Analysis
-
max time kernel
154s -
max time network
112s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
08-05-2021 20:27
General
-
Target
80a9acf19f576c8449e29840b61d757cb5615e9b9cece45609e37c57f7fa182c.exe
-
Size
9KB
-
MD5
02f9fdbad10a5915c4320ca783d2740b
-
SHA1
ce32da4ca17e5c5352bbee031349a0556942aa25
-
SHA256
80a9acf19f576c8449e29840b61d757cb5615e9b9cece45609e37c57f7fa182c
-
SHA512
d761a3fcef68d07cda86b9be0986f0f511b17bb870013a805271606de04e4b64e7be4830acc272bb324ab7d471ff6b07e3c8719545a9e71957f7de98146ccff9
Score
10/10
Malware Config
Signatures
-
Upatre
Upatre is a generic malware downloader.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\80a9acf19f576c8449e29840b61d757cb5615e9b9cece45609e37c57f7fa182c.exe"C:\Users\Admin\AppData\Local\Temp\80a9acf19f576c8449e29840b61d757cb5615e9b9cece45609e37c57f7fa182c.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\szgfw.exe"C:\Users\Admin\AppData\Local\Temp\szgfw.exe"2⤵
- Executes dropped EXE
-