Analysis
-
max time kernel
172s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
19-02-2022 19:00
General
-
Target
e05a7c95e2110ad3e2b1f02c97fc510e0c002b89f8185a7bdbee917d5aced119.exe
-
Size
7KB
-
MD5
fa66e2f1dd8fc0738174edefbb1454cc
-
SHA1
57444a442e09a27ab6bc4c0ed4822498e84ca91e
-
SHA256
e05a7c95e2110ad3e2b1f02c97fc510e0c002b89f8185a7bdbee917d5aced119
-
SHA512
fe23c0d4670a66bb9486f816803fd0d2b7cea18fa4d1ceade0590f2bc940e4ac33a68f95bdb50216ae39c9f54daa8ef36537f34899cc11e3f958420c09c449b5
Score
10/10
Malware Config
Signatures
-
Upatre
Upatre is a generic malware downloader.
-
Executes dropped EXE 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e05a7c95e2110ad3e2b1f02c97fc510e0c002b89f8185a7bdbee917d5aced119.exe"C:\Users\Admin\AppData\Local\Temp\e05a7c95e2110ad3e2b1f02c97fc510e0c002b89f8185a7bdbee917d5aced119.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\szgfw.exe"C:\Users\Admin\AppData\Local\Temp\szgfw.exe"2⤵
- Executes dropped EXE
-
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 131⤵
- Checks processor information in registry
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k wusvcs -p1⤵