Analysis
-
max time kernel
151s -
max time network
136s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
18-05-2021 05:59
General
-
Target
caec08293b6e392813fc9721d8612cdc2aa409bf8ff82ffc995e5c6558fd17b1.exe
-
Size
6KB
-
MD5
908c33afa775034f96b5ba7cbec464b9
-
SHA1
57295cd959a2db8cad415d793d5eb44bdebed711
-
SHA256
caec08293b6e392813fc9721d8612cdc2aa409bf8ff82ffc995e5c6558fd17b1
-
SHA512
0d6b73324529228e0a7ae677b4a60bf6ea0587c0e1aca03d5387a4d641c9e575c5cc4ac22f25d0718d6b6d61315ecbe8832587de041bbe181ed0b58a6f052d44
Score
10/10
Malware Config
Signatures
-
Upatre
Upatre is a generic malware downloader.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\caec08293b6e392813fc9721d8612cdc2aa409bf8ff82ffc995e5c6558fd17b1.exe"C:\Users\Admin\AppData\Local\Temp\caec08293b6e392813fc9721d8612cdc2aa409bf8ff82ffc995e5c6558fd17b1.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\szgfw.exe"C:\Users\Admin\AppData\Local\Temp\szgfw.exe"2⤵
- Executes dropped EXE
-