upatre | 5f0a30e4304945e1885d63daf5f67b3d19b3df409d264301c53854eaacda5b19

Analysis

max time kernel
149s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
01-04-2024 00:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63111c203d09d7e94323ddd3ddbb9152_JaffaCakes118.exe
Size

13KB
MD5

63111c203d09d7e94323ddd3ddbb9152
SHA1

2c8d694a35552a3ef5b98e9bf8f53796ec9f1089
SHA256

5f0a30e4304945e1885d63daf5f67b3d19b3df409d264301c53854eaacda5b19
SHA512

698397db499fbf4dbcbcb8a3db3909066aa7047faa168de545c554aefb03c79a187c46dafa47c299c7f3e9b41372b1bf7c23ae3c822f40ecf8c8af5fc8ccaff9
SSDEEP

384:6K+dKfzQHxFxRmyja4QhiP7UlY/pjKkFlplVDuyUylyylylylyylPh8yQ:v+dAURFxna4QAPQlYgkFlplVDuyUylyv

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre
Executes dropped EXE 1 IoCs

Processes:

szgfw.exe

pid process

1252 szgfw.exe
Loads dropped DLL 2 IoCs

Processes:

63111c203d09d7e94323ddd3ddbb9152_JaffaCakes118.exe

pid process

2220 63111c203d09d7e94323ddd3ddbb9152_JaffaCakes118.exe
2220 63111c203d09d7e94323ddd3ddbb9152_JaffaCakes118.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
1252	szgfw.exe

pid	process
2220	63111c203d09d7e94323ddd3ddbb9152_JaffaCakes118.exe
2220	63111c203d09d7e94323ddd3ddbb9152_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

63111c203d09d7e94323ddd3ddbb9152_JaffaCakes118.exe

description	pid	process	target process
PID 2220 wrote to memory of 1252	2220	63111c203d09d7e94323ddd3ddbb9152_JaffaCakes118.exe	szgfw.exe
PID 2220 wrote to memory of 1252	2220	63111c203d09d7e94323ddd3ddbb9152_JaffaCakes118.exe	szgfw.exe
PID 2220 wrote to memory of 1252	2220	63111c203d09d7e94323ddd3ddbb9152_JaffaCakes118.exe	szgfw.exe
PID 2220 wrote to memory of 1252	2220	63111c203d09d7e94323ddd3ddbb9152_JaffaCakes118.exe	szgfw.exe

C:\Users\Admin\AppData\Local\Temp\63111c203d09d7e94323ddd3ddbb9152_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\63111c203d09d7e94323ddd3ddbb9152_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2220

C:\Users\Admin\AppData\Local\Temp\szgfw.exe
"C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
2⤵
- Executes dropped EXE
PID:1252

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\szgfw.exe
Filesize
13KB

MD5
a81cbb6cb1d8c00b0fe21cd8b1d3b475

SHA1
01120c4d598870b1ca388045b2f085128468b851

SHA256
582a9fff366d4125e0384659ca0d99af9f62f658951b3e45e1c751bb6c1b3400

SHA512
fdd28a750c0cdb6c2f9c0eef483c6d67ebb92a021d55ad61b042b01254c3697b2ccfdbee3e94ecffbd7ed4670107eb595ca7c0f5b1c2e46b5791a62fe8cba92f

Download Submit