Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
113s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
13/05/2021, 12:40
Static task
static1
Behavioral task
behavioral1
Sample
52a4325b439b3bfb5bb9dddf9c01c6c9b27a7f2c3fb372d68d8570c7c270c6c2.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
52a4325b439b3bfb5bb9dddf9c01c6c9b27a7f2c3fb372d68d8570c7c270c6c2.exe
Resource
win10v20210410
General
-
Target
52a4325b439b3bfb5bb9dddf9c01c6c9b27a7f2c3fb372d68d8570c7c270c6c2.exe
-
Size
33KB
-
MD5
ba32b6d1dc15af8c3420a0a7059f065d
-
SHA1
86e306bbea4a35841aa55d01660b1ea63d4f13e9
-
SHA256
52a4325b439b3bfb5bb9dddf9c01c6c9b27a7f2c3fb372d68d8570c7c270c6c2
-
SHA512
843b5814325c2bf29b379ff5649a4c1f4c843efccb6f3fd9d014ffbabcacb70dff4eb17a3280fb8fdc0688709c8f637996f77e439184c576178684c5365a1464
Malware Config
Signatures
-
Upatre
Upatre is a generic malware downloader.
-
Executes dropped EXE 1 IoCs
pid Process 1520 szgfw.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1908 wrote to memory of 1520 1908 52a4325b439b3bfb5bb9dddf9c01c6c9b27a7f2c3fb372d68d8570c7c270c6c2.exe 79 PID 1908 wrote to memory of 1520 1908 52a4325b439b3bfb5bb9dddf9c01c6c9b27a7f2c3fb372d68d8570c7c270c6c2.exe 79 PID 1908 wrote to memory of 1520 1908 52a4325b439b3bfb5bb9dddf9c01c6c9b27a7f2c3fb372d68d8570c7c270c6c2.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\52a4325b439b3bfb5bb9dddf9c01c6c9b27a7f2c3fb372d68d8570c7c270c6c2.exe"C:\Users\Admin\AppData\Local\Temp\52a4325b439b3bfb5bb9dddf9c01c6c9b27a7f2c3fb372d68d8570c7c270c6c2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\szgfw.exe"C:\Users\Admin\AppData\Local\Temp\szgfw.exe"2⤵
- Executes dropped EXE
PID:1520
-