Analysis
-
max time kernel
150s -
max time network
46s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
18-05-2021 11:15
General
-
Target
8bd4e50e1b6d2bdfbed9b98b7ed33ba7f467ec70bce27c9a2044bad02c35c067.exe
-
Size
10KB
-
MD5
5e0812410b587c0eeae54c0f39675cfc
-
SHA1
5b006181a9855a2b5f5995d70b7dffdf456e41f3
-
SHA256
8bd4e50e1b6d2bdfbed9b98b7ed33ba7f467ec70bce27c9a2044bad02c35c067
-
SHA512
a15687060a9fb00df4d1d5c269c1ca941b58319f55cc732ac66989baa6083e2f5cae5e2ae8a5f17688e087bbf920b1f5c7bc6695541209bf5687431965ae16f6
Score
10/10
Malware Config
Signatures
-
Upatre
Upatre is a generic malware downloader.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8bd4e50e1b6d2bdfbed9b98b7ed33ba7f467ec70bce27c9a2044bad02c35c067.exe"C:\Users\Admin\AppData\Local\Temp\8bd4e50e1b6d2bdfbed9b98b7ed33ba7f467ec70bce27c9a2044bad02c35c067.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\szgfw.exe"C:\Users\Admin\AppData\Local\Temp\szgfw.exe"2⤵
- Executes dropped EXE
-