Analysis
-
max time kernel
150s -
max time network
134s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
18-05-2021 02:21
General
-
Target
984786f387bf213654e434669a3335998a37a23eedbf1896b68164ad18b71647.exe
-
Size
7KB
-
MD5
536b9fb2fb2ce292fc96b40da8eea374
-
SHA1
47587952d2c59c1ee1071171f7362da3f95aa3b2
-
SHA256
984786f387bf213654e434669a3335998a37a23eedbf1896b68164ad18b71647
-
SHA512
fd1feb086e0eed68494ae8a8c119121d78d9923fe512ea3c1650c2a066899971963ecb97177a88707ab968255005f75f49a91fe8b2ed26eba3a10423ad6dd207
Score
10/10
Malware Config
Signatures
-
Upatre
Upatre is a generic malware downloader.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\984786f387bf213654e434669a3335998a37a23eedbf1896b68164ad18b71647.exe"C:\Users\Admin\AppData\Local\Temp\984786f387bf213654e434669a3335998a37a23eedbf1896b68164ad18b71647.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\szgfw.exe"C:\Users\Admin\AppData\Local\Temp\szgfw.exe"2⤵
- Executes dropped EXE
-