Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    111s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    11/05/2021, 15:28

General

  • Target

    23476fefcdea958721e286472dd3f7a9aa647b6f8c122eeb427971cfc8d210f4.exe

  • Size

    51KB

  • MD5

    1c564a1bdbd1fa3aea6714f9369e43f5

  • SHA1

    7071ea8082ab1ddb272dc601d74b63e321785731

  • SHA256

    23476fefcdea958721e286472dd3f7a9aa647b6f8c122eeb427971cfc8d210f4

  • SHA512

    bb02be66dd61bcfa0a31eb31083e20bab1c1486bc4defb02a9a7ce36e26fb5d880deca7b157de7e223d9c3834f0f925cf2442b15b2e064a25a33d7a5dfe3ab69

Score
10/10

Malware Config

Signatures

  • Upatre

    Upatre is a generic malware downloader.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\23476fefcdea958721e286472dd3f7a9aa647b6f8c122eeb427971cfc8d210f4.exe
    "C:\Users\Admin\AppData\Local\Temp\23476fefcdea958721e286472dd3f7a9aa647b6f8c122eeb427971cfc8d210f4.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:796
    • C:\Users\Admin\AppData\Local\Temp\szgfw.exe
      "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
      2⤵
      • Executes dropped EXE
      PID:4080

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads