upatre | 96617a64af06e3bbddf86c904e5835e645ef0f1e35ee7bfdcf87664f0d5956a2

Analysis

max time kernel
151s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 00:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

96617a64af06e3bbddf86c904e5835e645ef0f1e35ee7bfdcf87664f0d5956a2.exe
Size

4KB
MD5

05073e5c1babb45031e99c0a17b5f819
SHA1

c88b477beac62c0724b0e296af85db5ccd8d79ff
SHA256

96617a64af06e3bbddf86c904e5835e645ef0f1e35ee7bfdcf87664f0d5956a2
SHA512

fc925d61b6a8a6a1a9d89a709ce82c6e1d18b3ce5eea39f211b970cf06eacb03f98ebc9be2b2786ed5e2e9c43abfa1b2c3dc012c8e261da22bc5d4f97af36cef
SSDEEP

48:Zdni+Wyi18DN0nCvTaE6nc9fhXcGEY3sJd9ga91RsuYnA7B8mOo4jUx7OtKGc:Z0v4mUWKh9ctgC1R3YnKymV44Sh

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

96617a64af06e3bbddf86c904e5835e645ef0f1e35ee7bfdcf87664f0d5956a2.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	96617a64af06e3bbddf86c904e5835e645ef0f1e35ee7bfdcf87664f0d5956a2.exe

Deletes itself 1 IoCs

Processes:

szgfw.exe

pid process

3400 szgfw.exe
Executes dropped EXE 1 IoCs

Processes:

szgfw.exe

pid process

3400 szgfw.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
3400	szgfw.exe

pid	process
3400	szgfw.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

96617a64af06e3bbddf86c904e5835e645ef0f1e35ee7bfdcf87664f0d5956a2.exe

description	pid	process	target process
PID 2388 wrote to memory of 3400	2388	96617a64af06e3bbddf86c904e5835e645ef0f1e35ee7bfdcf87664f0d5956a2.exe	szgfw.exe
PID 2388 wrote to memory of 3400	2388	96617a64af06e3bbddf86c904e5835e645ef0f1e35ee7bfdcf87664f0d5956a2.exe	szgfw.exe
PID 2388 wrote to memory of 3400	2388	96617a64af06e3bbddf86c904e5835e645ef0f1e35ee7bfdcf87664f0d5956a2.exe	szgfw.exe

C:\Users\Admin\AppData\Local\Temp\96617a64af06e3bbddf86c904e5835e645ef0f1e35ee7bfdcf87664f0d5956a2.exe
"C:\Users\Admin\AppData\Local\Temp\96617a64af06e3bbddf86c904e5835e645ef0f1e35ee7bfdcf87664f0d5956a2.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2388

C:\Users\Admin\AppData\Local\Temp\szgfw.exe
"C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
2⤵
- Deletes itself
- Executes dropped EXE
PID:3400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4136 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8
1⤵
PID:2644

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\szgfw.exe
Filesize
4KB

MD5
6d9b6b031c0c25bf1c69d17306ce22c4

SHA1
6c07cd8bca8813dcf65c47630a8b93a30affb686

SHA256
a9c5619b44887a88e68d03f6dee5751e2c142f345216a9731e331fe71fb9fd69

SHA512
1fe925021cbc42e95fd83680aa53e896973434d593b1554b0a2a537dcd214ad5468020153f426bf7da444b40d1c99de0280811e60138c30477f35c1d70744e8b

Download Submit