upatre | a1a8dbfdf668d614386ac24cdfea52df2d58e472f11837ddacd92867cc1b4d71

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29-03-2024 13:31

Target

23440f371220f5473ee19450f12d9e28_JaffaCakes118.exe
Size

33KB
MD5

23440f371220f5473ee19450f12d9e28
SHA1

4da5871b1a75d1c4ffcf0b1f479f5eaf7d14d8dd
SHA256

a1a8dbfdf668d614386ac24cdfea52df2d58e472f11837ddacd92867cc1b4d71
SHA512

8ce3e8351ee7244b9dd34add94a7e9eb1643ca2ada727a63a65b8d3595f84716b7b8f101bff055baafab893cd96cefaa2fd61d74bf7f0cdc9e3d53e2a4016183
SSDEEP

768:kf1Y9RRw/dUT6vurGd/pkUOyGAv+rh95kRCalySylZyya:GY9jw/dUT62rGdiUOWWrNlg

Score

10^/10

Upatre
Upatre is a generic malware downloader.
downloader upatre
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

23440f371220f5473ee19450f12d9e28_JaffaCakes118.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation 23440f371220f5473ee19450f12d9e28_JaffaCakes118.exe
Executes dropped EXE 1 IoCs

Processes:

szgfw.exe

pid process

4128 szgfw.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	23440f371220f5473ee19450f12d9e28_JaffaCakes118.exe

pid	process
4128	szgfw.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

23440f371220f5473ee19450f12d9e28_JaffaCakes118.exe

description	pid	process	target process
PID 1832 wrote to memory of 4128	1832	23440f371220f5473ee19450f12d9e28_JaffaCakes118.exe	szgfw.exe
PID 1832 wrote to memory of 4128	1832	23440f371220f5473ee19450f12d9e28_JaffaCakes118.exe	szgfw.exe
PID 1832 wrote to memory of 4128	1832	23440f371220f5473ee19450f12d9e28_JaffaCakes118.exe	szgfw.exe

C:\Users\Admin\AppData\Local\Temp\szgfw.exe
"C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
2⤵
- Executes dropped EXE
PID:4128

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

C:\Users\Admin\AppData\Local\Temp\szgfw.exe
Filesize
33KB

MD5
bf33311794ce1426fd9c5774d9df50fb

SHA1
1b4301a5d27870750bcf27e66f6b08532a7e1831

SHA256
bda7eb6375347db16875ad491d845b50d126aacf5a858596e45e8a610567d08e

SHA512
32f2d934d0d218f65be8f9d3efe419878ee80313dd1f401dc73b25081f3e875e48cdc043e5f88ab085d3dc7fffc4a42595efdcb9ac2531b999c5193de0b7cdeb

Download Submit
memory/1832-0-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download
memory/1832-9-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4128-10-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download