Analysis
-
max time kernel
150s -
max time network
102s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
17-05-2021 03:10
General
-
Target
93fae32a9f34eacd3552674f39244e24d35450e15eea40ef5bed81d4dd77f7df.exe
-
Size
6KB
-
MD5
8972008123e06285f31ac670452b073e
-
SHA1
47696472be021bae0ebbd9ae2f952cea49d83eb4
-
SHA256
93fae32a9f34eacd3552674f39244e24d35450e15eea40ef5bed81d4dd77f7df
-
SHA512
3c0178b23b3ed954097b8d54bd07df11839a0569da8e746af5cd3e21f897e0ae5add11aa85c292281c362e8d9ee7d9b6202689fb1d4a890072c81a75ba2db7dd
Score
10/10
Malware Config
Signatures
-
Upatre
Upatre is a generic malware downloader.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\93fae32a9f34eacd3552674f39244e24d35450e15eea40ef5bed81d4dd77f7df.exe"C:\Users\Admin\AppData\Local\Temp\93fae32a9f34eacd3552674f39244e24d35450e15eea40ef5bed81d4dd77f7df.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\szgfw.exe"C:\Users\Admin\AppData\Local\Temp\szgfw.exe"2⤵
- Executes dropped EXE
-