upatre | 7d8cb147dc1decf552bc378a303b486ceb1f71a2ad09e6866f3f1ac9bab1e275

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
01-04-2024 05:20

Target

68d747a391999aede953e1647243e751_JaffaCakes118.exe
Size

33KB
MD5

68d747a391999aede953e1647243e751
SHA1

473a4b1ef1156f934204f75a9765c9622231c253
SHA256

7d8cb147dc1decf552bc378a303b486ceb1f71a2ad09e6866f3f1ac9bab1e275
SHA512

2521ca6330eb160f8d0d209de4485d543d003380ae4486f4b724fe335cc629dd81b818b83da61d4bd1d9ca24c4e8c8a43001af26a537821ff4db0a4f2e1844b0
SSDEEP

768:kf1Y9RRw/dUT6vurGd/pkUOyGAv+rh95kRCaC0yvQ:GY9jw/dUT62rGdiUOWWrNlq

Score

10^/10

Upatre
Upatre is a generic malware downloader.
downloader upatre
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

68d747a391999aede953e1647243e751_JaffaCakes118.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Control Panel\International\Geo\Nation 68d747a391999aede953e1647243e751_JaffaCakes118.exe
Executes dropped EXE 1 IoCs

Processes:

szgfw.exe

pid process

2808 szgfw.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Control Panel\International\Geo\Nation	68d747a391999aede953e1647243e751_JaffaCakes118.exe

pid	process
2808	szgfw.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

68d747a391999aede953e1647243e751_JaffaCakes118.exe

description	pid	process	target process
PID 696 wrote to memory of 2808	696	68d747a391999aede953e1647243e751_JaffaCakes118.exe	szgfw.exe
PID 696 wrote to memory of 2808	696	68d747a391999aede953e1647243e751_JaffaCakes118.exe	szgfw.exe
PID 696 wrote to memory of 2808	696	68d747a391999aede953e1647243e751_JaffaCakes118.exe	szgfw.exe

C:\Users\Admin\AppData\Local\Temp\szgfw.exe
"C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
2⤵
- Executes dropped EXE
PID:2808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3264 --field-trial-handle=3408,i,16599691418790971742,134777455365707676,262144 --variations-seed-version /prefetch:8
1⤵
PID:2084

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

C:\Users\Admin\AppData\Local\Temp\szgfw.exe
Filesize
33KB

MD5
0a416ed658361648a2d773929a28122b

SHA1
83584ee14dd7fd47de94f000004538a238a11b98

SHA256
16de8867e090686300effae07387ef4982485abf1e073a9ff27d8fe3e879becc

SHA512
1752d1873e72b70136fb6608639dfb1a8a6c0ee2d56752c2e31d74d3ff6f4d7f8890771d456268d22103e28f92de51a74e8865c6b249983505a07646cb7c88fd

Download Submit
memory/696-0-0x0000000002150000-0x0000000002151000-memory.dmp

Filesize
4KB

Download
memory/696-9-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2808-10-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download