upatre | e78a86a2c1f47cf0a5bf5906f6b4087716747636a850bd33f9a0efa774f739d8

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01-04-2024 05:04

Target

687cedc46c9a39e7c8f4b7a81dec547c_JaffaCakes118.exe
Size

33KB
MD5

687cedc46c9a39e7c8f4b7a81dec547c
SHA1

dd57176f55e871127f93d653363763138effbb54
SHA256

e78a86a2c1f47cf0a5bf5906f6b4087716747636a850bd33f9a0efa774f739d8
SHA512

dffb9388ad5d23ba7d675d308fbb65f30c08e7e7842b010f1202bff7075decce22776599f01ceb54340103b71522d48e2b9ab70eb9c8258ed16f4d0ac28ccae6
SSDEEP

768:kf1Y9RRw/dUT6vurGd/pkUOyGAv+rh95kRCalKv6lyyyQ:GY9jw/dUT62rGdiUOWWrNla

Score

10^/10

Upatre
Upatre is a generic malware downloader.
downloader upatre
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

687cedc46c9a39e7c8f4b7a81dec547c_JaffaCakes118.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation 687cedc46c9a39e7c8f4b7a81dec547c_JaffaCakes118.exe
Executes dropped EXE 1 IoCs

Processes:

szgfw.exe

pid process

2824 szgfw.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	687cedc46c9a39e7c8f4b7a81dec547c_JaffaCakes118.exe

pid	process
2824	szgfw.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

687cedc46c9a39e7c8f4b7a81dec547c_JaffaCakes118.exe

description	pid	process	target process
PID 2172 wrote to memory of 2824	2172	687cedc46c9a39e7c8f4b7a81dec547c_JaffaCakes118.exe	szgfw.exe
PID 2172 wrote to memory of 2824	2172	687cedc46c9a39e7c8f4b7a81dec547c_JaffaCakes118.exe	szgfw.exe
PID 2172 wrote to memory of 2824	2172	687cedc46c9a39e7c8f4b7a81dec547c_JaffaCakes118.exe	szgfw.exe

C:\Users\Admin\AppData\Local\Temp\szgfw.exe
"C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
2⤵
- Executes dropped EXE
PID:2824

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

C:\Users\Admin\AppData\Local\Temp\szgfw.exe
Filesize
33KB

MD5
628209a9f7ac02d4ddd86a41e88bdccb

SHA1
b0712a7e92ca831ef56d23c5bdfbe086470b144e

SHA256
d5805d2473f2482ef9783fcb871d07beed33ed2a5b642d5ad50dbf282f4b1cb0

SHA512
168e838a3991285a1fff5415d200e64a27bc354d6b43b52ddadf204d778a03b439b1f154341eef0728dc8484e072cdf9f2dfc47b18e97428c0f927eeb0454455

Download Submit
memory/2172-0-0x00000000006B0000-0x00000000006B1000-memory.dmp

Filesize
4KB

Download
memory/2172-9-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2824-10-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download