Analysis
-
max time kernel
149s -
max time network
113s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
18-05-2021 04:51
General
-
Target
270dc7fdc9b0467b4ac79e18e70ade69ed87f3a360b0292d7a3a2d2e8afc2411.exe
-
Size
6KB
-
MD5
03a0c35f689cdc5d20371ee990077bf8
-
SHA1
1680ea2f67763e6b786dc42cea47117164bc9419
-
SHA256
270dc7fdc9b0467b4ac79e18e70ade69ed87f3a360b0292d7a3a2d2e8afc2411
-
SHA512
a92722d923747fb8bbdae559e383d1955cfddad17e318aa2f074bcbb500c197e7a733f49ab201a8fb10f1d45de573e10d41d75b4b499ef7752b649fcd88834be
Score
10/10
Malware Config
Signatures
-
Upatre
Upatre is a generic malware downloader.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\270dc7fdc9b0467b4ac79e18e70ade69ed87f3a360b0292d7a3a2d2e8afc2411.exe"C:\Users\Admin\AppData\Local\Temp\270dc7fdc9b0467b4ac79e18e70ade69ed87f3a360b0292d7a3a2d2e8afc2411.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\szgfw.exe"C:\Users\Admin\AppData\Local\Temp\szgfw.exe"2⤵
- Executes dropped EXE
-