Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    8s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    18/05/2021, 00:13

General

  • Target

    7a90b5f598457780f1da3dd4140734d3477e047352b89d0350f5903b4e140ba2.exe

  • Size

    31KB

  • MD5

    08d559ba762634a65f28a3bc18802e2b

  • SHA1

    9b22b230015b31ac0349fce64332a3b535da42f1

  • SHA256

    7a90b5f598457780f1da3dd4140734d3477e047352b89d0350f5903b4e140ba2

  • SHA512

    79096e47f7c7cd56cadcd705c0a7673c97d97394fe4637aa9f331af52704898cfb355bdbd708f5d45398ac643d11a4af35c5189f946d42bfb826171798fb3f85

Score
10/10

Malware Config

Signatures

  • Upatre

    Upatre is a generic malware downloader.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7a90b5f598457780f1da3dd4140734d3477e047352b89d0350f5903b4e140ba2.exe
    "C:\Users\Admin\AppData\Local\Temp\7a90b5f598457780f1da3dd4140734d3477e047352b89d0350f5903b4e140ba2.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:452
    • C:\Users\Admin\AppData\Local\Temp\szgfw.exe
      "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
      2⤵
      • Executes dropped EXE
      PID:1264

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/452-60-0x00000000753E1000-0x00000000753E3000-memory.dmp

    Filesize

    8KB

  • memory/452-66-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB