Analysis
-
max time kernel
149s -
max time network
133s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
18-05-2021 07:34
General
-
Target
d413fe458a72131b05cf5b275996273da0207c4ae8659dcf17b4a14eabcd1a7b.exe
-
Size
7KB
-
MD5
126307a50aa2b78f64298be3a56147ff
-
SHA1
a06567fbdc4af8c8c619adbb8b813766ad8e37c1
-
SHA256
d413fe458a72131b05cf5b275996273da0207c4ae8659dcf17b4a14eabcd1a7b
-
SHA512
05f8dde115c1aa0376f2c6c8d8d7e61c131ae7ba464e174698462ddec7f2bdd5eff0f1e8aea0c6452efbd866875b5659ab4265fe12e4710de610e96d49ebfd28
Score
10/10
Malware Config
Signatures
-
Upatre
Upatre is a generic malware downloader.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d413fe458a72131b05cf5b275996273da0207c4ae8659dcf17b4a14eabcd1a7b.exe"C:\Users\Admin\AppData\Local\Temp\d413fe458a72131b05cf5b275996273da0207c4ae8659dcf17b4a14eabcd1a7b.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\szgfw.exe"C:\Users\Admin\AppData\Local\Temp\szgfw.exe"2⤵
- Executes dropped EXE
-