upatre | e78a86a2c1f47cf0a5bf5906f6b4087716747636a850bd33f9a0efa774f739d8

Analysis

max time kernel
149s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01-04-2024 05:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

687cedc46c9a39e7c8f4b7a81dec547c_JaffaCakes118.exe
Size

33KB
MD5

687cedc46c9a39e7c8f4b7a81dec547c
SHA1

dd57176f55e871127f93d653363763138effbb54
SHA256

e78a86a2c1f47cf0a5bf5906f6b4087716747636a850bd33f9a0efa774f739d8
SHA512

dffb9388ad5d23ba7d675d308fbb65f30c08e7e7842b010f1202bff7075decce22776599f01ceb54340103b71522d48e2b9ab70eb9c8258ed16f4d0ac28ccae6
SSDEEP

768:kf1Y9RRw/dUT6vurGd/pkUOyGAv+rh95kRCalKv6lyyyQ:GY9jw/dUT62rGdiUOWWrNla

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre
Executes dropped EXE 1 IoCs

Processes:

szgfw.exe

pid process

1940 szgfw.exe
Loads dropped DLL 2 IoCs

Processes:

687cedc46c9a39e7c8f4b7a81dec547c_JaffaCakes118.exe

pid process

1932 687cedc46c9a39e7c8f4b7a81dec547c_JaffaCakes118.exe
1932 687cedc46c9a39e7c8f4b7a81dec547c_JaffaCakes118.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
1940	szgfw.exe

pid	process
1932	687cedc46c9a39e7c8f4b7a81dec547c_JaffaCakes118.exe
1932	687cedc46c9a39e7c8f4b7a81dec547c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

687cedc46c9a39e7c8f4b7a81dec547c_JaffaCakes118.exe

description	pid	process	target process
PID 1932 wrote to memory of 1940	1932	687cedc46c9a39e7c8f4b7a81dec547c_JaffaCakes118.exe	szgfw.exe
PID 1932 wrote to memory of 1940	1932	687cedc46c9a39e7c8f4b7a81dec547c_JaffaCakes118.exe	szgfw.exe
PID 1932 wrote to memory of 1940	1932	687cedc46c9a39e7c8f4b7a81dec547c_JaffaCakes118.exe	szgfw.exe
PID 1932 wrote to memory of 1940	1932	687cedc46c9a39e7c8f4b7a81dec547c_JaffaCakes118.exe	szgfw.exe

C:\Users\Admin\AppData\Local\Temp\687cedc46c9a39e7c8f4b7a81dec547c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\687cedc46c9a39e7c8f4b7a81dec547c_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1932

C:\Users\Admin\AppData\Local\Temp\szgfw.exe
"C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
2⤵
- Executes dropped EXE
PID:1940

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\szgfw.exe
Filesize
33KB

MD5
628209a9f7ac02d4ddd86a41e88bdccb

SHA1
b0712a7e92ca831ef56d23c5bdfbe086470b144e

SHA256
d5805d2473f2482ef9783fcb871d07beed33ed2a5b642d5ad50dbf282f4b1cb0

SHA512
168e838a3991285a1fff5415d200e64a27bc354d6b43b52ddadf204d778a03b439b1f154341eef0728dc8484e072cdf9f2dfc47b18e97428c0f927eeb0454455

Download Submit
memory/1932-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1932-9-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download