Analysis
-
max time kernel
150s -
max time network
69s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
16-05-2021 01:00
General
-
Target
7014722b368656b4f8a1301951dda9e35dd84d909d9ee12b81f11d2747c464c7.exe
-
Size
5KB
-
MD5
37be00585fd2b8af188eb9d0cd241cf3
-
SHA1
b52ca310cc550cf9e44b0e1432d84393e8d0b072
-
SHA256
7014722b368656b4f8a1301951dda9e35dd84d909d9ee12b81f11d2747c464c7
-
SHA512
4c9a419af66785d353f5a0123861759f5a8662a7e91068a47d07b62d0e50986be4597a904967a12e8b3d65828d8136d99027de125eb24e733659835c1c9b89cc
Score
10/10
Malware Config
Signatures
-
Upatre
Upatre is a generic malware downloader.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7014722b368656b4f8a1301951dda9e35dd84d909d9ee12b81f11d2747c464c7.exe"C:\Users\Admin\AppData\Local\Temp\7014722b368656b4f8a1301951dda9e35dd84d909d9ee12b81f11d2747c464c7.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\szgfw.exe"C:\Users\Admin\AppData\Local\Temp\szgfw.exe"2⤵
- Executes dropped EXE
-