Analysis
-
max time kernel
150s -
max time network
117s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
04-05-2021 22:28
General
-
Target
d5e4dc90ffbfee81e3c07952bd03c3fe0f29003d8c42acefffddf481f5c970e9.exe
-
Size
6KB
-
MD5
aef1d900df89b1686a1d6aac7799c9ae
-
SHA1
b1914f992d5405a3896e2e0a378f6c40d9e8dad9
-
SHA256
d5e4dc90ffbfee81e3c07952bd03c3fe0f29003d8c42acefffddf481f5c970e9
-
SHA512
57ffaaf71423c9497dacf27be6ac772f2685886690d82a454a772f01a68127a22807adf6917517c171914c6b4fb88e568c7f9478b044b899a287ced0054478a6
Score
10/10
Malware Config
Signatures
-
Upatre
Upatre is a generic malware downloader.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d5e4dc90ffbfee81e3c07952bd03c3fe0f29003d8c42acefffddf481f5c970e9.exe"C:\Users\Admin\AppData\Local\Temp\d5e4dc90ffbfee81e3c07952bd03c3fe0f29003d8c42acefffddf481f5c970e9.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\szgfw.exe"C:\Users\Admin\AppData\Local\Temp\szgfw.exe"2⤵
- Executes dropped EXE
-