upatre | 544427acf9e0f95f3bf6aab0b6e38a54d5359897a5223a46c34c0a3346c1f6a7

General

Target

544427acf9e0f95f3bf6aab0b6e38a54d5359897a5223a46c34c0a3346c1f6a7.exe
Size

7KB
MD5

c8fce40a1152013bb4388b82c47040a5
SHA1

b666778f94542ede11764b96fec581423dd1e87f
SHA256

544427acf9e0f95f3bf6aab0b6e38a54d5359897a5223a46c34c0a3346c1f6a7
SHA512

e72ab29693d61c8bf35b0858bf0b5844476ecf203e68f122811a7ee80493f9c410f9dccf35e10d9b6fc2b2a06bccdb3299d1d9f679677b8cfb248b56c32c0854

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre
Executes dropped EXE 1 IoCs

Processes:

szgfw.exe

pid process

4056 szgfw.exe

pid	process
4056	szgfw.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

544427acf9e0f95f3bf6aab0b6e38a54d5359897a5223a46c34c0a3346c1f6a7.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	544427acf9e0f95f3bf6aab0b6e38a54d5359897a5223a46c34c0a3346c1f6a7.exe

Drops file in Windows directory 6 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

svchost.exe

description	pid	process
Token: SeShutdownPrivilege	3080	svchost.exe
Token: SeCreatePagefilePrivilege	3080	svchost.exe
Token: SeShutdownPrivilege	3080	svchost.exe
Token: SeCreatePagefilePrivilege	3080	svchost.exe
Token: SeShutdownPrivilege	3080	svchost.exe
Token: SeCreatePagefilePrivilege	3080	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

544427acf9e0f95f3bf6aab0b6e38a54d5359897a5223a46c34c0a3346c1f6a7.exe

description	pid	process	target process
PID 2000 wrote to memory of 4056	2000	544427acf9e0f95f3bf6aab0b6e38a54d5359897a5223a46c34c0a3346c1f6a7.exe	szgfw.exe
PID 2000 wrote to memory of 4056	2000	544427acf9e0f95f3bf6aab0b6e38a54d5359897a5223a46c34c0a3346c1f6a7.exe	szgfw.exe
PID 2000 wrote to memory of 4056	2000	544427acf9e0f95f3bf6aab0b6e38a54d5359897a5223a46c34c0a3346c1f6a7.exe	szgfw.exe

C:\Users\Admin\AppData\Local\Temp\544427acf9e0f95f3bf6aab0b6e38a54d5359897a5223a46c34c0a3346c1f6a7.exe
"C:\Users\Admin\AppData\Local\Temp\544427acf9e0f95f3bf6aab0b6e38a54d5359897a5223a46c34c0a3346c1f6a7.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2000

C:\Users\Admin\AppData\Local\Temp\szgfw.exe
"C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
2⤵
- Executes dropped EXE
PID:4056

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3080

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\szgfw.exe
MD5
4020718f364d669490811afd5a536d50

SHA1
ce8b5749a0216f45d479fcc7c211d0763dcc3564

SHA256
09fd47d653ea13d28de87fdaa85676939ab6405d2a9dff20e1a34ece59ff2acf

SHA512
d32e26be31299197aa1c7a630f019bdf12118659ee3f5f7d6e3b8ec4437c10177f36beda0316ebefc4927b3a78f32b6feb5990a10730e3968ec97173e84fae36

Download Submit
C:\Users\Admin\AppData\Local\Temp\szgfw.exe
MD5
4020718f364d669490811afd5a536d50

SHA1
ce8b5749a0216f45d479fcc7c211d0763dcc3564

SHA256
09fd47d653ea13d28de87fdaa85676939ab6405d2a9dff20e1a34ece59ff2acf

SHA512
d32e26be31299197aa1c7a630f019bdf12118659ee3f5f7d6e3b8ec4437c10177f36beda0316ebefc4927b3a78f32b6feb5990a10730e3968ec97173e84fae36

Download Submit
memory/3080-132-0x0000025901F30000-0x0000025901F40000-memory.dmp

Filesize
64KB

Download
memory/3080-133-0x0000025901F90000-0x0000025901FA0000-memory.dmp

Filesize
64KB

Download
memory/3080-134-0x0000025904C70000-0x0000025904C74000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads