Analysis
-
max time kernel
150s -
max time network
140s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
16-05-2021 06:09
General
-
Target
d43e7a4bfb05db5a72be5ff7498850a1e5e25015197b766d17011926d03e54f2.exe
-
Size
5KB
-
MD5
bb481805a8e2fc4a6f8156f11f8c4561
-
SHA1
550ae9163d041b2281c0fd25650799eb8d4e0b50
-
SHA256
d43e7a4bfb05db5a72be5ff7498850a1e5e25015197b766d17011926d03e54f2
-
SHA512
a2c850f63ae5f057131d64f196f38427c871ac5556c71444bd35810c08ead2ae70ff1b7b30f2bec30024eec1075b1864d3a45070ee97886792f192d0b4b834ec
Score
10/10
Malware Config
Signatures
-
Upatre
Upatre is a generic malware downloader.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d43e7a4bfb05db5a72be5ff7498850a1e5e25015197b766d17011926d03e54f2.exe"C:\Users\Admin\AppData\Local\Temp\d43e7a4bfb05db5a72be5ff7498850a1e5e25015197b766d17011926d03e54f2.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\szgfw.exe"C:\Users\Admin\AppData\Local\Temp\szgfw.exe"2⤵
- Executes dropped EXE
-