Analysis
-
max time kernel
149s -
max time network
136s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
17-05-2021 05:52
General
-
Target
12aa647c8d6be00d07333b9bc5c8b217f83927503c3711f29963d26cf3c8a237.exe
-
Size
9KB
-
MD5
adf2f7885156f1f2ef9641bacb98441d
-
SHA1
12964887675e22dd27d89b17817ae32e7304f543
-
SHA256
12aa647c8d6be00d07333b9bc5c8b217f83927503c3711f29963d26cf3c8a237
-
SHA512
5ed81aa3b173a057ce6fe4e8152cad72c29435554319250595a4bf3b20a3003dc51d60cd6aab17ba97256489c3bc08ea7f8156c834c85d1042b6d084eeec8433
Score
10/10
Malware Config
Signatures
-
Upatre
Upatre is a generic malware downloader.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\12aa647c8d6be00d07333b9bc5c8b217f83927503c3711f29963d26cf3c8a237.exe"C:\Users\Admin\AppData\Local\Temp\12aa647c8d6be00d07333b9bc5c8b217f83927503c3711f29963d26cf3c8a237.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\szgfw.exe"C:\Users\Admin\AppData\Local\Temp\szgfw.exe"2⤵
- Executes dropped EXE
-