upatre | 486bace70fc33408f1f8504e52c01806229a765a5341546292d0d744e2534844

Analysis

max time kernel
149s
max time network
120s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
30-03-2024 21:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

44ba8ed64d6e67b0b203b2053e687f21_JaffaCakes118.exe
Size

13KB
MD5

44ba8ed64d6e67b0b203b2053e687f21
SHA1

2686960fe872658eb744bd6a99bcddb8dbfb2dd6
SHA256

486bace70fc33408f1f8504e52c01806229a765a5341546292d0d744e2534844
SHA512

751c6ee0db2717e6f37a306b33e190c6b76c065f8b06f2e8715d7e9cd2df0dcb27b83b38b510f4d32efad50886bd8a86cecb3d07cb704e35ae986e6587079d11
SSDEEP

384:6K+dKfzQHxFxRmyja4QhiP7UlY/pjKkFlplVDuyUyGyylqFlyylkQ:v+dAURFxna4QAPQlYgkFlplVDuyUyGy5

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Executes dropped EXE 1 IoCs

pid	Process
2868	szgfw.exe

Loads dropped DLL 2 IoCs

pid	Process
2152	44ba8ed64d6e67b0b203b2053e687f21_JaffaCakes118.exe
2152	44ba8ed64d6e67b0b203b2053e687f21_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 2868	2152	44ba8ed64d6e67b0b203b2053e687f21_JaffaCakes118.exe	28
PID 2152 wrote to memory of 2868	2152	44ba8ed64d6e67b0b203b2053e687f21_JaffaCakes118.exe	28
PID 2152 wrote to memory of 2868	2152	44ba8ed64d6e67b0b203b2053e687f21_JaffaCakes118.exe	28
PID 2152 wrote to memory of 2868	2152	44ba8ed64d6e67b0b203b2053e687f21_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\44ba8ed64d6e67b0b203b2053e687f21_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\44ba8ed64d6e67b0b203b2053e687f21_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Users\Admin\AppData\Local\Temp\szgfw.exe
  "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
  2⤵
  - Executes dropped EXE
  PID:2868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
13KB

MD5
d4adad39f22b3c982ec798ae1c365e7e

SHA1
5e5ad0eff75bea06c0a0cd3a1316282b197227ed

SHA256
b114f53ee56d8e76334b7ca661b6b7386fe4aa87a0083b5039ed3254ac78de0c

SHA512
224be6d88a783965b5acd4994781a969df4cad1a834ca4fecea889ff9ac2fa5e5e53a0edfabedfc9d0ad61919e955da929123eda5a4f4af34c74cfc8eb1d4bb8

Download Submit