4f0accb086cff88aab31a4050c8bd66da04ccf3bb2cfb3.exe szgfw.exe PID 2108 wrote to memory of 3064 2108 8fb5bb6e9859732b8c4f0accb086cff88aab31a4050c8bd66da04ccf3bb2cfb3.exe szgfw.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8fb5bb6e9859732b8c4f0accb086cff88aab31a4050c8bd66da04ccf3bb2cfb3.exe"C:\Users\Admin\AppData\Local\Temp\8fb5bb6e9859732b8c4f0accb086cff88aab31a4050c8bd66da04ccf3bb2cfb3.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\szgfw.exe"C:\Users\Admin\AppData\Local\Temp\szgfw.exe"2⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\szgfw.exeMD5
a747b5b803378610701d8484b32ff044
SHA14b713334ce5fc9e661d5c9e75030661f92854c51
SHA2564a18c99738e4e6d3c93e73fad07d54f6cbceeca3a7a9d606c429c1897d1c71c9
SHA5121273a26747d3214376ceb5e10fd296f261c36eb4ffd0844368d9176fa863d8d94cc9eb9f9fa4b855023b644906af2bcae885ca75fe3e9b04b103612e154b7393
-
C:\Users\Admin\AppData\Local\Temp\szgfw.exeMD5
a747b5b803378610701d8484b32ff044
SHA14b713334ce5fc9e661d5c9e75030661f92854c51
SHA2564a18c99738e4e6d3c93e73fad07d54f6cbceeca3a7a9d606c429c1897d1c71c9
SHA5121273a26747d3214376ceb5e10fd296f261c36eb4ffd0844368d9176fa863d8d94cc9eb9f9fa4b855023b644906af2bcae885ca75fe3e9b04b103612e154b7393
-
memory/804-130-0x000001D5A5330000-0x000001D5A5340000-memory.dmpFilesize
64KB
-
memory/804-131-0x000001D5A5390000-0x000001D5A53A0000-memory.dmpFilesize
64KB
-
memory/804-132-0x000001D5A80B0000-0x000001D5A80B4000-memory.dmpFilesize
16KB
-
memory/3064-135-0x0000000000550000-0x0000000000551000-memory.dmpFilesize
4KB