Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
15/05/2021, 04:00
Static task
static1
Behavioral task
behavioral1
Sample
ea8327e4770813a6bdf201ca0daf2740a063ccebdbcae88246a67e6a1c4314cc.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
ea8327e4770813a6bdf201ca0daf2740a063ccebdbcae88246a67e6a1c4314cc.exe
Resource
win10v20210410
General
-
Target
ea8327e4770813a6bdf201ca0daf2740a063ccebdbcae88246a67e6a1c4314cc.exe
-
Size
37KB
-
MD5
c6ce2916ab16c24a4e14c77c44528b5d
-
SHA1
acf178075e194811ca6fdbf1b6152b953cf9459a
-
SHA256
ea8327e4770813a6bdf201ca0daf2740a063ccebdbcae88246a67e6a1c4314cc
-
SHA512
c15a0526cfb1bf8d614e7c5b7a6b91e4eefb3c63091c32eaca1c8e2343935107363ea609e13d9cd70e303eaee81ba71fb357a5a728241e8caaf878ea0c88cac4
Malware Config
Signatures
-
Upatre
Upatre is a generic malware downloader.
-
Executes dropped EXE 1 IoCs
pid Process 2548 szgfw.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2256 wrote to memory of 2548 2256 ea8327e4770813a6bdf201ca0daf2740a063ccebdbcae88246a67e6a1c4314cc.exe 78 PID 2256 wrote to memory of 2548 2256 ea8327e4770813a6bdf201ca0daf2740a063ccebdbcae88246a67e6a1c4314cc.exe 78 PID 2256 wrote to memory of 2548 2256 ea8327e4770813a6bdf201ca0daf2740a063ccebdbcae88246a67e6a1c4314cc.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\ea8327e4770813a6bdf201ca0daf2740a063ccebdbcae88246a67e6a1c4314cc.exe"C:\Users\Admin\AppData\Local\Temp\ea8327e4770813a6bdf201ca0daf2740a063ccebdbcae88246a67e6a1c4314cc.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\szgfw.exe"C:\Users\Admin\AppData\Local\Temp\szgfw.exe"2⤵
- Executes dropped EXE
PID:2548
-