Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    110s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    11/05/2021, 17:02

General

  • Target

    09211ba367c0996bfdfe286794fc5cdcd2d925b132dd60beb7775765f5a4ee8f.exe

  • Size

    131KB

  • MD5

    8cf7d4d6ba709db12eb5774027148544

  • SHA1

    c7e3435c7960cb306a9ff82766f150c42e758f88

  • SHA256

    09211ba367c0996bfdfe286794fc5cdcd2d925b132dd60beb7775765f5a4ee8f

  • SHA512

    a048e8071ddba74ada9328f317bf7480bf96acdf2899d131c4495926ebd586bbcd3ff22ca8e3b227cd4e2f425c11d0baf606769269e2a6c99c85e688cf4242f1

Score
10/10

Malware Config

Signatures

  • Upatre

    Upatre is a generic malware downloader.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\09211ba367c0996bfdfe286794fc5cdcd2d925b132dd60beb7775765f5a4ee8f.exe
    "C:\Users\Admin\AppData\Local\Temp\09211ba367c0996bfdfe286794fc5cdcd2d925b132dd60beb7775765f5a4ee8f.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:796
    • C:\Users\Admin\AppData\Local\Temp\szgfw.exe
      "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
      2⤵
      • Executes dropped EXE
      PID:3636

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/796-114-0x00000000004A0000-0x00000000004A1000-memory.dmp

    Filesize

    4KB

  • memory/3636-118-0x0000000000460000-0x000000000050E000-memory.dmp

    Filesize

    696KB